@hirey/hi-mcp-server 0.1.25 → 0.1.26

package/dist/apiKey.d.ts

@@ -0,0 +1,9 @@
+export declare const HI_API_KEY_PREFIX = "hi_ak_";
+export type HiApiKeyMaterial = {
+    clientId: string;
+    clientSecret: string;
+};
+export declare function isHiApiKey(token: unknown): boolean;
+export declare function encodeHiApiKey(clientId: string, clientSecret: string): string;
+export declare function decodeHiApiKey(key: unknown): HiApiKeyMaterial | null;
+//# sourceMappingURL=apiKey.d.ts.map

package/dist/apiKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiKey.d.ts","sourceRoot":"","sources":["../src/apiKey.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C,MAAM,MAAM,gBAAgB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1E,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAElD;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAM7E;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,GAAG,IAAI,CAapE"}

package/dist/apiKey.js

@@ -0,0 +1,51 @@
+// Portable, revocable Hi API key for hosts that send a STATIC bearer to the
+// remote /mcp endpoint instead of doing OAuth — e.g. Codex's
+// `codex mcp add hi --url https://mcp.hirey.ai/mcp --bearer-token-env-var HI_API_KEY`.
+//
+// Why this exists: Codex persists its remote-MCP OAuth token in its OWN local
+// store (~/.codex/.credentials.json) with a non-atomic write + token rotation.
+// A crash/kill mid-write loses the file → the credential "mysteriously vanishes"
+// and the user is forced to re-login (and lands on a fresh anonymous agent). An
+// API key sidesteps that entirely: the credential is a NON-rotating
+// client_credentials pair that lives in a user-controlled env var (never in
+// Codex's fragile store), and is revocable by revoking the underlying client.
+//
+// Format: "hi_ak_" + base64url(JSON({ v:1, id:<client_id>, secret:<client_secret> })).
+// The /mcp edge detects the prefix, exchanges the pair for a short-lived JWT via
+// the standard client_credentials grant, and replays THAT JWT to downstream Hi
+// APIs — so nothing downstream needs to learn about API keys; they keep seeing
+// an ordinary access token. Revocation is free: revoke the OAuth client and the
+// next exchange fails closed.
+//
+// This module is intentionally dependency-free (no SDK / network) so the codec
+// is trivially unit-testable; the network exchange + cache lives in server.ts.
+export const HI_API_KEY_PREFIX = 'hi_ak_';
+export function isHiApiKey(token) {
+    return typeof token === 'string' && token.startsWith(HI_API_KEY_PREFIX) && token.length > HI_API_KEY_PREFIX.length;
+}
+export function encodeHiApiKey(clientId, clientSecret) {
+    const id = String(clientId || '').trim();
+    const secret = String(clientSecret || '').trim();
+    if (!id || !secret)
+        throw new Error('encodeHiApiKey: client_id and client_secret are required');
+    const payload = JSON.stringify({ v: 1, id, secret });
+    return HI_API_KEY_PREFIX + Buffer.from(payload, 'utf8').toString('base64url');
+}
+export function decodeHiApiKey(key) {
+    if (!isHiApiKey(key))
+        return null;
+    try {
+        const json = Buffer.from(key.slice(HI_API_KEY_PREFIX.length), 'base64url').toString('utf8');
+        const obj = JSON.parse(json);
+        if (!obj || typeof obj !== 'object')
+            return null;
+        const clientId = String(obj.id || '').trim();
+        const clientSecret = String(obj.secret || '').trim();
+        if (!clientId || !clientSecret)
+            return null;
+        return { clientId, clientSecret };
+    }
+    catch {
+        return null;
+    }
+}

package/dist/apiKeyExchange.d.ts

@@ -0,0 +1,9 @@
+export type ApiKeyExchanger = (apiKey: string) => Promise<string | null>;
+export declare function createApiKeyExchanger(opts: {
+    tokenUrl: string;
+    resource: string[];
+    now?: () => number;
+    fetchImpl?: typeof fetch;
+    maxEntries?: number;
+}): ApiKeyExchanger;
+//# sourceMappingURL=apiKeyExchange.d.ts.map

package/dist/apiKeyExchange.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiKeyExchange.d.ts","sourceRoot":"","sources":["../src/apiKeyExchange.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAIzE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,eAAe,CA4ClB"}

package/dist/apiKeyExchange.js

@@ -0,0 +1,65 @@
+// /mcp edge exchanger for Hi API keys. When a host (e.g. Codex via
+// `--bearer-token-env-var`) sends a static `hi_ak_...` bearer, the edge can't
+// verify it as a JWT — it's a portable client_credentials pair. This module
+// exchanges it for a SHORT-LIVED access token via the standard
+// client_credentials grant (requesting the canonical MCP `resource` so the
+// token's `aud` matches what the edge verifier enforces), caches the JWT until
+// shortly before expiry, and hands it back so the edge can verify + replay it
+// downstream exactly like a normal OAuth bearer.
+//
+// Fail-closed: any bad key / revoked client / auth outage returns null, which
+// the caller turns into a 401 — never a partial / unauthenticated pass.
+import { decodeHiApiKey, isHiApiKey } from './apiKey.js';
+export function createApiKeyExchanger(opts) {
+    const cache = new Map();
+    const now = opts.now || (() => Date.now());
+    const doFetch = opts.fetchImpl || fetch;
+    const maxEntries = opts.maxEntries ?? 5000;
+    return async (apiKey) => {
+        if (!isHiApiKey(apiKey) || !opts.tokenUrl)
+            return null;
+        const cached = cache.get(apiKey);
+        if (cached && cached.expAt > now())
+            return cached.token;
+        const material = decodeHiApiKey(apiKey);
+        if (!material)
+            return null;
+        try {
+            const body = {
+                grant_type: 'client_credentials',
+                client_id: material.clientId,
+                client_secret: material.clientSecret,
+            };
+            // RFC 8707: bind the issued token's aud to the MCP resource so the edge
+            // verifier (which checks aud == its resource) accepts it.
+            if (opts.resource.length > 0)
+                body.resource = opts.resource;
+            const resp = await doFetch(opts.tokenUrl, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify(body),
+            });
+            if (!resp.ok)
+                return null;
+            const json = await resp.json().catch(() => null);
+            const token = String(json?.access_token || '').trim();
+            if (!token)
+                return null;
+            const expiresIn = Number(json?.expires_in || 3600);
+            // Bound memory: drop expired entries, then hard-clear if still at cap.
+            if (cache.size >= maxEntries) {
+                for (const [k, v] of cache) {
+                    if (v.expAt <= now())
+                        cache.delete(k);
+                }
+                if (cache.size >= maxEntries)
+                    cache.clear();
+            }
+            cache.set(apiKey, { token, expAt: now() + Math.max(30, expiresIn - 60) * 1000 });
+            return token;
+        }
+        catch {
+            return null;
+        }
+    };
+}

package/dist/oauthRequestAuth.d.ts

@@ -63,5 +63,5 @@ export type BearerVerifyOutcome = {
     error: 'invalid_token';
     description: string;
 };
-export declare function verifyRequestBearer(req: express.Request, verifier: (token: string) => Promise<JWTVerifyResult<JWTPayload>>): Promise<BearerVerifyOutcome>;
+export declare function verifyRequestBearer(req: express.Request, verifier: (token: string) => Promise<JWTVerifyResult<JWTPayload>>, apiKeyExchanger?: (apiKey: string) => Promise<string | null>): Promise<BearerVerifyOutcome>;
 //# sourceMappingURL=oauthRequestAuth.d.ts.map

package/dist/oauthRequestAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauthRequestAuth.d.ts","sourceRoot":"","sources":["../src/oauthRequestAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAEnC,OAAO,EAAiC,KAAK,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,MAAM,CAAC;AAM5F,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,UAAU,CAAC;CACpB,CAAC;AAMF,eAAO,MAAM,kBAAkB,uCAA8C,CAAC;AAE9E,wBAAgB,qBAAqB,IAAI,WAAW,GAAG,IAAI,CAE1D;AAED,MAAM,MAAM,mBAAmB,GAAG;IAGhC,MAAM,EAAE,MAAM,CAAC;IAMf,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAG5B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAMF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,mBAAmB,IAS/B,OAAO,MAAM,KAAG,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAMlF;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,MAAM,GAAG,IAAI,CAOjE;AAKD,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,4BAA4B,EAAE,MAAM,CAAC;IACrC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,eAAe,GAAG,oBAAoB,CAAC;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,MAAM,CAaT;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,wBAAwB,EAAE,CAAC,QAAQ,CAAC,CAAC;IACrC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,wBAAwB,EAAE,CAAC,MAAM,CAAC,CAAC;IACnC,wBAAwB,EAAE,CAAC,OAAO,CAAC,CAAC;IACpC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAC;IACrF,qCAAqC,EAAE,CAAC,MAAM,EAAE,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;IAC7F,gCAAgC,EAAE,CAAC,MAAM,CAAC,CAAC;IAC3C,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,6BAA6B,EAAE,IAAI,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC,CAAC;AAMF,wBAAgB,qCAAqC,CAAC,KAAK,EAAE;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC,GAAG,gCAAgC,CAiBnC;AAKD,wBAAgB,8BAA8B,CAAC,KAAK,EAAE;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC,GAAG,yBAAyB,CAQ5B;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC/B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,GAChE,OAAO,CAAC,mBAAmB,CAAC,CAuB9B"}
+{"version":3,"file":"oauthRequestAuth.d.ts","sourceRoot":"","sources":["../src/oauthRequestAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAEnC,OAAO,EAAiC,KAAK,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,MAAM,CAAC;AAQ5F,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,UAAU,CAAC;CACpB,CAAC;AAMF,eAAO,MAAM,kBAAkB,uCAA8C,CAAC;AAE9E,wBAAgB,qBAAqB,IAAI,WAAW,GAAG,IAAI,CAE1D;AAED,MAAM,MAAM,mBAAmB,GAAG;IAGhC,MAAM,EAAE,MAAM,CAAC;IAMf,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAG5B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAMF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,mBAAmB,IAS/B,OAAO,MAAM,KAAG,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAMlF;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,MAAM,GAAG,IAAI,CAOjE;AAKD,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,4BAA4B,EAAE,MAAM,CAAC;IACrC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,eAAe,GAAG,oBAAoB,CAAC;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,MAAM,CAaT;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,wBAAwB,EAAE,CAAC,QAAQ,CAAC,CAAC;IACrC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,wBAAwB,EAAE,CAAC,MAAM,CAAC,CAAC;IACnC,wBAAwB,EAAE,CAAC,OAAO,CAAC,CAAC;IACpC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAC;IACrF,qCAAqC,EAAE,CAAC,MAAM,EAAE,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;IAC7F,gCAAgC,EAAE,CAAC,MAAM,CAAC,CAAC;IAC3C,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,6BAA6B,EAAE,IAAI,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC,CAAC;AAMF,wBAAgB,qCAAqC,CAAC,KAAK,EAAE;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC,GAAG,gCAAgC,CAiBnC;AAKD,wBAAgB,8BAA8B,CAAC,KAAK,EAAE;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC,GAAG,yBAAyB,CAQ5B;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC/B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,EAMjE,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAC3D,OAAO,CAAC,mBAAmB,CAAC,CA8B9B"}

package/dist/oauthRequestAuth.js

@@ -1,5 +1,6 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { createRemoteJWKSet, jwtVerify } from 'jose';
+import { HI_API_KEY_PREFIX } from './apiKey.js';
 function normalizeText(input) {
     return String(input || '').trim();
 }
@@ -90,11 +91,24 @@ export function buildProtectedResourceMetadata(input) {
         ...(input.resourceDocumentationUrl ? { resource_documentation: input.resourceDocumentationUrl } : {}),
     };
 }
-export async function verifyRequestBearer(req, verifier) {
-    const bearer = extractBearer(req);
+export async function verifyRequestBearer(req, verifier, 
+// Optional: when the inbound bearer is a Hi API key (hi_ak_...) instead of a
+// JWT, exchange it for a short-lived access token first, then verify + replay
+// THAT downstream. Lets static-bearer hosts (Codex --bearer-token-env-var) use
+// a non-rotating, revocable credential that never touches their fragile local
+// OAuth store. When omitted, only JWT bearers are accepted (unchanged).
+apiKeyExchanger) {
+    let bearer = extractBearer(req);
     if (!bearer) {
         return { ok: false, error: 'invalid_token', description: 'missing_bearer' };
     }
+    if (apiKeyExchanger && bearer.startsWith(HI_API_KEY_PREFIX)) {
+        const exchanged = await apiKeyExchanger(bearer);
+        if (!exchanged) {
+            return { ok: false, error: 'invalid_token', description: 'api_key_invalid_or_revoked' };
+        }
+        bearer = exchanged;
+    }
     try {
         const { payload } = await verifier(bearer);
         const subjectId = normalizeText(payload.sub);

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AAgDA,OAAO,EASL,KAAK,6BAA6B,EAMnC,MAAM,YAAY,CAAC;AAgqBpB,wBAAgB,oBAAoB,yCAEnC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AAgDA,OAAO,EASL,KAAK,6BAA6B,EAMnC,MAAM,YAAY,CAAC;AAsrBpB,wBAAgB,oBAAoB,yCAEnC"}

package/dist/server.js

@@ -25,6 +25,8 @@ import { applyReceiverRuntimeSnapshot, receiverConfigMaterialEquals, } from './r
 import { resolveInstallDefaultReplyDeliveryContext, resolveInstallRouteMissingPolicy, } from './defaultReplyRoute.js';
 import { resolveInstallDisplayName } from './installDefaults.js';
 import { buildAuthorizationServerMetadataAlias, buildOAuthVerifier, buildProtectedResourceMetadata, buildWwwAuthenticateChallenge, getCurrentRequestAuth, requestAuthStorage, verifyRequestBearer, } from './oauthRequestAuth.js';
+import { createApiKeyExchanger } from './apiKeyExchange.js';
+import { encodeHiApiKey } from './apiKey.js';
 // Hosts that hi-mcp-server can claim a first-class identity for. Everything
 // outside this set normalizes down to `generic`. We carry the wider list here
 // (not the narrow openclaw/generic split) so install state + telemetry can
@@ -111,6 +113,15 @@ const config = {
     oauthIssuer: normalizeText(process.env.HI_MCP_OAUTH_ISSUER)
         || normalizeText(process.env.HI_MCP_OAUTH_AUTHORIZATION_SERVER),
     oauthScopesSupported: readListEnv('HI_MCP_OAUTH_SCOPES', ['hi.read', 'hi.write', 'hi.events']),
+    // Token endpoint used to exchange a Hi API key (hi_ak_...) for a short-lived
+    // access token at the /mcp edge. When unset, the API-key path is disabled and
+    // only OAuth bearers are accepted (zero behavior change for existing installs).
+    // In prod this points at hi-auth's /oauth/token; default-derived from the
+    // authorization server base for convenience.
+    apiKeyTokenUrl: normalizeText(process.env.HI_MCP_API_KEY_TOKEN_URL)
+        || (normalizeText(process.env.HI_MCP_OAUTH_AUTHORIZATION_SERVER)
+            ? `${normalizeText(process.env.HI_MCP_OAUTH_AUTHORIZATION_SERVER).replace(/\/+$/, '')}/oauth/token`
+            : ''),
 };
 let capabilityCache = null;
 function assertConfig() {
@@ -317,6 +328,16 @@ function controlTools() {
                 required: ['claim_token'],
             },
         },
+        {
+            name: 'hi_api_key_create',
+            description: '铸一个**稳定、可吊销的 Hi API key**（hi_ak_… 形态），用于让 codex 等只发静态 bearer 的宿主走远程 MCP——不靠 codex 自己那个会轮换、会被写坏丢失的 OAuth 凭证。返回的 key 放进 HI_API_KEY 环境变量，再 `codex mcp add hi --url <mcp> --bearer-token-env-var HI_API_KEY` 即可；key 是不轮换的 client_credentials，永不进 codex 的本地凭证文件，所以不会"莫名消失"。新铸的 key 先属于一个全新 agent；codex 用上这个 key 后，再用 phone_binding 绑你的手机号，就并进你已有的 Hi 身份。',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    display_name: { type: 'string', description: '可选；这个 key 对应设备的显示名，例如 "Codex (我的 MacBook)"。' },
+                },
+            },
+        },
         {
             name: 'hi_agent_installation_get',
             description: '读取当前 installation 的正式 persisted state，包括 delivery_capabilities。',
@@ -1415,6 +1436,56 @@ async function handleClaimRedeem(args) {
     // 自然解析到新 agent，无需改本地 state。
     return ok(data);
 }
+// Mint a portable, revocable Hi API key (hi_ak_...) by registering a FRESH
+// client_credentials installation and encoding it. Deliberately does NOT touch
+// the current install's local state — it's for handing a static bearer to a
+// different host (Codex --bearer-token-env-var). The fresh agent is converged
+// into the caller's real identity later via phone_binding (the same path every
+// client uses to onboard), so no new gateway/identity surgery is needed here.
+async function handleApiKeyCreate(args) {
+    const displayName = normalizeText(args.display_name) || 'Codex (API key)';
+    let registryBase = config.platformBaseUrl;
+    try {
+        const wellKnown = await loadWellKnown();
+        registryBase = normalizeText(wellKnown?.platform?.registry_base_url) || registryBase;
+    }
+    catch {
+        // fall back to platformBaseUrl
+    }
+    const res = await fetch(`${registryBase.replace(/\/+$/, '')}/v1/agents/register`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ display_name: displayName }),
+    });
+    const data = (await res.json().catch(() => ({})));
+    if (!res.ok)
+        return fail(String(data?.error || 'api_key_create_failed'), data);
+    const auth = (data?.auth || {});
+    const clientId = normalizeText(auth.client_id);
+    const clientSecret = normalizeText(auth.client_secret);
+    if (!clientId || !clientSecret)
+        return fail('api_key_create_missing_credentials', data);
+    const apiKey = encodeHiApiKey(clientId, clientSecret);
+    const mcpUrl = config.oauthMcpResources[0] || `${registryBase.replace(/\/+$/, '')}/mcp`;
+    return ok({
+        api_key: apiKey,
+        agent_id: data?.agent_id ?? null,
+        mcp_url: mcpUrl,
+        setup: {
+            // Preferred: a literal header in Codex's config.toml — a static file Codex
+            // reads EVERY session (works for terminal codex AND the Codex.app GUI). The
+            // key is written once at setup and never rewritten, which is exactly why it
+            // can't vanish: the OAuth path vanished because Codex rewrites a ROTATING
+            // token on every refresh and a crash mid-write loses it; a static key has
+            // no rewrites. Same model as pasting a static key into Codex.app.
+            codex_config_toml: `[mcp_servers.hi]\nurl = "${mcpUrl}"\n\n[mcp_servers.hi.http_headers]\nAuthorization = "Bearer ${apiKey}"`,
+            // Alternative (terminal-launched codex): keep the key in an env var.
+            codex_env_var: `export HI_API_KEY='${apiKey}'   # then: codex mcp add hi --url ${mcpUrl} --bearer-token-env-var HI_API_KEY`,
+            restart: 'Fully quit and relaunch Codex — it loads MCP servers only at session start.',
+        },
+        note: 'Stable, revocable, NON-rotating API key. Put it in Codex config.toml as a literal Authorization header (preferred — read every session, never rewritten, so it cannot vanish like the rotating OAuth token did) or in the HI_API_KEY env var. It currently belongs to a fresh agent; once Codex is running on this key, call phone_binding to merge it into your existing Hi identity (your phone number). Revoke by rotating/deleting that agent.',
+    });
+}
 async function handleStatus(args) {
     const state = await loadPersistedState();
     const requestAuth = config.authMode === 'oauth' ? getCurrentRequestAuth() : null;
@@ -2345,6 +2416,8 @@ async function handleControlTool(name, args) {
             return await handleClaimExport(args);
         case 'hi_agent_claim_redeem':
             return await handleClaimRedeem(args);
+        case 'hi_api_key_create':
+            return await handleApiKeyCreate(args);
         case 'hi_agent_installation_get':
             return await handleInstallationGet();
         case 'hi_agent_installation_update':
@@ -2407,6 +2480,7 @@ const CONTROL_TOOL_ANNOTATIONS = {
     hi_agent_activate: { readOnlyHint: false, openWorldHint: false, destructiveHint: false, title: 'Hi agent activate' },
     hi_agent_claim_export: { readOnlyHint: false, openWorldHint: false, destructiveHint: false, title: 'Claim export' },
     hi_agent_claim_redeem: { readOnlyHint: false, openWorldHint: false, destructiveHint: false, title: 'Claim redeem' },
+    hi_api_key_create: { readOnlyHint: false, openWorldHint: false, destructiveHint: false, title: 'Create API key' },
     hi_agent_installation_get: { readOnlyHint: true, openWorldHint: false, destructiveHint: false, title: 'Installation get' },
     hi_agent_installation_update: { readOnlyHint: false, openWorldHint: false, destructiveHint: false, title: 'Installation update' },
     hi_agent_endpoints_list: { readOnlyHint: true, openWorldHint: false, destructiveHint: false, title: 'Endpoints list' },
@@ -2632,6 +2706,13 @@ async function runHttpServer() {
             audience: config.oauthMcpResources,
         })
         : null;
+    // /mcp edge exchanger for Hi API keys (hi_ak_...). Built only in OAuth mode
+    // with a token endpoint configured; otherwise undefined so only JWT bearers
+    // are accepted (unchanged). The exchange requests the canonical MCP resource
+    // so the issued token's aud satisfies the verifier above.
+    const apiKeyExchanger = config.authMode === 'oauth' && config.apiKeyTokenUrl
+        ? createApiKeyExchanger({ tokenUrl: config.apiKeyTokenUrl, resource: config.oauthMcpResources })
+        : undefined;
     function send401(req, res, description, error = 'invalid_token') {
         if (config.authMode === 'oauth') {
             const entry = resolveOAuthResource(req);
@@ -2691,7 +2772,7 @@ async function runHttpServer() {
         // OAuth-mode bearer enforcement. Stdio path and 'local' HTTP path keep
         // the existing single-tenant disk identity model untouched.
         if (config.authMode === 'oauth' && oauthVerifier) {
-            const outcome = await verifyRequestBearer(req, oauthVerifier);
+            const outcome = await verifyRequestBearer(req, oauthVerifier, apiKeyExchanger);
             if (!outcome.ok) {
                 return send401(req, res, outcome.description);
             }
@@ -2728,7 +2809,7 @@ async function runHttpServer() {
     };
     const challengeOrMethodNotAllowed = async (req, res) => {
         if (config.authMode === 'oauth' && oauthVerifier) {
-            const outcome = await verifyRequestBearer(req, oauthVerifier);
+            const outcome = await verifyRequestBearer(req, oauthVerifier, apiKeyExchanger);
             if (!outcome.ok) {
                 return send401(req, res, outcome.description);
             }

package/dist/state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACvD,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,wBAAwB,EAAE,MAAM,CAAC;IACjC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;QACpC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAC;QACxC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;KACpC,CAAC;IACF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACtC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACtC,OAAO,EAAE,mBAAmB,CAAC;CAC9B,CAAC;AAeF,eAAO,MAAM,sBAAsB,YAAY,CAAC;AAEhD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAE1D;AAaD,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAIrE;AAED,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,CAK5F;AAOD,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,OAAO,GAAG,MAAM,CAIlE;AAED,wBAAgB,gCAAgC,CAAC,UAAU,GAAE,OAAyB,GAAG,MAAM,CAG9F;AAED,MAAM,MAAM,0BAA0B,GAAG;IACvC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,EAAE,WAAW,GAAG,sBAAsB,GAAG,eAAe,CAAC;CAChE,CAAC;AAEF,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,OAAO,EACpB,UAAU,GAAE,OAAyB,GACpC,0BAA0B,CA2B5B;AAED,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE,CAMrE;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,qBAAqB,CAOxE;AAID,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAUlE;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,4BAA4B,CAAC;IACrC,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,wBAAwB,EAAE,MAAM,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,KAAK,EAAE,qBAAqB,CAAC;IAC7B,WAAW,EAAE,6BAA6B,GAAG,IAAI,CAAC;CACnD,CAAC;AAcF,wBAAsB,+BAA+B,CAAC,IAAI,EAAE;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,KAAK,EAAE,qBAAqB,CAAC;IAC7B,EAAE,CAAC,EAAE;QAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IACjE,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB,GAAG,OAAO,CAAC,6BAA6B,CAAC,CA+BzC;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,UAG3E;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAoCjC;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,qBAAqB,CAAC;CAC9B,iBAIA;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,qBAAqB,CAAC;CACpE,kCASA"}
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACvD,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,wBAAwB,EAAE,MAAM,CAAC;IACjC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;QACpC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAC;QACxC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;KACpC,CAAC;IACF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACtC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACtC,OAAO,EAAE,mBAAmB,CAAC;CAC9B,CAAC;AAeF,eAAO,MAAM,sBAAsB,YAAY,CAAC;AAEhD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAE1D;AAaD,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAIrE;AAED,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,CAK5F;AAOD,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,OAAO,GAAG,MAAM,CAIlE;AAED,wBAAgB,gCAAgC,CAAC,UAAU,GAAE,OAAyB,GAAG,MAAM,CAG9F;AAED,MAAM,MAAM,0BAA0B,GAAG;IACvC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,EAAE,WAAW,GAAG,sBAAsB,GAAG,eAAe,CAAC;CAChE,CAAC;AAEF,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,OAAO,EACpB,UAAU,GAAE,OAAyB,GACpC,0BAA0B,CA2B5B;AAED,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE,CAMrE;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,qBAAqB,CAOxE;AAID,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAUlE;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,4BAA4B,CAAC;IACrC,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,wBAAwB,EAAE,MAAM,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,KAAK,EAAE,qBAAqB,CAAC;IAC7B,WAAW,EAAE,6BAA6B,GAAG,IAAI,CAAC;CACnD,CAAC;AAcF,wBAAsB,+BAA+B,CAAC,IAAI,EAAE;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,KAAK,EAAE,qBAAqB,CAAC;IAC7B,EAAE,CAAC,EAAE;QAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IACjE,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB,GAAG,OAAO,CAAC,6BAA6B,CAAC,CA+BzC;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,UAG3E;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA8CjC;AA+BD,wBAAsB,UAAU,CAAC,IAAI,EAAE;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,qBAAqB,CAAC;CAC9B,iBAGA;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,qBAAqB,CAAC;CACpE,kCASA"}

package/dist/state.js

@@ -204,13 +204,63 @@ export async function readState(args) {
     catch (error) {
         if (error?.code === 'ENOENT')
             return buildDefaultState(args.profile);
+        if (error instanceof SyntaxError) {
+            // File exists but isn't valid JSON — a legacy torn/truncated write (from
+            // before atomicWriteFile) or external corruption. Don't hard-fail every
+            // tool call; preserve the bad file for forensics and fall back to a fresh
+            // default so the agent can re-provision instead of bricking.
+            const corruptPath = `${filePath}.corrupt-${process.pid}-${crypto.randomBytes(4).toString('hex')}`;
+            try {
+                await fs.rename(filePath, corruptPath);
+            }
+            catch { }
+            try {
+                console.error(`[hi-mcp] state file was corrupt; quarantined to ${corruptPath} and reset to default`);
+            }
+            catch { }
+            return buildDefaultState(args.profile);
+        }
+        throw error;
+    }
+}
+// Crash-safe atomic file write. A plain fs.writeFile truncates the target up
+// front and streams bytes in — a SIGKILL / OOM / power loss mid-write leaves a
+// 0-byte or half-written file. For the credential/identity file that means the
+// agent's client_id/client_secret silently vanish and the user is forced to
+// re-login (the "codex creds mysteriously disappeared" class of bug). Instead:
+// write to a unique temp file, fsync its contents to disk, then atomically
+// rename it over the target. A concurrent reader always sees either the old
+// complete file or the new complete file — never a torn one. mode 0o600 because
+// the payload carries client_secret.
+async function atomicWriteFile(filePath, data) {
+    await fs.mkdir(path.dirname(filePath), { recursive: true });
+    const tmpPath = `${filePath}.tmp-${process.pid}-${crypto.randomBytes(6).toString('hex')}`;
+    let fh;
+    try {
+        fh = await fs.open(tmpPath, 'w', 0o600);
+        await fh.writeFile(data, 'utf8');
+        await fh.sync();
+        await fh.close();
+        fh = undefined;
+        await fs.rename(tmpPath, filePath);
+    }
+    catch (error) {
+        if (fh) {
+            try {
+                await fh.close();
+            }
+            catch { }
+        }
+        try {
+            await fs.unlink(tmpPath);
+        }
+        catch { }
         throw error;
     }
 }
 export async function writeState(args) {
     const filePath = resolveStateFile(args);
-    await fs.mkdir(path.dirname(filePath), { recursive: true });
-    await fs.writeFile(filePath, `${JSON.stringify(args.state, null, 2)}\n`, 'utf8');
+    await atomicWriteFile(filePath, `${JSON.stringify(args.state, null, 2)}\n`);
 }
 export async function updateState(args) {
     const current = await readState(args);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hirey/hi-mcp-server",
-  "version": "0.1.25",
+  "version": "0.1.26",
   "private": false,
   "type": "module",
   "main": "dist/server.js",