@husar.ai/cli 0.4.0 → 0.4.2

package/src/mcp.ts

@@ -7,7 +7,7 @@ import { ConfigMaker } from 'config-maker';
 import { parser } from './functions/parser.js';
 import { generateCms } from './functions/generate.js';
 import path from 'path';
-import { HusarConfigType } from '@/types/config.js';
+import { HusarConfigType, getAdminToken } from '@/types/config.js';
 import {
   buildClientSchema,
   printSchema,
@@ -227,8 +227,9 @@ const createCmsParseFileHandler = ({ timeoutMs = 300_000 }: { timeoutMs?: number
       if (!raw.host) {
         throw new Error('Please implement host in husar.json');
       }
-      if (!raw.adminToken) {
-        throw new Error('Please implement adminToken in husar.json');
+      const adminToken = getAdminToken(raw);
+      if (!adminToken) {
+        throw new Error('Admin token not configured. Set HUSAR_ADMIN_TOKEN env var, or adminTokenEnv in husar.json');
       }
       const result = await withTimeout(
         parser({
@@ -237,7 +238,7 @@ const createCmsParseFileHandler = ({ timeoutMs = 300_000 }: { timeoutMs?: number
           opts: { type: (type ?? 'shape') as 'model' | 'shape', name },
           authentication: {
             HUSAR_MCP_HOST: raw.host,
-            HUSAR_MCP_ADMIN_TOKEN: raw.adminToken,
+            HUSAR_MCP_ADMIN_TOKEN: adminToken,
           },
         }),
         timeoutMs,
@@ -333,9 +334,10 @@ export const startMcpServer = async () => {
         const cfg = await getConfig(workspaceRoot);
         const raw = cfg.get();
         const host = raw.host;
-        const token = raw.adminToken;
+        const token = getAdminToken(raw);
         if (!host) throw new Error('Missing host in husar.json');
-        if (!token) throw new Error('Missing adminToken in husar.json');
+        if (!token)
+          throw new Error('Admin token not configured. Set HUSAR_ADMIN_TOKEN env var, or adminTokenEnv in husar.json');
         const url = new URL(endpointPath || 'api/graphql', host).toString();
         const vars =
           typeof variables === 'string' && variables.trim().length ? JSON.parse(variables) : (variables ?? {});
@@ -375,9 +377,10 @@ export const startMcpServer = async () => {
         const cfg = await getConfig(workspaceRoot);
         const raw = cfg.get();
         const host = raw.host;
-        const token = raw.adminToken;
+        const token = getAdminToken(raw);
         if (!host) throw new Error('Missing host in husar.json');
-        if (!token) throw new Error('Missing adminToken in husar.json');
+        if (!token)
+          throw new Error('Admin token not configured. Set HUSAR_ADMIN_TOKEN env var, or adminTokenEnv in husar.json');
         const url = new URL(endpointPath || 'api/graphql', host).toString();
         const res = await fetch(url, {
           method: 'POST',
@@ -403,9 +406,10 @@ export const startMcpServer = async () => {
       const cfg = await getConfig(workspaceRoot);
       const raw = cfg.get();
       const host = raw.host;
-      const token = raw.adminToken;
+      const token = getAdminToken(raw);
       if (!host) throw new Error('Missing host in husar.json');
-      if (!token) throw new Error('Missing adminToken in husar.json');
+      if (!token)
+        throw new Error('Admin token not configured. Set HUSAR_ADMIN_TOKEN env var, or adminTokenEnv in husar.json');
       const url = new URL(endpointPath || 'api/graphql', host).toString();
       const res = await fetch(url, {
         method: 'POST',
@@ -603,9 +607,10 @@ export const startMcpServer = async () => {
         const cfg = await getConfig(workspaceRoot);
         const raw = cfg.get();
         const host = raw.host;
-        const token = raw.adminToken;
+        const token = getAdminToken(raw);
         if (!host) throw new Error('Missing host in husar.json');
-        if (!token) throw new Error('Missing adminToken in husar.json');
+        if (!token)
+          throw new Error('Admin token not configured. Set HUSAR_ADMIN_TOKEN env var, or adminTokenEnv in husar.json');
         const { query, variables: tmpl } = suggestQueryFromSDL({ sdl, task, rootType: 'Query' });
         const overrides =
           typeof variables === 'string' && variables.trim().length ? JSON.parse(variables) : (variables ?? {});
@@ -689,9 +694,10 @@ export const startMcpServer = async () => {
         const cfg = await getConfig(undefined);
         const raw = cfg.get();
         const host = raw.host;
-        const token = raw.adminToken;
+        const token = getAdminToken(raw);
         if (!host) throw new Error('Missing host in husar.json');
-        if (!token) throw new Error('Missing adminToken in husar.json');
+        if (!token)
+          throw new Error('Admin token not configured. Set HUSAR_ADMIN_TOKEN env var, or adminTokenEnv in husar.json');
         const url = new URL('api/graphql', host).toString();
         const input = { name, args };
         const res = await fetch(url, {
@@ -718,20 +724,34 @@ export const startMcpServer = async () => {
       },
     });
 
+    // Create a passthrough Zod schema that accepts any object properties.
+    // This allows the MCP SDK to properly pass arguments to handlers while
+    // letting the backend handle actual validation. We use z.object({}).passthrough()
+    // which accepts and preserves all properties.
+    const passthroughZodSchema = z.object({}).passthrough();
+
     for (const toolDef of ormTools) {
-      // We pass raw JSON Schema parameters to MCP server; SDK will forward as-is.
-      server.tool(toolDef.name, toolDef.description, toolDef.parameters, (async (args: unknown) => {
-        try {
-          const outcome = await toolDef.run(args);
-          const payload =
-            typeof outcome.result !== 'undefined' ? outcome.result : { ok: outcome.ok, error: outcome.error };
-          return { content: [{ type: 'text', text: JSON.stringify(payload, null, 2) }] };
-        } catch (err) {
-          const message = err instanceof Error ? err.message : String(err);
-          const stack = err instanceof Error && err.stack ? `\nStack: ${err.stack}` : '';
-          return { isError: true, content: [{ type: 'text', text: `Error: ${message}${stack}` }] };
-        }
-      }) as any);
+      // Register ORM tools with the passthrough schema.
+      // The description includes the actual JSON Schema for AI context.
+      server.registerTool(
+        toolDef.name,
+        {
+          description: `${toolDef.description}\n\nExpected parameters: ${JSON.stringify(toolDef.parameters, null, 2)}`,
+          inputSchema: passthroughZodSchema,
+        },
+        (async (args: unknown, _extra: unknown) => {
+          try {
+            const outcome = await toolDef.run(args);
+            const payload =
+              typeof outcome.result !== 'undefined' ? outcome.result : { ok: outcome.ok, error: outcome.error };
+            return { content: [{ type: 'text', text: JSON.stringify(payload, null, 2) }] };
+          } catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            const stack = err instanceof Error && err.stack ? `\nStack: ${err.stack}` : '';
+            return { isError: true, content: [{ type: 'text', text: `Error: ${message}${stack}` }] };
+          }
+        }) as any,
+      );
     }
   } catch (e) {
     // In case tool spec import fails, keep MCP operational for other tools

package/src/types/config.ts

@@ -3,5 +3,36 @@ export type HusarConfigType = {
   hostEnvironmentVariable: string;
   authenticationEnvironmentVariable: string;
   overrideHost: boolean;
-  adminToken: string;
+  /** @deprecated Use adminTokenEnv instead for security. This field is kept for backward compatibility. */
+  adminToken?: string;
+  /** Environment variable name containing the admin token (recommended) */
+  adminTokenEnv?: string;
 };
+
+/**
+ * Get the admin token from config, checking env vars first
+ * Priority:
+ * 1. HUSAR_MCP_ADMIN_TOKEN env var (for MCP override)
+ * 2. ENV var specified by adminTokenEnv in config
+ * 3. HUSAR_ADMIN_TOKEN env var (default)
+ * 4. adminToken field in config (deprecated, for backward compatibility)
+ */
+export function getAdminToken(config: Partial<HusarConfigType>): string | undefined {
+  // 1. MCP-specific override
+  if (process.env.HUSAR_MCP_ADMIN_TOKEN) {
+    return process.env.HUSAR_MCP_ADMIN_TOKEN;
+  }
+
+  // 2. Config-specified env var
+  if (config.adminTokenEnv && process.env[config.adminTokenEnv]) {
+    return process.env[config.adminTokenEnv];
+  }
+
+  // 3. Default env var
+  if (process.env.HUSAR_ADMIN_TOKEN) {
+    return process.env.HUSAR_ADMIN_TOKEN;
+  }
+
+  // 4. Deprecated: direct token in config (backward compatibility)
+  return config.adminToken;
+}