@hzlmy2002/web-market 0.1.0 → 0.1.1

package/README.md

@@ -4,15 +4,15 @@ Node/TypeScript stdio MCP for focused website competitive analysis. Five tools c
 
 ## Install with npx
 
-Requires Node 22 or newer. Set AISA_API_KEY in the environment of the process launching your MCP client, then run one of:
+Requires Node 22 or newer. Run one of these commands in a terminal:
 
 ```sh
-npx -y @hzlmy2002/web-market@0.1.0 setup --client codex
-npx -y @hzlmy2002/web-market@0.1.0 setup --client claude-code
-npx -y @hzlmy2002/web-market@0.1.0 setup --client hermes
+npx -y @hzlmy2002/web-market@0.1.1 setup --client codex
+npx -y @hzlmy2002/web-market@0.1.1 setup --client claude-code
+npx -y @hzlmy2002/web-market@0.1.1 setup --client hermes
 ```
 
-This installs the Skill and registers a version-pinned `npx -y @hzlmy2002/web-market@0.1.0 serve` MCP command. Clearing the npm cache does not invalidate the configured path: npx downloads the pinned release again when necessary. Restart or refresh the client to discover the Skill. Credentials must still reach the MCP process; the installer never stores your key. Use `uninstall --client ...` to remove an unchanged managed installation.
+This installs the Skill and registers a version-pinned `npx -y @hzlmy2002/web-market@0.1.1 serve` MCP command. Clearing the npm cache does not invalidate the configured path: npx downloads the pinned release again when necessary. Restart or refresh the client to discover the Skill. If no key is configured, setup prompts for hidden input and saves the key in the selected client’s MCP `env.AISA_API_KEY` setting. This works independently of shell startup files on macOS, Linux, and Windows. Existing saved keys are reused. If `AISA_API_KEY` is already set in the setup environment, setup keeps using environment-based authentication without copying the key; the client must inherit that variable. Non-interactive setup without a saved or environment key exits with instructions. Use `uninstall --client ...` to remove an unchanged managed installation.
 
 ## Local setup
 
@@ -24,7 +24,7 @@ npm test
 npm run build
 ```
 
-Set `AISA_API_KEY` in the environment of the process launching your MCP client. It is an AIsa API key; never put it in a Skill or commit it. Desktop clients started outside your shell may need the variable configured explicitly in their MCP settings. The installer does not read or persist the key.
+Setup prompts for a missing AIsa API key and stores it as plaintext in the selected client configuration, with restrictive file permissions where supported. It is never printed or copied into Skills or installer state. This is a temporary Bearer authentication flow ahead of OAuth support. Setup does not edit shell profiles or Windows user environment variables. Alternatively, set `AISA_API_KEY` in the environment inherited by your MCP client. Desktop applications may not inherit variables exported in a terminal.
 
 Run one of these from this checkout:
 

package/dist/cli.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { resolveSetupKey } from './credentials.js';
 import { parseArgs } from 'node:util';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { createServer } from './server.js';
@@ -7,20 +8,20 @@ async function main() {
     const { values, positionals } = parseArgs({ allowPositionals: true, options: { client: { type: 'string' }, home: { type: 'string' }, 'install-skills': { type: 'boolean' }, help: { type: 'boolean' } } });
     const command = positionals[0] ?? 'serve';
     if (values.help) {
-        console.log('aisa-web-market serve [--install-skills --client codex|claude-code|hermes]\naisa-web-market setup|uninstall --client codex|claude-code|hermes [--home directory]\naisa-web-market status\nSet AISA_API_KEY in the server environment. setup never stores the token.');
+        console.log('aisa-web-market serve [--install-skills --client codex|claude-code|hermes]\naisa-web-market setup|uninstall --client codex|claude-code|hermes [--home directory]\naisa-web-market status\nSet AISA_API_KEY in the server environment. setup prompts for a missing key and saves it in the client MCP configuration.');
         return;
     }
     if (positionals.length > 1)
         throw Error('Unexpected positional argument.');
     if (command === 'status') {
-        console.log(JSON.stringify({ credential_configured: Boolean(process.env.AISA_API_KEY?.trim()), authentication: 'bearer', version: '0.1.0' }));
+        console.log(JSON.stringify({ credential_configured: Boolean(process.env.AISA_API_KEY?.trim()), authentication: 'bearer', version: '0.1.1' }));
         return;
     }
     if (command === 'setup' || command === 'uninstall') {
         if (!values.client)
             throw Error('--client is required.');
-        console.log(JSON.stringify(await install(values.client, { home: values.home, remove: command === 'uninstall' })));
-        console.log('Client configuration preserves existing values; serialization may reformat comments. Ensure AISA_API_KEY reaches the client process. Restart or refresh the client to load skills.');
+        console.log(JSON.stringify(await install(values.client, { home: values.home, remove: command === 'uninstall', resolveKey: command === 'setup' ? resolveSetupKey : undefined })));
+        console.log('Client configuration preserves existing values; serialization may reformat comments. A saved key is passed directly to the MCP process; otherwise ensure the client inherits AISA_API_KEY. Restart or refresh the client to load skills.');
         return;
     }
     if (command !== 'serve')

package/dist/credentials.d.ts

@@ -0,0 +1,2 @@
+export declare function promptKey(): Promise<string>;
+export declare function resolveSetupKey(savedKey?: string): Promise<string | undefined>;

package/dist/credentials.js

@@ -0,0 +1,62 @@
+import { emitKeypressEvents } from 'node:readline';
+// Read from the terminal without echoing credentials or consuming MCP stdin.
+export async function promptKey() {
+    if (!process.stdin.isTTY || !process.stderr.isTTY) {
+        throw Error('AISA_API_KEY is missing. Run setup in an interactive terminal to save a key, or set AISA_API_KEY before running setup.');
+    }
+    process.stderr.write('Enter AISA_API_KEY (saved locally in the client MCP configuration; input hidden): ');
+    const input = process.stdin;
+    const wasRaw = input.isRaw;
+    emitKeypressEvents(input);
+    input.setRawMode(true);
+    input.resume();
+    return new Promise((resolve, reject) => {
+        let value = '';
+        const finish = (error) => {
+            input.removeListener('keypress', onKey);
+            input.removeListener('end', onEnd);
+            input.removeListener('error', onError);
+            input.setRawMode(wasRaw);
+            input.pause();
+            process.stderr.write('\n');
+            if (error)
+                reject(error);
+            else
+                resolve(value.trim());
+        };
+        const onEnd = () => finish(Error('Key input ended; setup cancelled.'));
+        const onError = () => finish(Error('Could not read key; setup cancelled.'));
+        const onKey = (text, key) => {
+            if (key.ctrl && (key.name === 'c' || key.name === 'd'))
+                return finish(Error('Setup cancelled.'));
+            if (key.name === 'return' || key.name === 'enter') {
+                if (!value.trim()) {
+                    process.stderr.write('\nKey cannot be empty. Enter AISA_API_KEY: ');
+                    return;
+                }
+                return finish();
+            }
+            if (key.name === 'backspace') {
+                value = Array.from(value).slice(0, -1).join('');
+                return;
+            }
+            if (key.ctrl && key.name === 'u') {
+                value = '';
+                return;
+            }
+            if (!key.ctrl && !key.meta && text && !/[\x00-\x1f\x7f]/.test(text))
+                value += text;
+        };
+        input.on('keypress', onKey);
+        input.once('end', onEnd);
+        input.once('error', onError);
+    });
+}
+export async function resolveSetupKey(savedKey) {
+    if (savedKey?.trim())
+        return savedKey;
+    // Preserve the existing environment-based setup; only prompted keys are saved.
+    if (process.env.AISA_API_KEY?.trim())
+        return undefined;
+    return promptKey();
+}

package/dist/install.d.ts

@@ -9,6 +9,7 @@ export declare function install(client: Client, options?: {
     home?: string;
     remove?: boolean;
     skillsOnly?: boolean;
+    resolveKey?: (savedKey?: string) => Promise<string | undefined>;
 }): Promise<{
     client: Client;
     skill: string;

package/dist/install.js

@@ -12,7 +12,7 @@ const skillName = 'aisa-web-market';
 // local Node entry so development changes remain immediately testable.
 export function launchEntry(client, root = packageRoot) {
     const command = root.split(path.sep).includes('node_modules')
-        ? { command: process.platform === 'win32' ? 'npx.cmd' : 'npx', args: ['-y', '@hzlmy2002/web-market@0.1.0', 'serve'] }
+        ? { command: process.platform === 'win32' ? 'npx.cmd' : 'npx', args: ['-y', '@hzlmy2002/web-market@0.1.1', 'serve'] }
         : { command: process.execPath, args: [path.join(root, 'dist/cli.js'), 'serve'] };
     return { ...command, ...(client === 'codex' ? { env_vars: ['AISA_API_KEY'] } : {}) };
 }
@@ -96,7 +96,7 @@ export async function install(client, options = {}) {
         const root = skillRoot(client, home);
         const entry = launchEntry(client);
         const writes = new Map();
-        const next = { version: '0.1.0', files: {}, config: previous.config };
+        const next = { version: '0.1.1', files: {}, config: previous.config, configHash: previous.configHash };
         const bundled = await skillFiles(path.join(packageRoot, 'skills', skillName));
         for (const relative of new Set([...Object.keys(bundled), ...Object.keys(previous.files)])) {
             if (path.isAbsolute(relative) || relative.split(/[\\/]/).includes('..'))
@@ -118,7 +118,7 @@ export async function install(client, options = {}) {
                 next.files[relative] = hash(content);
             }
         }
-        if (!options.skillsOnly && (!options.remove || previous.config)) {
+        if (!options.skillsOnly && (!options.remove || previous.config || previous.configHash)) {
             await noSymlinks(cfg.file);
             const current = await read(cfg.file);
             let config;
@@ -134,16 +134,25 @@ export async function install(client, options = {}) {
             if (typeof config[cfg.key] !== 'object' || Array.isArray(config[cfg.key]))
                 throw Error('Invalid MCP configuration section.');
             const existing = config[cfg.key][skillName];
+            const owned = previous.configHash ? existing !== undefined && hash(JSON.stringify(existing)) === previous.configHash : JSON.stringify(existing) === JSON.stringify(previous.config);
             if (options.remove) {
-                if (existing && JSON.stringify(existing) !== JSON.stringify(previous.config))
+                if (existing && !owned)
                     throw Error('MCP entry has been modified; preserving it.');
                 delete config[cfg.key][skillName];
             }
             else {
-                if (existing && JSON.stringify(existing) !== JSON.stringify(previous.config) && JSON.stringify(existing) !== JSON.stringify(entry))
+                if (existing && !owned && JSON.stringify(existing) !== JSON.stringify(entry))
                     throw Error('An unowned aisa-web-market MCP entry already exists; preserving it.');
-                config[cfg.key][skillName] = entry;
-                next.config = entry;
+                const savedKey = typeof existing?.env?.AISA_API_KEY === 'string' ? existing.env.AISA_API_KEY : undefined;
+                const apiKey = options.resolveKey ? await options.resolveKey(savedKey) : savedKey;
+                const configured = { ...entry };
+                if (apiKey) {
+                    configured.env = { AISA_API_KEY: apiKey };
+                    delete configured.env_vars;
+                }
+                config[cfg.key][skillName] = configured;
+                delete next.config;
+                next.configHash = hash(JSON.stringify(configured));
             }
             writes.set(cfg.file, cfg.stringify(config));
         }

package/dist/server.js

@@ -3,7 +3,7 @@ import { ApiClient, safeError } from './api.js';
 import { inputs, output } from './schema.js';
 import { execute, descriptions } from './tools.js';
 export function createServer(api = new ApiClient()) {
-    const server = new McpServer({ name: 'aisa-web-market', version: '0.1.0' }, { instructions: 'Website competitive analysis using five AIsa tools. Use the installed aisa-web-market skill for scenario guidance. Compare identical scope and preserve missing-data evidence. API calls are billed. Credentials come from AISA_API_KEY; never request the key in conversation.' });
+    const server = new McpServer({ name: 'aisa-web-market', version: '0.1.1' }, { instructions: 'Website competitive analysis using five AIsa tools. Use the installed aisa-web-market skill for scenario guidance. Compare identical scope and preserve missing-data evidence. API calls are billed. Credentials come from AISA_API_KEY; never request the key in conversation.' });
     for (const name of Object.keys(inputs)) {
         server.registerTool(name, { description: descriptions[name], inputSchema: inputs[name], outputSchema: output.shape, annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: false, openWorldHint: true } }, async (args, extra) => {
             try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hzlmy2002/web-market",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Focused website competitive analysis: five MCP tools and a portable skill",
   "type": "module",
   "bin": {