@hzlmy2002/web-market 0.1.0 → 0.1.2

package/README.md

@@ -4,15 +4,25 @@ Node/TypeScript stdio MCP for focused website competitive analysis. Five tools c
 
 ## Install with npx
 
-Requires Node 22 or newer. Set AISA_API_KEY in the environment of the process launching your MCP client, then run one of:
+Requires Node 22 or newer. Run one of these commands in a terminal:
 
 ```sh
-npx -y @hzlmy2002/web-market@0.1.0 setup --client codex
-npx -y @hzlmy2002/web-market@0.1.0 setup --client claude-code
-npx -y @hzlmy2002/web-market@0.1.0 setup --client hermes
+npx -y @hzlmy2002/web-market@0.1.2 setup --client codex
+npx -y @hzlmy2002/web-market@0.1.2 setup --client claude-code
+npx -y @hzlmy2002/web-market@0.1.2 setup --client hermes
 ```
 
-This installs the Skill and registers a version-pinned `npx -y @hzlmy2002/web-market@0.1.0 serve` MCP command. Clearing the npm cache does not invalidate the configured path: npx downloads the pinned release again when necessary. Restart or refresh the client to discover the Skill. Credentials must still reach the MCP process; the installer never stores your key. Use `uninstall --client ...` to remove an unchanged managed installation.
+This installs the Skill and registers a version-pinned `npx -y @hzlmy2002/web-market@0.1.2 serve` MCP command. Clearing the npm cache does not invalidate the configured path: npx downloads the pinned release again when necessary. Restart or refresh the client to discover the Skill. If no key is configured, setup prompts for hidden input and saves the key in the selected client’s MCP `env.AISA_API_KEY` setting. This works independently of shell startup files on macOS, Linux, and Windows. Existing saved keys are reused. If `AISA_API_KEY` is already set in the setup environment, setup keeps using environment-based authentication without copying the key; the client must inherit that variable. Non-interactive setup without a saved or environment key exits with instructions. Use `uninstall --client ...` to remove an unchanged managed installation.
+
+When testing the published release from this source repository, first change to another directory (for example, `cd ~`). npm exec/npx can select the current project when its name and version match the requested package, but a source checkout has no installed `aisa-web-market` command link. This results in `sh: aisa-web-market: command not found`. Alternatively, use the local setup command below after building.
+
+## Automatic client detection
+
+Run `npx -y @hzlmy2002/web-market@0.1.2 setup` to install for every detected client. From a built source checkout, use `node dist/cli.js setup`. Detection checks `.codex/`, `.claude/` or `.claude.json`, and `.hermes/` in the user's home directory (or `--home`). These are usage traces, not proof that the executable is still installed. Shared `.agents/` directories alone do not count as detection.
+
+Use `--client` to select a single client or install before its first run. If nothing is detected, setup explains how to proceed without creating client configurations. Custom client configuration roots are not discovered automatically. A newly entered key is requested once and reused for clients needing a key; existing client keys remain in place. Installation results are reported per client; a failure does not undo successful installations, and any failure produces a nonzero exit status. Uninstall still requires `--client`.
+
+Automatic detection is available starting with version 0.1.2. Windows uses the same home-directory markers, but the full workflow has not yet been tested on a Windows machine.
 
 ## Local setup
 
@@ -24,7 +34,7 @@ npm test
 npm run build
 ```
 
-Set `AISA_API_KEY` in the environment of the process launching your MCP client. It is an AIsa API key; never put it in a Skill or commit it. Desktop clients started outside your shell may need the variable configured explicitly in their MCP settings. The installer does not read or persist the key.
+Setup prompts for a missing AIsa API key and stores it as plaintext in the selected client configuration, with restrictive file permissions where supported. It is never printed or copied into Skills or installer state. This is a temporary Bearer authentication flow ahead of OAuth support. Setup does not edit shell profiles or Windows user environment variables. Alternatively, set `AISA_API_KEY` in the environment inherited by your MCP client. Desktop applications may not inherit variables exported in a terminal.
 
 Run one of these from this checkout:
 

package/dist/cli.js

@@ -1,26 +1,41 @@
 #!/usr/bin/env node
+import { sharedSetupKeyResolver } from './credentials.js';
 import { parseArgs } from 'node:util';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { createServer } from './server.js';
-import { install } from './install.js';
+import { detectClients, install } from './install.js';
 async function main() {
     const { values, positionals } = parseArgs({ allowPositionals: true, options: { client: { type: 'string' }, home: { type: 'string' }, 'install-skills': { type: 'boolean' }, help: { type: 'boolean' } } });
     const command = positionals[0] ?? 'serve';
     if (values.help) {
-        console.log('aisa-web-market serve [--install-skills --client codex|claude-code|hermes]\naisa-web-market setup|uninstall --client codex|claude-code|hermes [--home directory]\naisa-web-market status\nSet AISA_API_KEY in the server environment. setup never stores the token.');
+        console.log('aisa-web-market serve [--install-skills --client codex|claude-code|hermes]\naisa-web-market setup [--client codex|claude-code|hermes] [--home directory]\naisa-web-market uninstall --client codex|claude-code|hermes [--home directory]\naisa-web-market status\nsetup detects all supported clients in your home directory when --client is omitted. Set AISA_API_KEY in the server environment. setup prompts for a missing key and saves it in the client MCP configuration.');
         return;
     }
     if (positionals.length > 1)
         throw Error('Unexpected positional argument.');
     if (command === 'status') {
-        console.log(JSON.stringify({ credential_configured: Boolean(process.env.AISA_API_KEY?.trim()), authentication: 'bearer', version: '0.1.0' }));
+        console.log(JSON.stringify({ credential_configured: Boolean(process.env.AISA_API_KEY?.trim()), authentication: 'bearer', version: '0.1.2' }));
         return;
     }
     if (command === 'setup' || command === 'uninstall') {
+        if (command === 'uninstall' && !values.client)
+            throw Error('--client is required for uninstall.');
+        const clients = values.client ? [values.client] : await detectClients(values.home);
+        if (!clients.length)
+            throw Error('No supported clients detected. Run a client once, or use setup --client codex|claude-code|hermes.');
         if (!values.client)
-            throw Error('--client is required.');
-        console.log(JSON.stringify(await install(values.client, { home: values.home, remove: command === 'uninstall' })));
-        console.log('Client configuration preserves existing values; serialization may reformat comments. Ensure AISA_API_KEY reaches the client process. Restart or refresh the client to load skills.');
+            console.error(`Detected clients: ${clients.join(', ')}`);
+        const resolveKey = sharedSetupKeyResolver();
+        for (const client of clients) {
+            try {
+                console.log(JSON.stringify(await install(client, { home: values.home, remove: command === 'uninstall', resolveKey: command === 'setup' ? resolveKey : undefined })));
+            }
+            catch (error) {
+                console.error(`${client}: ${error instanceof Error ? error.message : 'Installation failed.'}`);
+                process.exitCode = 1;
+            }
+        }
+        console.log('Client configuration preserves existing values; serialization may reformat comments. A saved key is passed directly to the MCP process; otherwise ensure the client inherits AISA_API_KEY. Restart or refresh the client to load skills.');
         return;
     }
     if (command !== 'serve')

package/dist/credentials.d.ts

@@ -0,0 +1,3 @@
+export declare function promptKey(): Promise<string>;
+export declare function resolveSetupKey(savedKey?: string): Promise<string | undefined>;
+export declare function sharedSetupKeyResolver(resolve?: typeof resolveSetupKey): (savedKey?: string) => Promise<string | undefined>;

package/dist/credentials.js

@@ -0,0 +1,71 @@
+import { emitKeypressEvents } from 'node:readline';
+// Read from the terminal without echoing credentials or consuming MCP stdin.
+export async function promptKey() {
+    if (!process.stdin.isTTY || !process.stderr.isTTY) {
+        throw Error('AISA_API_KEY is missing. Run setup in an interactive terminal to save a key, or set AISA_API_KEY before running setup.');
+    }
+    process.stderr.write('Enter AISA_API_KEY (saved locally in the client MCP configuration; input hidden): ');
+    const input = process.stdin;
+    const wasRaw = input.isRaw;
+    emitKeypressEvents(input);
+    input.setRawMode(true);
+    input.resume();
+    return new Promise((resolve, reject) => {
+        let value = '';
+        const finish = (error) => {
+            input.removeListener('keypress', onKey);
+            input.removeListener('end', onEnd);
+            input.removeListener('error', onError);
+            input.setRawMode(wasRaw);
+            input.pause();
+            process.stderr.write('\n');
+            if (error)
+                reject(error);
+            else
+                resolve(value.trim());
+        };
+        const onEnd = () => finish(Error('Key input ended; setup cancelled.'));
+        const onError = () => finish(Error('Could not read key; setup cancelled.'));
+        const onKey = (text, key) => {
+            if (key.ctrl && (key.name === 'c' || key.name === 'd'))
+                return finish(Error('Setup cancelled.'));
+            if (key.name === 'return' || key.name === 'enter') {
+                if (!value.trim()) {
+                    process.stderr.write('\nKey cannot be empty. Enter AISA_API_KEY: ');
+                    return;
+                }
+                return finish();
+            }
+            if (key.name === 'backspace') {
+                value = Array.from(value).slice(0, -1).join('');
+                return;
+            }
+            if (key.ctrl && key.name === 'u') {
+                value = '';
+                return;
+            }
+            if (!key.ctrl && !key.meta && text && !/[\x00-\x1f\x7f]/.test(text))
+                value += text;
+        };
+        input.on('keypress', onKey);
+        input.once('end', onEnd);
+        input.once('error', onError);
+    });
+}
+export async function resolveSetupKey(savedKey) {
+    if (savedKey?.trim())
+        return savedKey;
+    // Preserve the existing environment-based setup; only prompted keys are saved.
+    if (process.env.AISA_API_KEY?.trim())
+        return undefined;
+    return promptKey();
+}
+export function sharedSetupKeyResolver(resolve = resolveSetupKey) {
+    let requested;
+    return (savedKey) => {
+        // Keep each client's existing credentials. Share only the newly requested key.
+        if (savedKey?.trim())
+            return Promise.resolve(savedKey);
+        return requested ??= resolve();
+    };
+}

package/dist/install.d.ts

@@ -1,4 +1,5 @@
 export type Client = 'codex' | 'claude-code' | 'hermes';
+export declare function detectClients(home?: string): Promise<Client[]>;
 export declare const packageRoot: string;
 export declare function launchEntry(client: Client, root?: string): {
     env_vars?: string[] | undefined;
@@ -9,6 +10,7 @@ export declare function install(client: Client, options?: {
     home?: string;
     remove?: boolean;
     skillsOnly?: boolean;
+    resolveKey?: (savedKey?: string) => Promise<string | undefined>;
 }): Promise<{
     client: Client;
     skill: string;

package/dist/install.js

@@ -5,6 +5,27 @@ import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import TOML from '@iarna/toml';
 import YAML from 'yaml';
+export async function detectClients(home = homedir()) {
+    const markers = [
+        ['codex', '.codex', 'directory'],
+        ['claude-code', '.claude', 'directory'],
+        ['claude-code', '.claude.json', 'file'],
+        ['hermes', '.hermes', 'directory'],
+    ];
+    const found = new Set();
+    for (const [client, relative, kind] of markers) {
+        try {
+            const stat = await fs.stat(path.resolve(home, relative));
+            if (kind === 'directory' ? stat.isDirectory() : stat.isFile())
+                found.add(client);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT' && error.code !== 'ENOTDIR')
+                throw error;
+        }
+    }
+    return [...found];
+}
 export const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const skillName = 'aisa-web-market';
 // npm/npx installations live in node_modules. Persist a version-pinned registry
@@ -12,7 +33,7 @@ const skillName = 'aisa-web-market';
 // local Node entry so development changes remain immediately testable.
 export function launchEntry(client, root = packageRoot) {
     const command = root.split(path.sep).includes('node_modules')
-        ? { command: process.platform === 'win32' ? 'npx.cmd' : 'npx', args: ['-y', '@hzlmy2002/web-market@0.1.0', 'serve'] }
+        ? { command: process.platform === 'win32' ? 'npx.cmd' : 'npx', args: ['-y', '@hzlmy2002/web-market@0.1.2', 'serve'] }
         : { command: process.execPath, args: [path.join(root, 'dist/cli.js'), 'serve'] };
     return { ...command, ...(client === 'codex' ? { env_vars: ['AISA_API_KEY'] } : {}) };
 }
@@ -96,7 +117,7 @@ export async function install(client, options = {}) {
         const root = skillRoot(client, home);
         const entry = launchEntry(client);
         const writes = new Map();
-        const next = { version: '0.1.0', files: {}, config: previous.config };
+        const next = { version: '0.1.2', files: {}, config: previous.config, configHash: previous.configHash };
         const bundled = await skillFiles(path.join(packageRoot, 'skills', skillName));
         for (const relative of new Set([...Object.keys(bundled), ...Object.keys(previous.files)])) {
             if (path.isAbsolute(relative) || relative.split(/[\\/]/).includes('..'))
@@ -118,7 +139,7 @@ export async function install(client, options = {}) {
                 next.files[relative] = hash(content);
             }
         }
-        if (!options.skillsOnly && (!options.remove || previous.config)) {
+        if (!options.skillsOnly && (!options.remove || previous.config || previous.configHash)) {
             await noSymlinks(cfg.file);
             const current = await read(cfg.file);
             let config;
@@ -134,16 +155,25 @@ export async function install(client, options = {}) {
             if (typeof config[cfg.key] !== 'object' || Array.isArray(config[cfg.key]))
                 throw Error('Invalid MCP configuration section.');
             const existing = config[cfg.key][skillName];
+            const owned = previous.configHash ? existing !== undefined && hash(JSON.stringify(existing)) === previous.configHash : JSON.stringify(existing) === JSON.stringify(previous.config);
             if (options.remove) {
-                if (existing && JSON.stringify(existing) !== JSON.stringify(previous.config))
+                if (existing && !owned)
                     throw Error('MCP entry has been modified; preserving it.');
                 delete config[cfg.key][skillName];
             }
             else {
-                if (existing && JSON.stringify(existing) !== JSON.stringify(previous.config) && JSON.stringify(existing) !== JSON.stringify(entry))
+                if (existing && !owned && JSON.stringify(existing) !== JSON.stringify(entry))
                     throw Error('An unowned aisa-web-market MCP entry already exists; preserving it.');
-                config[cfg.key][skillName] = entry;
-                next.config = entry;
+                const savedKey = typeof existing?.env?.AISA_API_KEY === 'string' ? existing.env.AISA_API_KEY : undefined;
+                const apiKey = options.resolveKey ? await options.resolveKey(savedKey) : savedKey;
+                const configured = { ...entry };
+                if (apiKey) {
+                    configured.env = { AISA_API_KEY: apiKey };
+                    delete configured.env_vars;
+                }
+                config[cfg.key][skillName] = configured;
+                delete next.config;
+                next.configHash = hash(JSON.stringify(configured));
             }
             writes.set(cfg.file, cfg.stringify(config));
         }

package/dist/server.js

@@ -3,7 +3,7 @@ import { ApiClient, safeError } from './api.js';
 import { inputs, output } from './schema.js';
 import { execute, descriptions } from './tools.js';
 export function createServer(api = new ApiClient()) {
-    const server = new McpServer({ name: 'aisa-web-market', version: '0.1.0' }, { instructions: 'Website competitive analysis using five AIsa tools. Use the installed aisa-web-market skill for scenario guidance. Compare identical scope and preserve missing-data evidence. API calls are billed. Credentials come from AISA_API_KEY; never request the key in conversation.' });
+    const server = new McpServer({ name: 'aisa-web-market', version: '0.1.2' }, { instructions: 'Website competitive analysis using five AIsa tools. Use the installed aisa-web-market skill for scenario guidance. Compare identical scope and preserve missing-data evidence. API calls are billed. Credentials come from AISA_API_KEY; never request the key in conversation.' });
     for (const name of Object.keys(inputs)) {
         server.registerTool(name, { description: descriptions[name], inputSchema: inputs[name], outputSchema: output.shape, annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: false, openWorldHint: true } }, async (args, extra) => {
             try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hzlmy2002/web-market",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Focused website competitive analysis: five MCP tools and a portable skill",
   "type": "module",
   "bin": {