@hzlmy2002/web-market 0.1.2 → 0.1.3

package/README.md

@@ -1,26 +1,67 @@
 # AIsa Web Market
 
-Node/TypeScript stdio MCP for focused website competitive analysis. Five tools call **AIsa REST APIs directly**, with user-supplied Bearer authentication. No dependency on the Python aisa-mcp server, OAuth, or model calls inside tools.
+Node/TypeScript stdio MCP for focused website competitive analysis. Five tools call **AIsa REST APIs directly**, with OAuth or API Key Bearer authentication. No dependency on the Python aisa-mcp server or model calls inside tools.
+
+Version 0.1.3 adds OAuth setup and interactive uninstall. The commands below targeting 0.1.3 become available after this version is published; use the source commands before publication.
+
+## Install with your agent
+
+Copy the following prompt into Codex or another agent that can run commands on your computer. It uses the latest published npm package.
+
+```text
+Install and configure AIsa Web Market on this computer for me using the published npm package: @hzlmy2002/web-market.
+
+I am not technical. Please complete the installation yourself and involve me only when necessary.
+
+1. Check whether Node.js 22 or newer and npm are installed. If missing, install them using an official method suitable for my operating system. Explain any system permission I need to approve.
+2. From my home directory, run this command in an interactive terminal:
+   npx -y @hzlmy2002/web-market@latest setup
+3. Let setup detect and configure the supported agent clients. Reuse existing installations and credentials, and preserve my other settings.
+4. If OAuth opens, tell me to finish signing in through my browser. If automatic callback fails, guide me to paste the complete callback URL directly into the setup terminal. If necessary, use the API Key fallback with hidden terminal input. Never ask me to paste credentials or callback URLs into this conversation.
+5. Verify that the MCP server starts, its five tools are available, and its Skill is installed. Do not make paid API calls just to test installation.
+
+Use the published package's help output if needed. Do not clone the source repository or assume unreleased features are available.
+
+Keep going until installation is complete or a step genuinely requires my attention. If you cannot access my local computer or an interactive terminal, explain the limitation and give me the smallest possible next step.
+
+Finish with a brief explanation of which clients were configured and whether I need to restart or refresh them.
+```
+
+## Quick start (current source)
+
+```sh
+npm ci
+npm run build
+node dist/cli.js setup
+```
+
+Setup detects all supported clients and starts OAuth when no credentials are available. Finish in the browser, paste the complete callback URL into the terminal, or type `key` for API Key fallback. Existing credentials are reused. To remove the installation:
+
+```sh
+node dist/cli.js uninstall
+```
+
+The first menu entry is `0` for all installations; `1`, `2`, etc. select clients, and Enter cancels. Removing the last client clears local OAuth credentials, managed configuration, Skills and installation state, and attempts refresh-token revocation. Files belonging to other tools are retained.
 
 ## Install with npx
 
 Requires Node 22 or newer. Run one of these commands in a terminal:
 
 ```sh
-npx -y @hzlmy2002/web-market@0.1.2 setup --client codex
-npx -y @hzlmy2002/web-market@0.1.2 setup --client claude-code
-npx -y @hzlmy2002/web-market@0.1.2 setup --client hermes
+npx -y @hzlmy2002/web-market@0.1.3 setup --client codex
+npx -y @hzlmy2002/web-market@0.1.3 setup --client claude-code
+npx -y @hzlmy2002/web-market@0.1.3 setup --client hermes
 ```
 
-This installs the Skill and registers a version-pinned `npx -y @hzlmy2002/web-market@0.1.2 serve` MCP command. Clearing the npm cache does not invalidate the configured path: npx downloads the pinned release again when necessary. Restart or refresh the client to discover the Skill. If no key is configured, setup prompts for hidden input and saves the key in the selected client’s MCP `env.AISA_API_KEY` setting. This works independently of shell startup files on macOS, Linux, and Windows. Existing saved keys are reused. If `AISA_API_KEY` is already set in the setup environment, setup keeps using environment-based authentication without copying the key; the client must inherit that variable. Non-interactive setup without a saved or environment key exits with instructions. Use `uninstall --client ...` to remove an unchanged managed installation.
+This installs the Skill and registers a version-pinned `npx -y @hzlmy2002/web-market@0.1.3 serve` MCP command. Clearing the npm cache does not invalidate the configured path. Setup reuses credentials or starts OAuth automatically; paste a callback URL or type `key` for API Key fallback. Restart or refresh the client after setup. Run `npx -y @hzlmy2002/web-market@0.1.3 uninstall` for interactive removal.
 
 When testing the published release from this source repository, first change to another directory (for example, `cd ~`). npm exec/npx can select the current project when its name and version match the requested package, but a source checkout has no installed `aisa-web-market` command link. This results in `sh: aisa-web-market: command not found`. Alternatively, use the local setup command below after building.
 
 ## Automatic client detection
 
-Run `npx -y @hzlmy2002/web-market@0.1.2 setup` to install for every detected client. From a built source checkout, use `node dist/cli.js setup`. Detection checks `.codex/`, `.claude/` or `.claude.json`, and `.hermes/` in the user's home directory (or `--home`). These are usage traces, not proof that the executable is still installed. Shared `.agents/` directories alone do not count as detection.
+Run `npx -y @hzlmy2002/web-market@0.1.3 setup` to install for every detected client. From a built source checkout, use `node dist/cli.js setup`. Detection checks `.codex/`, `.claude/` or `.claude.json`, and `.hermes/` in the user's home directory (or `--home`). These are usage traces, not proof that the executable is still installed. Shared `.agents/` directories alone do not count as detection.
 
-Use `--client` to select a single client or install before its first run. If nothing is detected, setup explains how to proceed without creating client configurations. Custom client configuration roots are not discovered automatically. A newly entered key is requested once and reused for clients needing a key; existing client keys remain in place. Installation results are reported per client; a failure does not undo successful installations, and any failure produces a nonzero exit status. Uninstall still requires `--client`.
+Use `--client` to select a single client or install before its first run. If nothing is detected, setup explains how to proceed without creating client configurations. Custom client configuration roots are not discovered automatically. A new OAuth login or API Key fallback is requested once per setup and shared across clients needing credentials; existing client keys remain in place. Installation results are reported per client; a failure does not undo successful installations, and any failure produces a nonzero exit status. Run `uninstall` for an interactive selection of managed installations; `--client` remains available for scripts.
 
 Automatic detection is available starting with version 0.1.2. Windows uses the same home-directory markers, but the full workflow has not yet been tested on a Windows machine.
 
@@ -34,9 +75,23 @@ npm test
 npm run build
 ```
 
-Setup prompts for a missing AIsa API key and stores it as plaintext in the selected client configuration, with restrictive file permissions where supported. It is never printed or copied into Skills or installer state. This is a temporary Bearer authentication flow ahead of OAuth support. Setup does not edit shell profiles or Windows user environment variables. Alternatively, set `AISA_API_KEY` in the environment inherited by your MCP client. Desktop applications may not inherit variables exported in a terminal.
+Setup reuses existing credentials. When none are available, it starts **OAuth automatically**, without a method-selection prompt. Type `key` while waiting for the callback to switch to hidden API Key input. OAuth failure or cancellation also falls back to API Key input; press Ctrl+C there to cancel setup. Use `--auth` to explicitly switch an existing installation:
+
+```sh
+node dist/cli.js setup --auth oauth
+node dist/cli.js setup --auth oauth --no-browser
+node dist/cli.js setup --auth key
+```
+
+OAuth dynamically registers a public client with Clerk, uses PKCE S256, opens the browser and receives a loopback callback. The authorization URL is also printed. You may paste the **complete callback URL** into the terminal instead. On a different device, the localhost page may fail to load: copy its full URL from the address bar and paste it in the original terminal. `--no-browser` does not launch a browser or bind a local port; it uses manual paste only. Login times out after five minutes. Paste callbacks only into the setup terminal, never into an agent conversation.
 
-Run one of these from this checkout:
+OAuth credentials are saved in `~/.aisa/oauth.json` (under `--home` when supplied), using atomic replacement and restrictive file permissions where supported. Client configurations contain only `AISA_AUTH_FILE`, pointing to that file. All installed clients share one login. The runtime refreshes expiring tokens with a cross-process file lock; it never opens a browser during MCP tool calls. A failed refresh requires `setup --auth oauth`. A provider that does not issue a refresh token requires login again after expiry. Removing the last managed client deletes local OAuth credentials and attempts refresh-token revocation. Partial uninstall keeps credentials for remaining clients. Switching to API Key preserves that OAuth file too.
+
+API Key input is hidden and saved in the selected client's `env.AISA_API_KEY`. Existing client keys are preserved unless `--auth` explicitly selects a method. An environment key is reused without copying it by default; explicit `--auth key` saves it to the selected clients. Setup does not edit shell profiles or Windows environment settings. Headless OAuth still requires an interactive terminal for pasting; unattended installs should use `AISA_API_KEY`.
+
+The browser launcher supports macOS, Linux and Windows; the Windows workflow has not been tested on a Windows machine. Real Clerk discovery, public-client registration and authorization redirect have been checked. Token exchange and refresh are covered by simulated integration tests; end-to-end account authorization still needs live verification.
+
+The normal command is `node dist/cli.js setup`. To target a specific client before its first run:
 
 ```sh
 node dist/cli.js setup --client codex
@@ -54,14 +109,16 @@ Setup installs the Skill and merges a user-level MCP entry using the absolute No
 
 Refresh/restart the client after installation if the skill is not visible. Setup follows the actual user's home directory; use `--home /absolute/path` for an isolated profile or testing. Symlinked installation paths are refused to avoid writing outside the selected location. For Hermes custom profiles, pass the matching profile home explicitly; otherwise setup targets `~/.hermes`.
 
-To use MCP-only configuration, set `command` to your Node executable and `args` to the absolute path to `dist/cli.js`, followed by `serve`. Pass `AISA_API_KEY` through the client environment. To install the skill during server startup, add `--install-skills --client codex` (or another supported client). This is an explicit opt-in, runs idempotently, and writes status only to stderr; the first session may require a refresh for skill discovery.
+To use MCP-only configuration, set `command` to your Node executable and `args` to the absolute path to `dist/cli.js`, followed by `serve`. Run OAuth setup first, or pass `AISA_API_KEY` through the client environment. To install the skill during server startup, add `--install-skills --client codex` (or another supported client). This is an explicit opt-in, runs idempotently, and writes status only to stderr; the first session may require a refresh for skill discovery.
 
 ```sh
 node dist/cli.js status
-node dist/cli.js uninstall --client codex
+node dist/cli.js uninstall
 ```
 
-Uninstall removes only matching owned files and the matching MCP entry. It preserves other tools and settings. A modified owned file stops uninstall for review. It may leave empty directories. To update, rebuild this checkout and rerun setup.
+Interactive uninstall lists managed client installations and accepts numbers (such as `1,2`), `0` for all, or Enter / Ctrl+C to cancel. `0` is displayed first. It describes the removal scope before selection. The menu is also available with no remaining managed clients so orphan OAuth credentials can be cleaned. Non-interactive callers must specify `--client`.
+
+Uninstall removes only matching owned files and the matching MCP entry. It preserves other tools and settings. A modified owned file stops uninstall for review. It removes empty managed Skill directories and, after the last removal, the local OAuth file and empty installer directories. Other user files are preserved. Remote revocation failures are reported; local deletion does not guarantee removal of the DCR application record or immediate invalidation of already-issued access tokens. To update, rebuild this checkout and rerun setup.
 
 ## Tools
 
@@ -95,13 +152,19 @@ Generates `plugins/{codex,claude-code,hermes}/aisa-web-market/`, each with the s
 
 - Codex: `.codex-plugin/plugin.json` plus `.mcp.json`; distribute using the client's local/plugin marketplace workflow.
 - Claude Code: `.claude-plugin/plugin.json` plus `.mcp.json`; local test with `claude --plugin-dir /absolute/path/to/plugins/claude-code/aisa-web-market`.
-- Hermes: Agent Plugins v1 `plugin.json` plus `mcp.json`; requires a version supporting portable packages. Enable after installing through Hermes. Configure AISA_API_KEY in the Hermes process environment.
+- Hermes: Agent Plugins v1 `plugin.json` plus `mcp.json`; requires a version supporting portable packages. Enable after installing through Hermes. Use the shared local OAuth login or configure AISA_API_KEY in the Hermes process environment.
 
 Prefer either plugin installation or direct setup for a client, to avoid duplicate skills and tools. Plugin host discovery has not been tested in interactive Codex/Claude/Hermes sessions. The bundled runtime is tested over real stdio, and setup configuration is tested in isolated profiles.
 
 ## Development and release
 
-`npm test` exercises API contracts, calculations, failures, installer preservation and real stdio protocol exchange without network calls or credits. `npm pack` creates an installable npm archive. The scoped package is configured for public npm publication. npm-installed setup registers a pinned npx command; setup from a source checkout registers its local Node entry. Plugin bundles remain a separate distribution option.
+`npm test` exercises API contracts, calculations, failures, installer preservation and real stdio protocol exchange without external network calls or credits (OAuth tests use a temporary loopback listener). `npm pack` creates an installable npm archive. The scoped package is configured for public npm publication. npm-installed setup registers a pinned npx command; setup from a source checkout registers its local Node entry. Plugin bundles remain a separate distribution option.
+
+npm publishes the version in `package.json`, not a Git tag. Each published name/version pair is immutable. The root version in `package-lock.json`, runtime version strings and pinned setup command must stay aligned. A Git tag is optional release bookkeeping; this repository does not require one for manual publishing.
+
+```sh
+npm publish --access public
+```
 
 `docs/contract.md` records the endpoint mapping and limits. `docs/upstream-snapshot.json` captures only the required operation definitions and examples from the supplied docs checkout. Run `node scripts/check-contract.mjs /path/to/docs/openapi/similarweb.json` to detect drift in those operations. Live API verification requires an explicitly selected funded account and month; no production calls are made by the test suite.
 

package/dist/api.js

@@ -1,3 +1,4 @@
+import { accessToken } from './oauth.js';
 export class ApiError extends Error {
     code;
     retryable;
@@ -21,20 +22,27 @@ export function safeError(error) {
 export class ApiClient {
     key;
     fetcher;
-    constructor(key = process.env.AISA_API_KEY, fetcher = fetch) {
+    constructor(key = process.env.AISA_AUTH_FILE ? undefined : process.env.AISA_API_KEY, fetcher = fetch) {
         this.key = key;
         this.fetcher = fetcher;
     }
     async get(path, query, cap, signal) {
-        if (!this.key?.trim())
-            throw new ApiError('missing_credentials', 'Set AISA_API_KEY in the MCP server environment and restart the server.');
+        let token;
+        try {
+            token = this.key?.trim() || await accessToken();
+        }
+        catch {
+            throw new ApiError('authentication_required', 'OAuth credentials could not be refreshed. Run setup --auth oauth to sign in again.');
+        }
+        if (!token)
+            throw new ApiError('missing_credentials', 'Run setup to sign in with OAuth or configure AISA_API_KEY.');
         if (!Object.values(paths).includes(path))
             throw new ApiError('invalid_input', 'Unsupported API operation.');
         const url = new URL('https://api.aisa.one/apis/v1' + path);
         for (const [k, v] of Object.entries(query))
             if (v !== undefined)
                 url.searchParams.set(k, String(v));
-        const headers = { Authorization: `Bearer ${this.key.trim()}`, Accept: 'application/json' };
+        const headers = { Authorization: `Bearer ${token}`, Accept: 'application/json' };
         if (cap !== undefined)
             headers['X-AISA-Max-Price-USD'] = String(cap);
         try {
@@ -90,7 +98,7 @@ export class ApiClient {
                 }
                 const codes = {
                     400: ['invalid_input', 'AIsa rejected the query scope or parameters.', false],
-                    401: ['unauthorized', 'AIsa rejected the API key. Check AISA_API_KEY.', false],
+                    401: ['unauthorized', 'AIsa rejected the credentials. Run setup --auth oauth to sign in again, or check AISA_API_KEY.', false],
                     402: ['payment_required', 'AIsa requires sufficient credit and the appropriate subscription. Check your AIsa account.', false],
                     403: ['forbidden', 'The account cannot access this data scope.', false],
                     404: ['not_found', 'HTTP 404 returned by AIsa or its data provider. The response does not establish whether the route is unavailable or the requested resource/data was not found.', false],

package/dist/cli.js

@@ -1,31 +1,48 @@
 #!/usr/bin/env node
-import { sharedSetupKeyResolver } from './credentials.js';
+import { setupCredentialResolver } from './credentials.js';
+import { cleanupUninstall } from './uninstall.js';
+import { chooseUninstall } from './interactive.js';
+import { authFile, readSession } from './oauth.js';
 import { parseArgs } from 'node:util';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { createServer } from './server.js';
-import { detectClients, install } from './install.js';
+import { detectClients, installedClients, install } from './install.js';
 async function main() {
-    const { values, positionals } = parseArgs({ allowPositionals: true, options: { client: { type: 'string' }, home: { type: 'string' }, 'install-skills': { type: 'boolean' }, help: { type: 'boolean' } } });
+    const { values, positionals } = parseArgs({ allowPositionals: true, options: { client: { type: 'string' }, home: { type: 'string' }, auth: { type: 'string' }, 'no-browser': { type: 'boolean' }, 'install-skills': { type: 'boolean' }, help: { type: 'boolean' } } });
     const command = positionals[0] ?? 'serve';
     if (values.help) {
-        console.log('aisa-web-market serve [--install-skills --client codex|claude-code|hermes]\naisa-web-market setup [--client codex|claude-code|hermes] [--home directory]\naisa-web-market uninstall --client codex|claude-code|hermes [--home directory]\naisa-web-market status\nsetup detects all supported clients in your home directory when --client is omitted. Set AISA_API_KEY in the server environment. setup prompts for a missing key and saves it in the client MCP configuration.');
+        console.log('aisa-web-market serve [--install-skills --client codex|claude-code|hermes]\naisa-web-market setup [--client codex|claude-code|hermes] [--home directory] [--auth oauth|key] [--no-browser]\naisa-web-market uninstall [--client codex|claude-code|hermes] [--home directory]\naisa-web-market status\nsetup detects all supported clients in your home directory when --client is omitted. setup reuses existing credentials or starts OAuth automatically; type key during login to use an API Key. --auth forces a method. --no-browser prints the OAuth URL without opening it; paste the complete callback URL after login.');
         return;
     }
     if (positionals.length > 1)
         throw Error('Unexpected positional argument.');
     if (command === 'status') {
-        console.log(JSON.stringify({ credential_configured: Boolean(process.env.AISA_API_KEY?.trim()), authentication: 'bearer', version: '0.1.2' }));
+        const key = !process.env.AISA_AUTH_FILE && process.env.AISA_API_KEY?.trim();
+        const oauth = key ? undefined : await readSession(process.env.AISA_AUTH_FILE || authFile(values.home));
+        console.log(JSON.stringify({ credential_configured: Boolean(key || oauth), authentication: key ? 'key' : oauth ? 'oauth' : 'none', version: '0.1.3' }));
         return;
     }
     if (command === 'setup' || command === 'uninstall') {
-        if (command === 'uninstall' && !values.client)
-            throw Error('--client is required for uninstall.');
-        const clients = values.client ? [values.client] : await detectClients(values.home);
-        if (!clients.length)
+        let clients;
+        if (values.client)
+            clients = [values.client];
+        else if (command === 'uninstall') {
+            const installed = await installedClients(values.home);
+            const selected = await chooseUninstall(installed);
+            if (!selected) {
+                console.log('Uninstall cancelled.');
+                return;
+            }
+            clients = selected;
+            console.error(`Uninstalling from: ${clients.join(', ')}`);
+        }
+        else
+            clients = await detectClients(values.home);
+        if (!clients.length && command === 'setup')
             throw Error('No supported clients detected. Run a client once, or use setup --client codex|claude-code|hermes.');
-        if (!values.client)
+        if (!values.client && command === 'setup')
             console.error(`Detected clients: ${clients.join(', ')}`);
-        const resolveKey = sharedSetupKeyResolver();
+        const resolveKey = setupCredentialResolver({ home: values.home, auth: values.auth, noBrowser: values['no-browser'] });
         for (const client of clients) {
             try {
                 console.log(JSON.stringify(await install(client, { home: values.home, remove: command === 'uninstall', resolveKey: command === 'setup' ? resolveKey : undefined })));
@@ -35,7 +52,14 @@ async function main() {
                 process.exitCode = 1;
             }
         }
-        console.log('Client configuration preserves existing values; serialization may reformat comments. A saved key is passed directly to the MCP process; otherwise ensure the client inherits AISA_API_KEY. Restart or refresh the client to load skills.');
+        if (command === 'uninstall') {
+            const cleanup = await cleanupUninstall(values.home);
+            if (cleanup.warning)
+                console.error(cleanup.warning);
+            console.log(cleanup.credentialsCleared ? 'Uninstalled. Local OAuth login and installation state cleared.' : 'Selected clients removed. OAuth login retained for remaining installations.');
+            return;
+        }
+        console.log('Client configuration preserves existing values; serialization may reformat comments. OAuth credentials are shared locally; API Keys are passed through client configuration or the environment. Restart or refresh the client to load skills.');
         return;
     }
     if (command !== 'serve')

package/dist/credentials.d.ts

@@ -1,3 +1,17 @@
+import { login } from './oauth.js';
 export declare function promptKey(): Promise<string>;
 export declare function resolveSetupKey(savedKey?: string): Promise<string | undefined>;
 export declare function sharedSetupKeyResolver(resolve?: typeof resolveSetupKey): (savedKey?: string) => Promise<string | undefined>;
+export type SetupCredential = string | {
+    oauthFile: string;
+} | undefined;
+export declare function setupCredentialResolver(options: {
+    home?: string;
+    auth?: string;
+    noBrowser?: boolean;
+}, io?: {
+    login: typeof login;
+    promptKey: typeof promptKey;
+    interactive: () => boolean;
+    report: (message: string) => void;
+}): (savedKey?: string) => Promise<SetupCredential>;

package/dist/credentials.js

@@ -1,4 +1,5 @@
 import { emitKeypressEvents } from 'node:readline';
+import { authFile, readSession, login } from './oauth.js';
 // Read from the terminal without echoing credentials or consuming MCP stdin.
 export async function promptKey() {
     if (!process.stdin.isTTY || !process.stderr.isTTY) {
@@ -69,3 +70,36 @@ export function sharedSetupKeyResolver(resolve = resolveSetupKey) {
         return requested ??= resolve();
     };
 }
+export function setupCredentialResolver(options, io = {
+    login, promptKey,
+    interactive: () => Boolean(process.stdin.isTTY && process.stderr.isTTY),
+    report: (message) => { process.stderr.write(message + '\n'); },
+}) {
+    if (options.auth && !['oauth', 'key'].includes(options.auth))
+        throw Error('Choose --auth oauth or key.');
+    let pending;
+    const file = authFile(options.home);
+    return (savedKey) => {
+        if (!options.auth && savedKey?.trim())
+            return Promise.resolve(savedKey);
+        if (!options.auth && process.env.AISA_API_KEY?.trim())
+            return Promise.resolve(undefined);
+        return pending ??= (async () => {
+            if (!options.auth && await readSession(file))
+                return { oauthFile: file };
+            if (options.auth === 'key')
+                return process.env.AISA_API_KEY?.trim() || await io.promptKey();
+            if (!io.interactive())
+                throw Error('No credentials. Run setup in an interactive terminal for OAuth, or set AISA_API_KEY.');
+            try {
+                await io.login(file, options.noBrowser);
+            }
+            catch (error) {
+                io.report(error instanceof Error ? error.message : 'OAuth login failed.');
+                io.report('Use an API Key instead (Ctrl+C to cancel setup).');
+                return await io.promptKey();
+            }
+            return { oauthFile: file };
+        })();
+    };
+}

package/dist/install.d.ts

@@ -1,5 +1,7 @@
+import type { SetupCredential } from './credentials.js';
 export type Client = 'codex' | 'claude-code' | 'hermes';
 export declare function detectClients(home?: string): Promise<Client[]>;
+export declare function installedClients(home?: string): Promise<Client[]>;
 export declare const packageRoot: string;
 export declare function launchEntry(client: Client, root?: string): {
     env_vars?: string[] | undefined;
@@ -10,7 +12,7 @@ export declare function install(client: Client, options?: {
     home?: string;
     remove?: boolean;
     skillsOnly?: boolean;
-    resolveKey?: (savedKey?: string) => Promise<string | undefined>;
+    resolveKey?: (savedKey?: string) => Promise<SetupCredential>;
 }): Promise<{
     client: Client;
     skill: string;

package/dist/install.js

@@ -26,6 +26,21 @@ export async function detectClients(home = homedir()) {
     }
     return [...found];
 }
+// Only installations with our ownership record are offered for removal.
+export async function installedClients(home = homedir()) {
+    const found = [];
+    for (const client of ['codex', 'claude-code', 'hermes']) {
+        try {
+            if ((await fs.lstat(path.resolve(home, '.aisa/web-market', `${client}.json`))).isFile())
+                found.push(client);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT' && error.code !== 'ENOTDIR')
+                throw error;
+        }
+    }
+    return found;
+}
 export const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const skillName = 'aisa-web-market';
 // npm/npx installations live in node_modules. Persist a version-pinned registry
@@ -33,7 +48,7 @@ const skillName = 'aisa-web-market';
 // local Node entry so development changes remain immediately testable.
 export function launchEntry(client, root = packageRoot) {
     const command = root.split(path.sep).includes('node_modules')
-        ? { command: process.platform === 'win32' ? 'npx.cmd' : 'npx', args: ['-y', '@hzlmy2002/web-market@0.1.2', 'serve'] }
+        ? { command: process.platform === 'win32' ? 'npx.cmd' : 'npx', args: ['-y', '@hzlmy2002/web-market@0.1.3', 'serve'] }
         : { command: process.execPath, args: [path.join(root, 'dist/cli.js'), 'serve'] };
     return { ...command, ...(client === 'codex' ? { env_vars: ['AISA_API_KEY'] } : {}) };
 }
@@ -117,7 +132,7 @@ export async function install(client, options = {}) {
         const root = skillRoot(client, home);
         const entry = launchEntry(client);
         const writes = new Map();
-        const next = { version: '0.1.2', files: {}, config: previous.config, configHash: previous.configHash };
+        const next = { version: '0.1.3', files: {}, config: previous.config, configHash: previous.configHash };
         const bundled = await skillFiles(path.join(packageRoot, 'skills', skillName));
         for (const relative of new Set([...Object.keys(bundled), ...Object.keys(previous.files)])) {
             if (path.isAbsolute(relative) || relative.split(/[\\/]/).includes('..'))
@@ -160,6 +175,8 @@ export async function install(client, options = {}) {
                 if (existing && !owned)
                     throw Error('MCP entry has been modified; preserving it.');
                 delete config[cfg.key][skillName];
+                if (!Object.keys(config[cfg.key]).length)
+                    delete config[cfg.key];
             }
             else {
                 if (existing && !owned && JSON.stringify(existing) !== JSON.stringify(entry))
@@ -168,14 +185,14 @@ export async function install(client, options = {}) {
                 const apiKey = options.resolveKey ? await options.resolveKey(savedKey) : savedKey;
                 const configured = { ...entry };
                 if (apiKey) {
-                    configured.env = { AISA_API_KEY: apiKey };
+                    configured.env = typeof apiKey === 'string' ? { AISA_API_KEY: apiKey } : { AISA_AUTH_FILE: apiKey.oauthFile };
                     delete configured.env_vars;
                 }
                 config[cfg.key][skillName] = configured;
                 delete next.config;
                 next.configHash = hash(JSON.stringify(configured));
             }
-            writes.set(cfg.file, cfg.stringify(config));
+            writes.set(cfg.file, options.remove && !Object.keys(config).length ? undefined : cfg.stringify(config));
         }
         writes.set(stateFile, options.remove ? undefined : JSON.stringify(next, null, 2));
         const backups = new Map();

package/dist/interactive.d.ts

@@ -0,0 +1,10 @@
+import type { Client } from './install.js';
+export declare function parseSelection(answer: string, clients: Client[]): Client[];
+export declare function chooseUninstall(clients: Client[], io?: {
+    input: NodeJS.ReadStream & {
+        fd: 0;
+    };
+    output: NodeJS.WriteStream & {
+        fd: 2;
+    };
+}): Promise<Client[] | undefined>;

package/dist/interactive.js

@@ -0,0 +1,43 @@
+import { createInterface } from 'node:readline';
+export function parseSelection(answer, clients) {
+    const value = answer.trim().toLowerCase();
+    if (!value)
+        return [];
+    if (value === '0')
+        return [...clients];
+    const parts = value.split(/[\s,]+/);
+    if (parts.some(part => !/^[1-9]\d*$/.test(part) || Number(part) > clients.length))
+        throw Error('Enter listed numbers (for example 1,2), 0 for all, or press Enter to cancel.');
+    return [...new Set(parts.map(part => clients[Number(part) - 1]))];
+}
+export async function chooseUninstall(clients, io = { input: process.stdin, output: process.stderr }) {
+    if (!io.input.isTTY)
+        throw Error('Interactive uninstall requires a terminal. For scripts, use uninstall --client codex|claude-code|hermes.');
+    io.output.write('Remove AIsa Web Market MCP configuration and installed Skills from:\n');
+    io.output.write('  0. Uninstall all and clear OAuth login / installation state\n');
+    clients.forEach((client, index) => io.output.write(`  ${index + 1}. ${client}\n`));
+    io.output.write('  Enter / Ctrl+C: Cancel\nRemoving the last client also clears OAuth login and installation state. Modified files will be preserved.\n');
+    const rl = createInterface(io);
+    try {
+        return await new Promise((resolve, reject) => {
+            rl.once('SIGINT', () => resolve(undefined));
+            rl.once('close', () => resolve(undefined));
+            rl.once('error', reject);
+            const ask = () => rl.question('Choose client numbers, 0 for all, or Enter to cancel: ', answer => {
+                try {
+                    const selected = parseSelection(answer, clients);
+                    resolve(answer.trim() === '0' || selected.length ? selected : undefined);
+                }
+                catch (error) {
+                    io.output.write(`${error.message}\n`);
+                    ask();
+                }
+            });
+            ask();
+        });
+    }
+    finally {
+        rl.close();
+        io.input.pause();
+    }
+}

package/dist/oauth.d.ts

@@ -0,0 +1,24 @@
+export declare const authFile: (home?: string) => string;
+export interface Session {
+    client_id: string;
+    access_token: string;
+    refresh_token?: string;
+    expires_at: number;
+}
+export declare function readSession(file?: string): Promise<Session | undefined>;
+export declare function saveSession(file: string, session: Session): Promise<void>;
+export declare function tokenSession(client_id: string, body: any, previous?: Session): Session;
+export declare function accessToken(file?: string, fetcher?: typeof fetch): Promise<string | undefined>;
+export declare function callbackCode(raw: string, redirect: string, state: string): string;
+declare function openBrowser(url: string): void;
+export declare function login(file: string, noBrowser?: boolean, io?: {
+    input: NodeJS.ReadStream & {
+        fd: 0;
+    };
+    output: NodeJS.WriteStream & {
+        fd: 2;
+    };
+    fetcher: typeof fetch;
+    launch: typeof openBrowser;
+}): Promise<void>;
+export {};

package/dist/oauth.js

@@ -0,0 +1,213 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { homedir } from 'node:os';
+import { createHash, randomBytes, randomUUID, randomInt } from 'node:crypto';
+import { createServer } from 'node:http';
+import { createInterface } from 'node:readline';
+import { spawn } from 'node:child_process';
+const issuer = 'https://clerk.aisa.one';
+export const authFile = (home = homedir()) => path.resolve(home, '.aisa/oauth.json');
+export async function readSession(file = process.env.AISA_AUTH_FILE || authFile()) {
+    try {
+        const value = JSON.parse(await fs.readFile(file, 'utf8'));
+        if (typeof value.client_id !== 'string' || typeof value.access_token !== 'string' || !Number.isFinite(value.expires_at)
+            || (value.refresh_token !== undefined && typeof value.refresh_token !== 'string'))
+            throw Error();
+        return value;
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return undefined;
+        throw Error('Cannot read OAuth credentials. Run setup --auth oauth to sign in again.');
+    }
+}
+export async function saveSession(file, session) {
+    await fs.mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+    const tmp = `${file}.${randomUUID()}.tmp`;
+    try {
+        await fs.writeFile(tmp, JSON.stringify(session), { flag: 'wx', mode: 0o600 });
+        await fs.rename(tmp, file);
+    }
+    finally {
+        await fs.rm(tmp, { force: true });
+    }
+}
+async function request(url, init, fetcher = fetch) {
+    let response;
+    try {
+        response = await fetcher(url, { ...init, redirect: 'error', signal: AbortSignal.timeout(20_000) });
+    }
+    catch {
+        throw Error('OAuth service unavailable. Retry setup or use --auth key.');
+    }
+    if (!response.ok)
+        throw Error(`OAuth request failed (HTTP ${response.status}). Run setup --auth oauth to sign in again.`);
+    try {
+        return await response.json();
+    }
+    catch {
+        throw Error('OAuth service returned invalid JSON.');
+    }
+}
+export function tokenSession(client_id, body, previous) {
+    if (body.token_type?.toLowerCase() !== 'bearer' || typeof body.access_token !== 'string' || !body.access_token
+        || !Number.isFinite(body.expires_in) || body.expires_in <= 0
+        || (body.refresh_token !== undefined && typeof body.refresh_token !== 'string'))
+        throw Error('OAuth service returned an invalid token response.');
+    return { client_id, access_token: body.access_token, refresh_token: body.refresh_token || previous?.refresh_token, expires_at: Date.now() + body.expires_in * 1000 };
+}
+// A file lock serializes refreshes across the three clients as well as concurrent tools.
+export async function accessToken(file = process.env.AISA_AUTH_FILE || authFile(), fetcher = fetch) {
+    const current = await readSession(file);
+    if (!current)
+        return undefined;
+    if (current.expires_at > Date.now() + 60_000)
+        return current.access_token;
+    const lock = `${file}.lock`;
+    let fd;
+    for (let attempt = 0; attempt < 120; attempt++) {
+        try {
+            fd = await fs.open(lock, 'wx', 0o600);
+            break;
+        }
+        catch (e) {
+            if (e.code !== 'EEXIST')
+                throw e;
+            await new Promise(r => setTimeout(r, 250));
+        }
+    }
+    if (!fd)
+        throw Error('OAuth credentials are busy. If a process crashed, remove oauth.json.lock after stopping the other AIsa processes.');
+    try {
+        const latest = await readSession(file);
+        if (!latest)
+            return undefined;
+        if (latest.expires_at > Date.now() + 60_000)
+            return latest.access_token;
+        if (!latest.refresh_token)
+            throw Error('OAuth session expired. Run setup --auth oauth to sign in again.');
+        const body = await request(`${issuer}/oauth/token`, { method: 'POST', body: new URLSearchParams({ grant_type: 'refresh_token', client_id: latest.client_id, refresh_token: latest.refresh_token }) }, fetcher);
+        const next = tokenSession(latest.client_id, body, latest);
+        await saveSession(file, next);
+        return next.access_token;
+    }
+    finally {
+        await fd.close();
+        await fs.rm(lock, { force: true });
+    }
+}
+export function callbackCode(raw, redirect, state) {
+    let url;
+    try {
+        url = new URL(raw.trim());
+    }
+    catch {
+        throw Error('Paste the complete callback URL, including code and state.');
+    }
+    const expected = new URL(redirect);
+    if (url.origin !== expected.origin || url.pathname !== expected.pathname)
+        throw Error('Callback URL does not match this login attempt.');
+    if (url.searchParams.getAll('state').length !== 1 || url.searchParams.get('state') !== state)
+        throw Error('Callback state does not match this login attempt.');
+    if (url.searchParams.has('iss') && url.searchParams.get('iss') !== issuer)
+        throw Error('Callback issuer does not match AIsa.');
+    if (url.searchParams.has('error'))
+        throw Error('OAuth authorization was declined. Run setup again or choose --auth key.');
+    const code = url.searchParams.get('code');
+    if (!code || url.searchParams.getAll('code').length !== 1)
+        throw Error('Callback URL has no unique authorization code.');
+    return code;
+}
+function openBrowser(url) {
+    const [command, args] = process.platform === 'darwin' ? ['open', [url]] : process.platform === 'win32'
+        ? ['rundll32.exe', ['url.dll,FileProtocolHandler', url]] : ['xdg-open', [url]];
+    const child = spawn(command, args, { stdio: 'ignore', detached: true });
+    child.on('error', () => { process.stderr.write('Could not open a browser. Open the printed URL on another device.\n'); });
+    child.unref();
+}
+export async function login(file, noBrowser = false, io = { input: process.stdin, output: process.stderr, fetcher: fetch, launch: openBrowser }) {
+    const { input, output, fetcher, launch } = io;
+    if (!input.isTTY)
+        throw Error('OAuth setup requires an interactive terminal. Use AISA_API_KEY for unattended setup.');
+    const verifier = randomBytes(32).toString('base64url');
+    const state = randomBytes(32).toString('base64url');
+    let redirect = '';
+    let complete = () => { };
+    const server = createServer((req, res) => {
+        try {
+            const code = callbackCode(new URL(req.url || '/', redirect).href, redirect, state);
+            res.writeHead(200, { 'Content-Type': 'text/plain' }).end('AIsa authorization received. You can return to the terminal.');
+            complete(code);
+        }
+        catch {
+            res.writeHead(400, { 'Content-Type': 'text/plain' }).end('Invalid callback. Return to the terminal or retry authorization.');
+        }
+    });
+    let lines;
+    let timer;
+    try {
+        if (noBrowser) {
+            // Manual mode also works where binding a local port is forbidden.
+            redirect = `http://127.0.0.1:${randomInt(49152, 65536)}/callback`;
+        }
+        else {
+            await new Promise((resolve, reject) => { server.once('error', reject); server.listen(0, '127.0.0.1', () => { server.removeListener('error', reject); resolve(); }); })
+                .catch(() => { throw Error('Cannot listen for OAuth callback. Retry setup --auth oauth --no-browser to paste the callback manually.'); });
+            const address = server.address();
+            if (!address || typeof address === 'string')
+                throw Error('Could not start OAuth callback listener.');
+            redirect = `http://127.0.0.1:${address.port}/callback`;
+        }
+        const metadata = await request(`${issuer}/.well-known/oauth-authorization-server`, undefined, fetcher);
+        if (metadata.issuer !== issuer || metadata.registration_endpoint !== `${issuer}/oauth/register`
+            || metadata.authorization_endpoint !== `${issuer}/oauth/authorize` || metadata.token_endpoint !== `${issuer}/oauth/token`
+            || !metadata.code_challenge_methods_supported?.includes('S256'))
+            throw Error('Unexpected AIsa OAuth discovery metadata.');
+        const client = await request(metadata.registration_endpoint, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ client_name: 'AIsa Scene Agents', redirect_uris: [redirect], grant_types: ['authorization_code', 'refresh_token'], response_types: ['code'], token_endpoint_auth_method: 'none', scope: 'profile email offline_access' }) }, fetcher);
+        if (!client.client_id || client.token_endpoint_auth_method !== 'none')
+            throw Error('OAuth registration did not return a public client.');
+        const url = new URL(metadata.authorization_endpoint);
+        url.search = new URLSearchParams({ client_id: client.client_id, redirect_uri: redirect, response_type: 'code', scope: 'profile email offline_access', state, code_challenge: createHash('sha256').update(verifier).digest('base64url'), code_challenge_method: 'S256' }).toString();
+        const code = await new Promise((resolve, reject) => {
+            complete = resolve;
+            timer = setTimeout(() => reject(Error('OAuth login timed out after 5 minutes. Run setup again.')), 300_000);
+            lines = createInterface({ input: input, output: output });
+            lines.on('line', line => {
+                if (!line.trim())
+                    return;
+                if (line.trim().toLowerCase() === 'key') {
+                    reject(Error('Switched to API Key.'));
+                    return;
+                }
+                try {
+                    resolve(callbackCode(line, redirect, state));
+                }
+                catch (e) {
+                    output.write(`${e.message}\nPaste callback URL: `);
+                }
+            });
+            lines.once('SIGINT', () => reject(Error('OAuth login cancelled.')));
+            lines.once('close', () => reject(Error('OAuth input closed. Run setup again.')));
+            output.write(`Open this URL to sign in:\n${url.href}\n\nWaiting for browser callback. Alternatively paste the COMPLETE callback URL here, or type key to use an API Key.\nOn another device, localhost may fail to load; copy the URL from its address bar.\nPaste callback URL: `);
+            if (!noBrowser)
+                launch(url.href);
+        });
+        lines?.close();
+        input.pause();
+        if (timer)
+            clearTimeout(timer);
+        const body = await request(metadata.token_endpoint, { method: 'POST', body: new URLSearchParams({ grant_type: 'authorization_code', client_id: client.client_id, code, redirect_uri: redirect, code_verifier: verifier }) }, fetcher);
+        await saveSession(file, tokenSession(client.client_id, body));
+        output.write('\nOAuth login saved.\n');
+        if (!body.refresh_token)
+            output.write('No refresh token was issued; sign in again when this session expires.\n');
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+        lines?.close();
+        input.pause();
+        server.close();
+        server.closeAllConnections();
+    }
+}

package/dist/schema.d.ts

@@ -160,9 +160,9 @@ export declare const output: z.ZodObject<{
     calculation: z.ZodRecord<z.ZodString, z.ZodUnknown>;
     warnings: z.ZodArray<z.ZodString, "many">;
 }, "strip", z.ZodTypeAny, {
+    scope: Record<string, unknown>;
     data: Record<string, unknown>[];
     schema_version: "1.0.0";
-    scope: Record<string, unknown>;
     derived: Record<string, unknown>[];
     completeness: {
         status: "complete" | "partial" | "empty";
@@ -185,9 +185,9 @@ export declare const output: z.ZodObject<{
     calculation: Record<string, unknown>;
     warnings: string[];
 }, {
+    scope: Record<string, unknown>;
     data: Record<string, unknown>[];
     schema_version: "1.0.0";
-    scope: Record<string, unknown>;
     derived: Record<string, unknown>[];
     completeness: {
         status: "complete" | "partial" | "empty";

package/dist/server.js

@@ -3,7 +3,7 @@ import { ApiClient, safeError } from './api.js';
 import { inputs, output } from './schema.js';
 import { execute, descriptions } from './tools.js';
 export function createServer(api = new ApiClient()) {
-    const server = new McpServer({ name: 'aisa-web-market', version: '0.1.2' }, { instructions: 'Website competitive analysis using five AIsa tools. Use the installed aisa-web-market skill for scenario guidance. Compare identical scope and preserve missing-data evidence. API calls are billed. Credentials come from AISA_API_KEY; never request the key in conversation.' });
+    const server = new McpServer({ name: 'aisa-web-market', version: '0.1.3' }, { instructions: 'Website competitive analysis using five AIsa tools. Use the installed aisa-web-market skill for scenario guidance. Compare identical scope and preserve missing-data evidence. API calls are billed. Credentials come from local OAuth login or AISA_API_KEY. If authentication fails, ask the user to run setup in their terminal; never request credentials or callback URLs in conversation.' });
     for (const name of Object.keys(inputs)) {
         server.registerTool(name, { description: descriptions[name], inputSchema: inputs[name], outputSchema: output.shape, annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: false, openWorldHint: true } }, async (args, extra) => {
             try {

package/dist/uninstall.d.ts

@@ -0,0 +1,4 @@
+export declare function cleanupUninstall(home?: string, fetcher?: typeof fetch): Promise<{
+    credentialsCleared: boolean;
+    warning: string | undefined;
+}>;

package/dist/uninstall.js

@@ -0,0 +1,109 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { homedir } from 'node:os';
+import { installedClients } from './install.js';
+import { authFile, readSession } from './oauth.js';
+async function prune(dir) {
+    try {
+        const stat = await fs.lstat(dir);
+        if (!stat.isDirectory() || stat.isSymbolicLink())
+            return;
+        for (const entry of await fs.readdir(dir, { withFileTypes: true }))
+            if (entry.isDirectory())
+                await prune(path.join(dir, entry.name));
+        await fs.rmdir(dir);
+    }
+    catch (e) {
+        if (!['ENOENT', 'ENOTEMPTY', 'EEXIST'].includes(e.code))
+            throw e;
+    }
+}
+async function empty(dir) {
+    try {
+        await fs.rmdir(dir);
+    }
+    catch (e) {
+        if (!['ENOENT', 'ENOTEMPTY', 'EEXIST'].includes(e.code))
+            throw e;
+    }
+}
+export async function cleanupUninstall(home = homedir(), fetcher = fetch) {
+    home = path.resolve(home);
+    const dir = path.join(home, '.aisa/web-market');
+    for (const target of [path.join(home, '.aisa'), dir, authFile(home)]) {
+        try {
+            if ((await fs.lstat(target)).isSymbolicLink())
+                throw Error('Refusing symlinked uninstall credential/state path.');
+        }
+        catch (e) {
+            if (e.code !== 'ENOENT')
+                throw e;
+        }
+    }
+    await fs.mkdir(dir, { recursive: true });
+    const lock = path.join(dir, 'install.lock');
+    let fd;
+    try {
+        fd = await fs.open(lock, 'wx', 0o600);
+    }
+    catch {
+        throw Error('Another setup is active; retry uninstall after it finishes.');
+    }
+    let cleared = false;
+    let warning;
+    try {
+        const remaining = await installedClients(home);
+        for (const [client, root] of [['codex', '.agents'], ['claude-code', '.claude'], ['hermes', '.hermes']]) {
+            if (remaining.includes(client))
+                continue;
+            await prune(path.join(home, root, 'skills/aisa-web-market'));
+            await empty(path.join(home, root, 'skills'));
+            await empty(path.join(home, root));
+        }
+        if (!remaining.length) {
+            const file = authFile(home);
+            const tokenLock = `${file}.lock`;
+            let tokenFd;
+            try {
+                tokenFd = await fs.open(tokenLock, 'wx', 0o600);
+            }
+            catch {
+                throw Error('OAuth credentials are in use; stop AIsa processes and retry uninstall.');
+            }
+            try {
+                let session;
+                try {
+                    session = await readSession(file);
+                }
+                catch { /* Corrupt credentials still need local cleanup. */ }
+                if (session?.refresh_token) {
+                    try {
+                        const response = await fetcher('https://clerk.aisa.one/oauth/token/revoke', { method: 'POST', redirect: 'error', signal: AbortSignal.timeout(10_000), body: new URLSearchParams({ token: session.refresh_token, token_type_hint: 'refresh_token', client_id: session.client_id }) });
+                        if (!response.ok)
+                            throw Error();
+                        await response.body?.cancel();
+                    }
+                    catch {
+                        warning = 'Local OAuth credentials removed, but server-side revocation could not be confirmed.';
+                    }
+                }
+                await fs.rm(file, { force: true });
+                cleared = true;
+            }
+            finally {
+                await tokenFd.close();
+                await fs.rm(tokenLock, { force: true });
+            }
+        }
+    }
+    finally {
+        await fd.close();
+        await fs.rm(lock, { force: true });
+    }
+    if (cleared) {
+        await empty(dir);
+        await empty(path.join(home, '.aisa'));
+        await empty(path.join(home, '.codex'));
+    }
+    return { credentialsCleared: cleared, warning };
+}

package/docs/contract.md

@@ -18,7 +18,9 @@ Traffic algorithm traffic-derived-v1 compares requested endpoints only, leaves g
 
 Bearer, request headers and arbitrary upstream error bodies are not returned. 402 is payment_required because the gateway can use it for subscription or credit restrictions. No per-endpoint prices are hardcoded. max_price_usd is divided among planned calls; tiny budgets that round to zero fail before requests. A network interruption is not automatically replayed.
 
-Remaining integration limits: no OAuth, no automatic publication-date discovery, no organic/nonbranded keyword filters, no live price estimation, no durable query cache, no interactive-client evals. See live-verification-2026-09-05.md for test-account evidence. HTTP bearer requests and sample parsing are verified using fixtures, including the docs' example envelopes.
+OAuth login uses Clerk DCR and PKCE with shared local credentials and automatic refresh. Token exchange and refresh have simulated integration coverage; live account authorization remains unverified.
+
+Remaining integration limits: no automatic publication-date discovery, no organic/nonbranded keyword filters, no live price estimation, no durable query cache, no interactive-client evals. See live-verification-2026-09-05.md for test-account evidence. HTTP bearer requests and sample parsing are verified using fixtures, including the docs' example envelopes.
 
 404 diagnostics: only the known gateway error `api endpoint not found` maps to unavailable_operation. Other 404 responses map to not_found without assuming route disablement, account permissions or missing domain data. Tool errors include http_status when known; arbitrary upstream messages are never forwarded. The aisa-mcp catalogue includes website-top-geographies but explicitly excludes website/traffic-geography and website/folders based on its 2026-08-26 production checks. This historical catalogue is not a live availability guarantee.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hzlmy2002/web-market",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Focused website competitive analysis: five MCP tools and a portable skill",
   "type": "module",
   "bin": {
@@ -17,7 +17,7 @@
   },
   "scripts": {
     "build": "tsc",
-    "test": "npm run build && node --test tests/*.test.mjs",
+    "test": "npm run build && node --import ./tests/isolate-env.mjs --test tests/*.test.mjs",
     "check": "tsc --noEmit",
     "prepack": "npm run build",
     "plugins": "npm run build && node scripts/package-plugins.mjs"