@jam-mcp/server 1.4.3 → 1.4.4

package/README.md

@@ -74,10 +74,10 @@ auth login   Store Jira credentials in this user's OS secret store
 runtime      Show or change which JAM build this machine runs
 ```
 
-Written out, that is `npx --yes @jam-mcp/launcher@1.4.3 doctor`, or just `jam
+Written out, that is `npx --yes @jam-mcp/launcher@1.4.4 doctor`, or just `jam
 doctor` if you took the launcher's optional global install. Starting from
 nothing — no install, no runtime chosen yet — use
-`npx --yes @jam-mcp/bootstrap@1.4.3 init` instead.
+`npx --yes @jam-mcp/bootstrap@1.4.4 init` instead.
 
 Credentials come from the process environment or this user's OS secret store —
 never from a repository file — and never appear in logs, telemetry, or tool

package/dist/adapters/credentials/composite.js

@@ -74,6 +74,15 @@ export class CompositeCredentialProvider {
             description.baseUrl = values.JIRA_BASE_URL;
         if (values.JIRA_EMAIL)
             description.email = values.JIRA_EMAIL;
+        // Per-field provenance, so "mixed" can be read rather than guessed at.
+        const sources = {};
+        for (const field of ["JIRA_BASE_URL", "JIRA_EMAIL", "JIRA_API_TOKEN"]) {
+            const from = sourceByKey[field];
+            if (from)
+                sources[field] = from;
+        }
+        if (Object.keys(sources).length > 0)
+            description.sources = sources;
         return description;
     }
 }

package/dist/bootstrap/mcp-config-merger.d.ts

@@ -13,7 +13,7 @@ import { LAUNCHER_PACKAGE_SPEC } from "@jam-mcp/launcher";
 export { LAUNCHER_PACKAGE_SPEC };
 export declare const JAM_MCP_ENTRY: {
     readonly command: "npx";
-    readonly args: readonly ["--yes", "@jam-mcp/launcher@1.4.3", "serve"];
+    readonly args: readonly ["--yes", "@jam-mcp/launcher@1.4.4", "serve"];
 };
 /**
  * Recognise wiring from before the launcher existed: a hard-coded `node` path

package/dist/bootstrap/setup-plan.d.ts

@@ -3,13 +3,23 @@ import type { MigrationTarget } from "./migration-target.js";
 import { type BootstrapSource } from "./project-config-bootstrapper.js";
 import type { SetupState } from "./setup-state.js";
 export type SetupStatus = "already_configured" | "ready_to_apply" | "user_action_required";
-export type SetupCode = "JAM_PROJECT_SELECTION_REQUIRED" | "JAM_BINDINGS_UNREADABLE" | "JAM_AUTH_REQUIRED" | "JAM_RUNTIME_CONFIG_MISSING" | "JAM_PROJECT_CONFIG_INVALID" | "JAM_MCP_CONFIG_UNREADABLE" | "JAM_MIGRATION_TARGET_UNAVAILABLE";
+export type SetupCode = "JAM_PROJECT_SELECTION_REQUIRED" | "JAM_BINDINGS_UNREADABLE" | "JAM_AUTH_REQUIRED" | "JAM_RUNTIME_CONFIG_MISSING" | "JAM_PROJECT_CONFIG_INVALID" | "JAM_MCP_CONFIG_UNREADABLE" | "JAM_MIGRATION_TARGET_UNAVAILABLE" | "JAM_PROJECT_KEY_CONFLICT";
+/**
+ * Where a project key came from. `repository` is the team's committed
+ * `.jira-agent/project.yaml`; the rest are this user's own settings, in the
+ * precedence order `decideProjectKey` applies.
+ */
+export type KeySource = BootstrapSource | "repository";
+export type KeyOrigin = {
+    key: string;
+    source: KeySource;
+};
 export type SetupChange = {
     type: "create";
     target: "project-config";
     path: string;
     key: string;
-    keySource: BootstrapSource;
+    keySource: KeySource;
 } | {
     type: "create";
     target: "mcp-config";
@@ -30,7 +40,7 @@ export type SetupChange = {
     path: string;
     workspaceId: string;
     key: string;
-    keySource: BootstrapSource;
+    keySource: KeySource;
     /** Present on a rebind, so the preview shows what is being replaced. */
     previousKey?: string;
 } | {
@@ -95,7 +105,11 @@ export type SetupPlan = {
     project?: {
         root: string;
         key?: string;
+        keySource?: KeySource;
     };
+    /** On JAM_PROJECT_KEY_CONFLICT: what was asked for, and what already stands. */
+    requested?: KeyOrigin;
+    existing?: KeyOrigin;
 };
 export type PlanOptions = {
     /**

package/dist/bootstrap/setup-plan.js

@@ -52,7 +52,23 @@ export function computeSetupPlan(state, options = {}) {
             project: { root: state.project.root },
         };
     }
-    const project = { root: state.project.root, key: key.key };
+    // The repository's committed key is the team's answer. When a personal
+    // `--project` disagrees with it, neither side may win silently: overwriting
+    // the repository is not setup's call, and quietly using the repository key
+    // makes the flag a lie. Stop, and name both sources.
+    const conflict = keyConflict(state, options, key);
+    if (conflict) {
+        return {
+            status: "user_action_required",
+            code: "JAM_PROJECT_KEY_CONFLICT",
+            changes: [],
+            requiresUserAction: true,
+            requested: conflict.requested,
+            existing: conflict.existing,
+            project: { root: state.project.root, key: conflict.existing.key, keySource: conflict.existing.source },
+        };
+    }
+    const project = { root: state.project.root, key: key.key, keySource: key.source };
     if (!shared) {
         // Personal scope: the record of "this workspace is that Jira project"
         // lives with the user, and nothing in the repository is touched.
@@ -207,9 +223,11 @@ function planBindingChange(state, key) {
 }
 function resolveKey(state, options) {
     // An existing project.yaml wins: setup must never silently repoint a project,
-    // and a personal note must never override what the team committed.
+    // and a personal note must never override what the team committed. It is
+    // labelled `repository` rather than `explicit` - a reader has to be able to
+    // tell the team's committed answer from what someone typed.
     if (state.project.key)
-        return { key: state.project.key, source: "explicit" };
+        return { key: state.project.key, source: "repository" };
     const decideOptions = {};
     if (options.explicitKey)
         decideOptions.explicitKey = options.explicitKey;
@@ -221,6 +239,24 @@ function resolveKey(state, options) {
         decideOptions.presetsPath = options.presetsPath;
     return decideProjectKey(state.project.root, decideOptions);
 }
+/**
+ * A repository key and an explicit `--project` that disagree. Personal
+ * sources are not conflicts: explicit already beats them in decideProjectKey,
+ * and a stale binding is repaired rather than reported.
+ */
+function keyConflict(state, options, resolved) {
+    const explicit = options.explicitKey?.trim();
+    if (!explicit)
+        return undefined;
+    const repository = state.project.key;
+    if (!repository || repository === explicit)
+        return undefined;
+    void resolved;
+    return {
+        requested: { key: explicit, source: "explicit" },
+        existing: { key: repository, source: "repository" },
+    };
+}
 function planMcpChange(state, options) {
     if (!state.mcp.exists) {
         return { type: "create", target: "mcp-config", path: state.mcp.path };

package/dist/bootstrap/setup-state.d.ts

@@ -1,5 +1,5 @@
 import { type RuntimeMode } from "@jam-mcp/launcher";
-import type { CredentialPort, CredentialSource } from "../ports/credentials.port.js";
+import type { CredentialDescription, CredentialPort, CredentialSource } from "../ports/credentials.port.js";
 import { type HostRunner, type HostState } from "./host-mcp.js";
 import { type McpInspection } from "./mcp-config-merger.js";
 import { type ProjectBinding } from "./project-bindings.js";
@@ -15,6 +15,8 @@ export type RuntimeState = {
 export type CredentialState = {
     present: boolean;
     source: CredentialSource;
+    /** Which source supplied each field. Names only - never a value. */
+    sources?: CredentialDescription["sources"];
     baseUrl?: string;
     email?: string;
 };

package/dist/bootstrap/setup-state.js

@@ -61,6 +61,8 @@ function detectCredentials(credentials) {
         source: described.source,
     };
     // Presence and origin only - the token value never enters this snapshot.
+    if (described.sources)
+        state.sources = described.sources;
     if (described.baseUrl)
         state.baseUrl = described.baseUrl;
     if (described.email)

package/dist/cli/agent-api.js

@@ -61,7 +61,8 @@ export async function setupApplyCommand(options = {}) {
     }
     if (plan.code === "JAM_PROJECT_CONFIG_INVALID" ||
         plan.code === "JAM_MCP_CONFIG_UNREADABLE" ||
-        plan.code === "JAM_BINDINGS_UNREADABLE") {
+        plan.code === "JAM_BINDINGS_UNREADABLE" ||
+        plan.code === "JAM_PROJECT_KEY_CONFLICT") {
         emitJson({ ...plan, changesApplied: false });
         return 1;
     }
@@ -102,7 +103,8 @@ export async function setupAgentCommand(options = {}) {
     }
     if (plan.code === "JAM_PROJECT_CONFIG_INVALID" ||
         plan.code === "JAM_MCP_CONFIG_UNREADABLE" ||
-        plan.code === "JAM_BINDINGS_UNREADABLE") {
+        plan.code === "JAM_BINDINGS_UNREADABLE" ||
+        plan.code === "JAM_PROJECT_KEY_CONFLICT") {
         emitJson({ ...plan, changesApplied: false });
         return 1;
     }
@@ -147,10 +149,71 @@ export async function doctorJsonCommand(options = {}) {
         ...(health.error ? { error: health.error } : {}),
         project: { root: state.project.root, ...(state.project.key ? { key: state.project.key } : {}) },
         axes,
+        diagnosis: diagnose(state, axes, health),
         checks: health.checks,
     });
     return passed ? 0 : 1;
 }
+function diagnose(state, axes, health) {
+    const check = (name) => health.checks.find((c) => c.name === name);
+    const fromCheck = (name, code) => {
+        const found = check(name);
+        if (!found)
+            return { state: "UNCHECKED" };
+        return found.ok
+            ? { state: "OK", ...(found.detail ? { detail: found.detail } : {}) }
+            : { state: "FAILED", code, ...(found.detail ? { detail: found.detail } : {}) };
+    };
+    // Credentials: this axis answers "are all three fields resolvable, and from
+    // where" - the snapshot knows that. Whether Jira accepts them is a different
+    // question with its own axis below, and conflating the two is what made a
+    // working "mixed" setup read as broken. "mixed" is never a failure here.
+    const credentialCheck = check("Credentials present");
+    const mixed = state.credentials.source === "mixed";
+    const credentials = !state.credentials.present
+        ? {
+            state: "FAILED",
+            code: "JAM_AUTH_REQUIRED",
+            ...(credentialCheck?.detail ? { detail: credentialCheck.detail } : {}),
+        }
+        : mixed
+            ? { state: "WARNING", detail: `fields come from more than one source: ${describeSources(state)}` }
+            : { state: "OK", detail: `source ${state.credentials.source}` };
+    return {
+        credentials,
+        projectBinding: state.project.key
+            ? { state: "OK", detail: `key ${state.project.key}` }
+            : { state: "FAILED", code: "JAM_PROJECT_SELECTION_REQUIRED", detail: "no project key for this workspace" },
+        runtime: axes.package === "PACKAGE_READY"
+            ? { state: "OK", ...(axes.packageVersion ? { detail: axes.packageVersion } : {}) }
+            : { state: "FAILED", code: "JAM_RUNTIME_CONFIG_MISSING", ...(state.runtime.error ? { detail: state.runtime.error } : {}) },
+        registration: axes.registration === "OK"
+            ? { state: "OK", ...(axes.registeredVersion ? { detail: axes.registeredVersion } : {}) }
+            : axes.registration === "UNREGISTERED"
+                ? { state: "UNCHECKED", detail: "no host has a jam entry for this user" }
+                : { state: "FAILED", code: axes.registration, ...(axes.detail ? { detail: axes.detail } : {}) },
+        liveToolset: axes.live === "OK"
+            ? { state: "OK" }
+            : axes.live === "UNCHECKED"
+                ? { state: "UNCHECKED", ...(axes.detail ? { detail: axes.detail } : {}) }
+                : {
+                    state: "FAILED",
+                    code: axes.live,
+                    ...(axes.missingTools ? { detail: `missing: ${axes.missingTools.join(", ")}` } : {}),
+                },
+        jiraAuthentication: fromCheck("Jira authentication", "JAM_JIRA_AUTHENTICATION_FAILED"),
+        jiraProjectAccess: fromCheck(health.checks.find((c) => c.name.startsWith("JQL search"))?.name ?? "JQL search", "JAM_JIRA_PROJECT_ACCESS_FAILED"),
+    };
+}
+/** Field-to-source names only. A credential value never appears here. */
+function describeSources(state) {
+    const sources = state.credentials.sources;
+    if (!sources)
+        return "unknown";
+    return Object.entries(sources)
+        .map(([field, from]) => `${field}=${from}`)
+        .join(", ");
+}
 async function inspectAxes(state, options) {
     const packageVersion = state.runtime.version;
     const axes = {
@@ -207,6 +270,8 @@ export function authStatusCommand(options = {}) {
         status: credentials.present ? "configured" : "not_configured",
         ...(credentials.present ? {} : { code: "JAM_AUTH_REQUIRED" }),
         source: credentials.source,
+        // Which field came from where. Names only - a value never appears.
+        ...(credentials.sources ? { sources: credentials.sources } : {}),
         ...(credentials.email ? { email: credentials.email } : {}),
         ...(credentials.baseUrl ? { baseUrl: credentials.baseUrl } : {}),
     });

package/dist/cli/auth.js

@@ -137,7 +137,8 @@ export function authLogoutCommand(options = {}) {
  * credential unreachable, and the resulting split shows up as "mixed".
  */
 function reportOverride(ui, port) {
-    const source = port.describe().source;
+    const described = port.describe();
+    const source = described.source;
     if (source === "secret-store")
         return;
     if (source === "mixed") {
@@ -147,6 +148,8 @@ function reportOverride(ui, port) {
         ui.warn("Current JIRA_* environment variables override the stored credentials");
     }
     ui.line(`  Effective source: ${source}`);
+    for (const line of fieldSourceLines(described))
+        ui.line(line);
     ui.line("  Unset them to use what was just stored.");
 }
 /** After a logout, say plainly whether anything still authenticates JAM. */
@@ -161,6 +164,8 @@ function reportRemaining(ui, port) {
         ? "Jira credentials still resolve from outside the secret store"
         : "Part of a Jira credential still resolves from outside the secret store");
     ui.line(`  Effective source: ${described.source}`);
+    for (const line of fieldSourceLines(described))
+        ui.line(line);
     ui.line("  Unset JIRA_BASE_URL, JIRA_EMAIL and JIRA_API_TOKEN to finish logging out.");
 }
 /** undefined when Jira accepted the credentials; otherwise the reason. */
@@ -200,3 +205,15 @@ export function toJiraOrigin(input) {
     }
     return url.protocol === "http:" || url.protocol === "https:" ? url.origin : undefined;
 }
+/**
+ * Which field came from where. "mixed" on its own tells a reader that
+ * something is split without telling them what, so they go looking - these
+ * lines answer it. Field names and source names only: a credential value is
+ * never printed.
+ */
+function fieldSourceLines(described) {
+    const sources = described.sources;
+    if (!sources)
+        return [];
+    return Object.entries(sources).map(([field, from]) => `    ${field}: ${from}`);
+}

package/dist/cli/setup.js

@@ -44,7 +44,8 @@ export async function setup(options = {}) {
     }
     if (plan.code === "JAM_PROJECT_CONFIG_INVALID" ||
         plan.code === "JAM_MCP_CONFIG_UNREADABLE" ||
-        plan.code === "JAM_BINDINGS_UNREADABLE") {
+        plan.code === "JAM_BINDINGS_UNREADABLE" ||
+        plan.code === "JAM_PROJECT_KEY_CONFLICT") {
         line(`[FAIL] ${describeBlockingCode(plan)}`);
         return 1;
     }
@@ -133,6 +134,16 @@ function reportApplied(applied, plan) {
     void plan;
 }
 function describeBlockingCode(plan) {
+    if (plan.code === "JAM_PROJECT_KEY_CONFLICT") {
+        // Both sides named, and no suggestion to delete the repository's file -
+        // which project this repository belongs to is the team's decision.
+        return [
+            `This repository declares ${plan.existing?.key} in .jira-agent/project.yaml,`,
+            `but --project asked for ${plan.requested?.key}. JAM will not overwrite the`,
+            "committed key. Either drop --project to use the repository's, or change",
+            "the repository's project.yaml with the team and re-run.",
+        ].join(" ");
+    }
     if (plan.code === "JAM_PROJECT_CONFIG_INVALID") {
         return "The project's .jira-agent/project.yaml could not be parsed. Fix it and re-run.";
     }

package/dist/ports/credentials.port.d.ts

@@ -14,6 +14,13 @@ export type CredentialDescription = {
     email?: string;
     hasToken: boolean;
     source: CredentialSource;
+    /**
+     * Which source supplied each field. `source` alone says "mixed" without
+     * saying mixed how, which reads as a fault when it is a normal state - a
+     * base URL and email in the OS store with the token exported for one shell
+     * is a supported setup. Names only: no value ever appears here.
+     */
+    sources?: Partial<Record<"JIRA_BASE_URL" | "JIRA_EMAIL" | "JIRA_API_TOKEN", Exclude<CredentialSource, "mixed" | "none">>>;
 };
 export interface CredentialPort {
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jam-mcp/server",
-  "version": "1.4.3",
+  "version": "1.4.4",
   "description": "JAM (Jira Agent MCP) - agent-facing Jira access layer: MCP server, setup core, and CLI",
   "keywords": [
     "jira",
@@ -41,7 +41,7 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@jam-mcp/launcher": "1.4.3",
+    "@jam-mcp/launcher": "1.4.4",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "yaml": "^2.9.0",
     "zod": "^4.4.3"