@kaneo/mcp 0.1.3 → 0.1.4

package/dist/auth/auth-service.js

@@ -42,6 +42,10 @@ export class AuthService {
             cached.clientId === this.clientId &&
             cached.accessToken) {
             const validation = await this.validateAccessToken(cached.accessToken);
+            // Fail-open for "unknown": validateAccessToken returns "unknown" on transient HTTP/network
+            // errors or ambiguous responses. Treating "unknown" like "valid" avoids clearToken() and a full
+            // device re-auth so flaky connectivity does not wipe cached.accessToken; only "invalid" forces
+            // a fresh login. Tests should cover both unknown and invalid paths.
             if (validation === "valid" || validation === "unknown") {
                 return cached.accessToken;
             }

package/dist/auth/device-flow.js

@@ -14,7 +14,32 @@ export async function requestDeviceCode(baseUrl, clientId) {
     if (!("device_code" in body) || typeof body.device_code !== "string") {
         throw new Error(`device/code: unexpected response ${JSON.stringify(body)}`);
     }
-    return body;
+    if (typeof body.user_code !== "string" ||
+        typeof body.verification_uri !== "string") {
+        throw new Error(`device/code: missing user_code or verification_uri ${JSON.stringify(body)}`);
+    }
+    const interval = toFiniteNumber(body.interval);
+    const expiresIn = toFiniteNumber(body.expires_in);
+    if (interval === undefined || expiresIn === undefined) {
+        throw new Error(`device/code: invalid interval or expires_in ${JSON.stringify(body)}`);
+    }
+    return {
+        ...body,
+        interval,
+        expires_in: expiresIn,
+    };
+}
+function toFiniteNumber(v) {
+    if (typeof v === "number" && Number.isFinite(v)) {
+        return v;
+    }
+    if (typeof v === "string" && v.trim() !== "") {
+        const n = Number(v);
+        if (Number.isFinite(n)) {
+            return n;
+        }
+    }
+    return undefined;
 }
 /**
  * Polls `/api/auth/device/token` until success or terminal error.
@@ -38,6 +63,9 @@ export async function pollDeviceAccessToken(baseUrl, clientId, deviceCode, initi
                 client_id: clientId,
             }),
         });
+        if (Date.now() - started > maxWait) {
+            throw new Error("Device authorization timed out waiting for approval.");
+        }
         const body = (await res.json().catch(() => ({})));
         if (res.ok && typeof body.access_token === "string") {
             return body.access_token;

package/dist/install/index.js

@@ -3,8 +3,15 @@ import { dirname } from "node:path";
 import { stdin as input, stdout as output } from "node:process";
 import { mergeMcpServerEntry } from "./merge-config.js";
 import { resolvePackageEntryPath } from "./resolve-entry.js";
-import { resolveTargetConfigPath } from "./targets.js";
+import { INSTALL_TARGETS, resolveTargetConfigPath, validateCustomConfigPathInput, } from "./targets.js";
 import { promptConfirmOverwrite, promptCustomConfigPath, promptTargetSelect, } from "./wizard.js";
+/** True if `v` looks like a CLI flag (`--long` or single-letter `-y`), not a value like `-my-server`. */
+function isFlagLikeToken(v) {
+    if (v.startsWith("--")) {
+        return true;
+    }
+    return /^-[A-Za-z]$/.test(v);
+}
 export function parseInstallArgs(argv) {
     let target;
     let output;
@@ -28,7 +35,7 @@ export function parseInstallArgs(argv) {
         }
         if (a === "--target") {
             const v = argv[i + 1];
-            if (!v || v.startsWith("-")) {
+            if (!v || isFlagLikeToken(v)) {
                 throw new Error("--target requires a value");
             }
             target = v;
@@ -41,7 +48,7 @@ export function parseInstallArgs(argv) {
         }
         if (a === "--output") {
             const v = argv[i + 1];
-            if (!v || v.startsWith("-")) {
+            if (!v || isFlagLikeToken(v)) {
                 throw new Error("--output requires a value");
             }
             output = v;
@@ -54,7 +61,7 @@ export function parseInstallArgs(argv) {
         }
         if (a === "--name") {
             const v = argv[i + 1];
-            if (!v || v.startsWith("-")) {
+            if (!v || isFlagLikeToken(v)) {
                 throw new Error("--name requires a value");
             }
             name = v;
@@ -67,7 +74,7 @@ export function parseInstallArgs(argv) {
         }
         if (a === "--api-url") {
             const v = argv[i + 1];
-            if (!v || v.startsWith("-")) {
+            if (!v || isFlagLikeToken(v)) {
                 throw new Error("--api-url requires a value");
             }
             apiUrl = v;
@@ -80,7 +87,7 @@ export function parseInstallArgs(argv) {
         }
         if (a === "--project-dir") {
             const v = argv[i + 1];
-            if (!v || v.startsWith("-")) {
+            if (!v || isFlagLikeToken(v)) {
                 throw new Error("--project-dir requires a value");
             }
             projectDir = v;
@@ -114,12 +121,7 @@ function hasExistingServerEntry(jsonText, serverName) {
         return false;
     }
 }
-const VALID_TARGETS = [
-    "cursor-user",
-    "cursor-project",
-    "claude-desktop",
-    "custom",
-];
+const VALID_TARGETS = INSTALL_TARGETS.map((t) => t.id);
 function isInstallTargetId(s) {
     return VALID_TARGETS.includes(s);
 }
@@ -161,7 +163,7 @@ export async function runInstall(argv) {
         process.exitCode = 1;
         return;
     }
-    let customPath = parsed.output;
+    let customPath = parsed.output?.trim();
     if (targetIds.includes("custom")) {
         if (!customPath) {
             if (input.isTTY && output.isTTY) {
@@ -173,6 +175,15 @@ export async function runInstall(argv) {
                 return;
             }
         }
+        else {
+            const validation = validateCustomConfigPathInput(customPath);
+            if (!validation.ok) {
+                console.error(`Invalid --output: ${validation.message}`);
+                process.exitCode = 1;
+                return;
+            }
+            customPath = validation.path;
+        }
     }
     const entryPath = resolvePackageEntryPath();
     const env = parsed.apiUrl !== undefined && parsed.apiUrl.length > 0
@@ -184,6 +195,7 @@ export async function runInstall(argv) {
         ...(env ? { env } : {}),
     };
     const writtenPaths = [];
+    const pending = [];
     for (const targetId of targetIds) {
         const configPath = resolveTargetConfigPath(targetId, {
             cwd: parsed.projectDir,
@@ -193,13 +205,24 @@ export async function runInstall(argv) {
         try {
             existingText = await readFile(configPath, "utf8");
         }
-        catch {
-            existingText = null;
+        catch (err) {
+            const code = err &&
+                typeof err === "object" &&
+                "code" in err &&
+                typeof err.code === "string"
+                ? err.code
+                : undefined;
+            if (code === "ENOENT") {
+                existingText = null;
+            }
+            else {
+                throw err;
+            }
         }
         const already = hasExistingServerEntry(existingText, parsed.name);
         if (already && !parsed.yes) {
             if (input.isTTY && output.isTTY) {
-                const ok = await promptConfirmOverwrite(parsed.name);
+                const ok = await promptConfirmOverwrite(parsed.name, configPath);
                 if (!ok) {
                     console.log(`Skipped:\n  ${configPath}`);
                     continue;
@@ -211,18 +234,27 @@ export async function runInstall(argv) {
                 return;
             }
         }
+        pending.push({ configPath, existingText });
+    }
+    const mergedWrites = [];
+    for (const p of pending) {
         let merged;
         try {
-            merged = mergeMcpServerEntry(existingText, parsed.name, serverConfig);
+            merged = mergeMcpServerEntry(p.existingText, parsed.name, serverConfig);
         }
-        catch {
-            console.error(`Cannot update config (invalid JSON or merge error): ${configPath}`);
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            const stack = err instanceof Error ? err.stack : undefined;
+            console.error(`Cannot update config at ${p.configPath}: ${message}${stack ? `\n${stack}` : ""}`);
             process.exitCode = 1;
             return;
         }
-        await mkdir(dirname(configPath), { recursive: true });
-        await writeFile(configPath, merged, { encoding: "utf8", mode: 0o600 });
-        writtenPaths.push(configPath);
+        mergedWrites.push({ configPath: p.configPath, merged });
+    }
+    for (const w of mergedWrites) {
+        await mkdir(dirname(w.configPath), { recursive: true });
+        await writeFile(w.configPath, w.merged, { encoding: "utf8", mode: 0o600 });
+        writtenPaths.push(w.configPath);
     }
     if (writtenPaths.length === 0) {
         console.log("No config files were updated.");
@@ -243,7 +275,7 @@ Usage:
 Without options, runs interactively (pick Cursor / Claude / custom path).
 
 Options:
-  --target <id>       cursor-user | cursor-project | claude-desktop | custom
+  --target <id>       ${VALID_TARGETS.join(" | ")}
   --output <path>     Required for --target custom (absolute path to JSON file)
   --project-dir <dir> Base directory for cursor-project (default: current dir)
   --name <string>     MCP server key under mcpServers (default: kaneo)

package/dist/install/merge-config.js

@@ -1,23 +1,45 @@
+const RESERVED_MCP_SERVER_KEYS = new Set([
+    "__proto__",
+    "constructor",
+    "prototype",
+]);
+function isPlainObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
 /**
  * Merges or replaces `mcpServers[serverName]` and returns formatted JSON.
  * Preserves other top-level keys and other MCP server entries.
  */
 export function mergeMcpServerEntry(existingJson, serverName, serverConfig) {
+    if (RESERVED_MCP_SERVER_KEYS.has(serverName)) {
+        throw new Error(`Refusing MCP server name "${serverName}" (reserved key; use a different --name).`);
+    }
     let root = {};
-    if (existingJson) {
-        const parsed = JSON.parse(existingJson);
-        if (typeof parsed === "object" &&
-            parsed !== null &&
-            !Array.isArray(parsed)) {
-            root = { ...parsed };
+    if (existingJson !== null) {
+        let parsed;
+        try {
+            parsed = JSON.parse(existingJson);
+        }
+        catch {
+            throw new Error("Existing MCP config is not valid JSON.");
+        }
+        if (!isPlainObject(parsed)) {
+            throw new Error("Existing MCP config must be a JSON object (not an array or primitive).");
         }
+        root = { ...parsed };
     }
     const mcpServers = (() => {
+        const map = Object.create(null);
         const raw = root.mcpServers;
         if (typeof raw === "object" && raw !== null && !Array.isArray(raw)) {
-            return { ...raw };
+            for (const key of Object.keys(raw)) {
+                if (RESERVED_MCP_SERVER_KEYS.has(key)) {
+                    continue;
+                }
+                map[key] = raw[key];
+            }
         }
-        return {};
+        return map;
     })();
     mcpServers[serverName] = serverConfig;
     root.mcpServers = mcpServers;

package/dist/install/targets.js

@@ -1,5 +1,22 @@
 import { homedir } from "node:os";
-import { join } from "node:path";
+import path, { join } from "node:path";
+/**
+ * Validates a non-interactive custom MCP config path (same rules as the install wizard).
+ * Returns the trimmed absolute path on success.
+ */
+export function validateCustomConfigPathInput(raw) {
+    const trimmed = raw.trim();
+    if (trimmed.length === 0) {
+        return { ok: false, message: "Path is required" };
+    }
+    if (!path.isAbsolute(trimmed)) {
+        return { ok: false, message: "Path must be absolute" };
+    }
+    if (!trimmed.toLowerCase().endsWith(".json")) {
+        return { ok: false, message: "Path must end with .json" };
+    }
+    return { ok: true, path: trimmed };
+}
 export const INSTALL_TARGETS = [
     {
         id: "cursor-user",
@@ -45,11 +62,11 @@ export function resolveTargetConfigPath(id, options) {
         case "claude-desktop":
             return getClaudeDesktopConfigPath();
         case "custom": {
-            const p = options.customPath?.trim();
-            if (!p) {
-                throw new Error("Custom target requires a file path");
+            const result = validateCustomConfigPathInput(options.customPath ?? "");
+            if (!result.ok) {
+                throw new Error(result.message);
             }
-            return p;
+            return result.path;
         }
     }
 }

package/dist/install/wizard.js

@@ -1,5 +1,5 @@
 import prompts from "prompts";
-import { INSTALL_TARGETS } from "./targets.js";
+import { INSTALL_TARGETS, validateCustomConfigPathInput, } from "./targets.js";
 function onCancel() {
     console.log("\nCancelled.");
     process.exit(0);
@@ -30,20 +30,24 @@ export async function promptCustomConfigPath() {
         type: "text",
         name: "path",
         message: "Absolute path to the JSON config file (create or update):",
-        validate: (v) => typeof v === "string" && v.trim().length > 0
-            ? true
-            : "Path is required",
+        validate: (v) => {
+            if (typeof v !== "string") {
+                return "Path is required";
+            }
+            const result = validateCustomConfigPathInput(v);
+            return result.ok ? true : result.message;
+        },
     }, { onCancel });
     if (answer.path === undefined) {
         onCancel();
     }
     return String(answer.path).trim();
 }
-export async function promptConfirmOverwrite(serverName) {
+export async function promptConfirmOverwrite(serverName, configPath) {
     const answer = await prompts({
         type: "confirm",
         name: "overwrite",
-        message: `MCP server "${serverName}" is already in this file. Overwrite it?`,
+        message: `MCP server "${serverName}" is already in this file (${configPath}). Overwrite it?`,
         initial: false,
     }, { onCancel });
     if (answer.overwrite === undefined) {

package/dist/kaneo/task-helpers.js

@@ -42,6 +42,9 @@ export function buildFullTaskUpdateBody(existing, patch) {
     if (!projectId) {
         throw new Error("Cannot update task: missing projectId.");
     }
+    // When patch.userId is explicitly null, we set userId to "" so the API clears assignee; the API
+    // treats "" as unassigned (userId || null). When patch.userId is undefined, keep existing.userId
+    // unchanged (leave assignee as-is).
     const userId = patch.userId !== undefined
         ? patch.userId === null
             ? ""

package/dist/tools/register.js

@@ -73,25 +73,54 @@ export function registerTools(server, ctx) {
         }),
     })));
     server.registerTool("update_project", {
-        description: "Update project metadata.",
+        description: "Update project metadata (PATCH-style: only provided fields are changed).",
         inputSchema: z.object({
             id: nonEmptyString,
-            name: nonEmptyString,
-            icon: nonEmptyString,
-            slug: nonEmptyString,
-            description: z.string(),
-            isPublic: z.boolean(),
-        }),
-    }, async (args) => run(() => client.json(`/api/project/${encodeURIComponent(args.id)}`, {
-        method: "PUT",
-        body: JSON.stringify({
-            name: args.name,
-            icon: args.icon,
-            slug: args.slug,
-            description: args.description,
-            isPublic: args.isPublic,
+            name: optionalNonEmptyString,
+            icon: z.string().optional(),
+            slug: optionalNonEmptyString,
+            description: z.string().optional(),
+            isPublic: z.boolean().optional(),
         }),
-    })));
+    }, async (args) => {
+        const { id, ...patch } = args;
+        return run(async () => {
+            const existing = (await client.json(`/api/project/${encodeURIComponent(id)}`, { method: "GET" }));
+            const name = patch.name ??
+                (typeof existing.name === "string" ? existing.name : "");
+            if (!name) {
+                throw new Error("Cannot update project: missing name.");
+            }
+            const icon = patch.icon !== undefined
+                ? patch.icon
+                : existing.icon != null
+                    ? String(existing.icon)
+                    : "";
+            const slug = patch.slug ??
+                (typeof existing.slug === "string" ? existing.slug : "");
+            if (!slug) {
+                throw new Error("Cannot update project: missing slug.");
+            }
+            const description = patch.description !== undefined
+                ? patch.description
+                : typeof existing.description === "string"
+                    ? existing.description
+                    : "";
+            const isPublic = patch.isPublic !== undefined
+                ? patch.isPublic
+                : Boolean(existing.isPublic);
+            return client.json(`/api/project/${encodeURIComponent(id)}`, {
+                method: "PUT",
+                body: JSON.stringify({
+                    name,
+                    icon,
+                    slug,
+                    description,
+                    isPublic,
+                }),
+            });
+        });
+    });
     const listTasksSchema = z.object({
         projectId: nonEmptyString,
         status: optionalNonEmptyString,

package/dist/utils/mcp-result.js

@@ -1,9 +1,10 @@
 export function textResult(data, isError = false) {
+    const text = typeof data === "string" ? data : (JSON.stringify(data, null, 2) ?? "");
     return {
         content: [
             {
                 type: "text",
-                text: typeof data === "string" ? data : JSON.stringify(data, null, 2),
+                text,
             },
         ],
         isError,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@kaneo/mcp",
-	"version": "0.1.3",
+	"version": "0.1.4",
 	"description": "Model Context Protocol (stdio) server for Kaneo — tasks, projects, labels, and device authorization",
 	"license": "MIT",
 	"homepage": "https://github.com/usekaneo/kaneo/",
@@ -28,7 +28,7 @@
 	],
 	"scripts": {
 		"build": "tsc -p tsconfig.json",
-		"prepublishOnly": "npm run build",
+		"prepublishOnly": "pnpm run build",
 		"dev": "tsx watch src/index.ts",
 		"lint": "biome check --write .",
 		"start": "node dist/index.js",