@kitae9999/openlog-cli 1.0.0 → 1.1.0

package/README.md

@@ -8,17 +8,24 @@ npx -y @kitae9999/openlog-cli whoami
 npx -y @kitae9999/openlog-cli mcp
 ```
 
-MCP tools:
-
-- `get_auth_status`
-- `get_me`
-- `list_my_notifications`
-- `list_my_posts`
-- `list_my_liked_posts`
-- `upload_post_image`
-- `publish_post`
-- `push_working_brief`
-- `get_post_detail`
+Local MCP permissions:
+
+```bash
+openlog mcp permissions
+openlog mcp permissions set read-only
+openlog mcp permissions set safe-write
+openlog mcp permissions set full
+openlog mcp permissions reset
+```
+
+`safe-write` is the default. Permission changes apply after the MCP server is restarted or reloaded.
+
+MCP tool groups:
+
+- Account and posts: authentication, notifications, authored/liked posts, image upload, post detail, and confirmed publishing
+- Workspace context: workspace discovery, activity, working brief, tasks, logs, todos, memories, outputs, and graph links
+- Safe writes: create/update, todo completion, link creation, image upload, and confirmed output/post publishing
+- Full-only writes: individual workspace-document/link deletes and working-brief clear
 
 MCP client configuration:
 
@@ -35,3 +42,5 @@ MCP client configuration:
 
 Set `OPENLOG_API_BASE_URL` to point at a non-production API. Set
 `OPENLOG_WEB_BASE_URL` to control absolute post URLs returned by `publish_post`.
+Set `OPENLOG_MCP_CONFIG_FILE` to replace the default
+`~/.openlog/mcp-config.json` permission file.

package/dist/api-client.js

@@ -38,6 +38,13 @@ export class OpenLogApiClient {
             body: body ? JSON.stringify(body) : undefined,
         });
     }
+    async patch(path, body) {
+        return this.request(path, {
+            method: "PATCH",
+            headers: body ? { "content-type": "application/json" } : undefined,
+            body: body ? JSON.stringify(body) : undefined,
+        });
+    }
     async postNoContent(path, body) {
         await this.request(path, {
             method: "POST",
@@ -52,6 +59,9 @@ export class OpenLogApiClient {
             body: body ? JSON.stringify(body) : undefined,
         });
     }
+    async deleteNoContent(path) {
+        await this.request(path, { method: "DELETE" });
+    }
     async request(path, init, allowRefresh = true) {
         const url = `${this.apiBaseUrl}${path}`;
         const response = await fetch(url, {
@@ -73,7 +83,11 @@ export class OpenLogApiClient {
         if (response.status === 204) {
             return undefined;
         }
-        return (await response.json());
+        const responseBody = await response.text();
+        if (!responseBody) {
+            return undefined;
+        }
+        return JSON.parse(responseBody);
     }
     async refreshAccessToken() {
         if (!this.refreshPromise) {

package/dist/config.js

@@ -12,3 +12,7 @@ export function getAuthFilePath() {
     return (process.env.OPENLOG_AUTH_FILE ??
         path.join(os.homedir(), ".openlog", "auth.json"));
 }
+export function getMcpConfigFilePath() {
+    return (process.env.OPENLOG_MCP_CONFIG_FILE ??
+        path.join(os.homedir(), ".openlog", "mcp-config.json"));
+}

package/dist/index.js

@@ -5,6 +5,7 @@ import { runMcpServer } from "./mcp-server.js";
 import { installMcp, printMcpInstallHelp } from "./mcp-install.js";
 import { ApiError, OpenLogApiClient } from "./api-client.js";
 import { createAuthenticatedApiClient } from "./authenticated-client.js";
+import { runMcpPermissionsCommand } from "./mcp-permissions-command.js";
 const command = process.argv[2] ?? "help";
 const subcommand = process.argv[3];
 try {
@@ -21,10 +22,12 @@ try {
         if (subcommand === "install") {
             await installMcpCommand();
         }
+        else if (subcommand === "permissions") {
+            await runMcpPermissionsCommand(process.argv.slice(4));
+        }
         else if (subcommand === undefined ||
             subcommand === "serve" ||
             subcommand === "start") {
-            printMcpStartupHint();
             await runMcpServer();
         }
         else {
@@ -78,37 +81,6 @@ async function logout() {
     await deleteAuthFile();
     console.log("Logged out.");
 }
-function printMcpStartupHint() {
-    if (!process.stderr.isTTY) {
-        return;
-    }
-    console.error(`OpenLog MCP server is running over stdio.
-
-This terminal is now reserved for MCP protocol traffic.
-Press Ctrl+C to stop it.
-
-To use it from an MCP client, add:
-{
-  "mcpServers": {
-    "openlog": {
-      "command": "openlog",
-      "args": ["mcp"]
-    }
-  }
-}
-
-Available tools:
-  get_auth_status
-  get_me
-  list_my_notifications
-  list_my_posts
-  list_my_liked_posts
-  upload_post_image
-  publish_post
-  push_working_brief
-  get_post_detail
-`);
-}
 function printHelp() {
     console.log(`OpenLog CLI
 
@@ -121,11 +93,19 @@ Usage:
                   Register OpenLog MCP with Codex
   openlog mcp install claude-code
                   Register OpenLog MCP with Claude Code
+  openlog mcp permissions
+                  Show the active local MCP permission profile
+  openlog mcp permissions set read-only|safe-write|full
+                  Change the local MCP permission profile
+  openlog mcp permissions reset
+                  Restore the default safe-write profile
 
 Environment:
   OPENLOG_API_BASE_URL  Override the OpenLog API base URL
   OPENLOG_WEB_BASE_URL  Override the OpenLog web base URL for published post links
   OPENLOG_AUTH_FILE     Override the local auth file path
+  OPENLOG_MCP_CONFIG_FILE
+                        Override the local MCP permission config path
 `);
 }
 function formatCliError(error) {

package/dist/mcp-install.js

@@ -28,7 +28,8 @@ Aliases:
   claude      Same as claude-code
 
 Notes:
-  If OPENLOG_API_BASE_URL or OPENLOG_WEB_BASE_URL is set, it is added to the client config.
+  If OPENLOG_API_BASE_URL, OPENLOG_WEB_BASE_URL, or OPENLOG_MCP_CONFIG_FILE is set,
+  it is added to the client config.
 `);
 }
 function buildServerConfig() {
@@ -41,6 +42,9 @@ function buildServerConfig() {
     if (webBaseUrl !== DEFAULT_WEB_BASE_URL) {
         env.OPENLOG_WEB_BASE_URL = webBaseUrl;
     }
+    if (process.env.OPENLOG_MCP_CONFIG_FILE) {
+        env.OPENLOG_MCP_CONFIG_FILE = process.env.OPENLOG_MCP_CONFIG_FILE;
+    }
     return {
         command: "openlog",
         args: ["mcp"],

package/dist/mcp-permissions-command.js

@@ -0,0 +1,45 @@
+import { isMcpPermissionProfile, readMcpPermissions, resetMcpPermissions, writeMcpPermissionProfile, } from "./mcp-permissions.js";
+export async function runMcpPermissionsCommand(args, writeOutput = console.log) {
+    const action = args[0] ?? "show";
+    if ((action === "show" && args.length === 1) || args.length === 0) {
+        writeOutput(formatPermissions(await readMcpPermissions()));
+        return;
+    }
+    if (action === "set" && args.length === 2) {
+        const profile = args[1];
+        if (!isMcpPermissionProfile(profile)) {
+            throw new Error(permissionUsage());
+        }
+        const permissions = await writeMcpPermissionProfile(profile);
+        writeOutput(formatPermissions(permissions));
+        // 실행 중인 MCP server는 시작 시 권한을 확정하므로 재시작 안내가 필요하다.
+        writeOutput("Restart or reload the OpenLog MCP server to apply this profile.");
+        return;
+    }
+    if (action === "reset" && args.length === 1) {
+        const permissions = await resetMcpPermissions();
+        writeOutput(formatPermissions(permissions));
+        writeOutput("Restart or reload the OpenLog MCP server to apply this profile.");
+        return;
+    }
+    throw new Error(permissionUsage());
+}
+export function permissionUsage() {
+    return `OpenLog MCP permissions
+
+Usage:
+  openlog mcp permissions
+  openlog mcp permissions show
+  openlog mcp permissions set read-only
+  openlog mcp permissions set safe-write
+  openlog mcp permissions set full
+  openlog mcp permissions reset`;
+}
+function formatPermissions(permissions) {
+    return [
+        `Profile: ${permissions.profile}`,
+        `Capabilities: ${permissions.capabilities.join(", ")}`,
+        `Source: ${permissions.configured ? "local config" : "default"}`,
+        ...(permissions.updatedAt ? [`Updated: ${permissions.updatedAt}`] : []),
+    ].join("\n");
+}

package/dist/mcp-permissions.js

@@ -0,0 +1,103 @@
+import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { getMcpConfigFilePath } from "./config.js";
+export const MCP_PERMISSION_PROFILES = [
+    "read-only",
+    "safe-write",
+    "full",
+];
+export const MCP_CAPABILITIES = ["read", "write", "publish", "delete"];
+export const DEFAULT_MCP_PERMISSION_PROFILE = "safe-write";
+const PROFILE_CAPABILITIES = {
+    // 프로필은 상위 프로필이 하위 capability를 모두 포함하도록 누적 구성한다.
+    "read-only": ["read"],
+    "safe-write": ["read", "write", "publish"],
+    full: ["read", "write", "publish", "delete"],
+};
+export async function readMcpPermissions() {
+    const filePath = getMcpConfigFilePath();
+    let content;
+    try {
+        content = await readFile(filePath, "utf8");
+    }
+    catch (error) {
+        if (hasErrorCode(error, "ENOENT")) {
+            // 설정 파일이 없는 최초 실행은 기존 동작과 호환되는 safe-write를 사용한다.
+            return resolvePermissions(DEFAULT_MCP_PERMISSION_PROFILE, false, null);
+        }
+        throw error;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch {
+        throw invalidConfigError(filePath, "file is not valid JSON");
+    }
+    const config = parsePermissionConfig(parsed, filePath);
+    return resolvePermissions(config.profile, true, config.updatedAt);
+}
+export async function writeMcpPermissionProfile(profile) {
+    const filePath = getMcpConfigFilePath();
+    const config = {
+        version: 1,
+        profile,
+        updatedAt: new Date().toISOString(),
+    };
+    await mkdir(path.dirname(filePath), { recursive: true, mode: 0o700 });
+    await writeFile(filePath, `${JSON.stringify(config, null, 2)}\n`, {
+        mode: 0o600,
+    });
+    // 기존 파일을 덮어쓸 때도 소유자만 읽고 쓸 수 있도록 권한을 다시 고정한다.
+    await chmod(filePath, 0o600);
+    return resolvePermissions(profile, true, config.updatedAt);
+}
+export async function resetMcpPermissions() {
+    await rm(getMcpConfigFilePath(), { force: true });
+    return resolvePermissions(DEFAULT_MCP_PERMISSION_PROFILE, false, null);
+}
+export function isMcpPermissionProfile(value) {
+    return MCP_PERMISSION_PROFILES.some((profile) => profile === value);
+}
+export function hasMcpCapability(permissions, capability) {
+    return permissions.capabilities.includes(capability);
+}
+function resolvePermissions(profile, configured, updatedAt) {
+    return {
+        profile,
+        capabilities: [...PROFILE_CAPABILITIES[profile]],
+        configured,
+        updatedAt,
+    };
+}
+function parsePermissionConfig(value, filePath) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw invalidConfigError(filePath, "root value must be an object");
+    }
+    const config = value;
+    if (config.version !== 1) {
+        throw invalidConfigError(filePath, "version must be 1");
+    }
+    if (typeof config.profile !== "string" ||
+        !isMcpPermissionProfile(config.profile)) {
+        throw invalidConfigError(filePath, `profile must be one of: ${MCP_PERMISSION_PROFILES.join(", ")}`);
+    }
+    if (typeof config.updatedAt !== "string" ||
+        !Number.isFinite(Date.parse(config.updatedAt))) {
+        throw invalidConfigError(filePath, "updatedAt must be an ISO date-time");
+    }
+    return {
+        version: 1,
+        profile: config.profile,
+        updatedAt: config.updatedAt,
+    };
+}
+function invalidConfigError(filePath, reason) {
+    return new Error(`Invalid OpenLog MCP config at ${filePath}: ${reason}. Run \`openlog mcp permissions reset\` to restore the safe-write default.`);
+}
+function hasErrorCode(error, code) {
+    return Boolean(error &&
+        typeof error === "object" &&
+        "code" in error &&
+        error.code === code);
+}

package/dist/mcp-server.js

@@ -4,81 +4,100 @@ import { z } from "zod";
 import { readAuthFile } from "./auth-store.js";
 import { createAuthenticatedApiClient } from "./authenticated-client.js";
 import { getApiBaseUrl, getWebBaseUrl } from "./config.js";
+import { readMcpPermissions, } from "./mcp-permissions.js";
+import { createContentPreview, McpToolRegistry, READ_TOOL_ANNOTATIONS, WRITE_TOOL_ANNOTATIONS, } from "./mcp-toolkit.js";
+import { registerWorkspaceTools } from "./mcp-workspace-tools.js";
 import { uploadPostImage } from "./post-image-upload.js";
-const WRITE_TOOL_ANNOTATIONS = {
-    readOnlyHint: false,
-    destructiveHint: false,
-    idempotentHint: false,
-    openWorldHint: true,
-};
-export async function runMcpServer() {
+export async function createOpenLogMcpServer(options = {}) {
+    // 의존성을 주입할 수 있는 factory로 구성해 실제 네트워크 없이 도구 목록과 호출을 테스트한다.
+    const permissions = options.permissions ?? (await readMcpPermissions());
+    const createClient = options.createAuthenticatedClient ?? createAuthenticatedApiClient;
+    const readAuth = options.readAuth ?? readAuthFile;
+    const uploadImage = options.uploadImage ?? uploadPostImage;
+    const apiBaseUrl = options.apiBaseUrl ?? getApiBaseUrl();
+    const webBaseUrl = options.webBaseUrl ?? getWebBaseUrl();
     const server = new McpServer({
         name: "openlog",
         version: "1.0.0",
     });
-    server.registerTool("get_auth_status", {
+    const registry = new McpToolRegistry(server, permissions, createClient);
+    registry.registerLocal("get_mcp_permissions", "read", {
+        title: "Get OpenLog MCP Permissions",
+        description: "Return the active local MCP permission profile and capabilities.",
+        inputSchema: {},
+        annotations: READ_TOOL_ANNOTATIONS,
+    }, async () => ({
+        ...permissions,
+        note: "This is a local agent safety policy, not a server-side authorization boundary.",
+    }));
+    registry.registerLocal("get_auth_status", "read", {
         title: "Get OpenLog Auth Status",
         description: "Check whether the local OpenLog CLI is authenticated.",
         inputSchema: {},
+        annotations: READ_TOOL_ANNOTATIONS,
     }, async () => {
-        let apiBaseUrl = getApiBaseUrl();
+        let resolvedApiBaseUrl = apiBaseUrl;
         try {
-            const authFile = await readAuthFile();
+            const authFile = await readAuth();
             if (!authFile) {
-                return textResult({
+                return {
                     authenticated: false,
-                    apiBaseUrl,
-                });
+                    apiBaseUrl: resolvedApiBaseUrl,
+                };
             }
-            apiBaseUrl = authFile.apiBaseUrl;
-            const me = await createAuthenticatedApiClient().then((client) => client.get("/auth/me"));
-            return textResult({
+            resolvedApiBaseUrl = authFile.apiBaseUrl;
+            const me = await createClient().then((client) => client.get("/auth/me"));
+            return {
                 authenticated: true,
                 apiBaseUrl: authFile.apiBaseUrl,
                 user: me,
-            });
+            };
         }
         catch (error) {
-            return textResult({
+            return {
                 authenticated: false,
-                apiBaseUrl,
+                apiBaseUrl: resolvedApiBaseUrl,
                 error: error instanceof Error ? error.message : String(error),
-            });
+            };
         }
     });
-    server.registerTool("get_me", {
+    registry.registerAuthenticated("get_me", "read", {
         title: "Get OpenLog Me",
         description: "Return the currently authenticated OpenLog user.",
         inputSchema: {},
-    }, async () => withAuthenticatedClient((client) => client.get("/auth/me")));
-    server.registerTool("list_my_notifications", {
+        annotations: READ_TOOL_ANNOTATIONS,
+    }, (client) => client.get("/auth/me"));
+    registry.registerAuthenticated("list_my_notifications", "read", {
         title: "List My OpenLog Notifications",
         description: "Return notifications for the authenticated OpenLog user.",
         inputSchema: {
             size: z.number().int().min(1).max(20).default(20),
         },
-    }, async ({ size }) => withAuthenticatedClient((client) => client.get(`/notifications?${new URLSearchParams({ size: String(size) })}`)));
-    server.registerTool("list_my_liked_posts", {
+        annotations: READ_TOOL_ANNOTATIONS,
+    }, (client, { size }) => client.get(`/notifications?${new URLSearchParams({ size: String(size) })}`));
+    registry.registerAuthenticated("list_my_liked_posts", "read", {
         title: "List My Liked OpenLog Posts",
         description: "Return posts liked by the authenticated OpenLog user.",
         inputSchema: {
             cursor: z.string().optional(),
             size: z.number().int().min(1).max(20).default(10),
         },
-    }, async ({ cursor, size }) => {
+        annotations: READ_TOOL_ANNOTATIONS,
+    }, (client, { cursor, size }) => {
         const params = new URLSearchParams({ size: String(size) });
         if (cursor) {
             params.set("cursor", cursor);
         }
-        return withAuthenticatedClient((client) => client.get(`/users/me/liked-posts?${params}`));
+        return client.get(`/users/me/liked-posts?${params}`);
     });
-    server.registerTool("list_my_posts", {
+    registry.registerAuthenticated("list_my_posts", "read", {
         title: "List My OpenLog Posts",
         description: "Return posts authored by the authenticated OpenLog user.",
         inputSchema: {
             size: z.number().int().min(1).max(100).default(20),
         },
-    }, async ({ size }) => withAuthenticatedClient(async (client) => {
+        annotations: READ_TOOL_ANNOTATIONS,
+    }, async (client, { size }) => {
         const me = await client.get("/auth/me");
         const username = me.username?.trim();
         if (!username) {
@@ -92,23 +111,22 @@ export async function runMcpServer() {
             hasMore: posts.length > size,
             posts: posts.slice(0, size),
         };
-    }));
-    server.registerTool("upload_post_image", {
+    });
+    registry.registerAuthenticated("upload_post_image", "write", {
         title: "Upload OpenLog Post Image",
         description: "Convert a local image file to WebP, upload it to OpenLog, and return markdown for post content.",
-        annotations: WRITE_TOOL_ANNOTATIONS,
         inputSchema: {
             filePath: z.string().min(1),
             altText: z.string().optional(),
         },
-    }, async ({ filePath, altText }) => withAuthenticatedClient((client) => uploadPostImage(client, {
+        annotations: WRITE_TOOL_ANNOTATIONS,
+    }, (client, { filePath, altText }) => uploadImage(client, {
         filePath,
         altText,
-    })));
-    server.registerTool("publish_post", {
+    }));
+    registry.registerAuthenticated("publish_post", "publish", {
         title: "Publish OpenLog Post",
-        description: "Publish a new post to the authenticated OpenLog account. Requires confirm: true unless skipConfirmation: true is explicitly provided.",
-        annotations: WRITE_TOOL_ANNOTATIONS,
+        description: "Publish a new post. Requires confirm: true unless skipConfirmation: true is explicitly provided.",
         inputSchema: {
             title: z.string().min(1),
             description: z.string().min(1),
@@ -123,7 +141,8 @@ export async function runMcpServer() {
             confirm: z.boolean().optional(),
             skipConfirmation: z.boolean().optional(),
         },
-    }, async ({ title, description, content, topics, links, confirm, skipConfirmation, }) => withAuthenticatedClient(async (client) => {
+        annotations: WRITE_TOOL_ANNOTATIONS,
+    }, async (client, { title, description, content, topics, links, confirm, skipConfirmation, }) => {
         const post = normalizePostInput({
             title,
             description,
@@ -131,6 +150,7 @@ export async function runMcpServer() {
             topics,
             links,
         });
+        // 명시적 확인 전에는 POST를 실행하지 않고 실제 발행 입력의 미리보기만 반환한다.
         if (confirm !== true && skipConfirmation !== true) {
             return {
                 requiresConfirmation: true,
@@ -150,38 +170,30 @@ export async function runMcpServer() {
         return {
             ...published,
             path: postPath,
-            url: new URL(postPath, `${getWebBaseUrl()}/`).toString(),
+            url: new URL(postPath, `${webBaseUrl}/`).toString(),
         };
-    }));
-    server.registerTool("push_working_brief", {
-        title: "Push OpenLog Working Brief",
-        description: "Overwrite the workspace Now Working brief with a short status update: what was done, what is still open, and optional task/branch context. Latest write wins.",
-        annotations: {
-            ...WRITE_TOOL_ANNOTATIONS,
-            idempotentHint: true,
-        },
-        inputSchema: {
-            workspaceId: z.number().int().positive(),
-            title: z.string().min(1).max(255),
-            prose: z.string().min(1),
-            taskId: z.number().int().positive().optional(),
-            branch: z.string().max(255).optional(),
-        },
-    }, async ({ workspaceId, title, prose, taskId, branch }) => withAuthenticatedClient((client) => client.put(`/workspaces/${workspaceId}/working-brief`, {
-        title,
-        prose,
-        taskId: taskId ?? null,
-        branch: branch ?? null,
-    })));
-    server.registerTool("get_post_detail", {
+    });
+    registry.registerAuthenticated("get_post_detail", "read", {
         title: "Get OpenLog Post Detail",
         description: "Return a public OpenLog post detail by author username and post slug.",
         inputSchema: {
             username: z.string().min(1),
             slug: z.string().min(1),
         },
-    }, async ({ username, slug }) => withAuthenticatedClient((client) => client.get(`/users/${encodeURIComponent(username)}/posts/${encodeURIComponent(slug)}`)));
-    await server.connect(new StdioServerTransport());
+        annotations: READ_TOOL_ANNOTATIONS,
+    }, (client, { username, slug }) => client.get(`/users/${encodeURIComponent(username)}/posts/${encodeURIComponent(slug)}`));
+    // 워크스페이스 도구는 별도 catalog에서 등록해 서버 시작 안내와 테스트 목록을 일치시킨다.
+    registerWorkspaceTools(registry, webBaseUrl);
+    return {
+        server,
+        permissions,
+        toolNames: [...registry.toolNames],
+    };
+}
+export async function runMcpServer() {
+    const created = await createOpenLogMcpServer();
+    printMcpStartupHint(created.permissions, created.toolNames);
+    await created.server.connect(new StdioServerTransport());
 }
 function normalizePostInput(input) {
     const title = input.title.trim();
@@ -225,38 +237,22 @@ function normalizeLinks(links) {
     }
     return normalized;
 }
-function createContentPreview(content) {
-    const preview = content.replace(/\s+/g, " ").trim();
-    return preview.length > 500 ? `${preview.slice(0, 497)}...` : preview;
-}
 function buildPublicPostPath(username, slug) {
     return `/@${encodeURIComponent(username)}/posts/${encodeURIComponent(slug)}`;
 }
-async function withAuthenticatedClient(callback) {
-    try {
-        const client = await createAuthenticatedApiClient();
-        const result = await callback(client);
-        return textResult(result);
-    }
-    catch (error) {
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: error instanceof Error ? error.message : String(error),
-                },
-            ],
-            isError: true,
-        };
+function printMcpStartupHint(permissions, toolNames) {
+    if (!process.stderr.isTTY) {
+        return;
     }
-}
-function textResult(value) {
-    return {
-        content: [
-            {
-                type: "text",
-                text: typeof value === "string" ? value : JSON.stringify(value, null, 2),
-            },
-        ],
-    };
+    console.error(`OpenLog MCP server is running over stdio.
+
+Profile: ${permissions.profile}
+Capabilities: ${permissions.capabilities.join(", ")}
+
+This terminal is now reserved for MCP protocol traffic.
+Press Ctrl+C to stop it.
+
+Available tools:
+${toolNames.map((name) => `  ${name}`).join("\n")}
+`);
 }