@koda-sl/baker-cli 0.158.1 → 0.159.0

package/README.md

@@ -2642,7 +2642,7 @@ baker mcp add --name mine --url https://my.dev/mcp --scope user
 baker mcp remove --name weather
 ```
 
-- `--url` must be HTTPS and public; loopback / private / cloud-metadata hosts are rejected.
+- `--url` must be the **full MCP endpoint** (commonly ending in `/mcp`), HTTPS and public; loopback / private / cloud-metadata hosts are rejected. A bare domain frequently accepts the OAuth sign-in and then serves no tools, so every address is handshake-checked after it changes: `connected` and `list` report `usable: false` plus a `problem` (and a `suggestedAddress` when the server advertises a better endpoint) for a server that isn't serving tools, or `lastCheck: failed` when the last check only hit an outage — that one may work anyway, and a later turn re-checks it automatically. Repointing a server at a different host clears its saved sign-in: a token belongs to the host that issued it, so the server has to be connected again.
 - Scope is two independent choices — audience (just you / everyone) × level (this company / whole org):
   - `--scope company` (default) — everyone in this company.
   - `--scope org` — everyone across the org; needs an admin API key.
@@ -4809,6 +4809,7 @@ baker brand fonts fetch "Inter" --subsets latin,latin-ext  # add accented-glyph
 - **Failures carry the numbers, so nothing needs a second call.** `check`'s error keeps the full per-family breakdown at `error.fix.families` (healthy families included, so a multi-family brand shows what not to touch), and both commands probe the standard weights to report the ones that *do* exist at `error.fix.served` — the remediation is "retry with one of these" rather than "run `check`", which would be the command that just failed.
 - **`fetch`** downloads the family into `src/brand/fonts/` and prints the `@font-face` block to paste above `@theme`. Defaults to the `latin` subset; `--subsets latin,latin-ext` adds accented-glyph coverage for Spanish and Portuguese copy. One file per weight *and* subset, since Google ships them separately and `unicode-range` is carried through verbatim.
 - **It does not edit `global.css` for you.** Paste the block, then drop that family from the Google `@import` — otherwise the page self-hosts *and* still calls Google. Record the weights in `src/brand/BRAND.md` in the same change.
+- **The emitted `src:` is relative to `global.css` (`../brand/fonts/…`) on purpose — keep it that way.** A root-relative `/src/brand/fonts/…` reads to the bundler as a path something else already serves, so the file never lands in the published build and every page 404s it. That failure is silent: an unfetchable face falls back to a system font, so the site just renders off-brand. Kept relative, the bundler resolves it on disk, content-hashes it, and ships it. The scaffold's `validate-public-asset-refs` blocks the root-relative form.
 - **Licensing:** Google Fonts are open-licensed and safe to self-host. A client's own commercial typeface is not — confirm before re-hosting one.
 
 Complements the offline `validate-brand-fonts` check that runs in the scaffold's `verify`: that one compares what `global.css` declares against what provides it, with no network. Only the network can answer whether Google really serves a given family and weight.

package/dist/cli.js

@@ -16618,7 +16618,10 @@ function fontFileName(face) {
   const style = face.style === "italic" ? "italic" : "";
   return `${family}-${face.weight}${style}-${face.subset}.woff2`;
 }
-function renderFontFaceCss(faces, hrefFor) {
+function fontFaceHref(face) {
+  return `../brand/fonts/${fontFileName(face)}`;
+}
+function renderFontFaceCss(faces) {
   return faces.map(
     (face) => [
       "@font-face {",
@@ -16626,7 +16629,7 @@ function renderFontFaceCss(faces, hrefFor) {
       `  font-style: ${face.style};`,
       `  font-weight: ${face.weight};`,
       "  font-display: swap;",
-      `  src: url('${hrefFor(face)}') format('woff2');`,
+      `  src: url('${fontFaceHref(face)}') format('woff2');`,
       ...face.unicodeRange ? [`  unicode-range: ${face.unicodeRange};`] : [],
       "}"
     ].join("\n")
@@ -16866,7 +16869,7 @@ var fontsFetchCommand = defineCommand86({
         explanation: "The font stylesheet resolved but the font files themselves did not download."
       });
     }
-    const fontFace = renderFontFaceCss(downloaded, (f) => `/${FONTS_DIR}/${fontFileName(f)}`);
+    const fontFace = renderFontFaceCss(downloaded);
     const downloadedWeights = [...new Set(downloaded.map((f) => f.weight))].sort((a, b) => a - b);
     const incomplete = weights.filter((w) => !downloadedWeights.includes(w));
     writeJson({
@@ -29491,6 +29494,20 @@ function parseScope(raw) {
 function actingUserId() {
   return getEnv().BAKER_ACTING_USER_ID;
 }
+function customEntry(server) {
+  const failed = server.health && !server.health.ok;
+  const problem = server.health?.message ?? "This server's address is not serving tools.";
+  return {
+    name: server.name,
+    scope: server.scope,
+    enabled: server.enabled,
+    ...failed && !server.health?.transient ? { usable: false, problem } : {},
+    ...failed && server.health?.transient ? { lastCheck: "failed", problem } : {},
+    ...failed && server.health?.suggestedUrl ? { suggestedAddress: server.health.suggestedUrl } : {}
+  };
+}
+var BROKEN_SERVER_HINT = "A server marked usable=false will NOT answer: its tools are absent from this turn. Say plainly that the tool is not working and relay `problem`; never claim its tools are loading, coming next message, or temporarily unavailable. Fixing it needs a person: the user updates its address in the dashboard (Brain \u2192 Integrations \u2192 MCPs). If `suggestedAddress` is present, that is the address to use.";
+var LAST_CHECK_FAILED_HINT = "A server with lastCheck=failed was unreachable or erroring when it was last checked \u2014 that may already have passed, and its tools ARE loaded this turn. Try the tool; if it works, say nothing about the check. If it fails, report `problem` as what happened rather than guessing.";
 function parseHeaders(raw) {
   const list = raw === void 0 ? [] : Array.isArray(raw) ? raw : [raw];
   const headers = {};
@@ -29537,8 +29554,14 @@ A tool the user names that is NOT listed here is simply not connected yet.`
         ...c.accountLabel ? { account: c.accountLabel } : {},
         ...c.readOnly ? { readOnly: true } : {}
       }));
-      const custom = data.custom.map((s) => ({ name: s.name, scope: s.scope, enabled: s.enabled }));
+      const custom = data.custom.map(customEntry);
       const hints = [];
+      if (data.custom.some((s) => s.health && !s.health.ok && !s.health.transient)) {
+        hints.push(BROKEN_SERVER_HINT);
+      }
+      if (data.custom.some((s) => s.health && !s.health.ok && s.health.transient)) {
+        hints.push(LAST_CHECK_FAILED_HINT);
+      }
       if (data.managedDisabled) {
         hints.push("Managed integrations are disabled for this company \u2014 only custom MCP servers load.");
       }
@@ -29574,7 +29597,15 @@ var listCommand13 = defineCommand139({
         "/api/mcp/custom",
         user ? { actingUserId: user } : void 0
       );
-      writeJson({ ok: true, data: data.servers });
+      writeJson({
+        ok: true,
+        // Detail view: the full row (address included) plus the usability verdict.
+        // `health` itself is folded into `usable`/`problem` by `customEntry`.
+        data: data.servers.map((server) => ({ ...server, health: void 0, ...customEntry(server) })),
+        ...data.servers.some((s) => s.health && !s.health.ok) ? {
+          hints: data.servers.some((s) => s.health && !s.health.ok && !s.health.transient) ? [BROKEN_SERVER_HINT] : [LAST_CHECK_FAILED_HINT]
+        } : {}
+      });
     } catch (err) {
       fail6(err);
     }
@@ -29585,7 +29616,11 @@ registerSchema({
   description: "Register a custom MCP server. Tools appear as mcp__<name>__* on the next message. URL must be HTTPS. Scope: company (default, all chats) | org (org admin key) | user (only the current sender).",
   args: {
     name: { type: "string", description: "Server name \u2192 tools appear as mcp__<name>__*", required: true },
-    url: { type: "string", description: "HTTPS MCP endpoint", required: true },
+    url: {
+      type: "string",
+      description: "Full HTTPS MCP endpoint (commonly ends in /mcp, not just the domain)",
+      required: true
+    },
     scope: { type: "string", description: "user | user_org | company | org (default company)", required: false },
     header: { type: "string", description: 'Auth header "Key: Value" (repeatable)', required: false }
   }
@@ -29604,7 +29639,11 @@ Examples:
   },
   args: {
     name: { type: "string", description: "Server name (mcp__<name>__*)", required: true },
-    url: { type: "string", description: "HTTPS MCP endpoint", required: true },
+    url: {
+      type: "string",
+      description: "Full HTTPS MCP endpoint (commonly ends in /mcp, not just the domain)",
+      required: true
+    },
     scope: { type: "string", description: "user | user_org | company | org (default company)", required: false },
     header: { type: "string", description: 'Auth header "Key: Value" (repeatable)', required: false }
   },
@@ -29620,7 +29659,14 @@ Examples:
         ...user ? { actingUserId: user } : {},
         ...headers ? { headers } : {}
       });
-      writeJson({ ok: true, data });
+      writeJson({
+        ok: true,
+        data,
+        hints: [
+          "The address must be the full MCP endpoint (commonly ending in /mcp), not just the domain \u2014 a domain on its own usually answers sign-in and then serves no tools.",
+          "The address is checked in the background. Run `baker mcp connected` on the next message to confirm it serves tools before promising the user anything."
+        ]
+      });
     } catch (err) {
       fail6(err);
     }