@levr-one/cli 0.7.0 → 0.7.2

package/dist/{addHandler-7QMKiy7o.js → addHandler-Brr4ndcR.js}

@@ -1044,6 +1044,11 @@ const KNOWN_MCP_URLS = {
 * deployments) derives `<api-url>/v1/mcp`.
 */
 function resolveMcpUrl(flagUrl) {
+	const resolved = resolveRaw(flagUrl);
+	assertUsableMcpUrl(resolved.url, resolved.source);
+	return resolved;
+}
+function resolveRaw(flagUrl) {
 	if (flagUrl) return {
 		url: stripSlash(flagUrl),
 		source: "flag"
@@ -1059,6 +1064,41 @@ function resolveMcpUrl(flagUrl) {
 		source: `derived:${apiUrl}`
 	};
 }
+/** Name the input the user has to change, not our internal source tag. */
+function sourceLabel(source) {
+	if (source === "flag") return "--url";
+	if (source === "env:LEVR_MCP_URL") return "LEVR_MCP_URL";
+	return `the API URL (${source.slice(8)})`;
+}
+/**
+* Reject a URL that must not reach a client config or a spawned CLI (ENG-4159).
+*
+* Three things this stops:
+*
+* 1. **No scheme.** `claude mcp add --transport http --scope user levr <value>`
+*    is spawned with fixed argv since ENG-4156, so a value like `--foo` is read
+*    by that CLI as a FLAG rather than as its URL operand — argument injection.
+*    Requiring a parseable absolute URL removes the shape entirely.
+* 2. **A non-http(s) scheme.** `file:` / `javascript:` is never a valid MCP
+*    endpoint, but would be written verbatim into every client's config.
+* 3. **Embedded credentials.** `https://user:pass@host` would be written into
+*    a config file — and since ENG-4151 a config file can be `--scope project`,
+*    which the user is told to COMMIT. That turns a bad URL into a secret in
+*    git history. MCP authenticates via OAuth in the browser; credentials in
+*    the URL are never needed.
+*/
+function assertUsableMcpUrl(url, source) {
+	const from = sourceLabel(source);
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new Error(`Invalid MCP URL from ${from}: ${JSON.stringify(url)} is not a URL. Expected an absolute http(s) URL, e.g. https://ai.levr.one/api/v1/mcp`);
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error(`Invalid MCP URL from ${from}: ${JSON.stringify(url)} uses "${parsed.protocol}" — only http and https are supported.`);
+	if (!parsed.hostname) throw new Error(`Invalid MCP URL from ${from}: ${JSON.stringify(url)} has no host.`);
+	if (parsed.username || parsed.password) throw new Error(`Invalid MCP URL from ${from}: ${JSON.stringify(url)} embeds credentials. They would be written into client config files — including project-scoped ones you are told to commit. Levr authenticates in the browser; remove the user:password@ prefix.`);
+}
 function knownMcpUrl(apiUrl) {
 	try {
 		return KNOWN_MCP_URLS[new URL(apiUrl).host];
@@ -1268,7 +1308,15 @@ const defaultDeps = {
 	install: defaultInstall
 };
 async function mcpAddHandler(flags) {
-	const { url, source } = resolveMcpUrl(flags.url);
+	let url;
+	let source;
+	try {
+		({url, source} = resolveMcpUrl(flags.url));
+	} catch (err) {
+		this.logger.error(err instanceof Error ? err.message : "Could not resolve the MCP URL.");
+		this.process.exitCode = 1;
+		return;
+	}
 	const clients = (flags.client ?? []).flatMap((c) => c.split(",").map((s) => s.trim()).filter(Boolean));
 	const options = {
 		all: flags.all,

package/dist/cli.js

@@ -172,7 +172,7 @@ Examples:
 		aliases: { y: "yes" }
 	},
 	loader: async () => {
-		const { mcpAddHandler } = await import("./addHandler-7QMKiy7o.js");
+		const { mcpAddHandler } = await import("./addHandler-Brr4ndcR.js");
 		return mcpAddHandler;
 	}
 });
@@ -210,7 +210,7 @@ Examples:
 		aliases: { d: "device-code" }
 	},
 	loader: async () => {
-		const { loginHandler } = await import("./loginHandler-BE8MQq83.js");
+		const { loginHandler } = await import("./loginHandler-BNmD3R0O.js");
 		return loginHandler;
 	}
 });
@@ -249,7 +249,7 @@ Examples:
 	},
 	parameters: {},
 	loader: async () => {
-		const { statusHandler } = await import("./statusHandler-C2_XOUal.js");
+		const { statusHandler } = await import("./statusHandler-ChymW9I9.js");
 		return statusHandler;
 	}
 });
@@ -361,7 +361,7 @@ Examples:
 		}
 	},
 	loader: async () => {
-		const { pushHandler } = await import("./pushHandler-Bf1F1Ltk.js");
+		const { pushHandler } = await import("./pushHandler-B0s2pHMU.js");
 		return pushHandler;
 	}
 });
@@ -473,7 +473,7 @@ Examples:
 		}
 	},
 	loader: async () => {
-		const { importHandler } = await import("./importHandler-D43Q8Jey.js");
+		const { importHandler } = await import("./importHandler-DhF7psRj.js");
 		return importHandler;
 	}
 });
@@ -494,7 +494,7 @@ Examples:
 	},
 	parameters: {},
 	loader: async () => {
-		const { listHandler } = await import("./listHandler-jEyTQhBk.js");
+		const { listHandler } = await import("./listHandler-hpPpE3WN.js");
 		return listHandler;
 	}
 });
@@ -527,7 +527,7 @@ Examples:
 		flags: {}
 	},
 	loader: async () => {
-		const { selectHandler } = await import("./selectHandler-KNiDUd9H.js");
+		const { selectHandler } = await import("./selectHandler-D4dL2zUJ.js");
 		return selectHandler;
 	}
 });
@@ -551,7 +551,7 @@ Examples:
 
 //#endregion
 //#region package.json
-var version = "0.7.0";
+var version = "0.7.2";
 
 //#endregion
 //#region src/app.ts

package/dist/{importHandler-D43Q8Jey.js → importHandler-DhF7psRj.js}

@@ -1,7 +1,7 @@
 import { getApiUrl } from "./env-CHeKHu5S.js";
-import { configureClient, testCaseImportCommitV1, testCaseImportPreviewV1 } from "./sdk-client-DKifoBwD.js";
+import { configureClient, testCaseImportCommitV1, testCaseImportPreviewV1 } from "./sdk-client-CMgf3JjV.js";
 import "./workspace-store-DDOxnut1.js";
-import { resolveWorkspace } from "./resolve-workspace-DfEX0LDh.js";
+import { resolveWorkspace } from "./resolve-workspace-CpmC9eWS.js";
 import "./token-refresh-Cu5RpkLJ.js";
 import { resolveToken } from "./resolve-token-DbQsmn03.js";
 import chalk from "chalk";

package/dist/{listHandler-jEyTQhBk.js → listHandler-hpPpE3WN.js}

@@ -1,5 +1,5 @@
 import "./env-CHeKHu5S.js";
-import { authGetSitesV1, configureClient } from "./sdk-client-DKifoBwD.js";
+import { authGetSitesV1, configureClient } from "./sdk-client-CMgf3JjV.js";
 import { loadWorkspace } from "./workspace-store-DDOxnut1.js";
 import "./token-refresh-Cu5RpkLJ.js";
 import { resolveToken } from "./resolve-token-DbQsmn03.js";

package/dist/{loginHandler-BE8MQq83.js → loginHandler-BNmD3R0O.js}

@@ -1,7 +1,7 @@
 import { CLI_CLIENT_ID, getApiUrl, getAuthUrl, setSessionApiUrl, writeCredentials } from "./env-CHeKHu5S.js";
-import { configureClient } from "./sdk-client-DKifoBwD.js";
+import { configureClient } from "./sdk-client-CMgf3JjV.js";
 import "./workspace-store-DDOxnut1.js";
-import { autoSelectWorkspace } from "./resolve-workspace-DfEX0LDh.js";
+import { autoSelectWorkspace } from "./resolve-workspace-CpmC9eWS.js";
 import chalk from "chalk";
 import { createHash, randomBytes } from "node:crypto";
 import { createServer } from "node:http";

package/dist/{pushHandler-Bf1F1Ltk.js → pushHandler-B0s2pHMU.js}

@@ -1,7 +1,7 @@
 import { getApiUrl, getAutomationSourceIdOverride, getSourceOverride, getTeamId } from "./env-CHeKHu5S.js";
-import { client, configureClient, uploadAutomationIngest, uploadImport } from "./sdk-client-DKifoBwD.js";
+import { client, configureClient, uploadAutomationIngest, uploadImport } from "./sdk-client-CMgf3JjV.js";
 import "./workspace-store-DDOxnut1.js";
-import { resolveWorkspace } from "./resolve-workspace-DfEX0LDh.js";
+import { resolveWorkspace } from "./resolve-workspace-CpmC9eWS.js";
 import "./token-refresh-Cu5RpkLJ.js";
 import { resolveToken } from "./resolve-token-DbQsmn03.js";
 import { readFileSync, statSync } from "node:fs";

package/dist/{resolve-workspace-DfEX0LDh.js → resolve-workspace-CpmC9eWS.js}

@@ -1,4 +1,4 @@
-import { authGetSitesV1 } from "./sdk-client-DKifoBwD.js";
+import { authGetSitesV1 } from "./sdk-client-CMgf3JjV.js";
 import { clearWorkspace, loadWorkspace, saveWorkspace } from "./workspace-store-DDOxnut1.js";
 
 //#region src/workspace/resolve-workspace.ts

package/dist/{sdk-client-DKifoBwD.js → sdk-client-CMgf3JjV.js}

@@ -49,7 +49,8 @@ const zResponseIssueDto = z.object({
 	deleted_by: z.string().nullable().describe(""),
 	archived_at: z.unknown().describe(""),
 	archived_by: z.string().nullable().describe(""),
-	auto_archived_at: z.unknown().describe("")
+	auto_archived_at: z.unknown().describe(""),
+	web_url: z.string().nullable().optional().describe("")
 });
 const zPaginatedMetaDocumented = z.object({
 	itemsPerPage: z.number(),
@@ -2896,7 +2897,8 @@ const zResponseAutomationRunDto = z.object({
 	deleted_at: z.unknown().describe(""),
 	deleted_by: z.string().nullable().describe(""),
 	archived_at: z.unknown().describe(""),
-	archived_by: z.string().nullable().describe("")
+	archived_by: z.string().nullable().describe(""),
+	web_url: z.string().nullable().optional().describe("")
 });
 const zUpdateAutomationRunDto = z.object({
 	id: z.string().optional().describe(""),
@@ -3312,7 +3314,8 @@ const zResponseAutomationRunResultDto = z.object({
 	deleted_at: z.unknown().describe(""),
 	deleted_by: z.string().nullable().describe(""),
 	archived_at: z.unknown().describe(""),
-	archived_by: z.string().nullable().describe("")
+	archived_by: z.string().nullable().describe(""),
+	web_url: z.string().nullable().optional().describe("")
 });
 const zUpdateAutomationRunResultDto = z.object({
 	id: z.string().optional().describe(""),
@@ -9947,7 +9950,8 @@ const zResponseCycleDto = z.object({
 	updated_by: z.string().describe(""),
 	workspace_id: z.string().describe(""),
 	deleted_at: z.unknown().describe(""),
-	deleted_by: z.string().nullable().describe("")
+	deleted_by: z.string().nullable().describe(""),
+	web_url: z.string().nullable().optional().describe("")
 });
 const zUpdateCycleDto = z.object({
 	id: z.string().optional().describe(""),
@@ -14921,7 +14925,8 @@ const zResponseGithubPullRequestDto = z.object({
 	epoch: z.number().describe(""),
 	created_by: z.string().describe(""),
 	updated_by: z.string().describe(""),
-	workspace_id: z.string().describe("")
+	workspace_id: z.string().describe(""),
+	web_url: z.string().nullable().optional().describe("")
 });
 const zGithubPullRequestFindAllV1Data = z.object({
 	query: z.object({
@@ -15278,7 +15283,8 @@ const zResponseInitiativeDto = z.object({
 	deleted_at: z.unknown().describe(""),
 	deleted_by: z.string().nullable().describe(""),
 	archived_at: z.unknown().describe(""),
-	archived_by: z.string().nullable().describe("")
+	archived_by: z.string().nullable().describe(""),
+	web_url: z.string().nullable().optional().describe("")
 });
 const zUpdateInitiativeDto = z.object({
 	id: z.string().optional().describe(""),
@@ -21213,7 +21219,8 @@ const zResponseProjectDto = z.object({
 	deleted_by: z.string().nullable().describe(""),
 	archived_at: z.unknown().describe(""),
 	archived_by: z.string().nullable().describe(""),
-	auto_archived_at: z.unknown().describe("")
+	auto_archived_at: z.unknown().describe(""),
+	web_url: z.string().nullable().optional().describe("")
 });
 const zUpdateProjectDto = z.object({
 	id: z.string().optional().describe(""),
@@ -27468,7 +27475,8 @@ const zResponseTeamDto = z.object({
 	deleted_at: z.unknown().describe(""),
 	deleted_by: z.string().nullable().describe(""),
 	archived_at: z.unknown().describe(""),
-	archived_by: z.string().nullable().describe("")
+	archived_by: z.string().nullable().describe(""),
+	web_url: z.string().nullable().optional().describe("")
 });
 const zUpdateTeamDto = z.object({
 	id: z.string().optional().describe(""),

package/dist/{selectHandler-KNiDUd9H.js → selectHandler-D4dL2zUJ.js}

@@ -1,5 +1,5 @@
 import "./env-CHeKHu5S.js";
-import { authGetSitesV1, configureClient } from "./sdk-client-DKifoBwD.js";
+import { authGetSitesV1, configureClient } from "./sdk-client-CMgf3JjV.js";
 import { saveWorkspace } from "./workspace-store-DDOxnut1.js";
 import "./token-refresh-Cu5RpkLJ.js";
 import { resolveToken } from "./resolve-token-DbQsmn03.js";

package/dist/{statusHandler-C2_XOUal.js → statusHandler-ChymW9I9.js}

@@ -1,5 +1,5 @@
 import { getApiUrl, getPatToken, readCredentials } from "./env-CHeKHu5S.js";
-import { authGetProfileV1, configureClient } from "./sdk-client-DKifoBwD.js";
+import { authGetProfileV1, configureClient } from "./sdk-client-CMgf3JjV.js";
 import { isTokenExpired } from "./token-refresh-Cu5RpkLJ.js";
 import chalk from "chalk";
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@levr-one/cli",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "The command-line interface for Levr",
   "type": "module",
   "license": "MIT",