@lineman-io/mcp 2.1.1 → 2.3.0

package/CHANGELOG.md

@@ -0,0 +1,76 @@
+# Changelog
+
+## 2.2.0
+
+### Minor Changes
+
+- [#418](https://github.com/lineman-io/lineman-mono/pull/418) [`3b3620a`](https://github.com/lineman-io/lineman-mono/commit/3b3620a9329622533a9dcb0a551cb82f876ca7df) Thanks [@grant-unwin](https://github.com/grant-unwin)! - Add `/lineman:auth` slash command for in-session authentication.
+
+  Wraps the existing device-code flow (`apps/lineman/mcp/src/auth.ts`) as a Claude Code skill so users no longer need to drop to a shell and run `npx lineman-mcp auth` to get a token. The new `auth` MCP tool is intentionally not auth-gated — it's the way users acquire auth.
+
+  Two-phase flow driven by the model's skill loop: first call returns the verification URL + user code + device code; subsequent calls with the device code poll the token endpoint and either return `pending`, `complete` (writes token to `~/.goodex/lineman.json`), or `expired`. Subsequent `assist` / `edit_file` tool calls pick up the token automatically without restarting the MCP server.
+
+  Companion to LIN-321 (Lineman Site homepage rewrite onto the plugin install path). The CLI `npx lineman-mcp auth` entry point remains for headless / scripted setups.
+
+## 2.1.1
+
+### Patch Changes
+
+- [#324](https://github.com/lineman-io/lineman-mono/pull/324) [`6b318a8`](https://github.com/lineman-io/lineman-mono/commit/6b318a82c15f83042d1932d12c5efa546245f0e6) Thanks [@grant-unwin](https://github.com/grant-unwin)! - Plugin marketplace install path now resolves through npm rather than a github-clone of `lineman-io/lineman-mono`.
+
+  `/plugin install lineman@lineman` previously cloned the repo and ran the committed `apps/lineman/mcp/dist/main.js`. The marketplace entry now points at the published `@lineman-io/mcp` package via the npm-source schema, so Claude Code installs the plugin straight from the npm registry. The npm tarball contents are unchanged from prior releases — this release exists so the install-path flip can be exercised end-to-end against a tagged version.
+
+  The accompanying repo cleanup retires `apps/lineman/mcp/dist/` git tracking and the `lineman-plugin-bundle.yml` workflow; one distribution surface (npm) is now authoritative.
+
+  Pre-launch posture is preserved: the package remains `access: "restricted"` on npm. Public-access flip is tracked separately under the **npm public flip** project (LIN-16, etc.).
+
+## 2.1.0
+
+### Minor Changes
+
+- [#295](https://github.com/lineman-io/lineman-mono/pull/295) [`b7f908f`](https://github.com/lineman-io/lineman-mono/commit/b7f908f3842f1da21f8d2f8781dded1b1d177ce4) Thanks [@grant-unwin](https://github.com/grant-unwin)! - Make the plugin survive a marketplace install with no `node_modules/`, and remove the dead channels feature scaffolding.
+
+  - **Hooks no longer crash on missing `@sentry/node`.** `hooks/sentry-hook.mjs` now loads Sentry via top-level dynamic import + try/catch, falling back to a no-op when the package isn't present. Was the static import that crashed every hook on every invocation under marketplace-install conditions.
+  - **MCP server no longer crashes on missing `@sentry/node`.** `src/sentry.ts` mirrors the same pattern with a no-op shim, so `Sentry.captureException(...)`, `Sentry.startSpan(...)`, and the other 14+ callsites in `src/server.ts` keep working without per-callsite null checks.
+  - **Plugin version is inlined at build time** via tsup's `define` instead of a runtime `package.json` read.
+  - **Channels feature removed.** The `claude/channel` capability declaration, the pending-prompt poller, the one-time channel tip, and the `checkChannelsCapability` doctor check have all been removed. The writer side of the pipeline was never built and the compression was a stub. Design intent + revisit conditions captured in `docs/claude/roadmap.md` under FA-P18 for when channels gets re-engaged.
+
+  Marketplace install requires `zod` to be available at runtime — solved by distributing this version via npm (which installs it as a normal dependency). Distribution from a github source remains broken pre-flip-to-public; FA-P19 in the roadmap captures the public-flip checklist.
+
+### Patch Changes
+
+- [#298](https://github.com/lineman-io/lineman-mono/pull/298) [`8d2381b`](https://github.com/lineman-io/lineman-mono/commit/8d2381b85bf129f8a88d3c6aa3143695ebfc2a7b) Thanks [@grant-unwin](https://github.com/grant-unwin)! - Fix runtime crash on `tools/list` after marketplace install: the MCP server bundled `@modelcontextprotocol/sdk` (with its transitive `zod` inlined) while our source's `zod` import resolved externally to `node_modules/zod`. Two distinct zod realms — schemas built with one couldn't pass MCP SDK's `instanceof ZodObject` checks, surfaced as `Cannot read properties of undefined (reading 'typeName')` from the `tools/list` handler.
+
+  Revert tsup's `noExternal` to workspace deps only (`@goodex/agent-core`, `@goodex/shared`); every npm dep stays external. Marketplace install brings deps via `npm install` once the package is distributed via npm (FA-P19). Verified locally: spawn `node start.mjs` against staging, `tools/list` returns `assist` + `edit_file` cleanly.
+
+## [Unreleased]
+
+### Removed
+
+- Channels feature scaffolding (`claude/channel` capability advertisement, `lineman-pending-prompt.json` poller in `src/main.ts`, `lineman-no-channels` first-call tip in `src/server.ts`, `checkChannelsCapability()` from `src/handlers/doctor.ts` and its tests). The writer side of the pipeline was never built and the compression was a stub, so the feature was inert. Design intent preserved in `docs/claude/roadmap.md` under FA-P18 for a future revisit.
+
+### Changed
+
+- `src/sentry.ts` and `hooks/sentry-hook.mjs` now load `@sentry/node` via dynamic import + try/catch and fall back to a no-op shim when the package is absent. Lets the plugin survive a marketplace install with no `node_modules/` (Sentry observability degrades silently instead of crashing every hook + the MCP server boot).
+- Plugin version is now inlined at build time via tsup's `define` (replaces the runtime `import.meta.dirname → package.json` lookup that wouldn't survive a CJS retarget).
+
+## [2.0.0] - 2026-04-23
+
+### Breaking
+
+- Package now ships as a Claude Code plugin. Install via `/plugin install lineman@lineman` instead of `claude mcp add`. See `MIGRATION.md` for upgrade steps.
+- MCP tool renamed from `lineman` to `assist`; full plugin-scoped name is `mcp__plugin_lineman_core__assist`.
+- Runtime files (`lineman-no-channels`, `lineman-pending-prompt.json`, `lineman-metrics.jsonl`) moved from `~/.goodex/` to `$CLAUDE_PLUGIN_DATA/`. Runtime state is now scoped to the plugin install; user config at `~/.goodex/lineman.json` is unchanged.
+
+### Added
+
+- `/lineman:doctor` slash command — diagnostic checklist (MCP reachable, token valid, tier recognized, hooks installed, channels capability, last-call latency).
+- `/lineman:stats` slash command — session token-savings stats with a by-task-type breakdown.
+- Auto-triggered `lineman` skill with trigger phrases for data-heavy tasks (large-file reads, error classification, build/test output triage, log analysis, grep ranking, diff summaries).
+- Core hook helpers under `apps/lineman/mcp/hooks/core/` (`routing.mjs`, `stdin.mjs`, `mcp-ready.mjs`, `tool-naming.mjs`).
+
+### Removed
+
+- `autoInstallHooks()` startup call and `install_hooks` MCP tool (`handleInstallHooks`). Hooks are now registered by the plugin from `hooks/hooks.json`.
+- Shell alias auto-injection into `~/.zshrc` / `~/.bashrc`.
+- `~/.goodex/lineman-hooks.json` sentinel — hooks use static constants.

package/README.md

@@ -10,15 +10,12 @@ The plugin bundles the MCP server, lifecycle hooks, and skills as a single unit:
 /plugin marketplace add lineman-io/lineman-mono
 /plugin install lineman@lineman
 /reload-plugins
+/lineman:auth
 ```
 
-Verify the install:
+`/lineman:auth` runs the device-code flow inside the Claude Code session — opens a browser, waits for confirmation, writes the token to `~/.goodex/lineman.json`. No shell drop required. The `npx lineman-mcp auth` CLI entry point still exists for headless / scripted setups.
 
-```
-/lineman:doctor
-```
-
-All checks should be green. If any fail, the command prints the remediation step inline (usually: run `npx lineman-mcp auth` to set an API token).
+Once authenticated, `/lineman:doctor` runs a diagnostic checklist (MCP reachable, token valid, tier recognised, hooks installed, last-call latency). Tracked separately as LIN-320 — the doctor + stats MCP tools were dropped in the 2026-04-25 context-mode revert and are pending reactivation.
 
 ## Install (alternative — MCP only)
 
@@ -39,12 +36,13 @@ This gives you a callable tool but no automatic routing — you must invoke Line
 
 Once the plugin is installed, the `lineman` skill auto-loads when your prompt matches a data-heavy trigger ("read the file", "classify error", "summarize build output", etc.) and routes the work through `mcp__plugin_lineman_core__assist`. Results come back tagged `[[LM_SUMMARY]]` / `[[LM_VERBATIM]]` / `[[LM_CONTEXT]]` / `[[LM_RESULT]]` and should be treated as authoritative.
 
-Two user-invocable slash commands:
+User-invocable slash commands:
 
 | Command | Purpose |
 |---------|---------|
-| `/lineman:doctor` | Diagnostic checklist — MCP reachable, token valid, tier recognized, hooks installed, channels capability, last-call latency. |
-| `/lineman:stats` | Session metrics — total `assist` calls, input tokens saved, output tokens consumed, average latency, savings ratio, and a by-task-type breakdown. |
+| `/lineman:auth` | Run the device-code flow to acquire and save an API token. Required once per machine before `assist` / `edit_file` will work. |
+| `/lineman:doctor` | Diagnostic checklist — MCP reachable, token valid, tier recognized, hooks installed, channels capability, last-call latency. *Pending reactivation, see LIN-320.* |
+| `/lineman:stats` | Session metrics — total `assist` calls, input tokens saved, output tokens consumed, average latency, savings ratio, and a by-task-type breakdown. *Pending reactivation, see LIN-320.* |
 
 ## Configuration
 
@@ -68,10 +66,38 @@ Environment variables take precedence:
 
 ### Auth at use time
 
-Lineman MCP tools (`assist`, `edit_file`) always register, even before authentication. Tool calls return a structured `not_authenticated` error envelope (`{ error: { reason: "not_authenticated", message, auth_url } }`) until `LINEMAN_API_TOKEN` is set (or `apiToken` is written to `~/.goodex/lineman.json` via `npx lineman-mcp auth`). This means a fresh `claude --plugin-dir apps/lineman-mcp` session always sees the tools listed — the model gets a clear, actionable error pointing at the auth flow rather than silently missing tools — and the moment the env var lands, subsequent tool calls succeed without restarting the MCP server.
+Lineman MCP tools (`assist`, `edit_file`) always register, even before authentication. Tool calls return a structured `not_authenticated` error envelope (`{ error: { reason: "not_authenticated", message, auth_url } }`) until `LINEMAN_API_TOKEN` is set (or `apiToken` is written to `~/.goodex/lineman.json` via `npx lineman-mcp auth`). This means a fresh `claude --plugin-dir apps/lineman/mcp` session always sees the tools listed — the model gets a clear, actionable error pointing at the auth flow rather than silently missing tools — and the moment the env var lands, subsequent tool calls succeed without restarting the MCP server.
 
 Runtime state (metrics, sentinels, pending prompts) is written to `$CLAUDE_PLUGIN_DATA/` by the plugin — not to `~/.goodex/`. In dev / tests without Claude Code present, it falls back to `$TMPDIR/lineman/`.
 
+## Telemetry
+
+Lineman MCP sends a small, anonymous stream of operational telemetry to Sentry so we can detect outages, fix bugs, and measure activation. We **never** send raw prompts, source code, file contents, or environment variable values.
+
+What we do send:
+
+- A stable per-machine UUID (`lineman_install_id`) generated on first launch. Not tied to your identity until you authenticate.
+- After authentication, your Lineman user id (`user_id` from the signed claim).
+- Tool-call telemetry: tool name, task type, latency, byte counts, savings estimates, error class.
+- Activation events: `mcp.first_run`, `mcp.auth_link_clicked`, `mcp.auth_completed`, `mcp.upgraded`.
+- Operating system, Node version, MCP version, runtime host (claude-code / aider / continue / unknown).
+
+What we strip before send:
+
+- All absolute file paths are rewritten — `/Users/<you>/...` and `/home/<you>/...` are replaced with `~`.
+- Stack-frame variables named `prompt`, `content`, `code`, `summary`, `messages`, `body`, `input`, or anything matching `KEY|TOKEN|SECRET|PASSWORD|API|AUTH|CREDENTIAL` are blanked.
+- HTTP request bodies are blanked wholesale.
+
+### Disabling telemetry
+
+Set `LINEMAN_TELEMETRY=off` (or `0` / `false` / `no`) in your shell environment. The MCP will skip Sentry initialisation entirely — no SDK loaded, no events emitted, no install_id sent.
+
+```sh
+export LINEMAN_TELEMETRY=off
+```
+
+A first-class plugin setting + slash command for this is tracked in LIN-524.
+
 ## Troubleshooting
 
 Run `/lineman:doctor`. It probes the MCP server, the API token, the configured tier, hook installation, channels capability, and last-call latency, and prints `fail` entries with actionable details (e.g. "no API token in ~/.goodex/lineman.json"). If everything is green but results look wrong, check `$CLAUDE_PLUGIN_DATA/lineman-metrics.jsonl` for per-call records.