@lyric_dev/data-loom 0.3.0 → 0.4.0

package/README.md

@@ -58,25 +58,28 @@ npm start            # serves the current directory's project
 
 ## Plan dependencies with your Claude (MCP server)
 
-DataLoom can also run as an **MCP server**, so your own Claude session determines and applies the order of interdependent proposals — DataLoom holds no API key and the reasoning runs under your authenticated Claude.
+The running daemon also **hosts an MCP server** over HTTP, so your own Claude session determines and applies the order of interdependent proposals — DataLoom holds no API key and the reasoning runs under your authenticated Claude. One registration serves **every** project; the target project is resolved per call (an explicit `project` argument, falling back to whatever the dashboard has selected).
 
-1. Register it in Claude Code (stdio server):
+1. Register it once, globally — no per-project setup:
 
    ```
-   claude mcp add data-loom -- npx @lyric_dev/data-loom mcp "C:\path\to\your\project"
+   claude mcp add --transport http --scope user data-loom http://127.0.0.1:4317/mcp
    ```
 
-   (From source: `node dist/index.js mcp "C:\path\to\project"`.)
+   The MCP server lives in the daemon, so **DataLoom must be running** for the tools to be reachable (start it with `npx @lyric_dev/data-loom "C:\path\to\your\project"`). It binds to loopback only.
 
-2. In that project, ask Claude something like *"review DataLoom's open proposals and set the dependencies."* On connect, the server asks Claude to surface any proposal that hasn't been reviewed for dependencies yet, propose the edges, and **confirm with you before writing**. It exposes three tools:
-   - `list_open_proposals` — the open changes with their proposal text, current phase/readiness, and dependency-review state (read-only; proposal text only, no secrets).
-   - `set_dependency(from, to)` — writes a `## Depends On` entry into a proposal.
-   - `mark_independent(change)` — records that a proposal genuinely depends on nothing, by writing an empty `## Depends On` block.
+2. In any project, ask Claude something like *"review DataLoom's open proposals and set the dependencies."* On connect, the server asks Claude to surface any proposal that hasn't been reviewed for dependencies yet, propose the edges, and **confirm with you before writing**. It exposes these tools:
+   - `list_projects` — the selectable OpenSpec workspaces plus the current selection (read-only), to discover/confirm a `project` path.
+   - `list_open_proposals(project?)` — the open changes with their proposal text, current phase/readiness, and dependency-review state (read-only; proposal text only, no secrets).
+   - `set_dependency(from, to, project?)` — writes a `## Depends On` entry into a proposal.
+   - `mark_independent(change, project?)` — records that a proposal genuinely depends on nothing, by writing an empty `## Depends On` block.
    - `install_weave_skill` — installs the `/loom:weave` shortcut command (one-time setup, see below).
 
    Each write is an explicit, reviewable `## Depends On` edit; the roadmap then recomputes deterministically. Proposals that still need a dependency decision are flagged in the roadmap with a **"needs review"** badge, and DataLoom appears as a server in its own MCP Topology tab once registered.
 
-3. **One command for it all: `/loom:weave`.** Ask Claude to *"install the weave skill"* (it calls `install_weave_skill`). That writes a `/loom:weave` slash command into your global Claude config (`~/.claude/commands/loom/weave.md`); reload Claude Code, and from then on `/loom:weave` runs the whole review — list, propose, confirm, apply — in any project where DataLoom is registered.
+3. **One command for it all: `/loom:weave`.** Ask Claude to *"install the weave skill"* (it calls `install_weave_skill`). That writes a `/loom:weave` slash command into your global Claude config (`~/.claude/commands/loom/weave.md`); reload Claude Code, and from then on `/loom:weave` runs the whole review — list, propose, confirm, apply — in any project, passing that project explicitly. (It needs the daemon running; if the tools aren't reachable it tells you to start DataLoom.)
+
+> **Upgrading from an earlier version?** The MCP server used to be a per-project stdio registration (`claude mcp add data-loom -- npx … mcp "<path>"`). That mode is gone. Remove any old per-project `data-loom` registrations and add the single user-scope HTTP one above.
 
 ## Design principles
 

package/dist/index.js

@@ -12,7 +12,6 @@ import { discover } from "./mcp/discovery.js";
 import { checkServer } from "./mcp/availability.js";
 import { discoverProjects, isViewableProject } from "./projects.js";
 import { resolvePublicDir } from "./assets.js";
-import { runMcpServer } from "./mcpServer.js";
 const host = "127.0.0.1";
 const port = Number(process.env.PORT ?? 4317);
 // Initial project: CLI argument, then DATA_LOOM_ROOT, then cwd.
@@ -52,6 +51,7 @@ async function main() {
         checkMcp,
         getProjects,
         selectProject,
+        getCurrentProject: () => session?.project ?? null,
     });
     console.log(`[data-loom] dashboard ready at http://${host}:${server.port}`);
     if (session)
@@ -141,17 +141,7 @@ function openBrowser(url) {
         /* non-fatal — the URL is already logged */
     }
 }
-if (process.argv[2] === "mcp") {
-    // MCP stdio server mode: `data-loom mcp [project]`
-    const project = resolve(process.argv[3] ?? process.env.DATA_LOOM_ROOT ?? process.cwd());
-    runMcpServer(project).catch((err) => {
-        console.error(err);
-        process.exit(1);
-    });
-}
-else {
-    main().catch((err) => {
-        console.error(err);
-        process.exit(1);
-    });
-}
+main().catch((err) => {
+    console.error(err);
+    process.exit(1);
+});

package/dist/mcpServer.js

@@ -1,27 +1,34 @@
-// data_loom as an MCP server: exposes the open proposals (read) and a
+// data_loom as an MCP server: exposes a project's open proposals (read) and a
 // dependency-writing action (write `## Depends On`) so an MCP client — the
 // user's own authenticated Claude — can determine and apply the order.
 // Holds no credentials; tools carry only proposal text and change names.
+//
+// Hosted by the dashboard daemon over Streamable-HTTP (see server.ts). A single
+// server serves every project: the target project is resolved per call from an
+// explicit `project` argument, falling back to the daemon's current dashboard
+// selection. The server holds no single project frozen for its lifetime.
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
 import { OpenSpecClient } from "./openspecClient.js";
 import { deriveModel } from "./derive.js";
+import { discoverProjects, isViewableProject } from "./projects.js";
 // Advertised to the client on connect. The "confirm before writing" gate lives
 // here, in the agent's behavior — the server cannot verify a human approved.
 const INSTRUCTIONS = `This server exposes a project's open OpenSpec proposals and lets you record the dependency order between them. It holds no model and cannot infer anything on its own — the judgment is yours and the decision is the user's.
 
-When you connect, call list_open_proposals and look at each proposal's "dependencyReview" field. For every proposal whose state is "pending" (it has no \`## Depends On\` declaration yet):
+It is hosted by the running DataLoom dashboard daemon and serves every project from one registration. Each tool takes an optional \`project\` (an absolute path); when omitted it acts on the project currently selected in the dashboard. Call list_projects to see the available OpenSpec workspaces. For automated/repeatable use, always pass \`project\` explicitly.
+
+When you connect, call list_open_proposals (passing the project you are working in) and look at each proposal's "dependencyReview" field. For every proposal whose state is "pending" (it has no \`## Depends On\` declaration yet):
   1. Read its proposal text alongside the others and reason about which changes it should be implemented after.
   2. PROPOSE the dependencies — or that it is independent — to the user in plain language, with your reasoning.
   3. Only AFTER the user confirms, record the result: call set_dependency(from, to) for each confirmed edge, or mark_independent(change) for a change that genuinely depends on nothing.
 
 Never write a dependency the user has not confirmed. Proposals already marked "declared" need no action.
 
-Tip: call install_weave_skill once to add a \`/loom:weave\` command (written to the user's global Claude config) that runs this whole review in one step; the user reloads Claude Code to pick it up.`;
+Tip: call install_weave_skill once to add a \`/loom:weave\` command (written to the user's global Claude config) that runs this whole review in one step; the user reloads Claude Code to pick it up. Register this server once, globally, with: claude mcp add --transport http --scope user data-loom http://127.0.0.1:4317/mcp`;
 // The `/loom:weave` slash command this server installs into the user's global
 // Claude commands dir. Static content that only orchestrates this server's tools.
 const WEAVE_COMMAND = `---
@@ -33,33 +40,64 @@ tags: [loom, dependencies, mcp, review]
 
 Weave the dependency order of this project's open OpenSpec proposals, using the **data-loom** MCP server.
 
-**Prerequisite:** the data-loom MCP server must be registered in this session — its tools are \`list_open_proposals\`, \`set_dependency\`, and \`mark_independent\`. If those tools are not available, tell the user to register it (\`claude mcp add data-loom -- npx @lyric_dev/data-loom mcp "<project path>"\`) and stop.
+**Prerequisite:** the DataLoom dashboard daemon must be running and the data-loom MCP server registered in this session — its tools are \`list_open_proposals\`, \`set_dependency\`, \`mark_independent\`, and \`list_projects\`. If those tools are not available, the daemon is almost certainly not running: tell the user to **start DataLoom** (\`npx @lyric_dev/data-loom "<project path>"\`) and, if they have not already, register it once with \`claude mcp add --transport http --scope user data-loom http://127.0.0.1:4317/mcp\`, then stop.
 
 Steps:
 
-1. Call \`list_open_proposals\` and note each proposal's \`dependencyReview\` state.
-2. Focus on the proposals whose state is \`pending\` (no \`## Depends On\` declaration yet). Proposals already \`declared\` need no action — leave them alone.
-3. Read the pending proposals alongside the others. Reason about which change should be implemented **after** which, from their capabilities and content: a change that extends or modifies what another change introduces depends on it; changes that touch disjoint areas are independent.
-4. **Propose** your conclusion to the user in plain language — for each pending proposal, the dependencies you would record (or that it is independent), each with a one-line reason. Do not write anything yet.
-5. **Wait for the user to confirm.** Never write a dependency the user has not approved.
-6. After the user confirms, record it:
-   - \`set_dependency(from, to)\` for each confirmed edge (the dependent is \`from\`).
-   - \`mark_independent(change)\` for a proposal the user confirms depends on nothing.
-7. Call \`list_open_proposals\` again and report the resulting phases — what moved, and what is now ready versus blocked.
+1. Determine this session's project — the absolute path of the current working directory — and pass it as the \`project\` argument to **every** tool call below, so the review is deterministic and acts on the project you are in (never on whatever the dashboard happens to be showing).
+2. Call \`list_open_proposals\` with that \`project\` and note each proposal's \`dependencyReview\` state.
+3. Focus on the proposals whose state is \`pending\` (no \`## Depends On\` declaration yet). Proposals already \`declared\` need no action — leave them alone.
+4. Read the pending proposals alongside the others. Reason about which change should be implemented **after** which, from their capabilities and content: a change that extends or modifies what another change introduces depends on it; changes that touch disjoint areas are independent.
+5. **Propose** your conclusion to the user in plain language — for each pending proposal, the dependencies you would record (or that it is independent), each with a one-line reason. Do not write anything yet.
+6. **Wait for the user to confirm.** Never write a dependency the user has not approved.
+7. After the user confirms, record it (passing the same \`project\` to each):
+   - \`set_dependency(from, to, project)\` for each confirmed edge (the dependent is \`from\`).
+   - \`mark_independent(change, project)\` for a proposal the user confirms depends on nothing.
+8. Call \`list_open_proposals\` again and report the resulting phases — what moved, and what is now ready versus blocked.
 
 The reasoning stays the user's to approve: you surface and apply, the user decides.
 `;
-export async function runMcpServer(project) {
-    const client = new OpenSpecClient(project);
-    const changesDir = join(project, "openspec", "changes");
-    const server = new Server({ name: "data-loom", version: "0.2.4" }, { capabilities: { tools: {} }, instructions: INSTRUCTIONS });
+const PROJECT_ARG = {
+    type: "string",
+    description: "Absolute path to the target OpenSpec project. Optional — defaults to the project currently selected in the DataLoom dashboard. Call list_projects to discover valid workspaces.",
+};
+/**
+ * Build a project-agnostic MCP server. A fresh instance is created per client
+ * session (see server.ts); all instances share the injected daemon state, so
+ * the dashboard selection is the single fallback source of project truth.
+ */
+export function createMcpServer(deps) {
+    const server = new Server({ name: "data-loom", version: "0.4.0" }, { capabilities: { tools: {} }, instructions: INSTRUCTIONS });
+    // Resolve the target project for a call: explicit arg, then dashboard
+    // selection, then an instructive error. Validated as a real workspace before
+    // any read or write.
+    const resolveProject = (explicit) => {
+        const raw = typeof explicit === "string" && explicit.trim() ? explicit : deps.getCurrentProject();
+        if (!raw) {
+            throw new Error("No `project` given and no project is selected in the DataLoom dashboard. Call list_projects to see the available OpenSpec workspaces, then pass one as the `project` argument.");
+        }
+        const abs = resolve(raw);
+        if (!isViewableProject(abs)) {
+            throw new Error(`${abs} is not an OpenSpec workspace (no openspec/ directory). Call list_projects to see the available workspaces.`);
+        }
+        return abs;
+    };
     server.setRequestHandler(ListToolsRequestSchema, async () => ({
         tools: [
             {
-                name: "list_open_proposals",
-                description: "List the open (non-archived) OpenSpec proposals for this project, each with its proposal text (Why / What Changes / Capabilities) and currently derived dependencies, phase, and readiness. Use this to reason about which proposals should be implemented after which.",
+                name: "list_projects",
+                description: "List the selectable projects — the OpenSpec workspaces discoverable from Claude Code's known projects, plus the dashboard's current selection. Read-only. Use it to discover and confirm a valid `project` path before calling a project-scoped tool.",
                 inputSchema: { type: "object", properties: {}, additionalProperties: false },
             },
+            {
+                name: "list_open_proposals",
+                description: "List the open (non-archived) OpenSpec proposals for the target project, each with its proposal text (Why / What Changes / Capabilities) and currently derived dependencies, phase, and readiness. Use this to reason about which proposals should be implemented after which.",
+                inputSchema: {
+                    type: "object",
+                    properties: { project: PROJECT_ARG },
+                    additionalProperties: false,
+                },
+            },
             {
                 name: "set_dependency",
                 description: "Declare that one open proposal depends on (should be implemented after) another by writing a `## Depends On` entry into the dependent's proposal. The roadmap then recomputes deterministically from that file.",
@@ -68,6 +106,7 @@ export async function runMcpServer(project) {
                     properties: {
                         from: { type: "string", description: "The dependent change (gets the `## Depends On` entry)" },
                         to: { type: "string", description: "The change it depends on" },
+                        project: PROJECT_ARG,
                     },
                     required: ["from", "to"],
                     additionalProperties: false,
@@ -80,6 +119,7 @@ export async function runMcpServer(project) {
                     type: "object",
                     properties: {
                         change: { type: "string", description: "The open change to mark as having no dependencies" },
+                        project: PROJECT_ARG,
                     },
                     required: ["change"],
                     additionalProperties: false,
@@ -87,28 +127,36 @@ export async function runMcpServer(project) {
             },
             {
                 name: "install_weave_skill",
-                description: "Install the `/loom:weave` slash command into the user's global Claude commands directory (~/.claude/commands/loom/weave.md), so this dependency review can be run as a single command from any project where this server is registered. Writes a static command file only (no project data or secrets) and overwrites any existing copy. Run once, then the user reloads Claude Code.",
+                description: "Install the `/loom:weave` slash command into the user's global Claude commands directory (~/.claude/commands/loom/weave.md), so this dependency review can be run as a single command from any project. Writes a static command file only (no project data or secrets) and overwrites any existing copy. Run once, then the user reloads Claude Code.",
                 inputSchema: { type: "object", properties: {}, additionalProperties: false },
             },
         ],
     }));
     server.setRequestHandler(CallToolRequestSchema, async (req) => {
         const { name, arguments: args } = req.params;
+        const a = (args ?? {});
         try {
+            if (name === "list_projects") {
+                return ok(await discoverProjects(deps.getCurrentProject() ?? ""));
+            }
+            if (name === "install_weave_skill") {
+                return ok(await installWeaveSkill());
+            }
+            // Project-scoped tools: resolve + validate the target, then act on it.
+            const project = resolveProject(a.project);
+            const client = new OpenSpecClient(project);
+            const changesDir = join(project, "openspec", "changes");
             if (name === "list_open_proposals") {
-                return ok(await listOpenProposals(client, changesDir));
+                return ok(await listOpenProposals(client, changesDir, project));
             }
             if (name === "set_dependency") {
-                const from = String(args?.from ?? "");
-                const to = String(args?.to ?? "");
-                return ok(await setDependency(client, changesDir, from, to));
+                const from = String(a.from ?? "");
+                const to = String(a.to ?? "");
+                return ok(await setDependency(client, changesDir, project, from, to));
             }
             if (name === "mark_independent") {
-                const change = String(args?.change ?? "");
-                return ok(await markIndependent(client, changesDir, change));
-            }
-            if (name === "install_weave_skill") {
-                return ok(await installWeaveSkill());
+                const change = String(a.change ?? "");
+                return ok(await markIndependent(client, changesDir, project, change));
             }
             return err(`unknown tool: ${name}`);
         }
@@ -116,9 +164,7 @@ export async function runMcpServer(project) {
             return err(e instanceof Error ? e.message : String(e));
         }
     });
-    await server.connect(new StdioServerTransport());
-    // Logs go to stderr so they don't corrupt the stdio JSON-RPC channel.
-    console.error(`[data-loom mcp] serving project ${project}`);
+    return server;
 }
 function ok(data) {
     return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
@@ -130,7 +176,7 @@ async function openChanges(client) {
     const model = await deriveModel(client);
     return model.changes.filter((c) => !c.archived);
 }
-async function listOpenProposals(client, changesDir) {
+async function listOpenProposals(client, changesDir, project) {
     const changes = await openChanges(client);
     const proposals = [];
     for (const c of changes) {
@@ -152,9 +198,9 @@ async function listOpenProposals(client, changesDir) {
             proposal, // proposal text only — never config, env, or secrets
         });
     }
-    return { proposals };
+    return { project, proposals };
 }
-async function setDependency(client, changesDir, from, to) {
+async function setDependency(client, changesDir, project, from, to) {
     if (!from || !to)
         throw new Error("both 'from' and 'to' are required");
     if (from === to)
@@ -170,9 +216,9 @@ async function setDependency(client, changesDir, from, to) {
     const written = updated !== text;
     if (written)
         await writeFile(path, updated);
-    return { from, to, written, dependsOn: await client.readProposalDependsOn(from) };
+    return { project, from, to, written, dependsOn: await client.readProposalDependsOn(from) };
 }
-async function markIndependent(client, changesDir, change) {
+async function markIndependent(client, changesDir, project, change) {
     if (!change)
         throw new Error("'change' is required");
     const names = new Set((await openChanges(client)).map((c) => c.name));
@@ -184,12 +230,12 @@ async function markIndependent(client, changesDir, change) {
     const written = updated !== text; // already declared -> idempotent no-op
     if (written)
         await writeFile(path, updated);
-    return { change, written, dependencyReview: "declared" };
+    return { project, change, written, dependencyReview: "declared" };
 }
 /**
  * Provision the `/loom:weave` command into the user's GLOBAL Claude commands
- * dir, so the review runs as one command from any project where this server is
- * registered. Writes only the static command file; overwrites in place.
+ * dir, so the review runs as one command from any project. Writes only the
+ * static command file; overwrites in place.
  */
 async function installWeaveSkill() {
     const dir = join(homedir(), ".claude", "commands", "loom");

package/dist/server.js

@@ -1,8 +1,12 @@
 // Serve the SPA on loopback and push roadmap + MCP + project state over a websocket.
 import { createServer } from "node:http";
+import { randomUUID } from "node:crypto";
 import { extname } from "node:path";
 import { WebSocketServer, WebSocket } from "ws";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 import { loadAsset } from "./assets.js";
+import { createMcpServer } from "./mcpServer.js";
 const MIME = {
     ".html": "text/html; charset=utf-8",
     ".js": "text/javascript; charset=utf-8",
@@ -11,7 +15,7 @@ const MIME = {
     ".svg": "image/svg+xml",
 };
 export async function startServer(opts) {
-    const { publicDir, host, port, getRoadmap, getMcp, checkMcp, getProjects, selectProject } = opts;
+    const { publicDir, host, port, getRoadmap, getMcp, checkMcp, getProjects, selectProject, getCurrentProject } = opts;
     let wss;
     const broadcast = (msg) => {
         const data = JSON.stringify(msg);
@@ -20,9 +24,56 @@ export async function startServer(opts) {
                 ws.send(data);
         }
     };
+    // One MCP server + transport per client session (stateful Streamable-HTTP),
+    // keyed by the session id. Each session's tools resolve their target project
+    // per call from getCurrentProject (see mcpServer.ts), so one daemon serves
+    // every project.
+    const mcpTransports = new Map();
+    const handleMcp = async (req, res) => {
+        const sessionId = req.headers["mcp-session-id"];
+        try {
+            if (req.method === "POST") {
+                const body = await readJsonBody(req);
+                let transport = sessionId ? mcpTransports.get(sessionId) : undefined;
+                if (!transport) {
+                    if (!isInitializeRequest(body)) {
+                        return sendError(res, 400, "missing or invalid mcp-session-id");
+                    }
+                    transport = new StreamableHTTPServerTransport({
+                        sessionIdGenerator: () => randomUUID(),
+                        onsessioninitialized: (sid) => {
+                            mcpTransports.set(sid, transport);
+                        },
+                    });
+                    transport.onclose = () => {
+                        if (transport.sessionId)
+                            mcpTransports.delete(transport.sessionId);
+                    };
+                    await createMcpServer({ getCurrentProject }).connect(transport);
+                }
+                await transport.handleRequest(req, res, body);
+                return;
+            }
+            if (req.method === "GET" || req.method === "DELETE") {
+                const transport = sessionId ? mcpTransports.get(sessionId) : undefined;
+                if (!transport)
+                    return sendError(res, 400, "missing or invalid mcp-session-id");
+                await transport.handleRequest(req, res);
+                return;
+            }
+            return sendError(res, 405, "method not allowed");
+        }
+        catch (e) {
+            if (!res.headersSent) {
+                sendError(res, 500, e instanceof Error ? e.message : "mcp error");
+            }
+        }
+    };
     const http = createServer(async (req, res) => {
         try {
             const url = new URL(req.url ?? "/", `http://${host}`);
+            if (url.pathname === "/mcp")
+                return handleMcp(req, res);
             if (url.pathname === "/api/model")
                 return sendJson(res, getRoadmap());
             if (url.pathname === "/api/mcp")
@@ -90,3 +141,21 @@ function sendError(res, code, message) {
     res.writeHead(code, { "content-type": MIME[".json"] });
     res.end(JSON.stringify({ error: message }));
 }
+/** Read and JSON-parse a request body; returns undefined for an empty body. */
+function readJsonBody(req) {
+    return new Promise((resolve, reject) => {
+        let data = "";
+        req.on("data", (chunk) => (data += chunk));
+        req.on("end", () => {
+            if (!data)
+                return resolve(undefined);
+            try {
+                resolve(JSON.parse(data));
+            }
+            catch (e) {
+                reject(e instanceof Error ? e : new Error("invalid JSON body"));
+            }
+        });
+        req.on("error", reject);
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lyric_dev/data-loom",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Local dashboard for spec-driven development: a phased OpenSpec roadmap (WHAT) and an MCP topology (HOW).",
   "type": "module",
   "license": "MIT",