@manudota/artist-mcp 1.5.2 → 1.5.3-staging.76

package/dist/audit.d.ts

@@ -12,6 +12,17 @@
  * since it defends against forgetting rather than against the user.
  */
 export declare const auditPath: () => string;
+/**
+ * Where a completed write is recorded.
+ *
+ * Injected for the same reason the token resolver is: on this machine it is a
+ * file in the user's home directory, and hosted it is a row bound to one user.
+ * A file on a serverless host is one nobody will ever read, and "detectable and
+ * reversible" is the whole justification for these writes existing — so the
+ * sink has to be the caller's to choose. See
+ * docs/decisions/0002-hosted-writes.md.
+ */
+export type RecordWrite = (entry: WriteRecord) => Promise<void>;
 export type WriteRecord = {
     operation: string;
     /** What was written, as the user would read it back. */

package/dist/calendar.d.ts

@@ -6,6 +6,7 @@
  * and recurring series — are both cases where the obvious code returns
  * something plausible and wrong, so they moved across unchanged.
  */
+import { type RecordWrite } from './audit.js';
 type CalendarTime = {
     dateTime?: string;
     date?: string;
@@ -227,7 +228,7 @@ export declare function previewEvent(token: string, params: Record<string, unkno
  * inexpressible too. It does not prove a person read the preview, and no part
  * of this protocol can.
  */
-export declare function createEvent(token: string, params: Record<string, unknown>): Promise<{
+export declare function createEvent(token: string, params: Record<string, unknown>, record?: RecordWrite): Promise<{
     created: {
         id: string;
         summary: string;
@@ -259,7 +260,7 @@ export declare function previewDeleteEvent(token: string, params: Record<string,
  * notices absence — so what is written down has to be enough to put it back by
  * hand once Google's 30-day bin has expired.
  */
-export declare function deleteEvent(token: string, params: Record<string, unknown>): Promise<{
+export declare function deleteEvent(token: string, params: Record<string, unknown>, record?: RecordWrite): Promise<{
     deleted: string;
     calendar_id: string;
     event_id: string;

package/dist/calendar.js

@@ -470,7 +470,7 @@ const describeDuplicate = async (token, calendarId, eventId) => {
  * inexpressible too. It does not prove a person read the preview, and no part
  * of this protocol can.
  */
-export async function createEvent(token, params) {
+export async function createEvent(token, params, record = recordWrite) {
     const draft = draftFrom(params);
     refuseUnsettled(draft);
     const supplied = typeof params.confirmation_token === 'string' ? params.confirmation_token : '';
@@ -514,7 +514,7 @@ export async function createEvent(token, params) {
     // the write another way leaves no trace at all — which is exactly what
     // happened the first time this was run against a real calendar. The audit has
     // to sit where the event is created or it is not an audit.
-    await recordWrite({
+    await record({
         operation: 'create_calendar_event',
         summary: renderDraft(draft),
         target: `${draft.calendar_id}/${created.id ?? 'unknown'}`,
@@ -631,7 +631,7 @@ export async function previewDeleteEvent(token, params) {
  * notices absence — so what is written down has to be enough to put it back by
  * hand once Google's 30-day bin has expired.
  */
-export async function deleteEvent(token, params) {
+export async function deleteEvent(token, params, record = recordWrite) {
     const calendarId = typeof params.calendar_id === 'string' && params.calendar_id.trim()
         ? params.calendar_id.trim()
         : 'primary';
@@ -646,13 +646,13 @@ export async function deleteEvent(token, params) {
             : 'The confirmation_token does not match this event. It has changed since ' +
                 'the preview, so preview again and show the musician what is there now.');
     }
-    const record = renderExisting(event, calendarId);
+    const written = renderExisting(event, calendarId);
     await calendarDeleteEvent(calendarId, eventId, token);
-    await recordWrite({
+    await record({
         operation: 'delete_calendar_event',
-        summary: record,
+        summary: written,
         target: `${calendarId}/${eventId}`,
         source_page: typeof params.source_page === 'string' ? params.source_page : null,
     });
-    return { deleted: record, calendar_id: calendarId, event_id: eventId };
+    return { deleted: written, calendar_id: calendarId, event_id: eventId };
 }

package/dist/dispatch.d.ts

@@ -10,6 +10,7 @@
  * Google connection has to be reported as such rather than surfacing as an
  * unrelated Microsoft error.
  */
+import { type RecordWrite } from './audit.js';
 import { type ProviderName } from './tokens.js';
 /**
  * Every operation this server can carry out, with its provider and its effect.
@@ -109,6 +110,6 @@ export declare const connectedProviders: () => Promise<ProviderName[]>;
  * stated once regardless of where the token was found.
  */
 export type ResolveToken = (provider: ProviderName) => Promise<string>;
-export declare const dispatchWith: (resolve: ResolveToken) => <T>(op: Operation, params?: Record<string, unknown>) => Promise<T>;
+export declare const dispatchWith: (resolve: ResolveToken, record?: RecordWrite) => <T>(op: Operation, params?: Record<string, unknown>) => Promise<T>;
 /** The local dispatcher: this machine's own connections, one process, one user. */
 export declare const call: <T>(op: Operation, params?: Record<string, unknown>) => Promise<T>;

package/dist/dispatch.js

@@ -11,6 +11,7 @@
  * unrelated Microsoft error.
  */
 import { GraphError } from './client.js';
+import { recordWrite } from './audit.js';
 import { mapAttachment, readAttachment } from './attachments.js';
 import { createEvent, deleteEvent, listCalendars, listEvents, previewDeleteEvent, previewEvent, readEvent, } from './calendar.js';
 import { listEmails, readEmail } from './mail.js';
@@ -72,7 +73,7 @@ export const connectedProviders = async () => {
     const { providers } = await loadTokens();
     return Object.keys(providers).filter((name) => providers[name] !== undefined);
 };
-export const dispatchWith = (resolve) => async (op, params = {}) => {
+export const dispatchWith = (resolve, record = recordWrite) => async (op, params = {}) => {
     const token = await resolve(PROVIDER_FOR[op]);
     switch (op) {
         case 'list_notes':
@@ -98,11 +99,11 @@ export const dispatchWith = (resolve) => async (op, params = {}) => {
         case 'preview_calendar_event':
             return (await previewEvent(token, params));
         case 'create_calendar_event':
-            return (await createEvent(token, params));
+            return (await createEvent(token, params, record));
         case 'preview_calendar_delete':
             return (await previewDeleteEvent(token, params));
         case 'delete_calendar_event':
-            return (await deleteEvent(token, params));
+            return (await deleteEvent(token, params, record));
         case 'list_calendars':
             // No parameters by design: the whole value is knowing the full set, and
             // a filtered list of what exists is the reach problem again.

package/dist/grants.d.ts

@@ -43,21 +43,25 @@ export declare const isWriteCapability: (value: unknown) => value is WriteCapabi
  * the tool they wanted was missing.
  */
 export declare const parseGrants: (raw: string | undefined) => WriteCapability[];
-export declare const setGrants: (capabilities: readonly WriteCapability[]) => void;
-export declare const grantedWrites: () => readonly WriteCapability[];
 /**
- * Whether a write tool may be registered at all.
+ * Whether a write tool may be registered, given what this caller was granted.
  *
- * Registration, not refusal at call time. A tool that exists is a tool a model
+ * A parameter, not module state. One stdio process serves one user and could
+ * safely hold it in a variable; the hosted route serves many users from one
+ * process, where a grant set per request would let one user's capability reach
+ * another's session. That failure would pass every test here, because every
+ * test runs one user at a time — so the shape has to prevent it rather than the
+ * discipline. See docs/decisions/0001-opt-in-calendar-writes.md.
+ *
+ * Registration, not refusal at call time: a tool that exists is a tool a model
  * will try, and a refusal inside a tool result reads as an obstacle to route
- * around rather than as a boundary — so an ungranted write tool is absent, not
- * present and saying no.
+ * around rather than as a boundary.
  */
-export declare const isGranted: (capability: WriteCapability) => boolean;
+export declare const isGranted: (grants: readonly WriteCapability[], capability: WriteCapability) => boolean;
 /**
  * How the grant is described wherever it is reported: `init`, `agents status`,
  * and the workflow briefing. A capability nobody can see is one nobody accounts
  * for, which is the handshake bug again — a correct thing that never reached
  * the client.
  */
-export declare const describeGrants: () => string;
+export declare const describeGrants: (grants: readonly WriteCapability[]) => string;

package/dist/grants.js

@@ -68,36 +68,30 @@ export const parseGrants = (raw) => {
     return [...new Set(named)];
 };
 /**
- * What this process may do, decided once at startup.
+ * Whether a write tool may be registered, given what this caller was granted.
  *
- * Module state for the same reason the playbook root is: the server is spawned
- * by Claude Desktop with whatever `init` wrote, and nothing downstream should
- * be re-deriving the answer or able to widen it later.
- */
-let granted = [];
-export const setGrants = (capabilities) => {
-    granted = [...capabilities];
-};
-export const grantedWrites = () => granted;
-/**
- * Whether a write tool may be registered at all.
+ * A parameter, not module state. One stdio process serves one user and could
+ * safely hold it in a variable; the hosted route serves many users from one
+ * process, where a grant set per request would let one user's capability reach
+ * another's session. That failure would pass every test here, because every
+ * test runs one user at a time — so the shape has to prevent it rather than the
+ * discipline. See docs/decisions/0001-opt-in-calendar-writes.md.
  *
- * Registration, not refusal at call time. A tool that exists is a tool a model
+ * Registration, not refusal at call time: a tool that exists is a tool a model
  * will try, and a refusal inside a tool result reads as an obstacle to route
- * around rather than as a boundary — so an ungranted write tool is absent, not
- * present and saying no.
+ * around rather than as a boundary.
  */
-export const isGranted = (capability) => granted.includes(capability);
+export const isGranted = (grants, capability) => grants.includes(capability);
 /**
  * How the grant is described wherever it is reported: `init`, `agents status`,
  * and the workflow briefing. A capability nobody can see is one nobody accounts
  * for, which is the handshake bug again — a correct thing that never reached
  * the client.
  */
-export const describeGrants = () => {
-    if (granted.length === 0) {
+export const describeGrants = (grants) => {
+    if (grants.length === 0) {
         return 'Writes: none. This install can only read.';
     }
-    const lines = granted.map((name) => `  - ${name}: ${WRITE_CAPABILITIES[name]}`);
+    const lines = grants.map((name) => `  - ${name}: ${WRITE_CAPABILITIES[name]}`);
     return `Writes granted to this install:\n${lines.join('\n')}`;
 };

package/dist/index.js

@@ -3,7 +3,7 @@ import { runInit, runUninstall } from './init.js';
 import { runServer } from './server.js';
 import { installAgentPack, runAgentsStatus, setLocalAgentRoot } from './agents.js';
 import { runConnect, runDisconnect, runStatus } from './connect.js';
-import { isWriteCapability, parseGrants, setGrants } from './grants.js';
+import { isWriteCapability, parseGrants } from './grants.js';
 const argv = process.argv.slice(2);
 /**
  * Pull an option and its value out of the arguments wherever they appear.
@@ -67,10 +67,9 @@ try {
             // only way the server learns where a user's playbooks live: there is no
             // cwd here worth trusting.
             setLocalAgentRoot(agentsDir || undefined);
-            // Decided once, before any tool is registered. An ungranted write tool is
-            // never built, rather than built and refusing.
-            setGrants(grants);
-            await runServer();
+            // Handed in, not stashed. An ungranted write tool is never built, rather
+            // than built and refusing.
+            await runServer(grants);
             break;
         case 'init':
             if (argv[1] && argv[1] !== '--local') {

package/dist/init.js

@@ -5,7 +5,7 @@ import { isStagingVersion, packageVersion } from "./client.js";
 import { sep } from "node:path";
 import { configPath, ENTRY_NAME, readConfig, writeConfig } from "./config.js";
 import { connectedProviders } from "./dispatch.js";
-import { describeGrants, setGrants } from "./grants.js";
+import { describeGrants } from "./grants.js";
 const PACKAGE = "@manudota/artist-mcp";
 const LOCAL_ENTRY = fileURLToPath(new URL("./index.js", import.meta.url));
 /**
@@ -84,8 +84,7 @@ export const runInit = async ({ local = false, editableDir, grants = [], } = {})
     // accounts for, and the useful line is the one that appears when the answer
     // is "none" — that is what tells a user their install is still read-only.
     console.log("");
-    setGrants(grants);
-    console.log(describeGrants());
+    console.log(describeGrants(grants));
     if (grants.length > 0) {
         console.log("Reconnect Google so the grant is on the token: `artist-mcp connect google`. " +
             "A refresh token carries the scopes it was granted with, so an existing " +

package/dist/server.d.ts

@@ -1,4 +1,5 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { type WriteCapability } from "./grants.js";
 import { type ResolvedEntry } from "./agents.js";
 import { type Operation } from "./dispatch.js";
 /**
@@ -18,11 +19,11 @@ type Dispatch = <T>(op: Operation, params?: Record<string, unknown>) => Promise<
  */
 declare const renderWorkflowBriefing: (entries: ResolvedEntry[], load: (id: string) => Promise<{
     content: string;
-}>) => Promise<string>;
-declare const createServer: (call: Dispatch) => Promise<McpServer>;
+}>, writes?: readonly WriteCapability[]) => Promise<string>;
+declare const createServer: (call: Dispatch, grants?: readonly WriteCapability[]) => Promise<McpServer>;
 /**
  * The stdio entry point, unchanged in behaviour: one process, one user, tokens
  * from this machine. It is now the only place that knows about stdio.
  */
-declare const runServer: () => Promise<void>;
+declare const runServer: (grants?: readonly WriteCapability[]) => Promise<void>;
 export { createServer, renderWorkflowBriefing, runServer, type Dispatch };

package/dist/server.js

@@ -2,7 +2,7 @@ import { join } from "node:path";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
-import { WRITE_CAPABILITIES, grantedWrites, isGranted } from "./grants.js";
+import { WRITE_CAPABILITIES, isGranted } from "./grants.js";
 import { listAgentWorkflows, loadAgentWorkflow } from "./agents.js";
 import { GraphError } from "./client.js";
 import { call as localCall } from "./dispatch.js";
@@ -103,7 +103,7 @@ const selectNotebook = async (call, notebook, tool) => {
         : null;
     return { pages, scope };
 };
-const serverVersion = '1.5.2'; // x-release-please-version
+const serverVersion = '1.5.3-staging.76'; // x-release-please-version
 const errorResult = (err) => {
     const message = err instanceof GraphError ? err.message : `Unexpected error: ${err}`;
     return { content: [{ type: "text", text: message }], isError: true };
@@ -115,7 +115,7 @@ const errorResult = (err) => {
  * tampering with the installed pack, which is how it was found in the first
  * place.
  */
-const renderWorkflowBriefing = async (entries, load) => {
+const renderWorkflowBriefing = async (entries, load, writes = []) => {
     // A one-line summary is enough to pick a role to load, but not to
     // classify a page: the rules that separate one project type from
     // another live in the body of the file. Intake is here for the same
@@ -214,7 +214,6 @@ const renderWorkflowBriefing = async (entries, load) => {
     // seven roles and six policies, so a session must be told plainly when it is
     // no longer true. The "none" line matters most: it is what keeps every
     // read-only install saying the same thing it always said.
-    const writes = grantedWrites();
     const capabilities = writes.length === 0
         ? [
             "# What this install may change",
@@ -251,8 +250,7 @@ const renderWorkflowBriefing = async (entries, load) => {
  * Derived, never restated. An install with no grant says so too — that line is
  * the one that keeps a read-only install describing itself correctly.
  */
-const capabilityLine = () => {
-    const writes = grantedWrites();
+const capabilityLine = (writes) => {
     if (writes.length === 0) {
         return (" This install can only read. It cannot create, change or delete " +
             "anything in OneNote, Gmail or Google Calendar, and must never offer to.");
@@ -263,7 +261,7 @@ const capabilityLine = () => {
         "this server as read-only while any write is granted, and never write a " +
         "value the notebook has not settled.");
 };
-const createServer = async (call) => {
+const createServer = async (call, grants = []) => {
     // Nothing is checked here on purpose. The server starts whether or not a
     // provider is connected, and a tool that needs one says so when it is called:
     // refusing to start would leave Claude Desktop reporting a broken server
@@ -302,7 +300,7 @@ const createServer = async (call) => {
         // This is not the third copy of the rules that drifted in AGENTS.md: it is
         // derived from the grant at startup, so it cannot say something the install
         // is not. The rules themselves are still only in the pack.
-        capabilityLine();
+        capabilityLine(grants);
     const server = new McpServer({ name: "artist-notes", version: serverVersion }, { instructions });
     server.tool("list_agent_workflows", "List the read-only artist roles, project types, and policies available " +
         "at runtime. Whatever comes back in full is in force as returned and is " +
@@ -312,7 +310,7 @@ const createServer = async (call) => {
         "Anything listed as a one-line summary is not in force until loaded. " +
         "Load the Orchestrator before handling a project.", {}, async () => {
         try {
-            const text = await renderWorkflowBriefing(await listAgentWorkflows(), loadAgentWorkflow);
+            const text = await renderWorkflowBriefing(await listAgentWorkflows(), loadAgentWorkflow, grants);
             return { content: [{ type: "text", text }] };
         }
         catch (err) {
@@ -793,7 +791,7 @@ const createServer = async (call) => {
     // present and refusing: a tool that exists is a tool a model will try, and a
     // refusal in a tool result reads as an obstacle to route around rather than
     // as a boundary. See docs/decisions/0001-opt-in-calendar-writes.md.
-    if (isGranted("calendar-create")) {
+    if (isGranted(grants, "calendar-create")) {
         server.tool("preview_calendar_event", "Call this before create_calendar_event — it is the only way to obtain the confirmation_token that one requires, and it is what puts the exact event in front of the musician. SHOW THE MUSICIAN WHAT IT RETURNS AND WAIT FOR THEIR YES. " +
             "Renders a Google Calendar event exactly as it would be written, and " +
             "lists what is already on that day in that calendar, so an event that " +
@@ -899,7 +897,7 @@ const createServer = async (call) => {
             }
         });
     }
-    if (isGranted("calendar-delete")) {
+    if (isGranted(grants, "calendar-delete")) {
         server.tool("preview_calendar_delete", "Call this before delete_calendar_event — it is the only way to obtain the confirmation_token that one requires. SHOW THE MUSICIAN WHAT IT RETURNS AND WAIT FOR THEIR YES. " +
             "Shows the event that would be removed, read fresh from Google rather " +
             "than from anything you were told about it. Changes nothing. Only an " +
@@ -1104,8 +1102,8 @@ const createServer = async (call) => {
  * The stdio entry point, unchanged in behaviour: one process, one user, tokens
  * from this machine. It is now the only place that knows about stdio.
  */
-const runServer = async () => {
-    const server = await createServer(localCall);
+const runServer = async (grants = []) => {
+    const server = await createServer(localCall, grants);
     await server.connect(new StdioServerTransport());
 };
 export { createServer, renderWorkflowBriefing, runServer };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@manudota/artist-mcp",
-  "version": "1.5.2",
+  "version": "1.5.3-staging.76",
   "description": "MCP server that reads your OneNote notes, with optional Gmail and Calendar as supporting evidence, via a hosted connection.",
   "repository": {
     "type": "git",
@@ -14,6 +14,8 @@
     ".": "./dist/index.js",
     "./server": "./dist/server.js",
     "./dispatch": "./dist/dispatch.js",
+    "./grants": "./dist/grants.js",
+    "./audit": "./dist/audit.js",
     "./oauth": "./dist/oauth.js",
     "./client": "./dist/client.js"
   },