@moor-sh/mcp 0.21.0 → 0.23.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moor-sh/mcp",
-  "version": "0.21.0",
+  "version": "0.23.0",
   "description": "MCP server for moor - lets AI agents (Claude Code, Cursor, etc.) manage your moor projects via the moor HTTP API.",
   "license": "MIT",
   "repository": {

package/src/index.ts

@@ -114,7 +114,11 @@ async function resolveProject(name: string): Promise<Project> {
 
 // --- SSE stream reader ---
 
-async function readSSE(res: Response): Promise<{ logs: string; error?: string }> {
+async function readSSE(res: Response): Promise<{
+  logs: string;
+  error?: string;
+  structuredError?: { code: string; message: string };
+}> {
   const reader = res.body?.getReader();
   if (!reader) return { logs: "" };
 
@@ -123,6 +127,7 @@ async function readSSE(res: Response): Promise<{ logs: string; error?: string }>
   let currentEvent = "";
   let logs = "";
   let error: string | undefined;
+  let structuredError: { code: string; message: string } | undefined;
 
   while (true) {
     const { done, value } = await reader.read();
@@ -139,11 +144,16 @@ async function readSSE(res: Response): Promise<{ logs: string; error?: string }>
         const data = JSON.parse(line.slice(6));
         if (currentEvent === "log") logs += data;
         else if (currentEvent === "error") error = data;
+        // #119: structured-error fires alongside event: error when the
+        // server classifies a build failure (today: source_credential_required).
+        // Captured here so deploy/rebuild tools can surface the code to
+        // the agent instead of throwing a generic message.
+        else if (currentEvent === "structured-error") structuredError = data;
         currentEvent = "";
       }
     }
   }
-  return { logs, error };
+  return { logs, error, structuredError };
 }
 
 // --- Validators ---
@@ -385,7 +395,22 @@ server.registerTool(
     const p = await resolveProject(project);
     const query = no_cache ? "?nocache=true" : "";
     const res = await apiPost(`/api/projects/${p.id}/run${query}`);
-    const { logs, error } = await readSSE(res);
+    const { logs, error, structuredError } = await readSSE(res);
+    // #119: a classified failure (today: source_credential_required) gets
+    // returned as isError with a structured payload the agent can branch
+    // on. Unclassified errors keep throwing so the existing UX is preserved.
+    if (structuredError) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: `rebuild failed: code=${structuredError.code} message=${structuredError.message}`,
+          },
+        ],
+        structuredContent: structuredError,
+        isError: true,
+      };
+    }
     if (error) throw new Error(error);
     return { content: [{ type: "text", text: logs || "Rebuild complete." }] };
   },
@@ -1174,6 +1199,15 @@ server.registerTool(
         .describe(
           "Named Docker volumes to attach. Each entry creates a per-project volume (stored as moor-<project>-<name>) and mounts it at the given target on next container recreate. Data survives container/project rebuilds unless explicitly purged via project delete with purge_volumes=true.",
         ),
+      source_credential_id: z
+        .number()
+        .int()
+        .positive()
+        .nullable()
+        .optional()
+        .describe(
+          "For github_url projects: pin the source credential row (from moor_source_credential_add) the build path should use. Build synthesizes the credentialed clone URL in memory; the secret is never stored on the project. Ignored when docker_image is set; save-time validation is structural only (id exists).",
+        ),
     }),
   },
   async (input) => {
@@ -1254,6 +1288,15 @@ server.registerTool(
         .describe(
           "Max CPU cores (fractional OK; min 0.001). Pass null to clear. Max host core count. Takes effect on container recreate.",
         ),
+      source_credential_id: z
+        .number()
+        .int()
+        .positive()
+        .nullable()
+        .optional()
+        .describe(
+          "Pin (or unlink, by passing null) the source credential the build path should use for this github_url project. Switching to docker_image force-clears the id regardless of input. Save-time validation is structural only; host-mismatch / not-active is enforced at build time.",
+        ),
     }),
   },
   async (input) => {
@@ -1879,6 +1922,15 @@ server.registerTool(
         .describe(
           "Env vars to MERGE into existing project envs. Omit to leave envs untouched. Pass {} for an explicit no-op. Use moor_env_delete to remove keys.",
         ),
+      source_credential_id: z
+        .number()
+        .int()
+        .positive()
+        .nullable()
+        .optional()
+        .describe(
+          "For github_url projects: pin the source credential row (created via moor_source_credential_add). Build path synthesizes the credentialed clone URL in memory; secret never gets stored on the project row. Pass null to detach without switching source type. Ignored when docker_image is set. Save-time validation is structural only (id exists); host-mismatch / not-active is enforced at build time so configuration can survive transient credential outages.",
+        ),
       run: z
         .boolean()
         .optional()
@@ -1978,6 +2030,7 @@ server.registerTool(
         restart_policy: input.restart_policy,
         memory_limit_mb: input.memory_limit_mb,
         cpus: input.cpus,
+        source_credential_id: input.source_credential_id,
       };
       const res = await apiPost("/api/projects", createBody);
       if (!res.ok) throw new Error(`[create] ${await res.text()}`);
@@ -1997,6 +2050,8 @@ server.registerTool(
       if (input.restart_policy !== undefined) updateBody.restart_policy = input.restart_policy;
       if (input.memory_limit_mb !== undefined) updateBody.memory_limit_mb = input.memory_limit_mb;
       if (input.cpus !== undefined) updateBody.cpus = input.cpus;
+      if (input.source_credential_id !== undefined)
+        updateBody.source_credential_id = input.source_credential_id;
 
       if (Object.keys(updateBody).length > 0) {
         const res = await apiPut(`/api/projects/${existing.id}`, updateBody);
@@ -2069,12 +2124,20 @@ server.registerTool(
 
     // Step 3: run, default true. Wait for the full SSE stream like moor_rebuild.
     let runLogs = "";
+    let runStructuredError: { code: string; message: string } | undefined;
     if (input.run) {
       const runRes = await apiPost(`/api/projects/${projectId}/run`);
       if (!runRes.ok) throw new Error(`[run] ${await runRes.text()}`);
-      const { logs, error } = await readSSE(runRes);
+      const { logs, error, structuredError } = await readSSE(runRes);
       runLogs = logs;
-      if (error) throw new Error(`[run] ${error}`);
+      // #119: classified failure (today: source_credential_required) is
+      // returned as isError below so the agent can branch on the code
+      // instead of parsing a thrown message.
+      if (structuredError) {
+        runStructuredError = structuredError;
+      } else if (error) {
+        throw new Error(`[run] ${error}`);
+      }
     }
 
     const lines: string[] = [];
@@ -2099,6 +2162,20 @@ server.registerTool(
       lines.push("Build/run output:");
       lines.push(runLogs || "(no output)");
     }
+    // #119: if the build was classified as auth-failure, return isError
+    // with the structured payload so the agent can call _check + add a
+    // credential and retry. The project row exists (create/update already
+    // committed) so the agent just needs to fix the credential and run
+    // deploy again with the pinned id.
+    if (runStructuredError) {
+      lines.push("");
+      lines.push(`Failed: code=${runStructuredError.code} message=${runStructuredError.message}`);
+      return {
+        content: [{ type: "text", text: lines.join("\n") }],
+        structuredContent: { ...runStructuredError, project_id: projectId },
+        isError: true,
+      };
+    }
     return { content: [{ type: "text", text: lines.join("\n") }] };
   },
 );