@myspec/mcp-server 0.1.2-next.37 → 0.1.2-next.38

package/dist/index.js

@@ -99,7 +99,7 @@ function applyCorsHeaders(res) {
   res.setHeader("Access-Control-Allow-Headers", "Content-Type");
 }
 async function waitForOAuthCallback(opts) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const settledFlag = { value: false };
     const timeoutRef = { handle: void 0 };
     const rlRef = { handle: void 0 };
@@ -157,7 +157,7 @@ async function waitForOAuthCallback(opts) {
       res.setHeader("Content-Type", "text/html");
       res.end(SUCCESS_HTML);
       settle(() => {
-        resolve2({ code });
+        resolve3({ code });
       });
     });
     server.on("error", (err) => {
@@ -204,7 +204,7 @@ async function waitForOAuthCallback(opts) {
         }
         settle(() => {
           opts.logger("Captured pasted token; finishing sign-in...");
-          resolve2({ code });
+          resolve3({ code });
         });
       });
     }
@@ -348,10 +348,10 @@ function createFileCredentialsStore(paths = {}) {
 async function loadOauthCreds(target) {
   try {
     if (process.platform !== "win32") {
-      const stat = await fs.stat(target);
-      if ((stat.mode & 63) !== 0) {
+      const stat2 = await fs.stat(target);
+      if ((stat2.mode & 63) !== 0) {
         throw new Error(
-          `Refusing to load credentials from ${target}: file mode is too permissive (${(stat.mode & 511).toString(8)}). Run \`chmod 600 ${target}\` and retry.`
+          `Refusing to load credentials from ${target}: file mode is too permissive (${(stat2.mode & 511).toString(8)}). Run \`chmod 600 ${target}\` and retry.`
         );
       }
     }
@@ -840,7 +840,7 @@ function calculateDelay(attempt, config) {
   return Math.round(cappedDelay * jitterMultiplier);
 }
 function sleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 async function withRetry(fn, config = DEFAULT_RETRY_CONFIG, shouldRetry = defaultShouldRetry) {
   const startTime = Date.now();
@@ -2480,6 +2480,59 @@ var updateProjectTool = {
 // src/server/tools/update_spec_file.ts
 import { z as z11 } from "zod";
 
+// src/server/tools/spec-content-source.ts
+import { readFile, stat } from "fs/promises";
+import { isAbsolute, resolve } from "path";
+var MAX_LOCAL_SPEC_FILE_BYTES = 5 * 1024 * 1024;
+async function resolveSpecContent(input, maxBytes = MAX_LOCAL_SPEC_FILE_BYTES) {
+  const { content, localFilePath } = input;
+  if (content !== void 0 && localFilePath !== void 0) {
+    return { error: "Provide either content or local_file_path, not both." };
+  }
+  if (content !== void 0) {
+    return { bytes: new TextEncoder().encode(content) };
+  }
+  if (localFilePath === void 0) {
+    return { error: "Provide the file body via content or local_file_path (one is required)." };
+  }
+  const absPath = isAbsolute(localFilePath) ? localFilePath : resolve(process.cwd(), localFilePath);
+  let info;
+  try {
+    info = await stat(absPath);
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT") {
+      return { error: `local file not found: ${absPath}` };
+    }
+    const message = err instanceof Error ? err.message : String(err);
+    return { error: `failed to read local file ${absPath}: ${message}` };
+  }
+  if (!info.isFile()) {
+    return { error: `local_file_path is not a regular file: ${absPath}` };
+  }
+  if (info.size === 0) {
+    return { error: `local file is empty: ${absPath}` };
+  }
+  if (info.size > maxBytes) {
+    return {
+      error: `local file is too large (${String(info.size)} bytes); max is ${String(maxBytes)} bytes.`
+    };
+  }
+  let raw;
+  try {
+    raw = await readFile(absPath);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { error: `failed to read local file ${absPath}: ${message}` };
+  }
+  if (raw.byteLength > maxBytes) {
+    return {
+      error: `local file is too large (${String(raw.byteLength)} bytes); max is ${String(maxBytes)} bytes.`
+    };
+  }
+  return { bytes: new Uint8Array(raw) };
+}
+
 // src/server/tools/spec-file-output.ts
 function specFileSummary(file) {
   return {
@@ -2501,13 +2554,25 @@ var inputSchema11 = {
   file_id: z11.string().min(1).optional().describe("UUID of the spec file to overwrite. Provide this or (project_id + file_path)."),
   project_id: z11.string().min(1).optional().describe("UUID of the project. Required (with file_path) when file_id is not given."),
   file_path: z11.string().min(1).optional().describe("Path of the spec file. Required (with project_id) when file_id is not given."),
-  content: z11.string().min(1).describe("Full UTF-8 replacement content (non-empty), saved as a new revision.")
+  content: z11.string().min(1).optional().describe(
+    "Full UTF-8 replacement content, saved as a new revision. Provide this OR local_file_path (exactly one). Use for in-memory / generated content."
+  ),
+  local_file_path: z11.string().min(1).optional().describe(
+    "Path to a local file whose bytes become the new revision; the server reads it directly. Provide this OR content (exactly one). Absolute paths are most reliable; a relative path resolves against the MCP server working directory. Point this only at an intended spec file \u2014 its bytes are uploaded to the project as-is; never use it for secrets or unrelated files."
+  )
 };
 var updateSpecFileTool = {
   name: "update_spec_file",
-  description: "Overwrite an existing spec file by saving a new revision from full content. Reference the file by file_id or by (project_id + file_path).",
+  description: "Overwrite an existing spec file by saving a new revision. Provide the new body inline via `content` or by pointing at a local file with `local_file_path` \u2014 exactly one is required. Prefer `local_file_path` when the body is already an existing local file (the server reads it directly); use `content` for text generated in-memory. Reference the file by file_id or by (project_id + file_path).",
   inputSchema: inputSchema11,
   handler: async (args, ctx) => {
+    const resolved = await resolveSpecContent({
+      content: args.content,
+      localFilePath: args.local_file_path
+    });
+    if (resolved.error || !resolved.bytes) {
+      return errorResult(resolved.error ?? "Failed to resolve file content.");
+    }
     let fileId;
     if (args.file_id) {
       const meta = await ctx.client.getFileMetadata(args.file_id).catch(() => null);
@@ -2526,16 +2591,15 @@ var updateSpecFileTool = {
     } else {
       return errorResult("Provide either file_id, or both project_id and file_path.");
     }
-    const content = new TextEncoder().encode(args.content);
-    const file = await ctx.client.saveSpecFileRevision(fileId, content);
+    const file = await ctx.client.saveSpecFileRevision(fileId, resolved.bytes);
     return jsonResult({ file: specFileSummary(file) });
   }
 };
 
 // src/server/tools/upload_attachment.ts
 import { createHash as createHash2 } from "crypto";
-import { lstat, readFile } from "fs/promises";
-import { basename, extname, isAbsolute } from "path";
+import { lstat, readFile as readFile2 } from "fs/promises";
+import { basename, extname, isAbsolute as isAbsolute2 } from "path";
 import { z as z12 } from "zod";
 var DEFAULT_MIME = "application/octet-stream";
 var MAX_ATTACHMENT_MB = MAX_ATTACHMENT_BYTES / (1024 * 1024);
@@ -2654,7 +2718,7 @@ var uploadAttachmentTool = {
   description: `Upload a local file as a new attachment on a project. Reads \`file_path\` from the host running the MCP server, computes its SHA256, then performs the two-phase platform upload. Max ${String(MAX_ATTACHMENT_MB)} MB. Supported content: PDF, DOCX, XLSX, and any UTF-8 text file (XML, JSON, YAML, HTML, Markdown, CSV, source code, ...). Binary files outside the structured types will be rejected by the platform.`,
   inputSchema: inputSchema12,
   handler: async (args, ctx) => {
-    if (!isAbsolute(args.file_path)) {
+    if (!isAbsolute2(args.file_path)) {
       return errorResult(`file_path must be an absolute path; got "${args.file_path}".`);
     }
     let stats;
@@ -2690,7 +2754,7 @@ var uploadAttachmentTool = {
     }
     let buf;
     try {
-      buf = await readFile(args.file_path);
+      buf = await readFile2(args.file_path);
     } catch (err) {
       const code = err.code;
       if (code === "EACCES" || code === "EPERM") {
@@ -2794,15 +2858,16 @@ function validateSpecFilePath(filePath) {
   if (segments.some((s) => s === "" || s === ".")) {
     return 'file_path must be a normalized path (no empty, "." or trailing-slash segments).';
   }
-  if (segments[0] !== "specs") {
-    return "file_path must be rooted at 'specs' (e.g. specs/changes/add-oauth-login/proposal.md).";
+  const root = segments[0];
+  if (root !== "specs" && root !== "openspec") {
+    return "file_path must be rooted at 'specs' or 'openspec' (e.g. specs/changes/add-oauth-login/proposal.md).";
   }
   if (segments.length < 2) {
-    return "file_path must include a filename under 'specs' (e.g. specs/proposal.md).";
+    return `file_path must include a filename under '${root}' (e.g. ${root}/proposal.md).`;
   }
   const dirLevels = segments.length - 2;
   if (dirLevels > MAX_SPEC_DIR_DEPTH) {
-    return `file_path must not nest deeper than ${String(MAX_SPEC_DIR_DEPTH)} directory levels below specs.`;
+    return `file_path must not nest deeper than ${String(MAX_SPEC_DIR_DEPTH)} directory levels below the '${root}' root.`;
   }
   return null;
 }
@@ -2831,20 +2896,32 @@ var SPEC_FILE_TYPES = [
 var inputSchema13 = {
   project_id: z13.string().min(1).describe("UUID of the project to upload the file into."),
   file_path: z13.string().min(1).describe(
-    'Path of the new spec file, rooted at "specs" with at most 3 directory levels below specs (e.g. specs/changes/add-oauth-login/proposal.md).'
+    'Path of the new spec file, rooted at "specs" or "openspec" with at most 3 directory levels below the root (e.g. specs/changes/add-oauth-login/proposal.md).'
+  ),
+  content: z13.string().min(1).optional().describe(
+    "Full UTF-8 text content of the spec file. Provide this OR local_file_path (exactly one). Use for in-memory / generated content."
+  ),
+  local_file_path: z13.string().min(1).optional().describe(
+    "Path to a local file whose bytes become the spec file body; the server reads it directly. Provide this OR content (exactly one). Absolute paths are most reliable; a relative path resolves against the MCP server working directory. Point this only at an intended spec file \u2014 its bytes are uploaded to the project as-is; never use it for secrets or unrelated files."
   ),
-  content: z13.string().min(1).describe("Full UTF-8 text content of the spec file (non-empty)."),
   file_type: z13.enum(SPEC_FILE_TYPES).optional().describe("Spec file type. Omit to derive from the filename (e.g. proposal.md \u2192 proposal).")
 };
 var uploadSpecFileTool = {
   name: "upload_spec_file",
-  description: "Upload a new, session-less spec file into a project from full content. Rejects if a file already exists at the same path (use update_spec_file to overwrite).",
+  description: "Upload a new, session-less spec file into a project. Provide the file body inline via `content` or by pointing at a local file with `local_file_path` \u2014 exactly one is required. Prefer `local_file_path` when the body is already an existing local file (the server reads it directly, avoiding sending large content through the model); use `content` for text generated in-memory. Rejects if a file already exists at the same path (use update_spec_file to overwrite).",
   inputSchema: inputSchema13,
   handler: async (args, ctx) => {
     const pathError = validateSpecFilePath(args.file_path);
     if (pathError) {
       return errorResult(pathError);
     }
+    const resolved = await resolveSpecContent({
+      content: args.content,
+      localFilePath: args.local_file_path
+    });
+    if (resolved.error || !resolved.bytes) {
+      return errorResult(resolved.error ?? "Failed to resolve file content.");
+    }
     const existing = await ctx.client.findSpecFileByPath(args.project_id, args.file_path);
     if (existing) {
       return errorResult(
@@ -2852,12 +2929,11 @@ var uploadSpecFileTool = {
       );
     }
     const fileType = args.file_type ?? deriveFileType(args.file_path);
-    const content = new TextEncoder().encode(args.content);
     const file = await ctx.client.uploadSpecFile({
       projectId: args.project_id,
       filePath: args.file_path,
       fileType,
-      content
+      content: resolved.bytes
     });
     return jsonResult({ file: specFileSummary(file) });
   }
@@ -2949,13 +3025,13 @@ var WebSocketClientTransport = class {
     return Promise.resolve();
   }
   send(message) {
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       this.ws.send(JSON.stringify(message), (err) => {
         if (err) {
           reject(err);
           return;
         }
-        resolve2();
+        resolve3();
       });
     });
   }
@@ -2989,7 +3065,7 @@ var WebSocketClientTransport = class {
 
 // src/reverse/safe-path.ts
 import { realpath } from "fs/promises";
-import { isAbsolute as isAbsolute2, resolve, sep } from "path";
+import { isAbsolute as isAbsolute3, resolve as resolve2, sep } from "path";
 var PathOutsideRootError = class extends Error {
   constructor(userPath) {
     super(`path_outside_root: ${userPath}`);
@@ -3007,10 +3083,10 @@ var AbsolutePathError = class extends Error {
   userPath;
 };
 async function resolveSafePath(realRoot, userPath, opts = {}) {
-  if (isAbsolute2(userPath)) {
+  if (isAbsolute3(userPath)) {
     throw new AbsolutePathError(userPath);
   }
-  const joined = resolve(realRoot, userPath);
+  const joined = resolve2(realRoot, userPath);
   let resolved;
   try {
     resolved = await realpath(joined);
@@ -3115,7 +3191,7 @@ function ripgrepIgnoreGlobs() {
 
 // src/reverse/pack-codebase.ts
 import { createHash as createHash3 } from "crypto";
-import { mkdtemp, readFile as readFile2, rm } from "fs/promises";
+import { mkdtemp, readFile as readFile3, rm } from "fs/promises";
 import { tmpdir } from "os";
 import { join } from "path";
 import { runCli } from "repomix";
@@ -3252,7 +3328,7 @@ async function invokeRepomix(exec, targetDir, args, timeoutMs) {
   const execPromise = exec(["."], targetDir, options);
   try {
     await withTimeout(execPromise, timeoutMs);
-    const content = await readFile2(outputFile, "utf-8");
+    const content = await readFile3(outputFile, "utf-8");
     await rm(workDir, { recursive: true, force: true });
     return content;
   } catch (err) {
@@ -3402,20 +3478,20 @@ async function handleRead(args, opts) {
       return structuredError("path_ignored", `Path matches ignore rule ${check.rule ?? ""}`);
     }
   }
-  let stat;
+  let stat2;
   try {
-    stat = await fs4.stat(realPath);
+    stat2 = await fs4.stat(realPath);
   } catch (err) {
     return structuredError("stat_failed", errorMessage(err));
   }
-  if (!stat.isFile()) {
+  if (!stat2.isFile()) {
     return structuredError("not_a_file", `Not a regular file: ${args.path}`);
   }
-  if (stat.size > READ_FILE_MAX_BYTES) {
+  if (stat2.size > READ_FILE_MAX_BYTES) {
     return structuredError(
       "file_too_large",
-      `File is ${String(stat.size)} bytes; the read cap is ${String(READ_FILE_MAX_BYTES)} bytes. Use local_fs_grep to find the lines you need, or local_pack_codebase to pull the whole tree.`,
-      { sizeBytes: stat.size, maxBytes: READ_FILE_MAX_BYTES }
+      `File is ${String(stat2.size)} bytes; the read cap is ${String(READ_FILE_MAX_BYTES)} bytes. Use local_fs_grep to find the lines you need, or local_pack_codebase to pull the whole tree.`,
+      { sizeBytes: stat2.size, maxBytes: READ_FILE_MAX_BYTES }
     );
   }
   let raw;
@@ -4020,7 +4096,7 @@ async function runOneConnection(opts) {
       pongTimer = null;
     }
   });
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     ws.once("close", (code, reasonBuf) => {
       clearInterval(pingTimer);
       if (pongTimer) clearTimeout(pongTimer);
@@ -4030,7 +4106,7 @@ async function runOneConnection(opts) {
 `
       );
       const terminal = TERMINAL_CLOSE_CODES.has(code);
-      resolve2({
+      resolve3({
         terminal,
         reason: `code=${String(code)} ${reasonStr}`,
         upMs: Date.now() - connectedAt,
@@ -4040,10 +4116,10 @@ async function runOneConnection(opts) {
   });
 }
 function waitForOpen(ws) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const onOpen = () => {
       ws.removeListener("error", onError);
-      resolve2();
+      resolve3();
     };
     const onError = (err) => {
       ws.removeListener("open", onOpen);
@@ -4054,7 +4130,7 @@ function waitForOpen(ws) {
   });
 }
 function sleep2(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 
 // src/index.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myspec/mcp-server",
-  "version": "0.1.2-next.37",
+  "version": "0.1.2-next.38",
   "description": "MySpec MCP server — exposes MySpec platform projects, files and attachments to MCP-aware clients via OAuth-authenticated access tokens.",
   "type": "module",
   "repository": {