@myspec/mcp-server 0.2.0-next.80 → 0.2.0-next.81

package/README.md

@@ -64,6 +64,10 @@ value, including the dot** and paste it back into the terminal. Two traps:
 without a person present (a server, a container, a CI job, a shared machine),
 use an API token instead.
 
+> Needs **`@myspec/mcp-server` 0.2.0 or newer** (`npm view @myspec/mcp-server
+> version`). Earlier builds ignore the `apiToken` field and report that they are
+> not signed in, without mentioning the version.
+
 **1. Create the token.** In the MySpec webapp, open the avatar menu → **API
 tokens** → **Create token**. Choose the organization it should act in, whether
 it may write or only read, and an expiry. The token is shown **once**; it

package/dist/index.js

@@ -565,12 +565,20 @@ var TokenManager = class {
       this.apiTokenRejection = rejection;
       throw rejection;
     }
+    if (response.status === 404) {
+      const body = await response.text().catch(() => "");
+      throw new HttpStatusError(
+        response.status,
+        body,
+        `Token exchange failed: ${url} returned 404, so no exchange endpoint is there. This URL comes from userAuthUrl in ~/.myspec/settings.json \u2014 check it names the environment the token was created in, and rewrite it with \`npx @myspec/mcp-server login --user-auth-url <url>\`. Note that --user-auth-url and MYSPEC_USER_AUTH_URL do not redirect the exchange on their own, and userAuthUrl in oauth_creds.json is ignored entirely.`
+      );
+    }
     if (!response.ok) {
       const body = await response.text().catch(() => "");
       throw new HttpStatusError(
         response.status,
         body,
-        `Token exchange failed: HTTP ${String(response.status)}`
+        `Token exchange failed: HTTP ${String(response.status)} from ${url}`
       );
     }
     const payload = await response.json().catch(() => null);
@@ -5057,13 +5065,16 @@ function printHelp() {
     "  login --org <slug>      Sign in and pin that organization. Tokens only work",
     "                          when an organization is active; the CLI asks when you",
     "                          belong to several and this flag is not given.",
-    "  logout                  Revoke refresh token and clear local credentials",
+    "  logout                  Sign out and clear the session credentials. A",
+    "                          configured apiToken is KEPT, so an unattended",
+    "                          install keeps working.",
     "  reverse --root <dir>    Connect to ai-agent and expose local_fs tools.",
     "                          The agent WebSocket URL is discovered from the webapp",
     "                          (GET /api/v1/config) using your saved credentials;",
     "                          override with --agent-url <url> or MYSPEC_AI_AGENT_WS_URL.",
-    "                          Uses the saved refresh_token from `npx @myspec/mcp-server login`",
-    "                          to obtain & auto-refresh access tokens. Override with",
+    "                          Uses the apiToken from ~/.myspec/oauth_creds.json if one",
+    "                          is set, otherwise the refresh_token saved by `login`, to",
+    "                          obtain & auto-refresh access tokens. Override with",
     "                          --access-token <jwt> or MYSPEC_ACCESS_TOKEN for local testing.",
     "  --version               Print version",
     "  --help                  Print this help",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myspec/mcp-server",
-  "version": "0.2.0-next.80",
+  "version": "0.2.0-next.81",
   "description": "MySpec MCP server — exposes MySpec platform projects, files and attachments to MCP-aware clients via OAuth-authenticated access tokens.",
   "type": "module",
   "repository": {