@myspec/mcp-server 0.4.0-next.94 → 0.4.0-next.96

package/README.md

@@ -101,9 +101,17 @@ claude mcp add --scope user myspec \
 ```
 
 Nothing else is required — no `login`, no files. **For a non-production token,
-set `MYSPEC_USER_AUTH_URL` too** (e.g. `https://dev-auth.myspec.dev`); a dev
-token against the production default fails with a bare 401 that reads like a bad
-token.
+set `MYSPEC_USER_AUTH_URL` too** (e.g. `https://dev-auth.myspec.dev`) unless
+`~/.myspec/settings.json` already names that environment, which the server reads
+even with no `oauth_creds.json` beside it; a dev token against the production
+default fails with a 401 that reads like a bad token until you read the host it
+names.
+
+That cuts both ways: set it explicitly for a **production** token on a machine
+that was ever signed in to dev. `login` writes `settings.json` and `logout` does
+not remove it, so the leftover `userAuthUrl` decides the exchange either way.
+The 401 names the host it asked, so the wrong environment is visible rather than
+looking like a rejected token.
 
 The server writes `~/.myspec/settings.json` so restarts skip endpoint discovery.
 It never writes the token to disk, so unsetting the variable removes the
@@ -272,7 +280,7 @@ Local state is stored under `~/.myspec/` (alongside the on-disk cache root), spl
 | Variable | Purpose |
 |---|---|
 | `MYSPEC_API_TOKEN` | Long-lived MySpec API token (`msp_pat_…`) for unattended use. Takes precedence over anything in `~/.myspec/oauth_creds.json` and is never written to disk. Needs 0.3.0+. |
-| `MYSPEC_USER_AUTH_URL` | user-auth base URL (default `https://auth.myspec.dev`). The webapp URL is derived from it; the platform / ai-agent URLs are discovered via the webapp. |
+| `MYSPEC_USER_AUTH_URL` | user-auth base URL (`--user-auth-url` > this > `userAuthUrl` in `~/.myspec/settings.json` > `https://auth.myspec.dev`). The webapp URL is derived from it; the platform / ai-agent URLs are discovered via the webapp. |
 | `MYSPEC_DOWNLOAD_ROOT` | Absolute path used by `read_spec_file` as its on-disk cache root (default: `~/.myspec`). Tools never write outside this root. |
 | `MYSPEC_AI_AGENT_WS_URL` | ai-agent WebSocket URL for `reverse`; skips the webapp discovery call |
 

package/dist/index.js

@@ -360,6 +360,10 @@ async function loadSettings(target) {
     throw err;
   }
 }
+async function readSettingsUserAuthUrl(settingsPath = defaultSettingsPath()) {
+  const settings = await loadSettings(settingsPath);
+  return settings?.userAuthUrl;
+}
 async function writeJsonFile(target, data, opts) {
   const dir = path.dirname(target);
   await fs.mkdir(dir, { recursive: true, mode: 448 });
@@ -726,7 +730,7 @@ var TokenManager = class {
     if (response.status === 401 || response.status === 403) {
       const reason = response.status === 403 ? "the token owner no longer has access to its organization" : "the token is invalid, disabled, or expired";
       const rejection = new ApiTokenRejectedError(
-        `API token exchange failed: ${reason}. Create a new API token in MySpec and set it as MYSPEC_API_TOKEN (or write it to the apiToken field of your credentials file).`
+        `API token exchange failed at ${url}: ${reason}. Check that URL names the environment the token was created in. With MYSPEC_API_TOKEN it comes from MYSPEC_USER_AUTH_URL (or --user-auth-url), then userAuthUrl in ~/.myspec/settings.json, defaulting to https://auth.myspec.dev; with an apiToken in oauth_creds.json it comes from that settings.json value alone, which only \`npx @myspec/mcp-server login --user-auth-url <url>\` rewrites. If the host is right, create a new API token in MySpec and set it as MYSPEC_API_TOKEN (or write it to the apiToken field of your credentials file).`
       );
       this.apiTokenRejection = rejection;
       throw rejection;
@@ -736,7 +740,7 @@ var TokenManager = class {
       throw new HttpStatusError(
         response.status,
         body,
-        `Token exchange failed: ${url} returned 404, so no exchange endpoint is there. Check that URL names the environment the token was created in. With MYSPEC_API_TOKEN it comes from MYSPEC_USER_AUTH_URL (or --user-auth-url), defaulting to https://auth.myspec.dev. Otherwise it comes from userAuthUrl in ~/.myspec/settings.json, which only \`npx @myspec/mcp-server login --user-auth-url <url>\` rewrites \u2014 the flag and the variable do not redirect a file-configured exchange on their own, and userAuthUrl in oauth_creds.json is ignored entirely.`
+        `Token exchange failed: ${url} returned 404, so no exchange endpoint is there. Check that URL names the environment the token was created in. With MYSPEC_API_TOKEN it comes from MYSPEC_USER_AUTH_URL (or --user-auth-url), then userAuthUrl in ~/.myspec/settings.json, defaulting to https://auth.myspec.dev. Otherwise it comes from that same settings.json value, which only \`npx @myspec/mcp-server login --user-auth-url <url>\` rewrites \u2014 the flag and the variable do not redirect a file-configured exchange on their own, and userAuthUrl in oauth_creds.json is ignored entirely.`
       );
     }
     if (!response.ok) {
@@ -4930,7 +4934,7 @@ function registerLocalFsTools(server, opts) {
     },
     {
       name: "local_pack_codebase",
-      description: "Pack the entire local codebase (under the granted --root) into a single XML bundle using `npx repomix@latest --style xml --compress`. Prefer this over many `local_fs_read_file` calls when you need broad codebase context. Output is paginated at ~2500 lines per page; a `<file>` block is never split across a page boundary, but the `<files>` root wrapper spans pages (its opener is on the first files page and its closer on the last) \u2014 always keep reading while `hasMore` is true rather than stopping at a `</files>`. The response includes `outputId`, `page`, `totalPages`, `totalLines`, `pageLines`, `hasMore`, and a `nextPage` hint. Use `local_pack_codebase_read_page` to fetch subsequent pages by `outputId`. Repeat calls with the same `subpath`/`includePatterns`/`ignorePatterns` return the same `outputId` and are served instantly from the 30-minute cache without re-running repomix.",
+      description: "Pack the local codebase (under the granted --root) into a single compressed XML bundle (embedded repomix, `--style xml --compress`; file bodies use `\u22EE----` delimiters). Prefer this over many `local_fs_read_file` calls when you need broad codebase context. Output is paginated at ~2500 lines per page; a `<file>` block is never split across a page boundary, but the `<files>` root wrapper spans pages (its opener is on the first files page and its closer on the last) \u2014 never treat a missing `</files>` as truncation. The response includes `outputId`, `page`, `totalPages`, `totalLines`, `pageLines`, `hasMore`, and a `nextPage` hint; page 1 opens with the full directory structure. Fetch further pages with `local_pack_codebase_read_page` while `totalPages` is small; for a large pack (roughly 10+ pages) do NOT page through everything \u2014 use page 1 as the repo map, then re-pack narrowed with `subpath`/`includePatterns` or switch to `local_fs_grep`/`local_fs_read_file` for targeted reads. Repeat calls with the same `subpath`/`includePatterns`/`ignorePatterns` return the same `outputId` and are served instantly from the 30-minute cache without re-running repomix.",
       inputSchema: jsonSchemaFromZod(packCodebaseInput),
       handler: async (args) => {
         try {
@@ -4943,7 +4947,7 @@ function registerLocalFsTools(server, opts) {
     },
     {
       name: "local_pack_codebase_read_page",
-      description: "Read a specific page of a previously packed codebase output. Provide the `outputId` returned by `local_pack_codebase` and the 1-indexed `page` to fetch. Each page is up to ~2500 lines of XML; no `<file>` block is split across pages, but the `<files>` root wrapper spans pages \u2014 keep fetching while `hasMore` is true, do not stop at a `</files>`. Cache entries expire after 30 minutes; on cache miss, re-run `local_pack_codebase` (same args return the same outputId \u2014 re-pack is cheap, served from cache).",
+      description: "Read a specific page of a previously packed codebase output. Provide the `outputId` returned by `local_pack_codebase` and the 1-indexed `page` to fetch. Each page is up to ~2500 lines of the compressed XML bundle; no `<file>` block is split across pages, but the `<files>` root wrapper spans pages \u2014 never treat a missing `</files>` as truncation. Cache entries expire after 30 minutes; on cache miss, re-run `local_pack_codebase` (same args return the same outputId \u2014 re-pack is cheap, served from cache).",
       inputSchema: jsonSchemaFromZod(packCodebaseReadPageInput),
       handler: (args) => {
         try {
@@ -5487,21 +5491,59 @@ async function resolveReverseAgentUrl(sources) {
     throw err;
   }
 }
+function ignoringSettings(settingsPath, reason) {
+  return `myspec-mcp: ignoring the userAuthUrl in ${settingsPath} for the MYSPEC_API_TOKEN exchange URL \u2014 ${reason}.`;
+}
+function usableAuthUrl(candidate, settingsPath, warn) {
+  if (candidate === void 0) {
+    return void 0;
+  }
+  try {
+    resolveConfig({ env: {}, storedUserAuthUrl: candidate });
+    return candidate;
+  } catch (err) {
+    if (!(err instanceof ConfigError)) {
+      throw err;
+    }
+    warn(ignoringSettings(settingsPath, err.message));
+    return void 0;
+  }
+}
 async function buildCredentialsStore(opts = {}) {
   const env = opts.env ?? process.env;
-  const fileStore = opts.fileStore ?? createFileCredentialsStore();
+  const settingsPath = opts.settingsPath ?? defaultSettingsPath();
+  const fileStore = opts.fileStore ?? createFileCredentialsStore({ settingsPath });
+  const warn = opts.warn ?? ((message) => {
+    process.stderr.write(message + "\n");
+  });
   const usingEnvApiToken = hasEnvApiToken(env);
   const tolerate = opts.toleratesUnreadableFile ?? usingEnvApiToken;
   const stored = tolerate ? await fileStore.load().catch(() => null) : await fileStore.load();
+  const overridden = (opts.cliUserAuthUrl ?? env.MYSPEC_USER_AUTH_URL) !== void 0;
+  const fromSettings = usingEnvApiToken && !overridden && stored?.userAuthUrl === void 0 ? await readSettingsUserAuthUrl(settingsPath).catch((err) => {
+    const message = err instanceof Error ? err.message : String(err);
+    warn(ignoringSettings(settingsPath, `it could not be read (${message})`));
+    return void 0;
+  }) : void 0;
   const config = resolveConfig({
     env,
     cliUserAuthUrl: opts.cliUserAuthUrl,
-    storedUserAuthUrl: stored?.userAuthUrl
+    // Validated on its own before it joins the chain, for the same reason the
+    // unreadable file above is forgiven: parseSettings only requires a
+    // non-empty string, so a hand-written `htps://…` or a bare host in a
+    // settings.json that is not even the credential would otherwise turn a
+    // pure-env install that used to start on the prod default into a
+    // ConfigError exit — and one that never names the file it came from.
+    storedUserAuthUrl: stored?.userAuthUrl ?? usableAuthUrl(fromSettings, settingsPath, warn)
   });
   return {
     store: createEnvApiTokenStore({
       fileStore,
-      envConfig: readEnvApiToken(config.userAuthUrl, env)
+      // `warn` rather than the default sink, so the "cannot be sent as a
+      // header" warning lands wherever the caller's other warnings do.
+      envConfig: readEnvApiToken(config.userAuthUrl, env, warn),
+      settingsPath,
+      warn
     }),
     config,
     usingEnvApiToken

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myspec/mcp-server",
-  "version": "0.4.0-next.94",
+  "version": "0.4.0-next.96",
   "description": "MySpec MCP server — exposes MySpec platform projects, files and attachments to MCP-aware clients via OAuth-authenticated access tokens.",
   "type": "module",
   "repository": {