@nooticr/mcp 1.26.48 → 1.26.50

package/dist/index.js

@@ -15,7 +15,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { getBaseUrl, getPublicUrl, getPort, getCredentialsFile, getTransportMode, DEFAULT_PORT, } from "./config.js";
 import { AuthManager, NooticrAuthError, createApiKeyTokenProvider, createHttpTokenProvider, createManagementTokenProvider, createStdioTokenProvider, } from "./auth.js";
-import { looksLikeApiKey } from "./shared/api-key.js";
+import { forwardedHeaders, forwardedSession, looksLikeApiKey } from "./shared/api-key.js";
 import { NooticrClient, NooticrError } from "./nooticr.js";
 import { OAuthManager, SCOPES } from "./oauth.js";
 import { createMcpServer } from "./shared/tools.js";
@@ -95,6 +95,9 @@ function validMcpToken(token, oauth) {
         return true;
     if (looksLikeApiKey(token))
         return true;
+    // Same reasoning as a key: the backend verifies the session on every call.
+    if (forwardedSession(token))
+        return true;
     const envToken = process.env.NOOTICR_ACCESS_TOKEN;
     return typeof envToken === "string" && envToken.length > 0 && token === envToken;
 }
@@ -242,6 +245,11 @@ export async function runHttp(port, publicUrl) {
             if (looksLikeApiKey(bearer)) {
                 return new NooticrClient(baseUrl, createApiKeyTokenProvider(bearer));
             }
+            // nooticr-server's chat, calling as the user signed in to it.
+            const forwarded = forwardedSession(bearer);
+            if (forwarded) {
+                return new NooticrClient(baseUrl, createApiKeyTokenProvider(forwarded.token), undefined, forwardedHeaders(forwarded));
+            }
             const session = bearer
                 ? oauth.verifyToken(bearer)
                 : undefined;

package/dist/shared/api-key.js

@@ -18,3 +18,41 @@ export const API_KEY_PREFIX = "nk_";
 export function looksLikeApiKey(token) {
     return typeof token === "string" && token.startsWith(API_KEY_PREFIX);
 }
+/**
+ * A nooticr session forwarded by nooticr-server's own agent — the dashboard's
+ * chat, calling these tools on behalf of the user who is signed in there.
+ *
+ * The chat used to call a second, Rust copy of 28 of these tools, so it had
+ * none of the others and none of their guidance. It now calls this server,
+ * and needs a way to say "as this user" that is not an OAuth grant (there is
+ * no browser in the loop) and not an API key (the user never minted one).
+ *
+ * Shape: `nooticr-session.<conversation id or ->.<nooticr access token>`. The
+ * token is the user's own, forwarded to the backend exactly as a key is, and
+ * the backend checks it on every call. The conversation rides along so the
+ * backend's run ledger files each call under the chat thread that made it,
+ * rather than as an anonymous connector call. The prefix keeps it from ever
+ * being read as an OAuth token this process issued, which a bare JWT would be.
+ */
+export const SESSION_TOKEN_PREFIX = "nooticr-session.";
+/** The session inside a forwarded bearer, or undefined for anything else. */
+export function forwardedSession(bearer) {
+    if (typeof bearer !== "string" || !bearer.startsWith(SESSION_TOKEN_PREFIX))
+        return undefined;
+    const rest = bearer.slice(SESSION_TOKEN_PREFIX.length);
+    const dot = rest.indexOf(".");
+    if (dot < 0)
+        return undefined;
+    const conversation = rest.slice(0, dot);
+    const token = rest.slice(dot + 1).trim();
+    if (!token)
+        return undefined;
+    return /^[0-9a-f-]{36}$/i.test(conversation) ? { token, conversationId: conversation } : { token };
+}
+/** Headers that attribute a forwarded call to the chat thread that made it. */
+export function forwardedHeaders(session) {
+    return {
+        "x-nooticr-surface": "chat",
+        ...(session.conversationId ? { "x-nooticr-conversation": session.conversationId } : {}),
+    };
+}

package/dist/shared/nooticr.js

@@ -45,14 +45,17 @@ export class NooticrClient {
     tokenProvider;
     /** Stable per-call key so a retried tool call is billed once. */
     idempotencyKey;
-    constructor(baseUrl, tokenProvider, idempotencyKey) {
+    /** Sent on every request — how a forwarded chat call is attributed. */
+    extraHeaders;
+    constructor(baseUrl, tokenProvider, idempotencyKey, extraHeaders = {}) {
         this.baseUrl = baseUrl.replace(/\/+$/, "");
         this.tokenProvider = tokenProvider;
         this.idempotencyKey = idempotencyKey;
+        this.extraHeaders = extraHeaders;
     }
     async request(method, path, opts = {}) {
         const doRequest = async (accessToken) => {
-            const headers = {};
+            const headers = { ...this.extraHeaders };
             if (opts.body !== undefined) {
                 headers["content-type"] = "application/json";
             }

package/dist/shared/output-schemas.js

@@ -851,6 +851,7 @@ export const OUTPUT_SCHEMAS = {
         mcpCredits,
     }),
     get_post_transcript: open({
+        url: scalar().describe("The post the transcript came from, as asked for."),
         available: scalar().describe("false when the post carries no caption track."),
         // Deliberately no text: it is already in `transcript`, and a caption
         // track is long enough that sending it twice would be a real cost in a

package/dist/shared/tools.js

@@ -30,7 +30,7 @@ import { registerCollabTools } from "./collab.js";
 import { registerAmazonTools } from "./amazon.js";
 import { registerMarketplaceTools } from "./marketplace.js";
 /** Current MCP server version — bumped on every deploy for traceability. */
-export const MCP_SERVER_VERSION = "1.26.48";
+export const MCP_SERVER_VERSION = "1.26.50";
 /** MCP Apps extension identifier */
 const UI_EXTENSION = "io.modelcontextprotocol/ui";
 /** MIME type for MCP Apps HTML resources */
@@ -1302,7 +1302,14 @@ export function createMcpServer(rawMakeClient, opts) {
     }, async (args, extra) => {
         const client = await makeClient({ ...extra, arguments: args });
         try {
-            return await toToolResult(await client.callTool("get_post_transcript", { ...args }));
+            const res = await client.callTool("get_post_transcript", { ...args });
+            // The post the words came from, echoed so the view can open a video at
+            // the moment a cue was said — the backend's result names the words, not
+            // the post, and a timestamp you cannot follow is only a number.
+            if (res.structured && typeof res.structured === "object" && !("url" in res.structured)) {
+                res.structured = { ...res.structured, url: args.url };
+            }
+            return await toToolResult(res);
         }
         catch (err) {
             return toolError("get_post_transcript failed", err);