@paigy/mcp 0.40.25 → 0.40.27

package/dist/{dist-NMHU2UNG.js → dist-N6ZJUJV7.js}

@@ -17,7 +17,7 @@ import {
   acknowledge,
   agentName,
   authToken,
-  claimGoal,
+  checkActivity,
   claimSessionEnds,
   claimSessions,
   contact,
@@ -40,6 +40,7 @@ import {
   pollToken,
   reach,
   reachAs,
+  readDelivery,
   readSlot,
   readToken,
   receive,
@@ -61,12 +62,10 @@ import {
   slotName,
   submitTriage,
   subscribeWake,
-  updateGoal,
   updateSlot,
   whoAmI,
-  whoIsWorking,
   withCodexEnv
-} from "./chunk-EJYXBEWN.js";
+} from "./chunk-4C6SDQ7A.js";
 export {
   AGENT_TOOLS,
   AGENT_TOOL_NAMES,
@@ -86,7 +85,7 @@ export {
   acknowledge,
   agentName,
   authToken,
-  claimGoal,
+  checkActivity,
   claimSessionEnds,
   claimSessions,
   contact,
@@ -109,6 +108,7 @@ export {
   pollToken,
   reach,
   reachAs,
+  readDelivery,
   readSlot,
   readToken,
   receive,
@@ -130,9 +130,7 @@ export {
   slotName,
   submitTriage,
   subscribeWake,
-  updateGoal,
   updateSlot,
   whoAmI,
-  whoIsWorking,
   withCodexEnv
 };

package/dist/enable.js

@@ -3,9 +3,9 @@ import {
   PAIGY_TOOL_IDS,
   enablePaigyTools,
   installSessionListening
-} from "./chunk-UAVXYNLV.js";
-import "./chunk-GHSB2VP6.js";
-import "./chunk-EJYXBEWN.js";
+} from "./chunk-A5FYZK6P.js";
+import "./chunk-X3GTDW5G.js";
+import "./chunk-4C6SDQ7A.js";
 
 // src/enable.ts
 function main() {
@@ -16,14 +16,14 @@ function main() {
     if (arg === "-h" || arg === "--help") {
       console.log("usage: paigy-enable-tools [--scope user|project]");
       console.log("");
-      console.log("Allowlist Paigy's notify/await tools in Claude Code so they run without an");
+      console.log("Allowlist Paigy's tools in Claude Code so they run without an");
       console.log("approval prompt each time \u2014 an unattended session can't stall on a dialog.");
       console.log("");
       console.log("  --scope user     ~/.claude/settings.json (default) \u2014 every project");
       console.log("  --scope project  ./.claude/settings.json \u2014 just this repo");
       console.log("");
       console.log(`Adds: ${PAIGY_TOOL_IDS.join(", ")}`);
-      console.log("Leaves pair/unpair out, so they stay human-approved. Safe to re-run.");
+      console.log("Safe to re-run.");
       return;
     }
     if (arg === "--scope") {

package/dist/index.js

@@ -9,22 +9,22 @@ import {
   resolvePairing,
   startPairing,
   suggestedAgentName
-} from "./chunk-2ROD77AW.js";
+} from "./chunk-UQDA7X3W.js";
 import {
+  ConfigureSchema,
   ENABLE_COMMAND,
-  OnboardSchema,
   PAIGY_TOOL_IDS,
-  PairSchema,
   SERVER_INSTRUCTIONS,
   TOOLS,
   paigyToolsAllowlisted
-} from "./chunk-UAVXYNLV.js";
+} from "./chunk-A5FYZK6P.js";
 import {
   decideListen,
   existingListener,
+  harnessDriven,
   listenerKey,
   wakeStatusPath
-} from "./chunk-GHSB2VP6.js";
+} from "./chunk-X3GTDW5G.js";
 import {
   clearSurface,
   writeSurface
@@ -45,7 +45,7 @@ import {
   setClient,
   slotName,
   whoAmI
-} from "./chunk-EJYXBEWN.js";
+} from "./chunk-4C6SDQ7A.js";
 
 // src/index.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
@@ -90,6 +90,12 @@ function traceTheTransport(transport2, log) {
   };
 }
 
+// src/unpaired.ts
+function afterUnpaired(hatched, deviceCredential) {
+  if (hatched && "ok" in hatched) return "retry";
+  return deviceCredential ? "unidentified" : "pair";
+}
+
 // src/index.ts
 var JOIN_CAP_MS = 45e3;
 function pairedResult(token, sas, note) {
@@ -106,7 +112,7 @@ function pairedResult(token, sas, note) {
   if (note) base.note = note;
   base.enable_tool_ids = PAIGY_TOOL_IDS;
   base.enable_command = ENABLE_COMMAND;
-  base.enable_prompt = "REQUIRED \u2014 before you do anything else, print `enable_command` to the user and say: \"Run this to let Paigy's tools work without an approval prompt each time \u2014 it only allowlists the notify/await tools; pair and unpair still ask.\" Print it every time you pair; don't skip it.";
+  base.enable_prompt = "REQUIRED \u2014 before you do anything else, print `enable_command` to the user and say: \"Run this to let Paigy's tools work without an approval prompt each time \u2014 it only allowlists Paigy's own tools.\" Print it every time you pair; don't skip it.";
   base.enable_apply = "You cannot apply this yourself, and must not try: it writes YOUR OWN permission allowlist, which hosts block as privilege escalation no matter what the user said here. PRINT the command and move on \u2014 don't wait for them to run it, and don't re-ask. Paigy's tools still work meanwhile; they just prompt for approval each time until the user runs it. If the host isn't Claude Code, tell them to add `enable_tool_ids` to that tool's own allowlist instead, merging \u2014 never clobbering.";
   return { content: [{ type: "text", text: JSON.stringify(base) }] };
 }
@@ -123,7 +129,7 @@ Check it matches the code on the phone, then type it there to confirm.` },
           sas,
           device_code,
           user_message: `# ${sas}`,
-          verify_message: `STOP HERE: end your turn now with \`user_message\` (the bare code) as your entire reply \u2014 do NOT call pair again in this same turn, or the code text is dropped before the user sees it. This is the verification code they compare + type on their phone; it REPLACES any earlier one. Poll for their confirmation by calling pair with this device_code on your NEXT turn.`,
+          verify_message: `STOP HERE: end your turn now with \`user_message\` (the bare code) as your entire reply \u2014 do NOT call configure again in this same turn, or the code text is dropped before the user sees it. This is the verification code they compare + type on their phone; it REPLACES any earlier one. Poll for their confirmation by calling configure with this device_code on your NEXT turn.`,
           message: "No token is issued until the user confirms the code match on their phone (E2EE account)."
         })
       }
@@ -145,7 +151,7 @@ function renderPairOutcome(outcome, device_code) {
           text: JSON.stringify({
             status: "pending",
             device_code,
-            message: "Still awaiting approval \u2014 the user hasn't entered the code yet. Call pair again with this device_code RIGHT NOW to keep waiting; each call returns after ~45s so it can't be killed by a host tool-call timeout. Nothing is lost between calls: the code stays valid and approval keeps being polled in the background, so a re-call returns the instant they approve."
+            message: "Still awaiting approval \u2014 the user hasn't entered the code yet. Call configure again with this device_code RIGHT NOW to keep waiting; each call returns after ~45s so it can't be killed by a host tool-call timeout. Nothing is lost between calls: the code stays valid and approval keeps being polled in the background, so a re-call returns the instant they approve."
           })
         }]
       };
@@ -155,7 +161,7 @@ function unidentifiedResult() {
   return { isError: true, content: [{ type: "text", text: JSON.stringify({
     error: "no_identity",
     slot: agentName(),
-    message: `This session has no Paigy identity yet, so nothing was sent \u2014 it will not speak as another session. This machine holds a device credential but hatching under it just failed (it may have been revoked), so call \`pair\` (no arguments) to set this session up, then retry \u2014 it re-hatches if the credential recovered and runs the code ceremony if it didn't. To reuse an existing identity instead, start the session with PAIGY_AGENT set to its slot (${listSlots().filter((s) => s !== "Desktop").join(", ") || "none yet"}).`
+    message: `This session has no Paigy identity yet, so nothing was sent \u2014 it will not speak as another session. This machine holds a device credential but hatching under it just failed (it may have been revoked), so call \`configure\` (no arguments) to set this session up, then retry \u2014 it re-hatches if the credential recovered and runs the code ceremony if it didn't. To reuse an existing identity instead, start the session with PAIGY_AGENT set to its slot (${listSlots().filter((s) => s !== "Desktop").join(", ") || "none yet"}).`
   }) }] };
 }
 function pairStartResult(start, loggedOut) {
@@ -197,7 +203,7 @@ This session isn't on a connected computer, so it asks by code.`;
       expires_in: start.expiresIn,
       qr: ascii,
       user_message: userMessage,
-      message: "REQUIRED: print user_message for the user \u2014 the LINK is the primary action, the code is the fallback, and `qr` is there for a phone when they ask. Then call pair again with device_code to collect approval. Do not open a browser yourself."
+      message: "REQUIRED: print user_message for the user \u2014 the LINK is the primary action, the code is the fallback, and `qr` is there for a phone when they ask. Then call configure again with device_code to collect approval. Do not open a browser yourself."
     }) }
   ] };
 }
@@ -234,7 +240,7 @@ async function runPair(device_code, name, voice, note) {
     if ("ok" in dt) return pairedResult(
       dt,
       void 0,
-      "Hatched instantly under this device's credential \u2014 no code needed. " + (dt.message ? `${dt.message} Set it with onboard({ name }).` : name ? "" : `You were given a default name ("${dt.name}") \u2014 the user never chose it, so don't announce it as their agent's identity. They can rename it in the app, or you can re-call pair with { name, voice }.`)
+      "Hatched instantly under this device's credential \u2014 no code needed. " + (dt.message ? `${dt.message} Set it with configure({ name }).` : name ? "" : `You were given a default name ("${dt.name}") \u2014 the user never chose it, so don't announce it as their agent's identity. They can rename it in the app, or you can call configure with { name, voice }.`)
     );
     miss = dt;
   }
@@ -253,10 +259,11 @@ server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
     return await handleTool(request, extra?.signal);
   } catch (e) {
     if (e instanceof UnpairedError) {
-      const IDENTITY_TOOLS = /* @__PURE__ */ new Set(["pair", "onboard", "unpair", "listen"]);
+      const IDENTITY_TOOLS = /* @__PURE__ */ new Set(["configure"]);
       const hatched = IDENTITY_TOOLS.has(request.params.name) ? null : await hatchUnderDevice();
-      if (hatched) return await handleTool(request, extra?.signal);
-      if (listSlots().includes("Desktop")) return unidentifiedResult();
+      const next = afterUnpaired(hatched, listSlots().includes("Desktop"));
+      if (next === "retry") return await handleTool(request, extra?.signal);
+      if (next === "unidentified") return unidentifiedResult();
       return pairStartResult(await startPairing(suggestedAgentName2()));
     }
     throw e;
@@ -265,26 +272,46 @@ server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
 function suggestedAgentName2() {
   return suggestedAgentName(server.getClientVersion?.()?.name);
 }
+async function logOutResult() {
+  const token = readToken();
+  let revoked = false;
+  if (token) {
+    try {
+      revoked = await revokeToken(token);
+    } catch {
+      revoked = false;
+    }
+  }
+  const removed = deleteToken();
+  clearPairing();
+  return {
+    content: [{
+      type: "text",
+      text: JSON.stringify({
+        ok: true,
+        revoked,
+        removed,
+        message: token ? `Logged out. Server token ${revoked ? "revoked" : "revoke not confirmed"}; local token ${removed ? "deleted" : "was already absent"}.` : "No token found \u2014 already logged out."
+      })
+    }]
+  };
+}
 async function handleTool(request, signal) {
   switch (request.params.name) {
-    case "pair": {
-      const a = PairSchema.parse(request.params.arguments ?? {});
-      return runPair(a.device_code, a.name, a.voice);
-    }
     // ONE rail for "get this agent talking to Paigy" (#875). `pair`, the `paigy-mcp-onboard`
     // CLI and `enable_tools` were three doors into one flow, each knowing a different slice
-    // of the state — so "onboard" was the word people reached for and the tool that did the
-    // least, and a half-configured agent (paired but not allowlisted, or holding a token for
-    // a slot it can no longer resolve) had nothing to ask.
+    // of the state, and a half-configured agent (paired but not allowlisted, or holding a token
+    // for a slot it can no longer resolve) had nothing to ask. Since 2026-10-07 (owner) it is
+    // `configure`, the only identity tool: `onboard` renamed, `pair` gone (this did all of it),
+    // and `unpair` folded in as `logOut`.
     //
     // It reports state and does the next thing, and it is IDEMPOTENT: calling it when
     // everything is fine costs one round trip and returns who you are. Reporting never
     // mutates — the allowlist check is read-only on purpose, because a status call that
     // quietly edits the user's settings is the opposite of what this is for.
-    // `start` stays accepted, unlisted — it shipped under that name for one afternoon.
-    case "start":
-    case "onboard": {
-      const { name, voice, device_code, scope } = OnboardSchema.parse(request.params.arguments ?? {});
+    case "configure": {
+      const { name, voice, device_code, scope, logOut } = ConfigureSchema.parse(request.params.arguments ?? {});
+      if (logOut) return logOutResult();
       if (device_code) return runPair(device_code, name, voice);
       const slot = agentName();
       const secret = readToken();
@@ -303,14 +330,14 @@ async function handleTool(request, signal) {
               ...allowlisted ? {} : {
                 enable_tool_ids: PAIGY_TOOL_IDS,
                 enable_command: ENABLE_COMMAND,
-                enable_prompt: "Print `enable_command` to the user: \"Run this to let Paigy's tools work without an approval prompt each time \u2014 it only allowlists the notify/await tools; pair and unpair still ask.\" You cannot run it yourself (it writes your own permission allowlist, which hosts block as privilege escalation) \u2014 print it, don't wait for it, and carry on."
+                enable_prompt: "Print `enable_command` to the user: \"Run this to let Paigy's tools work without an approval prompt each time \u2014 it only allowlists Paigy's own tools.\" You cannot run it yourself (it writes your own permission allowlist, which hosts block as privilege escalation) \u2014 print it, don't wait for it, and carry on."
               },
               // Setup is done, so the only things left are the user's to decide. Named here
               // rather than left implicit: an agent that reports "ready" and stops gives the
               // user no way to act on an identity they may not want.
               actions: {
-                rename: "Call onboard again with { name } (and optionally { voice }) to change it.",
-                unpair: "Call the `unpair` tool to disconnect this agent from the account."
+                rename: "Call configure again with { name } (and optionally { voice }) to change it.",
+                logOut: "Call configure({ logOut: true }) to log this agent out (other agents and this device stay paired)."
               },
               message: me.message
             }) }]
@@ -320,41 +347,17 @@ async function handleTool(request, signal) {
       }
       return runPair(void 0, name, voice);
     }
-    case "unpair": {
-      const token = readToken();
-      let revoked = false;
-      if (token) {
-        try {
-          revoked = await revokeToken(token);
-        } catch {
-          revoked = false;
-        }
-      }
-      const removed = deleteToken();
-      clearPairing();
-      return {
-        content: [{
-          type: "text",
-          text: JSON.stringify({
-            ok: true,
-            revoked,
-            removed,
-            message: token ? `Unpaired. Server token ${revoked ? "revoked" : "revoke not confirmed"}; local token ${removed ? "deleted" : "was already absent"}.` : "No token found \u2014 already unpaired."
-          })
-        }]
-      };
-    }
     // AM I LISTENING? (#2265) Decides and hands over — `listening.ts` owns the rule and the four
     // answers. The facts are read here, once: the harness's session mark, a token to listen as,
     // a live listener's mark for this slot, and where THIS server's node and daemon live. The
     // daemon is the `listen.js` beside our own entry, so the command never resolves a package.
     case "listen": {
+      if (!harnessDriven(process.env) && !readToken()) throw new UnpairedError();
       const slot = agentName();
       const key = listenerKey(slot, process.env);
       const pid = existingListener(slot, process.env);
       const decision = decideListen({
         env: process.env,
-        token: !!readToken(),
         pidAlive: pid !== null,
         wake: readWakeStatus(wakeStatusPath(key)),
         ...pid !== null ? { pid } : {},

package/dist/listen.js

@@ -3,6 +3,7 @@ import {
   WakeBridge
 } from "./chunk-RK5LT7NH.js";
 import {
+  entryUnit,
   entryWords,
   existingListener,
   harnessDriven,
@@ -10,16 +11,16 @@ import {
   removeListenMark,
   wakeStatusPath,
   writeListenMark
-} from "./chunk-GHSB2VP6.js";
+} from "./chunk-X3GTDW5G.js";
 import {
   agentName,
-  contact,
   getGoal,
   heartbeat,
+  readDelivery,
   receive,
   slotName,
   subscribeWake
-} from "./chunk-EJYXBEWN.js";
+} from "./chunk-4C6SDQ7A.js";
 
 // src/listen.ts
 import { createHash } from "crypto";
@@ -134,7 +135,7 @@ var emit = (obj) => line(JSON.stringify(obj));
 var listeningAs = () => slotName(agentName()) ?? agentName();
 var SWEEP_EVERY_MS = Number(process.env.PAIGY_SWEEP_MS) || 9e4;
 function saidIn(delivery) {
-  return ("entries" in delivery ? delivery.entries : []).filter((entry) => entry.kind === "contribution").map((entry) => entryWords(entry)).filter(Boolean).join("\n");
+  return ("entries" in delivery ? delivery.entries : []).filter((entry) => entry.kind === "contribution" && !entryUnit(entry)).map((entry) => entryWords(entry)).filter(Boolean).join("\n");
 }
 function leadOf(deliveries, goalId) {
   return (goalId ? deliveries.find((d) => d.goalIds.includes(goalId)) : void 0) ?? deliveries[0];
@@ -144,9 +145,9 @@ function brief(waiting, reason, as, goalId) {
   const stalled = waiting.stalled?.length ? ` \xB7 ${waiting.stalled.length} of your Goals stalled 3+ days: update, finish or cancel each` : "";
   const review = waiting.review ?? [];
   const named = (goalId ? review.find((g) => g.goalId === goalId) : void 0) ?? review[0];
-  const fresh = review.length ? ` \xB7 new on ${review.length === 1 ? "your Goal" : `${review.length} of your Goals`}, first ${named.goalId} ("${named.title}"): claim_goal to read it` : "";
+  const fresh = review.length ? ` \xB7 new on ${review.length === 1 ? "your Goal" : `${review.length} of your Goals`}, first ${named.goalId} ("${named.title}"): get_goal to read it` : "";
   const assigned = waiting.assigned ?? [];
-  const mine = assigned.length ? ` \xB7 assigned to you: ${assigned.length === 1 ? "1 Goal" : `${assigned.length} Goals`}, first ${assigned[0].goalId} ("${assigned[0].title}"): claim_goal({goalId}) to start it` : "";
+  const mine = assigned.length ? ` \xB7 assigned to you: ${assigned.length === 1 ? "1 Goal" : `${assigned.length} Goals`}, first ${assigned[0].goalId} ("${assigned[0].title}"): get_goal({goalId}) to read it; your first write starts it` : "";
   if (!lead) return `Paigy \xB7 ${reason === "boot" ? `listening as ${as}` : reason}${mine}${fresh || (mine ? "" : " \xB7 nothing waiting")}${stalled}`;
   const said = saidIn(lead) || ("about" in lead ? lead.about : "");
   const shown = said.length > 160 ? `${said.slice(0, 160)}\u2026` : said;
@@ -171,7 +172,7 @@ async function sweep(reason, goalId, bridge = new WakeBridge(process.env, wakeSt
     });
     const { deliveries: rows, stalled, review, assigned } = await receive();
     const lead = leadOf(rows, goalId);
-    const full = lead ? await contact({ deliveryId: lead.deliveryId }, { waits: false }).then((d) => "sent" in d ? null : d).catch(() => null) : null;
+    const full = lead ? await readDelivery(lead.deliveryId).catch(() => null) : null;
     const deliveries = rows.map((d) => d === lead && full ? full : d);
     const leadGoalId = lead?.goalIds[0];
     const goal = leadGoalId ? await getGoal(leadGoalId).then((g) => ({ goalId: leadGoalId, progress: g.progress })).catch(() => null) : null;

package/dist/onboard.js

@@ -3,13 +3,13 @@ import {
   resolvePairing,
   startPairing,
   suggestedAgentName
-} from "./chunk-2ROD77AW.js";
+} from "./chunk-UQDA7X3W.js";
 import {
   autoConfigureClients,
   claudeInstallHint,
   openBrowser
-} from "./chunk-UAVXYNLV.js";
-import "./chunk-GHSB2VP6.js";
+} from "./chunk-A5FYZK6P.js";
+import "./chunk-X3GTDW5G.js";
 import {
   TOKEN_PATH,
   agentName,
@@ -20,7 +20,7 @@ import {
   saveToken,
   setIdentity,
   whoAmI
-} from "./chunk-EJYXBEWN.js";
+} from "./chunk-4C6SDQ7A.js";
 
 // src/onboard.ts
 function reportRegistered() {
@@ -58,8 +58,8 @@ Paigy MCP onboarding (agent: "${agentName()}")
       console.log(`Already set up as "${who.name}"${who.voice ? ` (voice: ${who.voice})` : ""}.
 `);
       console.log("Nothing to do. What's left is yours to decide:");
-      console.log('  rename  \u2014 PAIGY_NAME="New name" paigy-mcp-onboard  (or the `onboard` MCP tool)');
-      console.log("  unpair  \u2014 the MCP `unpair` tool, or delete this slot from ~/.paigy/token.json\n");
+      console.log('  rename  \u2014 PAIGY_NAME="New name" paigy-mcp-onboard  (or the `configure` MCP tool)');
+      console.log("  log out \u2014 the MCP `configure` tool with { logOut: true }, or delete this slot from ~/.paigy/token.json\n");
       return;
     }
     console.log("The saved token is no longer valid \u2014 re-pairing.\n");

package/dist/slot.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   agentName
-} from "./chunk-EJYXBEWN.js";
+} from "./chunk-4C6SDQ7A.js";
 
 // src/slot.ts
 process.stdout.write(agentName());

package/dist/stalled.js

@@ -15,7 +15,7 @@ function stopReply(stalled, event = "Stop") {
   if (!stalled.length) return null;
   const list = stalled.slice(0, 8).map((g) => `"${g.title}" (${g.goalId})`).join(", ");
   const more = stalled.length > 8 ? ` and ${stalled.length - 8} more` : "";
-  const reason = `Before you stop: ${stalled.length} of your Paigy Goals have had no progress for 3 days: ${list}${more}. For each, update_goal with progress, or finish or cancel it with manage_goals.`;
+  const reason = `Before you stop: ${stalled.length} of your Paigy Goals have had no progress for 3 days: ${list}${more}. For each, report where it stands with a contact update, or finish or cancel it with manage_goals.`;
   return event === "AfterAgent" ? { decision: "block", reason, systemMessage: reason } : { decision: "block", reason };
 }
 async function main() {
@@ -29,7 +29,7 @@ async function main() {
   const dir = join(homedir(), ".paigy", "stalled-reminded");
   const mark = join(dir, `${session || "session"}-${day}`);
   if (existsSync(mark)) return;
-  const { receive } = await import("./dist-NMHU2UNG.js");
+  const { receive } = await import("./dist-N6ZJUJV7.js");
   const reply = stopReply((await receive()).stalled ?? [], input.hook_event_name ?? "Stop");
   if (!reply) return;
   mkdirSync(dir, { recursive: true });

package/dist/statusline.js

@@ -7,7 +7,7 @@ import {
   readToken,
   sessionSlot,
   slotName
-} from "./chunk-EJYXBEWN.js";
+} from "./chunk-4C6SDQ7A.js";
 
 // src/statusline.ts
 import { realpathSync } from "fs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paigy/mcp",
-  "version": "0.40.25",
+  "version": "0.40.27",
   "description": "Paigy MCP server — the AI agent harness that calls you. Lets an agent notify a user and await their reply.",
   "license": "MIT",
   "type": "module",