@pipeshub-ai/mcp 2.3.0 → 2.3.2

package/README.md

@@ -6,7 +6,7 @@ PipesHub exposes a remote MCP endpoint over **Streamable HTTP** at `/mcp`.MCP Cl
 
 > **Looking for the tool reference?** See [TOOLS.md](./TOOLS.md) for descriptions, arguments, and a decision guide for each tool the MCP server exposes (`pipeshub_chat`, `pipeshub_search`, `pipeshub_download_record`, `pipeshub_directory`, `pipeshub_sources`).
 
-> **Using QM?** QM cannot attach a third-party MCP endpoint — it is an MCP *server* to its own harness, not a client. Install the deployment-layer bundle in [`qm/`](./qm/) instead, which gives QM agents a `pipeshub` command inside their sandbox. This package ships that command as a second bin.
+> **Using QM?** QM cannot attach a third-party MCP endpoint — it is an MCP *server* to its own harness, not a client. Follow [Use PipesHub with QM](./qm/docs/use-with-qm.md). The deployment-layer bundle in [`qm/`](./qm/) gives agents a `pipeshub` command inside their sandbox; this package ships that command as a second bin.
 
 ## Prerequisites
 

package/bin/mcp-server.js

@@ -53098,7 +53098,10 @@ var init_agentsListAgents = __esm(() => {
 });
 
 // src/mcp-server/tools/_helpers.ts
-async function readJson(response) {
+async function readJson(response, context = "PipesHub request") {
+  const httpErr = await httpErrorResult(response, context);
+  if (httpErr)
+    return { ok: false, result: httpErr };
   const text = await response.text();
   if (!text) {
     return {
@@ -53127,6 +53130,13 @@ ${text.slice(0, 500)}`
     };
   }
 }
+function expiredTokenError(exp) {
+  if (typeof exp !== "number" || !Number.isFinite(exp))
+    return null;
+  if (exp * 1000 > Date.now())
+    return null;
+  return errorResult(`The access token expired on ${new Date(exp * 1000).toISOString()}. ` + "Mint a new personal access token in PipesHub under " + "Developer Settings → Personal Access Tokens.");
+}
 function jsonResult(value) {
   return {
     content: [{ type: "text", text: JSON.stringify(value, null, 2) }]
@@ -53153,11 +53163,15 @@ async function httpErrorResult(response, context) {
       message = candidate || body;
     } catch {}
   }
-  const detail = message ? ` ${message.slice(0, 400)}` : "";
+  const reason = message.slice(0, 400).trim();
+  const detail = reason ? ` ${/[.!?]$/.test(reason) ? reason : `${reason}.`}` : "";
   const auth = response.status === 401 || response.status === 403 ? " Check that the bearer token / credentials are valid and not expired." : "";
   return errorResult(`${context} failed (HTTP ${response.status} ${response.statusText}).${detail}${auth}`);
 }
-async function readValidated(response, schema) {
+async function readValidated(response, schema, context = "PipesHub request") {
+  const httpErr = await httpErrorResult(response, context);
+  if (httpErr)
+    return { ok: false, result: httpErr };
   const text = await response.text();
   if (!text) {
     return { ok: false, result: errorResult("Empty response from server") };
@@ -53791,7 +53805,7 @@ When presenting results to the user, link each record using its
       }, { fetchOptions: { signal: ctx.signal } }).$inspect();
       if (!result.ok)
         return errorResult(result.error.message);
-      const parsed = await readJson(result.value);
+      const parsed = await readJson(result.value, "PipesHub search");
       if (!parsed.ok)
         return parsed.result;
       const sr = parsed.value.searchResponse ?? {};
@@ -54806,7 +54820,7 @@ var init_pipeshubDirectory = __esm(() => {
       "list_groups",
       "list_my_teams"
     ]).describe(`What to do:
-` + "- `whoami` — return the authenticated user's identity (decoded from " + `the bearer JWT). No other args needed.
+` + "- `whoami` — return the authenticated user's identity, confirmed " + `against the server. No other args needed.
 ` + "- `list_users` — paginated list of org users. Optional `page`, " + "`limit`, `search` (substring match against name or email).\n" + "- `get_user` — full profile for one user. Required `userId`. " + "Use `whoami` to find your own id first if needed.\n" + "- `list_groups` — paginated list of user groups (with `userCount`).\n" + "- `list_my_teams` — teams the authenticated user belongs to, with " + "capability flags."),
     userId: string2().optional().describe("Required when `action` is `get_user`. 24-character ObjectId."),
     page: number2().int().min(1).optional().describe("Pagination — 1-based page number. Used by list_* actions."),
@@ -54820,7 +54834,8 @@ actions — pick the right \`action\`:
 
 - \`whoami\` — who is the caller?  Use this whenever you need the
   authenticated user's own id, email, or full name (e.g. before
-  \`get_user\` on themselves).
+  \`get_user\` on themselves). Errors if the credential is expired
+  or revoked.
 - \`list_users\` — search / page through org users.
 - \`get_user\` — full \`User\` document for one user (requires \`userId\`).
 - \`list_groups\` — list user groups with \`userCount\`.
@@ -54845,13 +54860,39 @@ Output shape varies by action; see each action's docs above.`,
           if (!claims) {
             return errorResult("No bearer token configured on the SDK client, so `whoami` " + "cannot resolve the caller's identity. Ask the user for " + "their email and use `list_users` with `search`.");
           }
+          const exp = claims["exp"];
+          const expired = expiredTokenError(exp);
+          if (expired)
+            return expired;
+          const tokenExpiresAt = typeof exp === "number" ? new Date(exp * 1000).toISOString() : undefined;
+          const userId = claims["userId"];
+          let verified = "unchecked";
+          let unverifiedReason = "No userId claim in the token, so the identity could not be " + "confirmed with the server.";
+          if (typeof userId === "string" && userId) {
+            const [probe] = await usersGetUserById(client, { id: userId }, {
+              fetchOptions
+            }).$inspect();
+            if (!probe.ok) {
+              unverifiedReason = `Could not reach PipesHub to confirm the ` + `identity (${probe.error.message}). The details below come ` + `from the token itself.`;
+            } else if (probe.value.status === 401) {
+              return errorResult("PipesHub rejected this access token (HTTP 401 Unauthorized), " + "so the identity in it is no longer valid — it has most " + "likely been revoked. Mint a new personal access token " + "under Developer Settings → Personal Access Tokens.");
+            } else if (probe.value.ok) {
+              verified = true;
+              unverifiedReason = undefined;
+            } else {
+              unverifiedReason = `PipesHub returned HTTP ${probe.value.status} ` + `when confirming the identity, so it could not be checked. ` + `The details below come from the token itself.`;
+            }
+          }
           return jsonResult({
             userId: claims["userId"],
             orgId: claims["orgId"],
             email: claims["email"],
             fullName: claims["fullName"],
             mobile: claims["mobile"],
-            userSlug: claims["userSlug"]
+            userSlug: claims["userSlug"],
+            tokenExpiresAt,
+            identityVerified: verified,
+            note: unverifiedReason
           });
         }
         case "list_users": {
@@ -54862,7 +54903,7 @@ Output shape varies by action; see each action's docs above.`,
           }, { fetchOptions }).$inspect();
           if (!result.ok)
             return errorResult(result.error.message);
-          const parsed = await readJson(result.value);
+          const parsed = await readJson(result.value, "User listing");
           if (!parsed.ok)
             return parsed.result;
           return jsonResult(parsed.value);
@@ -54876,7 +54917,7 @@ Output shape varies by action; see each action's docs above.`,
           }, { fetchOptions }).$inspect();
           if (!result.ok)
             return errorResult(result.error.message);
-          const parsed = await readJson(result.value);
+          const parsed = await readJson(result.value, "User lookup");
           if (!parsed.ok)
             return parsed.result;
           return jsonResult(parsed.value);
@@ -54889,7 +54930,7 @@ Output shape varies by action; see each action's docs above.`,
           }, { fetchOptions }).$inspect();
           if (!result.ok)
             return errorResult(result.error.message);
-          const parsed = await readJson(result.value);
+          const parsed = await readJson(result.value, "Group listing");
           if (!parsed.ok)
             return parsed.result;
           return jsonResult(parsed.value);
@@ -54902,7 +54943,7 @@ Output shape varies by action; see each action's docs above.`,
           }, { fetchOptions }).$inspect();
           if (!result.ok)
             return errorResult(result.error.message);
-          const parsed = await readJson(result.value);
+          const parsed = await readJson(result.value, "Team listing");
           if (!parsed.ok)
             return parsed.result;
           return jsonResult(parsed.value);
@@ -55187,7 +55228,7 @@ are returned by default; pass \`include\` to override.`,
         }, { fetchOptions }).$inspect();
         if (!r.ok)
           return errorResult(`sources: ${r.error.message}`);
-        const parsed = await readJson(r.value);
+        const parsed = await readJson(r.value, "Knowledge base listing");
         if (!parsed.ok)
           return parsed.result;
         result["sources"] = (parsed.value.items ?? []).map((n) => ({
@@ -55209,7 +55250,7 @@ are returned by default; pass \`include\` to override.`,
         }, { fetchOptions }).$inspect();
         if (!r.ok)
           return errorResult(`${key}: ${r.error.message}`);
-        const parsed = await readJson(r.value);
+        const parsed = await readJson(r.value, "Model listing");
         if (!parsed.ok)
           return parsed.result;
         result[key] = (parsed.value.models ?? []).map((m) => ({
@@ -55560,7 +55601,7 @@ it using the \`Web URL\` from its metadata header (when present).`
     },
     {
       name: "pipeshub_directory",
-      description: "Look up people, groups, and teams in PipesHub. One tool with five\nactions — pick the right `action`:\n\n- `whoami` — who is the caller?  Use this whenever you need the\n  authenticated user's own id, email, or full name (e.g. before\n  `get_user` on themselves).\n- `list_users` — search / page through org users.\n- `get_user` — full `User` document for one user (requires `userId`).\n- `list_groups` — list user groups with `userCount`.\n- `list_my_teams` — teams the caller belongs to, with capability flags\n  (`canEdit` / `canDelete` / `canManageMembers`).\n\nOutput shape varies by action; see each action's docs above."
+      description: "Look up people, groups, and teams in PipesHub. One tool with five\nactions — pick the right `action`:\n\n- `whoami` — who is the caller?  Use this whenever you need the\n  authenticated user's own id, email, or full name (e.g. before\n  `get_user` on themselves). Errors if the credential is expired\n  or revoked.\n- `list_users` — search / page through org users.\n- `get_user` — full `User` document for one user (requires `userId`).\n- `list_groups` — list user groups with `userCount`.\n- `list_my_teams` — teams the caller belongs to, with capability flags\n  (`canEdit` / `canDelete` / `canManageMembers`).\n\nOutput shape varies by action; see each action's docs above."
     },
     {
       name: "pipeshub_agents",
@@ -59193,5 +59234,5 @@ export {
   app
 };
 
-//# debugId=90FD24D95D2C4D3664756E2164756E21
+//# debugId=B3EADAB5212D24DD64756E2164756E21
 //# sourceMappingURL=mcp-server.js.map