@pipeshub-ai/mcp 2.3.0 → 2.3.2

package/bin/pipeshub.js

@@ -166,7 +166,7 @@ function toolErrorToExit(message) {
   const m = message.match(/\(HTTP\s+(\d{3})/i);
   if (m && m[1] !== undefined)
     return statusToExit(Number(m[1]));
-  if (/\b401\b|unautheni?ticated|no token provided/i.test(message)) {
+  if (/\b401\b|unautheni?ticated|no token provided|token expired|been revoked/i.test(message)) {
     return EXIT.UNAUTHENTICATED;
   }
   if (/\b403\b|not have permission|forbidden/i.test(message)) {
@@ -366,6 +366,116 @@ RUN npm install -g "@pipeshub-ai/mcp@${version}" \\
  && pipeshub --help >/dev/null
 # ----------------------------------------------------------------------------
 `;
+function stripJsonComments(src) {
+  let out = "";
+  let inString = false;
+  let inLine = false;
+  let inBlock = false;
+  for (let i = 0;i < src.length; i++) {
+    const c = src[i];
+    const next = src[i + 1];
+    if (inLine) {
+      if (c === `
+`) {
+        inLine = false;
+        out += c;
+      }
+      continue;
+    }
+    if (inBlock) {
+      if (c === "*" && next === "/") {
+        inBlock = false;
+        i++;
+      }
+      continue;
+    }
+    if (inString) {
+      out += c;
+      if (c === "\\") {
+        out += next ?? "";
+        i++;
+        continue;
+      }
+      if (c === '"')
+        inString = false;
+      continue;
+    }
+    if (c === '"') {
+      inString = true;
+      out += c;
+      continue;
+    }
+    if (c === "/" && next === "/") {
+      inLine = true;
+      i++;
+      continue;
+    }
+    if (c === "/" && next === "*") {
+      inBlock = true;
+      i++;
+      continue;
+    }
+    out += c;
+  }
+  return out;
+}
+function dropTrailingCommas(src) {
+  let out = "";
+  let inString = false;
+  for (let i = 0;i < src.length; i++) {
+    const c = src[i];
+    if (inString) {
+      out += c;
+      if (c === "\\") {
+        out += src[i + 1] ?? "";
+        i++;
+        continue;
+      }
+      if (c === '"')
+        inString = false;
+      continue;
+    }
+    if (c === '"') {
+      inString = true;
+      out += c;
+      continue;
+    }
+    if (c === ",") {
+      let j = i + 1;
+      while (j < src.length && /\s/.test(src[j]))
+        j++;
+      if (src[j] === "}" || src[j] === "]")
+        continue;
+    }
+    out += c;
+  }
+  return out;
+}
+async function readDeploymentShape(dest) {
+  try {
+    const raw = await readFile(join(dest, "qm.config.jsonc"), "utf8");
+    const cfg = JSON.parse(dropTrailingCommas(stripJsonComments(raw)));
+    const target = typeof cfg.target === "string" ? cfg.target : undefined;
+    const backend = typeof cfg.sandbox?.backend === "string" ? cfg.sandbox.backend : undefined;
+    if (!target && !backend)
+      return null;
+    return { target, backend };
+  } catch {
+    return null;
+  }
+}
+function imageSkipReason(shape) {
+  if (!shape)
+    return null;
+  if (shape.backend === "aws")
+    return "aws-microvm";
+  if (shape.backend === "sprites" || shape.target === "fly") {
+    return "sprites-ignores-image";
+  }
+  if (shape.target === "aws")
+    return "sprites-ignores-image";
+  return null;
+}
 async function initQm(targetDir, force) {
   const root = await packageRoot();
   const bundle = join(root, "qm");
@@ -374,6 +484,7 @@ async function initQm(targetDir, force) {
   }
   const version = await packageVersion(root);
   const dest = resolve(targetDir);
+  const shape = await readDeploymentShape(dest);
   const written = [];
   const skipped = [];
   for (const sub of ["tools/pipeshub", "skills/pipeshub"]) {
@@ -381,7 +492,12 @@ async function initQm(targetDir, force) {
   }
   const dockerfile = join(dest, "sandbox", "Dockerfile");
   let dockerfileAction;
-  if (!await exists(dockerfile)) {
+  const skipReason = imageSkipReason(shape);
+  let staleDockerfile = false;
+  if (skipReason !== null) {
+    staleDockerfile = await exists(dockerfile);
+    dockerfileAction = "skipped-unusable";
+  } else if (!await exists(dockerfile)) {
     await copyFile(join(bundle, "sandbox", "Dockerfile"), dockerfile);
     const body = await readFile(dockerfile, "utf8");
     await writeFile(dockerfile, body.replace(/ARG PIPESHUB_CLI_VERSION=.*/, `ARG PIPESHUB_CLI_VERSION=${version}`), "utf8");
@@ -404,7 +520,16 @@ async function initQm(targetDir, force) {
   } catch (e) {
     throw new CliError(`the QM bundle is incomplete — could not read ${fragmentPath} ` + `(${e.message}). Reinstall @pipeshub-ai/mcp.`);
   }
-  return { written, skipped, dockerfileAction, version, configFragment };
+  return {
+    written,
+    skipped,
+    dockerfileAction,
+    version,
+    configFragment,
+    shape,
+    skipReason,
+    staleDockerfile
+  };
 }
 function renderInitReport(dest, r) {
   const lines = [];
@@ -416,6 +541,34 @@ function renderInitReport(dest, r) {
   for (const f of r.skipped)
     lines.push(`  kept    ${f}  (already existed — use --force to replace)`);
   lines.push("");
+  if (r.dockerfileAction === "skipped-unusable") {
+    if (r.skipReason === "aws-microvm") {
+      lines.push("No sandbox/Dockerfile was written: AWS Lambda MicroVM sandboxes");
+      lines.push("have no way to install a binary, so the file could never run.");
+    } else {
+      lines.push("No sandbox/Dockerfile was written: Fly Sprites boot the stock");
+      lines.push("image and ignore a published one, so the file would look like the");
+      lines.push("install path while never running.");
+    }
+    lines.push("The skill installs the CLI on first use instead — that is the line");
+    lines.push("that actually executes, and it needs nothing from you.");
+    lines.push("");
+  }
+  if (r.staleDockerfile) {
+    lines.push("ACTION NEEDED: sandbox/Dockerfile already exists here, written by an");
+    lines.push("earlier version. This deployment cannot use it, and upcoming QM");
+    lines.push("validation rejects it rather than ignoring it — `qm check` will fail");
+    lines.push("with an error naming that file. Delete it, or remove the PipesHub");
+    lines.push("install block if the rest of it is yours.");
+    lines.push("");
+  }
+  if (r.skipReason === "aws-microvm") {
+    lines.push("Heads up on AWS: with Lambda MicroVM sandboxes the CLI cannot be");
+    lines.push("installed at all (yc-software/qm#350). The tool's guidance, network");
+    lines.push("allowlist, and approval rules still apply, but the binary will be");
+    lines.push("missing. The sprites backend is what this bundle is tested against.");
+    lines.push("");
+  }
   if (r.dockerfileAction === "appended") {
     lines.push("Appended the install block to your existing sandbox/Dockerfile.");
   } else if (r.dockerfileAction === "manual") {
@@ -424,20 +577,22 @@ function renderInitReport(dest, r) {
   lines.push("");
   lines.push("Two things left to do:");
   lines.push("");
-  lines.push("1. Set your PipesHub origin in qm.config.jsonc. It must be a PUBLIC");
-  lines.push("   HTTPS address — QM sandboxes do not run on your machine, so");
-  lines.push("   localhost and LAN addresses are unreachable from them:");
+  lines.push("1. Set `egress` in sandbox/tools/pipeshub/tool.json to your PipesHub");
+  lines.push("   hostname (no scheme, no path). It must be reachable over public HTTPS");
+  lines.push("   — QM sandboxes do not run on your machine, so localhost is unreachable.");
   lines.push("");
-  lines.push('     "sandbox": {');
-  lines.push('       "env": { "PIPESHUB_BASE_URL": "https://pipeshub.your-company.com" }');
-  lines.push("     }");
+  lines.push("2. Each person adds two personal keychain entries (service: pipeshub):");
+  lines.push("     PIPESHUB_TOKEN     → their PAT (never paste it into chat)");
+  lines.push("     PIPESHUB_BASE_URL  → public HTTPS origin, no /mcp path");
+  lines.push("   Do NOT put a token in sandbox.secretEnv (org-wide). Do NOT rely on");
+  lines.push("   sandbox.env for the URL — it does not reach the sandbox.");
   lines.push("");
-  lines.push("   Do NOT put anyone's token in sandbox.secretEnv — that is org-wide and");
-  lines.push("   would hand one person's credential to everybody. Each person adds");
-  lines.push("   their own to their own keychain (service: pipeshub, kind: env).");
+  lines.push("Then:  qm check && qm up");
   lines.push("");
-  lines.push("2. Set `egress` in sandbox/tools/pipeshub/tool.json to your hostname,");
-  lines.push("   then run:  qm check && qm sandbox publish && qm up");
+  if (r.dockerfileAction !== "skipped-unusable") {
+    lines.push("On Sprites, `qm sandbox publish` does not put pipeshub on PATH.");
+    lines.push("The skill installs the CLI on first use.");
+  }
   return lines.join(`
 `);
 }
@@ -508,19 +663,25 @@ function connectHelp(ctx) {
     "Add your Personal Access Token to your own QM keychain:",
     "",
     "  1. In PipesHub, open Developer Settings → Personal Access Tokens.",
-    "  2. Create a token. Deselect every scope, then select only:",
-    "       conversation:chat  semantic:write  kb:read  user:read  connector:read",
-    "  3. In QM, add it to YOUR keychain (not a shared room) as:",
+    "  2. Create a token. The panel defaults are fine — do not deselect scopes,",
+    "     and do not add semantic:read if asked.",
+    "  3. In QM, add two personal keychain credentials (not a shared room):",
+    "       service: pipeshub",
+    "       environment variable: PIPESHUB_TOKEN",
+    "       value: the token only — no URL, no KEY= prefix",
+    "     and",
     "       service: pipeshub",
-    "       kind:    env",
-    "       value:   <the token value only — no URL, no KEY= prefix>",
+    "       environment variable: PIPESHUB_BASE_URL",
+    "       value: public HTTPS origin, no /mcp path",
     "",
-    "It arrives in your sandbox as $PIPESHUB_TOKEN on the next turn.",
+    "They arrive in your sandbox on the next turn.",
     "",
     "Never paste the token into a chat message: chat transcripts are durable",
     "and pass through the model provider. The keychain exists to avoid that.",
     "",
-    `The base URL is set by your admin and is currently: ${ctx.origin || "(unset)"}`
+    `The base URL currently visible here is: ${ctx.origin || "(unset)"}`,
+    "If it is unset, sandbox.env did not reach this sandbox — use the",
+    "PIPESHUB_BASE_URL keychain entry (or an org service credential)."
   ].join(`
 `);
   return { exit: EXIT.OK, payload: { requestId: ctx.requestId, help: text }, text };
@@ -613,7 +774,7 @@ async function ask(ctx, query, conversationId, chatMode) {
       citationCount: citations.length,
       citations,
       confidence: obj["confidence"] ?? null,
-      warning: citations.length === 0 ? "No citations. Treat this answer as ungrounded — it is not supported " + "by any retrieved document." : null
+      warning: citations.length === 0 ? "No citations — unsourced, so nothing in it can be verified. If " + "this is a refusal, relay it. If it asserts facts, do not repeat " + "them. Ignore confidence." : null
     }
   };
 }
@@ -876,7 +1037,7 @@ async function run(argv) {
   }
   if (origin === null) {
     const alsoNoToken = token === null ? " Your PipesHub credential is also missing ($PIPESHUB_TOKEN is unset)." : "";
-    throw new CliError("PIPESHUB_BASE_URL is not set — an admin sets it once for the deployment." + alsoNoToken + " Run 'pipeshub auth connect-help' for the steps.", EXIT.USAGE);
+    throw new CliError("PIPESHUB_BASE_URL is not set — it must reach the sandbox as an env var " + "(keychain or org service credential, not sandbox.env)." + alsoNoToken + " Run 'pipeshub auth connect-help' for the steps.", EXIT.USAGE);
   }
   if (token === null) {
     throw new CliError("No PipesHub credential found ($PIPESHUB_TOKEN is unset). " + "Run 'pipeshub auth connect-help' for setup steps.", EXIT.UNAUTHENTICATED);
@@ -942,5 +1103,5 @@ var code = await run(process.argv.slice(2)).catch(async (e) => {
 });
 process.exit(code);
 
-//# debugId=D78484EFB8F0261E64756E2164756E21
+//# debugId=593C31ACCEC7553364756E2164756E21
 //# sourceMappingURL=pipeshub.js.map