@productbrain/mcp 0.0.1-beta.14 → 0.0.1-beta.140

package/dist/chunk-MOPOQUJP.js

@@ -0,0 +1,312 @@
+// src/analytics.ts
+import { userInfo } from "os";
+import { PostHog } from "posthog-node";
+var client = null;
+var distinctId = "anonymous";
+var POSTHOG_HOST = "https://eu.i.posthog.com";
+function log(msg) {
+  if (process.env.MCP_DEBUG === "1") {
+    process.stderr.write(msg);
+  }
+}
+function getBuildTimeKey() {
+  try {
+    return "";
+  } catch {
+    return "";
+  }
+}
+function initAnalytics() {
+  const apiKey = process.env.POSTHOG_MCP_KEY || getBuildTimeKey();
+  if (!apiKey) {
+    log("[MCP-ANALYTICS] No PostHog key \u2014 tracking disabled (set SYNERGYOS_POSTHOG_KEY at build time for publish)\n");
+    return;
+  }
+  client = new PostHog(apiKey, {
+    host: POSTHOG_HOST,
+    flushAt: 1,
+    flushInterval: 5e3,
+    featureFlagsPollingInterval: 3e4
+  });
+  distinctId = process.env.MCP_USER_ID || fallbackDistinctId();
+  log(`[MCP-ANALYTICS] Initialized \u2014 host=${POSTHOG_HOST} distinctId=${distinctId}
+`);
+}
+function fallbackDistinctId() {
+  try {
+    return userInfo().username;
+  } catch {
+    return `os-${process.pid}`;
+  }
+}
+function trackSessionStarted(workspaceId, serverVersion) {
+  if (!client) return;
+  client.capture({
+    distinctId,
+    event: "mcp_session_started",
+    properties: {
+      workspace_id: workspaceId,
+      server_version: serverVersion,
+      source: "mcp-server",
+      $groups: { workspace: workspaceId }
+    }
+  });
+}
+function trackToolCall(fn, status, durationMs, workspaceId, errorMsg) {
+  const properties = {
+    tool: fn,
+    status,
+    duration_ms: durationMs,
+    workspace_id: workspaceId,
+    source: "mcp-server",
+    $groups: { workspace: workspaceId }
+  };
+  if (errorMsg) properties.error = errorMsg;
+  if (!client) return;
+  client.capture({
+    distinctId,
+    event: "mcp_tool_called",
+    properties
+  });
+}
+function trackSetupStarted() {
+  if (!client) return;
+  client.capture({
+    distinctId,
+    event: "mcp_setup_started",
+    properties: {
+      source: "mcp-server",
+      platform: process.platform
+    }
+  });
+}
+function trackSetupCompleted(chosenClient, outcome) {
+  if (!client) return;
+  client.capture({
+    distinctId,
+    event: "mcp_setup_completed",
+    properties: {
+      client: chosenClient,
+      outcome,
+      source: "mcp-server",
+      platform: process.platform
+    }
+  });
+}
+function trackQualityVerdict(workspaceId, props) {
+  if (!client) return;
+  client.capture({
+    distinctId,
+    event: "quality_verdict_generated",
+    properties: {
+      ...props,
+      workspace_id: workspaceId,
+      source_system: "mcp-server",
+      $groups: { workspace: workspaceId }
+    }
+  });
+}
+function trackQualityCheck(workspaceId, props) {
+  if (!client) return;
+  client.capture({
+    distinctId,
+    event: "quality_verdict_checked",
+    properties: {
+      ...props,
+      workspace_id: workspaceId,
+      source_system: "mcp-server",
+      $groups: { workspace: workspaceId }
+    }
+  });
+}
+function trackCaptureClassifierEvent(event, workspaceId, props) {
+  if (!client) return;
+  try {
+    client.capture({
+      distinctId,
+      event,
+      properties: {
+        ...props,
+        workspace_id: workspaceId,
+        source_system: "mcp-server",
+        $groups: { workspace: workspaceId }
+      }
+    });
+  } catch {
+  }
+}
+function trackCaptureClassifierEvaluated(workspaceId, props) {
+  trackCaptureClassifierEvent("mcp_capture_classifier_evaluated", workspaceId, props);
+}
+function trackCaptureClassifierAutoRouted(workspaceId, props) {
+  trackCaptureClassifierEvent("mcp_capture_classifier_auto_routed", workspaceId, props);
+}
+function trackCaptureClassifierFallback(workspaceId, props) {
+  trackCaptureClassifierEvent("mcp_capture_classifier_fallback", workspaceId, props);
+}
+function trackChainEntryCommitted(workspaceId, props) {
+  if (!client) return;
+  try {
+    client.capture({
+      distinctId,
+      event: "chain_entry_committed",
+      properties: {
+        workspace_id: workspaceId,
+        source_system: "mcp-server",
+        $groups: { workspace: workspaceId },
+        ...props
+      }
+    });
+  } catch {
+  }
+}
+function trackKnowledgeGap(workspaceId, props) {
+  if (!client) return;
+  try {
+    client.capture({
+      distinctId,
+      event: "knowledge_gap_detected",
+      properties: {
+        ...props,
+        query: props.query.slice(0, 200),
+        workspace_id: workspaceId,
+        source_system: "mcp-server",
+        $groups: { workspace: workspaceId }
+      }
+    });
+  } catch {
+  }
+}
+function trackCaptureQualityHints(workspaceId, props) {
+  if (!client) return;
+  try {
+    client.capture({
+      distinctId,
+      event: "mcp_capture_quality_hints",
+      properties: {
+        ...props,
+        workspace_id: workspaceId,
+        source_system: "mcp-server",
+        $groups: { workspace: workspaceId }
+      }
+    });
+  } catch {
+  }
+}
+function trackCaptureRelationSuggestions(workspaceId, props) {
+  if (!client) return;
+  try {
+    client.capture({
+      distinctId,
+      event: "mcp_capture_relation_suggestions",
+      properties: {
+        ...props,
+        workspace_id: workspaceId,
+        source_system: "mcp-server",
+        $groups: { workspace: workspaceId }
+      }
+    });
+  } catch {
+  }
+}
+function getPostHogClient() {
+  return client;
+}
+async function shutdownAnalytics() {
+  await client?.shutdown();
+}
+
+// src/cli/config-writer.ts
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";
+import { join, dirname } from "path";
+import { homedir, platform } from "os";
+var SERVER_ENTRY_KEY = "Product Brain";
+var LEGACY_ENTRY_KEY = "productbrain";
+var MCP_NPX_PACKAGE = "@productbrain/mcp@beta";
+function buildServerEntry(apiKey) {
+  return {
+    command: "npx",
+    args: ["-y", MCP_NPX_PACKAGE],
+    env: { PRODUCTBRAIN_API_KEY: apiKey }
+  };
+}
+function getCursorConfigPath() {
+  return join(process.cwd(), ".cursor", "mcp.json");
+}
+function getClaudeDesktopConfigPath() {
+  const os = platform();
+  if (os === "darwin") {
+    return join(
+      homedir(),
+      "Library",
+      "Application Support",
+      "Claude",
+      "claude_desktop_config.json"
+    );
+  }
+  if (os === "win32") {
+    const appData = process.env.APPDATA ?? join(homedir(), "AppData", "Roaming");
+    return join(appData, "Claude", "claude_desktop_config.json");
+  }
+  return null;
+}
+function resolveClient(name) {
+  if (name === "Cursor") {
+    return { name, configPath: getCursorConfigPath() };
+  }
+  const configPath = getClaudeDesktopConfigPath();
+  return configPath ? { name, configPath } : null;
+}
+function readJsonSafe(path) {
+  if (!existsSync(path)) return {};
+  try {
+    return JSON.parse(readFileSync(path, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+async function writeClientConfig(client2, apiKey) {
+  const config = readJsonSafe(client2.configPath);
+  const serversKey = "mcpServers";
+  if (!config[serversKey]) config[serversKey] = {};
+  if (config[serversKey][LEGACY_ENTRY_KEY]) {
+    const legacy = config[serversKey][LEGACY_ENTRY_KEY];
+    config[serversKey][SERVER_ENTRY_KEY] = {
+      ...buildServerEntry(apiKey),
+      env: { ...legacy.env, PRODUCTBRAIN_API_KEY: legacy.env?.PRODUCTBRAIN_API_KEY ?? apiKey }
+    };
+    delete config[serversKey][LEGACY_ENTRY_KEY];
+  } else {
+    const existing = config[serversKey][SERVER_ENTRY_KEY];
+    config[serversKey][SERVER_ENTRY_KEY] = existing ? { ...existing, env: { ...existing.env, PRODUCTBRAIN_API_KEY: apiKey } } : buildServerEntry(apiKey);
+  }
+  const dir = dirname(client2.configPath);
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true });
+  }
+  writeFileSync(client2.configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
+  return true;
+}
+
+export {
+  initAnalytics,
+  trackSessionStarted,
+  trackToolCall,
+  trackSetupStarted,
+  trackSetupCompleted,
+  trackQualityVerdict,
+  trackQualityCheck,
+  trackCaptureClassifierEvaluated,
+  trackCaptureClassifierAutoRouted,
+  trackCaptureClassifierFallback,
+  trackChainEntryCommitted,
+  trackKnowledgeGap,
+  trackCaptureQualityHints,
+  trackCaptureRelationSuggestions,
+  getPostHogClient,
+  shutdownAnalytics,
+  MCP_NPX_PACKAGE,
+  resolveClient,
+  writeClientConfig
+};
+//# sourceMappingURL=chunk-MOPOQUJP.js.map

package/dist/chunk-MOPOQUJP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/analytics.ts","../src/cli/config-writer.ts"],"sourcesContent":["/**\n * PostHog analytics for SynergyOS maintainers — tracks MCP usage (sessions, tool calls).\n * Not user-facing. Key is injected at build time via SYNERGYOS_POSTHOG_KEY.\n * Override with POSTHOG_MCP_KEY for self-hosted deployments.\n */\n\nimport { userInfo } from \"node:os\";\nimport { PostHog } from \"posthog-node\";\n\nlet client: PostHog | null = null;\nlet distinctId = \"anonymous\";\n\nconst POSTHOG_HOST = \"https://eu.i.posthog.com\";\n\n/** Injected at build time: SYNERGYOS_POSTHOG_KEY env when running `npm run build`/publish. */\ndeclare const __SYNERGYOS_POSTHOG_KEY__: string;\n\n/** Only write to stderr when MCP_DEBUG=1 for quieter default DX. */\nfunction log(msg: string): void {\n  if (process.env.MCP_DEBUG === \"1\") {\n    process.stderr.write(msg);\n  }\n}\n\nfunction getBuildTimeKey(): string {\n  try {\n    return __SYNERGYOS_POSTHOG_KEY__;\n  } catch {\n    // Not replaced by bundler (e.g. running via tsx in tests) — treat as absent.\n    return \"\";\n  }\n}\n\nexport function initAnalytics(): void {\n  const apiKey = process.env.POSTHOG_MCP_KEY || getBuildTimeKey();\n  if (!apiKey) {\n    log(\"[MCP-ANALYTICS] No PostHog key — tracking disabled (set SYNERGYOS_POSTHOG_KEY at build time for publish)\\n\");\n    return;\n  }\n\n  client = new PostHog(apiKey, {\n    host: POSTHOG_HOST,\n    flushAt: 1,\n    flushInterval: 5000,\n    featureFlagsPollingInterval: 30_000,\n  });\n  distinctId = process.env.MCP_USER_ID || fallbackDistinctId();\n\n  log(`[MCP-ANALYTICS] Initialized — host=${POSTHOG_HOST} distinctId=${distinctId}\\n`);\n}\n\nfunction fallbackDistinctId(): string {\n  try {\n    return userInfo().username;\n  } catch {\n    return `os-${process.pid}`;\n  }\n}\n\nexport function trackSessionStarted(\n  workspaceId: string,\n  serverVersion: string,\n): void {\n  if (!client) return;\n  client.capture({\n    distinctId,\n    event: \"mcp_session_started\",\n    properties: {\n      workspace_id: workspaceId,\n      server_version: serverVersion,\n      source: \"mcp-server\",\n      $groups: { workspace: workspaceId },\n    },\n  });\n}\n\nexport function trackToolCall(\n  fn: string,\n  status: \"ok\" | \"error\",\n  durationMs: number,\n  workspaceId: string,\n  errorMsg?: string,\n): void {\n  const properties: Record<string, unknown> = {\n    tool: fn,\n    status,\n    duration_ms: durationMs,\n    workspace_id: workspaceId,\n    source: \"mcp-server\",\n    $groups: { workspace: workspaceId },\n  };\n  if (errorMsg) properties.error = errorMsg;\n\n  if (!client) return;\n  client.capture({\n    distinctId,\n    event: \"mcp_tool_called\",\n    properties,\n  });\n}\n\nexport function trackSetupStarted(): void {\n  if (!client) return;\n  client.capture({\n    distinctId,\n    event: \"mcp_setup_started\",\n    properties: {\n      source: \"mcp-server\",\n      platform: process.platform,\n    },\n  });\n}\n\nexport function trackSetupCompleted(\n  chosenClient: string,\n  outcome: \"config_written\" | \"config_existed\" | \"snippet_shown\" | \"write_error\",\n): void {\n  if (!client) return;\n  client.capture({\n    distinctId,\n    event: \"mcp_setup_completed\",\n    properties: {\n      client: chosenClient,\n      outcome,\n      source: \"mcp-server\",\n      platform: process.platform,\n    },\n  });\n}\n\nexport function trackQualityVerdict(\n  workspaceId: string,\n  props: {\n    entry_id: string;\n    entry_type: string;\n    tier: string;\n    context: string;\n    passed: boolean;\n    source: string;\n    criteria_total: number;\n    criteria_failed: number;\n    llm_scheduled: boolean;\n  },\n): void {\n  if (!client) return;\n  client.capture({\n    distinctId,\n    event: \"quality_verdict_generated\",\n    properties: {\n      ...props,\n      workspace_id: workspaceId,\n      source_system: \"mcp-server\",\n      $groups: { workspace: workspaceId },\n    },\n  });\n}\n\nexport function trackQualityCheck(\n  workspaceId: string,\n  props: {\n    entry_id: string;\n    entry_type: string;\n    tier: string;\n    passed: boolean;\n    source: string;\n    llm_status?: string;\n    llm_duration_ms?: number;\n    llm_error?: string;\n    has_roger_martin: boolean;\n  },\n): void {\n  if (!client) return;\n  client.capture({\n    distinctId,\n    event: \"quality_verdict_checked\",\n    properties: {\n      ...props,\n      workspace_id: workspaceId,\n      source_system: \"mcp-server\",\n      $groups: { workspace: workspaceId },\n    },\n  });\n}\n\nexport type ClassifierReasonCategory =\n  | \"auto-routed\"\n  | \"low-confidence\"\n  | \"ambiguous\"\n  | \"non-provisioned\";\n\ntype CaptureClassifierTelemetryProps = {\n  predicted_collection: string;\n  confidence: number;\n  auto_routed: boolean;\n  reason_category: ClassifierReasonCategory;\n  explicit_collection_provided: boolean;\n};\n\nfunction trackCaptureClassifierEvent(\n  event: \"mcp_capture_classifier_evaluated\" | \"mcp_capture_classifier_auto_routed\" | \"mcp_capture_classifier_fallback\",\n  workspaceId: string,\n  props: CaptureClassifierTelemetryProps,\n): void {\n  if (!client) return;\n  try {\n    client.capture({\n      distinctId,\n      event,\n      properties: {\n        ...props,\n        workspace_id: workspaceId,\n        source_system: \"mcp-server\",\n        $groups: { workspace: workspaceId },\n      },\n    });\n  } catch {\n    // Analytics are advisory and must never break capture flow.\n  }\n}\n\nexport function trackCaptureClassifierEvaluated(\n  workspaceId: string,\n  props: CaptureClassifierTelemetryProps,\n): void {\n  trackCaptureClassifierEvent(\"mcp_capture_classifier_evaluated\", workspaceId, props);\n}\n\nexport function trackCaptureClassifierAutoRouted(\n  workspaceId: string,\n  props: CaptureClassifierTelemetryProps,\n): void {\n  trackCaptureClassifierEvent(\"mcp_capture_classifier_auto_routed\", workspaceId, props);\n}\n\nexport function trackCaptureClassifierFallback(\n  workspaceId: string,\n  props: CaptureClassifierTelemetryProps,\n): void {\n  trackCaptureClassifierEvent(\"mcp_capture_classifier_fallback\", workspaceId, props);\n}\n\n/** GLO-26 / TEN-156: every SSOT commit for PostHog funnels (split auto vs manual). */\nexport function trackChainEntryCommitted(\n  workspaceId: string,\n  props: {\n    entry_id: string;\n    collection?: string;\n    commit_method: \"auto\" | \"manual\";\n    surface:\n      | \"mcp_commit_tool\"\n      | \"mcp_capture\"\n      | \"mcp_wrapup\";\n  },\n): void {\n  if (!client) return;\n  try {\n    client.capture({\n      distinctId,\n      event: \"chain_entry_committed\",\n      properties: {\n        workspace_id: workspaceId,\n        source_system: \"mcp-server\",\n        $groups: { workspace: workspaceId },\n        ...props,\n      },\n    });\n  } catch {\n    // Analytics must never break the tool path.\n  }\n}\n\nexport function trackKnowledgeGap(\n  workspaceId: string,\n  props: {\n    query: string;\n    tool: string;\n    action: string;\n    gap_type: \"search_zero\" | \"context_task_empty\" | \"context_entry_isolated\" | \"context_graph_empty\";\n    collection_scope?: string;\n  },\n): void {\n  if (!client) return;\n  try {\n    client.capture({\n      distinctId,\n      event: \"knowledge_gap_detected\",\n      properties: {\n        ...props,\n        query: props.query.slice(0, 200),\n        workspace_id: workspaceId,\n        source_system: \"mcp-server\",\n        $groups: { workspace: workspaceId },\n      },\n    });\n  } catch {\n    // Analytics must never break the tool response path.\n  }\n}\n\n// ── BET-272 S6 / STD-155: Capture intelligence observability ────────────────\n\n/** Fires when formative quality hints are returned at capture time. */\nexport function trackCaptureQualityHints(\n  workspaceId: string,\n  props: {\n    collection: string;\n    hint_count: number;\n    hint_fields: string[];\n  },\n): void {\n  if (!client) return;\n  try {\n    client.capture({\n      distinctId,\n      event: \"mcp_capture_quality_hints\",\n      properties: {\n        ...props,\n        workspace_id: workspaceId,\n        source_system: \"mcp-server\",\n        $groups: { workspace: workspaceId },\n      },\n    });\n  } catch {\n    // Analytics must never break capture flow.\n  }\n}\n\n/** Fires when relation suggestions are returned at capture time. */\nexport function trackCaptureRelationSuggestions(\n  workspaceId: string,\n  props: {\n    collection: string;\n    suggestion_count: number;\n    relation_types: string[];\n    avg_confidence: number;\n  },\n): void {\n  if (!client) return;\n  try {\n    client.capture({\n      distinctId,\n      event: \"mcp_capture_relation_suggestions\",\n      properties: {\n        ...props,\n        workspace_id: workspaceId,\n        source_system: \"mcp-server\",\n        $groups: { workspace: workspaceId },\n      },\n    });\n  } catch {\n    // Analytics must never break capture flow.\n  }\n}\n\nexport function getPostHogClient(): PostHog | null {\n  return client;\n}\n\nexport async function shutdownAnalytics(): Promise<void> {\n  await client?.shutdown();\n}\n","/**\n * Multi-client MCP config detection and writer.\n *\n * Supports:\n *  - Cursor: .cursor/mcp.json in cwd (project-level)\n *  - Claude Desktop: ~/Library/Application Support/Claude/claude_desktop_config.json (macOS)\n *                    %APPDATA%/Claude/claude_desktop_config.json (Windows)\n *\n * The writer reads existing config, merges the new server entry (never\n * overwrites existing entries), and writes back. Falls back to printing\n * a snippet for unsupported OS or unknown formats.\n */\n\nimport { existsSync, readFileSync, writeFileSync, mkdirSync } from \"node:fs\";\nimport { join, dirname } from \"node:path\";\nimport { homedir, platform } from \"node:os\";\n\nexport interface McpClientInfo {\n  name: string;\n  configPath: string;\n}\n\nconst SERVER_ENTRY_KEY = \"Product Brain\";\nconst LEGACY_ENTRY_KEY = \"productbrain\";\n\n/**\n * Canonical npx package specifier. Update here when exiting beta.\n * Frontend mirror: src/lib/constants/mcp.ts\n * Business rule: BR-84 (Chain)\n */\nexport const MCP_NPX_PACKAGE = \"@productbrain/mcp@beta\";\n\nfunction buildServerEntry(apiKey: string) {\n  return {\n    command: \"npx\",\n    args: [\"-y\", MCP_NPX_PACKAGE],\n    env: { PRODUCTBRAIN_API_KEY: apiKey },\n  };\n}\n\n// ── Detection ───────────────────────────────────────────────────────────\n\nfunction getCursorConfigPath(): string {\n  return join(process.cwd(), \".cursor\", \"mcp.json\");\n}\n\nfunction getClaudeDesktopConfigPath(): string | null {\n  const os = platform();\n  if (os === \"darwin\") {\n    return join(\n      homedir(),\n      \"Library\",\n      \"Application Support\",\n      \"Claude\",\n      \"claude_desktop_config.json\",\n    );\n  }\n  if (os === \"win32\") {\n    const appData = process.env.APPDATA ?? join(homedir(), \"AppData\", \"Roaming\");\n    return join(appData, \"Claude\", \"claude_desktop_config.json\");\n  }\n  // Linux: no official Claude Desktop location yet\n  return null;\n}\n\nexport function resolveClient(name: \"Cursor\" | \"Claude Desktop\"): McpClientInfo | null {\n  if (name === \"Cursor\") {\n    return { name, configPath: getCursorConfigPath() };\n  }\n  const configPath = getClaudeDesktopConfigPath();\n  return configPath ? { name, configPath } : null;\n}\n\n// ── Writing ─────────────────────────────────────────────────────────────\n\nfunction readJsonSafe(path: string): Record<string, any> {\n  if (!existsSync(path)) return {};\n  try {\n    return JSON.parse(readFileSync(path, \"utf-8\"));\n  } catch {\n    return {};\n  }\n}\n\n/**\n * Write or merge the Product Brain server entry into a client config file.\n * Migrates legacy \"productbrain\" key to \"Product Brain\" when present.\n * Returns true if the config was written, false if already present.\n */\nexport async function writeClientConfig(\n  client: McpClientInfo,\n  apiKey: string,\n): Promise<boolean> {\n  const config = readJsonSafe(client.configPath);\n\n  const serversKey = \"mcpServers\";\n  if (!config[serversKey]) config[serversKey] = {};\n\n  // Migrate legacy \"productbrain\" key or update existing Product Brain with new API key\n  if (config[serversKey][LEGACY_ENTRY_KEY]) {\n    const legacy = config[serversKey][LEGACY_ENTRY_KEY];\n    config[serversKey][SERVER_ENTRY_KEY] = {\n      ...buildServerEntry(apiKey),\n      env: { ...legacy.env, PRODUCTBRAIN_API_KEY: legacy.env?.PRODUCTBRAIN_API_KEY ?? apiKey },\n    };\n    delete config[serversKey][LEGACY_ENTRY_KEY];\n  } else {\n    const existing = config[serversKey][SERVER_ENTRY_KEY];\n    config[serversKey][SERVER_ENTRY_KEY] = existing\n      ? { ...existing, env: { ...existing.env, PRODUCTBRAIN_API_KEY: apiKey } }\n      : buildServerEntry(apiKey);\n  }\n\n  const dir = dirname(client.configPath);\n  if (!existsSync(dir)) {\n    mkdirSync(dir, { recursive: true });\n  }\n\n  writeFileSync(client.configPath, JSON.stringify(config, null, 2) + \"\\n\", \"utf-8\");\n  return true;\n}\n"],"mappings":";AAMA,SAAS,gBAAgB;AACzB,SAAS,eAAe;AAExB,IAAI,SAAyB;AAC7B,IAAI,aAAa;AAEjB,IAAM,eAAe;AAMrB,SAAS,IAAI,KAAmB;AAC9B,MAAI,QAAQ,IAAI,cAAc,KAAK;AACjC,YAAQ,OAAO,MAAM,GAAG;AAAA,EAC1B;AACF;AAEA,SAAS,kBAA0B;AACjC,MAAI;AACF,WAAO;AAAA,EACT,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,gBAAsB;AACpC,QAAM,SAAS,QAAQ,IAAI,mBAAmB,gBAAgB;AAC9D,MAAI,CAAC,QAAQ;AACX,QAAI,iHAA4G;AAChH;AAAA,EACF;AAEA,WAAS,IAAI,QAAQ,QAAQ;AAAA,IAC3B,MAAM;AAAA,IACN,SAAS;AAAA,IACT,eAAe;AAAA,IACf,6BAA6B;AAAA,EAC/B,CAAC;AACD,eAAa,QAAQ,IAAI,eAAe,mBAAmB;AAE3D,MAAI,2CAAsC,YAAY,eAAe,UAAU;AAAA,CAAI;AACrF;AAEA,SAAS,qBAA6B;AACpC,MAAI;AACF,WAAO,SAAS,EAAE;AAAA,EACpB,QAAQ;AACN,WAAO,MAAM,QAAQ,GAAG;AAAA,EAC1B;AACF;AAEO,SAAS,oBACd,aACA,eACM;AACN,MAAI,CAAC,OAAQ;AACb,SAAO,QAAQ;AAAA,IACb;AAAA,IACA,OAAO;AAAA,IACP,YAAY;AAAA,MACV,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,QAAQ;AAAA,MACR,SAAS,EAAE,WAAW,YAAY;AAAA,IACpC;AAAA,EACF,CAAC;AACH;AAEO,SAAS,cACd,IACA,QACA,YACA,aACA,UACM;AACN,QAAM,aAAsC;AAAA,IAC1C,MAAM;AAAA,IACN;AAAA,IACA,aAAa;AAAA,IACb,cAAc;AAAA,IACd,QAAQ;AAAA,IACR,SAAS,EAAE,WAAW,YAAY;AAAA,EACpC;AACA,MAAI,SAAU,YAAW,QAAQ;AAEjC,MAAI,CAAC,OAAQ;AACb,SAAO,QAAQ;AAAA,IACb;AAAA,IACA,OAAO;AAAA,IACP;AAAA,EACF,CAAC;AACH;AAEO,SAAS,oBAA0B;AACxC,MAAI,CAAC,OAAQ;AACb,SAAO,QAAQ;AAAA,IACb;AAAA,IACA,OAAO;AAAA,IACP,YAAY;AAAA,MACV,QAAQ;AAAA,MACR,UAAU,QAAQ;AAAA,IACpB;AAAA,EACF,CAAC;AACH;AAEO,SAAS,oBACd,cACA,SACM;AACN,MAAI,CAAC,OAAQ;AACb,SAAO,QAAQ;AAAA,IACb;AAAA,IACA,OAAO;AAAA,IACP,YAAY;AAAA,MACV,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,UAAU,QAAQ;AAAA,IACpB;AAAA,EACF,CAAC;AACH;AAEO,SAAS,oBACd,aACA,OAWM;AACN,MAAI,CAAC,OAAQ;AACb,SAAO,QAAQ;AAAA,IACb;AAAA,IACA,OAAO;AAAA,IACP,YAAY;AAAA,MACV,GAAG;AAAA,MACH,cAAc;AAAA,MACd,eAAe;AAAA,MACf,SAAS,EAAE,WAAW,YAAY;AAAA,IACpC;AAAA,EACF,CAAC;AACH;AAEO,SAAS,kBACd,aACA,OAWM;AACN,MAAI,CAAC,OAAQ;AACb,SAAO,QAAQ;AAAA,IACb;AAAA,IACA,OAAO;AAAA,IACP,YAAY;AAAA,MACV,GAAG;AAAA,MACH,cAAc;AAAA,MACd,eAAe;AAAA,MACf,SAAS,EAAE,WAAW,YAAY;AAAA,IACpC;AAAA,EACF,CAAC;AACH;AAgBA,SAAS,4BACP,OACA,aACA,OACM;AACN,MAAI,CAAC,OAAQ;AACb,MAAI;AACF,WAAO,QAAQ;AAAA,MACb;AAAA,MACA;AAAA,MACA,YAAY;AAAA,QACV,GAAG;AAAA,QACH,cAAc;AAAA,QACd,eAAe;AAAA,QACf,SAAS,EAAE,WAAW,YAAY;AAAA,MACpC;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,gCACd,aACA,OACM;AACN,8BAA4B,oCAAoC,aAAa,KAAK;AACpF;AAEO,SAAS,iCACd,aACA,OACM;AACN,8BAA4B,sCAAsC,aAAa,KAAK;AACtF;AAEO,SAAS,+BACd,aACA,OACM;AACN,8BAA4B,mCAAmC,aAAa,KAAK;AACnF;AAGO,SAAS,yBACd,aACA,OASM;AACN,MAAI,CAAC,OAAQ;AACb,MAAI;AACF,WAAO,QAAQ;AAAA,MACb;AAAA,MACA,OAAO;AAAA,MACP,YAAY;AAAA,QACV,cAAc;AAAA,QACd,eAAe;AAAA,QACf,SAAS,EAAE,WAAW,YAAY;AAAA,QAClC,GAAG;AAAA,MACL;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,kBACd,aACA,OAOM;AACN,MAAI,CAAC,OAAQ;AACb,MAAI;AACF,WAAO,QAAQ;AAAA,MACb;AAAA,MACA,OAAO;AAAA,MACP,YAAY;AAAA,QACV,GAAG;AAAA,QACH,OAAO,MAAM,MAAM,MAAM,GAAG,GAAG;AAAA,QAC/B,cAAc;AAAA,QACd,eAAe;AAAA,QACf,SAAS,EAAE,WAAW,YAAY;AAAA,MACpC;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;AAKO,SAAS,yBACd,aACA,OAKM;AACN,MAAI,CAAC,OAAQ;AACb,MAAI;AACF,WAAO,QAAQ;AAAA,MACb;AAAA,MACA,OAAO;AAAA,MACP,YAAY;AAAA,QACV,GAAG;AAAA,QACH,cAAc;AAAA,QACd,eAAe;AAAA,QACf,SAAS,EAAE,WAAW,YAAY;AAAA,MACpC;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;AAGO,SAAS,gCACd,aACA,OAMM;AACN,MAAI,CAAC,OAAQ;AACb,MAAI;AACF,WAAO,QAAQ;AAAA,MACb;AAAA,MACA,OAAO;AAAA,MACP,YAAY;AAAA,QACV,GAAG;AAAA,QACH,cAAc;AAAA,QACd,eAAe;AAAA,QACf,SAAS,EAAE,WAAW,YAAY;AAAA,MACpC;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,mBAAmC;AACjD,SAAO;AACT;AAEA,eAAsB,oBAAmC;AACvD,QAAM,QAAQ,SAAS;AACzB;;;AC3VA,SAAS,YAAY,cAAc,eAAe,iBAAiB;AACnE,SAAS,MAAM,eAAe;AAC9B,SAAS,SAAS,gBAAgB;AAOlC,IAAM,mBAAmB;AACzB,IAAM,mBAAmB;AAOlB,IAAM,kBAAkB;AAE/B,SAAS,iBAAiB,QAAgB;AACxC,SAAO;AAAA,IACL,SAAS;AAAA,IACT,MAAM,CAAC,MAAM,eAAe;AAAA,IAC5B,KAAK,EAAE,sBAAsB,OAAO;AAAA,EACtC;AACF;AAIA,SAAS,sBAA8B;AACrC,SAAO,KAAK,QAAQ,IAAI,GAAG,WAAW,UAAU;AAClD;AAEA,SAAS,6BAA4C;AACnD,QAAM,KAAK,SAAS;AACpB,MAAI,OAAO,UAAU;AACnB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,SAAS;AAClB,UAAM,UAAU,QAAQ,IAAI,WAAW,KAAK,QAAQ,GAAG,WAAW,SAAS;AAC3E,WAAO,KAAK,SAAS,UAAU,4BAA4B;AAAA,EAC7D;AAEA,SAAO;AACT;AAEO,SAAS,cAAc,MAAyD;AACrF,MAAI,SAAS,UAAU;AACrB,WAAO,EAAE,MAAM,YAAY,oBAAoB,EAAE;AAAA,EACnD;AACA,QAAM,aAAa,2BAA2B;AAC9C,SAAO,aAAa,EAAE,MAAM,WAAW,IAAI;AAC7C;AAIA,SAAS,aAAa,MAAmC;AACvD,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO,CAAC;AAC/B,MAAI;AACF,WAAO,KAAK,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,EAC/C,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAOA,eAAsB,kBACpBA,SACA,QACkB;AAClB,QAAM,SAAS,aAAaA,QAAO,UAAU;AAE7C,QAAM,aAAa;AACnB,MAAI,CAAC,OAAO,UAAU,EAAG,QAAO,UAAU,IAAI,CAAC;AAG/C,MAAI,OAAO,UAAU,EAAE,gBAAgB,GAAG;AACxC,UAAM,SAAS,OAAO,UAAU,EAAE,gBAAgB;AAClD,WAAO,UAAU,EAAE,gBAAgB,IAAI;AAAA,MACrC,GAAG,iBAAiB,MAAM;AAAA,MAC1B,KAAK,EAAE,GAAG,OAAO,KAAK,sBAAsB,OAAO,KAAK,wBAAwB,OAAO;AAAA,IACzF;AACA,WAAO,OAAO,UAAU,EAAE,gBAAgB;AAAA,EAC5C,OAAO;AACL,UAAM,WAAW,OAAO,UAAU,EAAE,gBAAgB;AACpD,WAAO,UAAU,EAAE,gBAAgB,IAAI,WACnC,EAAE,GAAG,UAAU,KAAK,EAAE,GAAG,SAAS,KAAK,sBAAsB,OAAO,EAAE,IACtE,iBAAiB,MAAM;AAAA,EAC7B;AAEA,QAAM,MAAM,QAAQA,QAAO,UAAU;AACrC,MAAI,CAAC,WAAW,GAAG,GAAG;AACpB,cAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAAA,EACpC;AAEA,gBAAcA,QAAO,YAAY,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI,MAAM,OAAO;AAChF,SAAO;AACT;","names":["client"]}

package/dist/cli/index.js

@@ -3,7 +3,7 @@
 // src/cli/index.ts
 var subcommand = process.argv[2];
 if (subcommand === "setup") {
-  const { runSetup } = await import("../setup-GZ5OZ5OP.js");
+  const { runSetup } = await import("../setup-YYADLH22.js");
   await runSetup();
 } else {
   await import("../index.js");

package/dist/http.js

@@ -1,15 +1,15 @@
 import {
   SERVER_VERSION,
-  createProductBrainServer
-} from "./chunk-MV3VHRMV.js";
-import {
   bootstrapHttp,
+  createProductBrainServer,
+  initFeatureFlags,
   runWithAuth
-} from "./chunk-HLXF3QPE.js";
+} from "./chunk-CDBSOVW7.js";
 import {
+  getPostHogClient,
   initAnalytics,
   shutdownAnalytics
-} from "./chunk-XBMI6QHR.js";
+} from "./chunk-MOPOQUJP.js";
 
 // src/http.ts
 import { createHash, randomUUID } from "crypto";
@@ -19,19 +19,21 @@ import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 import rateLimit from "express-rate-limit";
 bootstrapHttp();
 initAnalytics();
-var PORT = parseInt(process.env.PORT ?? process.env.MCP_PORT ?? "3000", 10);
+initFeatureFlags(getPostHogClient());
+var PORT = parseInt(process.env.PORT ?? process.env.MCP_PORT ?? "3002", 10);
 function baseUrl(req) {
   const proto = req.headers["x-forwarded-proto"] ?? req.protocol ?? "http";
   const host = req.headers.host ?? `localhost:${PORT}`;
   return `${proto}://${host}`;
 }
 var app = express();
+app.set("trust proxy", 1);
 app.use(express.json());
 var ALLOWED_ORIGINS = process.env.CORS_ORIGINS?.split(",").map((o) => o.trim()).filter(Boolean);
 app.use((_req, res, next) => {
   const origin = _req.headers.origin;
-  if (!ALLOWED_ORIGINS || origin && ALLOWED_ORIGINS.includes(origin)) {
-    res.setHeader("Access-Control-Allow-Origin", origin ?? "*");
+  if (ALLOWED_ORIGINS && origin && ALLOWED_ORIGINS.includes(origin)) {
+    res.setHeader("Access-Control-Allow-Origin", origin);
   }
   res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
   res.setHeader(
@@ -62,7 +64,7 @@ app.get("/.well-known/oauth-authorization-server", (req, res) => {
     token_endpoint: `${base}/oauth/token`,
     registration_endpoint: `${base}/register`,
     response_types_supported: ["code"],
-    grant_types_supported: ["authorization_code"],
+    grant_types_supported: ["authorization_code", "refresh_token"],
     code_challenge_methods_supported: ["S256"],
     token_endpoint_auth_methods_supported: ["none"],
     scopes_supported: ["mcp:tools", "mcp:resources"]
@@ -100,6 +102,9 @@ app.post(
   }
 );
 var pendingCodes = /* @__PURE__ */ new Map();
+var ACCESS_TOKEN_TTL = 3600;
+var REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 6e4;
+var refreshTokens = /* @__PURE__ */ new Map();
 setInterval(() => {
   const now = Date.now();
   for (const [code, auth] of pendingCodes) {
@@ -108,6 +113,9 @@ setInterval(() => {
   for (const [id, client] of registeredClients) {
     if (now - client.registeredAt > 24 * 60 * 6e4) registeredClients.delete(id);
   }
+  for (const [token, entry] of refreshTokens) {
+    if (now - entry.createdAt > REFRESH_TOKEN_TTL_MS) refreshTokens.delete(token);
+  }
 }, 6e4);
 function esc(s) {
   return String(s ?? "").replace(
@@ -116,7 +124,7 @@ function esc(s) {
   );
 }
 app.get("/authorize", (req, res) => {
-  const { redirect_uri, code_challenge, code_challenge_method, state } = req.query;
+  const { redirect_uri, code_challenge, code_challenge_method, state, client_id } = req.query;
   res.type("html").send(`<!DOCTYPE html>
 <html lang="en"><head>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
@@ -145,6 +153,7 @@ button:hover{background:#6d28d9}
   <input type="hidden" name="code_challenge" value="${esc(code_challenge)}">
   <input type="hidden" name="code_challenge_method" value="${esc(code_challenge_method)}">
   <input type="hidden" name="state" value="${esc(state)}">
+  <input type="hidden" name="client_id" value="${esc(client_id)}">
   <label for="k">API Key</label>
   <input type="password" id="k" name="api_key" placeholder="pb_sk_\u2026" required autofocus>
   <p class="err" id="e">Key must start with pb_sk_</p>
@@ -160,11 +169,26 @@ app.post(
   "/authorize",
   express.urlencoded({ extended: false }),
   (req, res) => {
-    const { api_key, redirect_uri, code_challenge, state } = req.body;
+    const { api_key, redirect_uri, code_challenge, state, client_id } = req.body;
     if (!api_key?.startsWith("pb_sk_")) {
       res.status(400).send("Invalid API key");
       return;
     }
+    if (!client_id || !registeredClients.has(client_id)) {
+      res.status(400).json({
+        error: "invalid_request",
+        error_description: "Unknown or missing client_id"
+      });
+      return;
+    }
+    const client = registeredClients.get(client_id);
+    if (!client.redirect_uris.includes(redirect_uri)) {
+      res.status(400).json({
+        error: "invalid_request",
+        error_description: "redirect_uri does not match any registered redirect for this client"
+      });
+      return;
+    }
     const code = randomUUID();
     pendingCodes.set(code, {
       apiKey: api_key,
@@ -178,12 +202,38 @@ app.post(
     res.redirect(302, url.toString());
   }
 );
+function issueTokens(apiKey) {
+  const refreshToken = `pb_rt_${randomUUID()}`;
+  refreshTokens.set(refreshToken, { apiKey, createdAt: Date.now() });
+  return {
+    access_token: apiKey,
+    token_type: "Bearer",
+    expires_in: ACCESS_TOKEN_TTL,
+    refresh_token: refreshToken
+  };
+}
 app.post(
   "/oauth/token",
   express.urlencoded({ extended: false }),
   express.json(),
   (req, res) => {
-    const { grant_type, code, code_verifier, redirect_uri } = req.body;
+    const { grant_type, code, code_verifier, redirect_uri, refresh_token } = req.body;
+    if (grant_type === "refresh_token") {
+      const entry = refreshTokens.get(refresh_token);
+      if (!entry) {
+        res.status(400).json({ error: "invalid_grant", error_description: "Invalid refresh token" });
+        return;
+      }
+      if (Date.now() - entry.createdAt > REFRESH_TOKEN_TTL_MS) {
+        refreshTokens.delete(refresh_token);
+        res.status(400).json({ error: "invalid_grant", error_description: "Refresh token expired" });
+        return;
+      }
+      const apiKey = entry.apiKey;
+      refreshTokens.delete(refresh_token);
+      res.json(issueTokens(apiKey));
+      return;
+    }
     if (grant_type !== "authorization_code") {
       res.status(400).json({ error: "unsupported_grant_type" });
       return;
@@ -203,11 +253,7 @@ app.post(
       return;
     }
     pendingCodes.delete(code);
-    res.json({
-      access_token: pending.apiKey,
-      token_type: "Bearer",
-      expires_in: 3600
-    });
+    res.json(issueTokens(pending.apiKey));
   }
 );
 var mcpLimiter = rateLimit({
@@ -227,6 +273,7 @@ function evictStaleSessions() {
   const now = Date.now();
   for (const [id, entry] of sessions) {
     if (now - entry.lastAccess > SESSION_TTL_MS) {
+      logSessionLifecycle("session_deleted", id, "ttl");
       entry.transport.close().catch(() => {
       });
       sessions.delete(id);
@@ -237,6 +284,7 @@ function evictStaleSessions() {
       (a, b) => a[1].lastAccess - b[1].lastAccess
     );
     for (let i = 0; i < sorted.length - MAX_SESSIONS; i++) {
+      logSessionLifecycle("session_deleted", sorted[i][0], "eviction");
       sorted[i][1].transport.close().catch(() => {
       });
       sessions.delete(sorted[i][0]);
@@ -257,10 +305,17 @@ function send401(req, res) {
     `Bearer resource_metadata="${base}/.well-known/oauth-protected-resource"`
   ).json({ error: "unauthorized" });
 }
-function logRequest(method, outcome, sessionId) {
+function logRequest(method, outcome, sessionId, durationMs) {
   const ts = (/* @__PURE__ */ new Date()).toISOString();
   const sid = sessionId ? ` session=${sessionId}` : "";
-  process.stderr.write(`[HTTP] ${ts} ${method} ${outcome}${sid}
+  const dur = durationMs != null ? ` duration=${durationMs}ms` : "";
+  process.stderr.write(`[HTTP] ${ts} ${method} ${outcome}${sid}${dur}
+`);
+}
+function logSessionLifecycle(event, sessionId, reason) {
+  const ts = (/* @__PURE__ */ new Date()).toISOString();
+  const r = reason ? ` reason=${reason}` : "";
+  process.stderr.write(`[HTTP] ${ts} ${event} session=${sessionId}${r}
 `);
 }
 app.post("/mcp", mcpLimiter, async (req, res) => {
@@ -271,29 +326,38 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
     return;
   }
   const sessionId = req.headers["mcp-session-id"];
+  const reqStart = Date.now();
   try {
     await runWithAuth({ apiKey }, async () => {
       if (sessionId && sessions.has(sessionId)) {
         const entry = sessions.get(sessionId);
         entry.lastAccess = Date.now();
         await entry.transport.handleRequest(req, res, req.body);
-        logRequest("POST", "ok", sessionId);
+        logRequest("POST", "ok", sessionId, Date.now() - reqStart);
       } else if (!sessionId && isInitializeRequest(req.body)) {
         const transport = new StreamableHTTPServerTransport({
           sessionIdGenerator: () => randomUUID(),
           onsessioninitialized: (sid) => {
             sessions.set(sid, { transport, lastAccess: Date.now() });
-            logRequest("POST", "ok", sid);
+            logSessionLifecycle("session_created", sid);
           }
         });
         transport.onclose = () => {
           const sid = transport.sessionId;
-          if (sid) sessions.delete(sid);
+          if (sid) {
+            logSessionLifecycle("session_deleted", sid, "onclose");
+            sessions.delete(sid);
+          }
         };
         const server = createProductBrainServer();
         await server.connect(transport);
         await transport.handleRequest(req, res, req.body);
+        logRequest("POST", "ok", transport.sessionId ?? void 0, Date.now() - reqStart);
       } else {
+        process.stderr.write(
+          `[HTTP] ${(/* @__PURE__ */ new Date()).toISOString()} session_invalid no valid session ID (client may have omitted Mcp-Session-Id)
+`
+        );
         res.status(400).json({
           jsonrpc: "2.0",
           error: { code: -32e3, message: "Bad Request: no valid session ID provided" },
@@ -302,7 +366,7 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
       }
     });
   } catch (err) {
-    logRequest("POST", "error", sessionId);
+    logRequest("POST", "error", sessionId, Date.now() - reqStart);
     if (!res.headersSent) {
       res.status(500).json({
         jsonrpc: "2.0",
@@ -357,18 +421,40 @@ app.delete("/mcp", mcpLimiter, async (req, res) => {
     logRequest("DELETE", "error", sessionId);
   }
 });
-app.listen(PORT, "0.0.0.0", () => {
-  console.log(`Product Brain MCP HTTP server v${SERVER_VERSION} listening on port ${PORT}`);
+process.on("unhandledRejection", (reason) => {
+  const msg = reason instanceof Error ? reason.message : String(reason);
+  console.error(`[MCP HTTP] Unhandled rejection: ${msg}`);
+});
+process.on("uncaughtException", (err) => {
+  console.error(`[MCP HTTP] Uncaught exception: ${err.stack ?? err.message}`);
+  gracefulShutdown();
 });
+var shuttingDown = false;
 async function gracefulShutdown() {
+  if (shuttingDown) return;
+  shuttingDown = true;
+  setTimeout(() => process.exit(1), 3e3).unref();
   console.log("Shutting down...");
   for (const [, entry] of sessions) {
     await entry.transport.close().catch(() => {
     });
   }
-  await shutdownAnalytics();
+  try {
+    await shutdownAnalytics();
+  } catch {
+  }
   process.exit(0);
 }
+var LISTEN_HOST = "0.0.0.0";
+var httpServer = app.listen(PORT, LISTEN_HOST, () => {
+  console.log(
+    `Product Brain MCP HTTP server v${SERVER_VERSION} listening on ${LISTEN_HOST}:${PORT}`
+  );
+});
+httpServer.on("error", (err) => {
+  console.error(`[MCP HTTP] Server error: ${err.message}`);
+  process.exit(1);
+});
 process.on("SIGINT", gracefulShutdown);
 process.on("SIGTERM", gracefulShutdown);
 //# sourceMappingURL=http.js.map