@prom.codes/saver 0.1.1 → 0.1.3

package/dist/bin.js

@@ -5,7 +5,7 @@ import { resolve } from "node:path";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
 // dist/key.js
-var KEY_PATTERN = /^prom_(live|test)_[A-Za-z0-9]{10,}$/;
+var KEY_PATTERN = /^prom_(live|test)_[A-Za-z0-9]{6,}(?:_[A-Za-z0-9]{6,})?$/;
 var API_KEY_ENV = "PROMETHEUS_API_KEY";
 function classifyKey(raw) {
   const key = raw?.trim();
@@ -14,9 +14,6 @@ function classifyKey(raw) {
   return KEY_PATTERN.test(key) ? "valid" : "malformed";
 }
 
-// dist/server.js
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-
 // dist/tools.js
 import { z } from "zod";
 
@@ -34,26 +31,26 @@ var SAVER_RUNTIMES = [
 ];
 var BLOCK_START = "<!-- prom-saver:start -->";
 var BLOCK_END = "<!-- prom-saver:end -->";
-var NEVER_COMPRESS = `**Never compress (all levels):**
+var NEVER_COMPRESS = `**Never cut substance (all levels) \u2014 these are never "filler":**
 - Code, diffs, commit messages, CLI commands, API names, file paths and exact error strings \u2014 verbatim.
-- Load-bearing caveats, trade-offs, warnings and negations ("not", "only", "unless", "before"). If it changes correctness or safety, keep it.
-- Destructive, irreversible or multi-step sequences \u2014 spell those out in full.
-- **Anything you will need on a later turn \u2014 your own working context.** What you write IS your memory of this turn; condensing a recap for the reader is never a reason to drop a file path, value, decision, finding or error you may act on again. When unsure whether a detail matters later, keep it. This is the rule that prevents context loss \u2014 it overrides any urge to be brief.`;
+- Load-bearing caveats, trade-offs, warnings, negations ("not"/"only"/"unless"/"before"), and \u2014 for risky or destructive work \u2014 safer alternatives, precautions, dependency/foreign-key checks and backup/rollback advice. If it changes correctness or safety, keep it.
+- Destructive, irreversible or multi-step sequences \u2014 spell those out in full, including every step the task needs to actually work (e.g. a "without downtime" procedure keeps the dual-running / grace-period steps).
+- **Anything you will need on a later turn \u2014 your own working context.** What you write IS your memory of this turn; condensing a recap is never a reason to drop a file path, value, decision, finding or error you may act on again. When unsure whether a detail matters later, keep it.`;
 var LEVEL_BODY = {
-  lite: `Trim only ceremony and filler from your own prose: skip greetings, apologies, restating the question, and "I will now\u2026" preamble. Otherwise write normally.`,
-  balanced: `Lead with the answer or the action. Skip preamble and the play-by-play narration of routine tool calls \u2014 act, then give a short result. When you recap a long tool or command output for the reader, quote the lines that matter rather than pasting all of it \u2014 but keep every detail you might act on later. Close a task with one concise summary, not running commentary. Substance over brevity \u2014 when in doubt, say the necessary thing. This is "lean", not "terse".`,
-  aggressive: `Telegraphic prose: drop articles and filler, minimal hedging, the shortest wording that stays unambiguous; recap tool output as the essential lines only. Opt-in \u2014 more savings, more risk: the carve-outs below are hard limits, and you MUST fall back to "balanced" for any code-generation, debugging or destructive/irreversible work, where losing a single detail is costly.`
+  lite: `Drop ceremony and filler from your prose: no greetings, apologies, sign-offs, restating the question, or "I will now\u2026" preamble. Otherwise write normally.`,
+  balanced: `Lead with the answer or the action; cut preamble, sign-offs and play-by-play self-narration. Don't restate the question or pad. When several examples would be near-duplicates, give one. When recapping long tool or command output, keep the lines that carry meaning (failures, errors, the decision) and drop the noise. But include every step, caveat and precaution the answer needs to be correct and safe \u2014 if removing something would let a competent reviewer call the answer wrong, incomplete or unsafe, it stays. Lean, not terse: shorter because there is less filler, never because there is less help.`,
+  aggressive: `Telegraphic prose: drop articles and filler, minimal hedging, the shortest unambiguous wording; recap tool output as the load-bearing lines only. Opt-in \u2014 more savings, more risk: the carve-outs below are hard limits, and you MUST fall back to "balanced" for any code-generation, debugging or destructive/irreversible work, where losing a single detail is costly.`
 };
 function ruleBlockFor(level) {
   return `## prom.codes Saver \u2014 efficient output (level: ${level})
 
-Cut token cost WITHOUT cutting quality or losing context. This shapes ONLY how you PHRASE your own assistant messages \u2014 it never changes code, commands, tool inputs, what you do, or what you need to remember.
+Cut token cost by writing less FILLER \u2014 without cutting quality or losing context. This shapes ONLY how you PHRASE your own messages: never code, commands, tool inputs, what you do, or what you need to remember. Trim ceremony, restating, padding and redundant examples; keep all substance.
 
 ${LEVEL_BODY[level]}
 
 ${NEVER_COMPRESS}
 
-Correctness, safety, completeness and your own working context come FIRST; saving tokens comes second. If the two ever conflict, do not compress.`;
+Correctness, safety, completeness and your own working context come FIRST; saving tokens comes second. If the two ever conflict, do not compress \u2014 cut filler, never substance.`;
 }
 function withMarkers(block) {
   return `${BLOCK_START}
@@ -112,6 +109,7 @@ async function installRuntime(workspaceRoot, runtime, level) {
 }
 
 // dist/tools.js
+var REQUIRE_KEY_ENV = "PROMETHEUS_SAVER_REQUIRE_KEY";
 function textResult(payload) {
   return { content: [{ type: "text", text: JSON.stringify(payload, null, 2) }] };
 }
@@ -122,23 +120,47 @@ var setupInput = {
   runtimes: z.array(runtimeEnum).min(1).optional()
 };
 function registerTools(server, deps) {
-  const { workspaceRoot, apiKey } = deps;
+  const { workspaceRoot, apiKey, requireKey } = deps;
+  const keyState = deps.keyState ?? (apiKey !== void 0 ? "valid" : "absent");
   server.registerTool("setup", {
     title: "Install the prom.codes Saver efficient-output rules",
     description: "Idempotently install the prom.codes Saver efficient-output rule block into this workspace's agent runtime configs (CLAUDE.md / .cursor/rules / .augment/rules / AGENTS.md). The rules cut token cost by trimming the agent's own prose (preamble, narration, pasted tool output) while keeping code, caveats and destructive sequences verbatim. `level`: `lite` (filler only) | `balanced` (default \u2014 lean, not terse) | `aggressive` (telegraphic, opt-in, never for code/destructive). Without `runtimes` it auto-detects which are present (fallback: agents). Re-running updates the block in place. Run this once per workspace.",
     inputSchema: setupInput
   }, async (args) => {
+    if (requireKey === true && keyState !== "valid") {
+      return {
+        isError: true,
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({
+              ok: false,
+              installed: false,
+              keyState,
+              error: `prom.codes Saver: a valid ${API_KEY_ENV} (prom_live_\u2026 / prom_test_\u2026) is required to install because ${REQUIRE_KEY_ENV} is enabled (key is "${keyState}"). Set the key in this server's env block, or unset ${REQUIRE_KEY_ENV} to install keyless.`
+            }, null, 2)
+          }
+        ]
+      };
+    }
     const level = args.level ?? DEFAULT_LEVEL;
     const runtimes = args.runtimes ?? detectRuntimes(workspaceRoot);
     const results = [];
     for (const runtime of runtimes) {
       results.push(await installRuntime(workspaceRoot, runtime, level));
     }
-    return textResult({ workspaceRoot, level, keyed: apiKey !== void 0, results });
+    return textResult({
+      workspaceRoot,
+      level,
+      keyed: apiKey !== void 0,
+      keyState,
+      results
+    });
   });
 }
 
 // dist/server.js
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 var SERVER_IDENTITY = {
   name: "prom-codes-saver",
   version: "0.1.0",
@@ -161,14 +183,24 @@ async function main() {
   const workspaceRoot = resolve(process.env.PROMETHEUS_WORKSPACE_ROOT ?? process.cwd());
   const rawKey = process.env[API_KEY_ENV];
   const keyState = classifyKey(rawKey);
+  const requireKey = /^(1|true|yes|on)$/i.test(process.env[REQUIRE_KEY_ENV] ?? "");
   if (keyState === "malformed") {
     process.stderr.write(`prom-codes-saver: ${API_KEY_ENV} is malformed (expected prom_live_\u2026 / prom_test_\u2026); continuing keyless.
+`);
+  }
+  if (requireKey && keyState !== "valid") {
+    process.stderr.write(`prom-codes-saver: ${REQUIRE_KEY_ENV} is on but ${API_KEY_ENV} is ${keyState}; setup will refuse to install until a valid prom_ key is provided.
 `);
   }
   const apiKey = keyState === "valid" ? rawKey.trim() : void 0;
-  process.stderr.write(`prom-codes-saver: workspace=${workspaceRoot} key=${keyState}
+  process.stderr.write(`prom-codes-saver: workspace=${workspaceRoot} key=${keyState} requireKey=${requireKey}
 `);
-  const server = createServer({ workspaceRoot, ...apiKey !== void 0 ? { apiKey } : {} });
+  const server = createServer({
+    workspaceRoot,
+    keyState,
+    requireKey,
+    ...apiKey !== void 0 ? { apiKey } : {}
+  });
   const transport = new StdioServerTransport();
   const shutdown = async (signal) => {
     process.stderr.write(`prom-codes-saver: received ${signal}, shutting down

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prom.codes/saver",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "prom.codes Saver — cut token cost without cutting quality, as an MCP installer.",
   "type": "module",
   "bin": {