@robosystems/core 0.8.3 → 0.8.5

package/components/console/ConsoleContent.js

@@ -68,6 +68,10 @@ export function ConsoleContent({ config }) {
     const [historyIndex, setHistoryIndex] = useState(-1);
     const terminalEndRef = useRef(null);
     const terminalScrollRef = useRef(null);
+    // Prior operator exchanges, sent as `history` so a follow-up like "and for
+    // June?" resolves against the previous answer. Bounded to the last three
+    // exchanges — the backend seeds only its last five turns anyway.
+    const conversationRef = useRef([]);
     const [currentQueryStartTime, setCurrentQueryStartTime] = useState(null);
     const [apiVersion, setApiVersion] = useState(null);
     const [operatorProgress, setOperatorProgress] = useState({ isRunning: false, message: '' });
@@ -90,7 +94,8 @@ export function ConsoleContent({ config }) {
             (config.enableRecall
                 ? `  /recall     - Recall semantic memories\n`
                 : '') +
-            `  /mcp        - Show MCP connection setup\n` +
+            `  /mcp        - Connect an MCP client (sign in — no key)\n` +
+            `  /mcp key    - Mint a graph-scoped API key for header-only clients\n` +
             `  /help       - Show this help message\n` +
             `  /clear      - Clear console history\n` +
             `  /examples   - Show example queries`;
@@ -189,6 +194,9 @@ export function ConsoleContent({ config }) {
                 streamingQuery.cancelQuery();
             }
             setTerminalMessages([]);
+            // A follow-up on the new graph must not resolve against the previous
+            // graph's answers.
+            conversationRef.current = [];
             setCurrentQueryStartTime(null);
             addSystemMessage(`═══════════════════════════════════════════════════════════════\n` +
                 `${config.welcome.contextLabel} context changed: ${previousGraphId.current} → ${graphId}\n` +
@@ -316,10 +324,11 @@ export function ConsoleContent({ config }) {
         const startTime = Date.now();
         try {
             const { clients } = await import('@robosystems/client/clients');
-            const result = await clients.operator.executeQuery(graphId, {
-                message: userQuery,
-                mode: 'quick',
-            }, {
+            const history = conversationRef.current;
+            const result = await clients.operator.executeQuery(graphId, Object.assign({ message: userQuery, 
+                // `standard` gives the operator loop six tool turns; `quick` (three)
+                // was exhausted by schema + examples before the first query ran.
+                mode: 'standard' }, (history.length > 0 ? { history } : {})), {
                 mode: 'auto',
                 onProgress: (message, percentage) => {
                     setOperatorProgress({
@@ -330,6 +339,19 @@ export function ConsoleContent({ config }) {
                 },
             });
             setOperatorProgress({ isRunning: false, message: '' });
+            // The API reports operator failures (credit pre-flight, timeouts,
+            // unbilled calls) as HTTP 200 with `error_details` set and an
+            // explanatory `content`. Render those as errors, not as answers.
+            const errorDetails = result.error_details;
+            if (errorDetails) {
+                const detail = [
+                    errorDetails.message,
+                    errorDetails.error,
+                    errorDetails.detail,
+                ].find((v) => typeof v === 'string' && v.length > 0);
+                addErrorMessage(`Operator error: ${detail || result.content || 'The operator could not complete this request.'}`);
+                return;
+            }
             const duration = Date.now() - startTime;
             const metadata = (result.metadata || {});
             const creditsUsed = metadata.credits_consumed;
@@ -384,6 +406,13 @@ export function ConsoleContent({ config }) {
             // plain footer, matching the direct-query result style.
             if (narrative) {
                 addResultMessage(narrative, rows, cypher, { markdown: true, footer });
+                // Record the exchange for follow-ups. Only a narrative answer is
+                // worth carrying; the answer is clipped so history stays cheap.
+                conversationRef.current = [
+                    ...conversationRef.current,
+                    { role: 'user', content: userQuery },
+                    { role: 'assistant', content: narrative.slice(0, 2000) },
+                ].slice(-6);
             }
             else {
                 addResultMessage(footer, rows, cypher);
@@ -405,32 +434,54 @@ export function ConsoleContent({ config }) {
             }
         }
     };
-    const showMcpSetup = async () => {
-        addSystemMessage('Creating graph-scoped connector key...', true);
+    const showMcpSetup = async (mode) => {
         const apiUrl = process.env.NEXT_PUBLIC_ROBOSYSTEMS_API_URL ||
             'https://api.robosystems.ai';
         const { mcp } = config;
         const contextId = graphId || mcp.contextIdFallback;
+        const endpoint = `${apiUrl}/v1/graphs/${contextId}/mcp`;
+        const connectorName = `${mcp.serverName}-${contextId}`;
+        const exampleLines = mcp.exampleQuestions
+            .map((q) => `  • "${q}"`)
+            .join('\n');
+        // The graph id lives in the URL path and never becomes a tool argument,
+        // so one connection is anchored to exactly one graph. OAuth on the
+        // per-graph URL shows this graph preselected on the consent screen; no
+        // key is minted unless asked for, so a sign-in user never leaves an
+        // unused credential behind in Settings → API Keys.
+        if (mode !== 'key') {
+            addSystemMessage(`MCP — connect ${contextId}\n` +
+                `═══════════════════════════════════════════════════════════════\n\n` +
+                `Sign in to connect (recommended). Paste the URL; the client sends\n` +
+                `you to sign in, and this graph is already selected on the consent\n` +
+                `screen. Nothing to copy, store, or rotate.\n\n` +
+                `Claude (claude.ai / Desktop)\n` +
+                `  Settings → Connectors → Add custom connector\n` +
+                `  ${endpoint}\n\n` +
+                `Claude Code (then /mcp to sign in)\n` +
+                `  claude mcp add --transport http ${connectorName} ${endpoint}\n\n` +
+                `Cursor / VS Code (mcp.json)\n` +
+                `  "${connectorName}": { "url": "${endpoint}" }\n\n` +
+                `Any graph from one address: ${apiUrl}/v1/mcp — pick the graph at\n` +
+                `sign-in.\n\n` +
+                `Scripts, CI, or a client that can't sign in? Type /mcp key to mint\n` +
+                `an API key scoped to this graph, with the header snippets filled in.\n\n` +
+                `Once connected, ask questions like:\n` +
+                `${exampleLines}\n\n` +
+                `Clients without HTTP transport support can use the stdio bridge\n` +
+                `in proxy mode: https://github.com/RoboFinSystems/robosystems-mcp-client`, true);
+            return;
+        }
+        addSystemMessage('Creating graph-scoped API key...', true);
         try {
             const { createMcpConnectorUrl } = await import('../../lib/mcp-connector');
-            // The graph id lives in the URL path and never becomes a tool argument,
-            // so one connector is anchored to exactly one graph. Multi-graph users
-            // add one connector per graph, which is why the name carries the id.
-            // The key is graph-scoped: valid only for this graph, revocable in
-            // Settings → API Keys, and rejected on every account-level surface.
+            // Graph-scoped: valid only for this graph and its subgraphs, rejected on
+            // every account-level surface, revocable in Settings → API Keys.
             const connector = await createMcpConnectorUrl(contextId, { apiUrl });
-            const connectorName = `${mcp.serverName}-${contextId}`;
-            const exampleLines = mcp.exampleQuestions
-                .map((q) => `  • "${q}"`)
-                .join('\n');
-            addSystemMessage(`MCP Setup Instructions:\n` +
+            addSystemMessage(`API key for ${contextId}\n` +
                 `═══════════════════════════════════════════════════════════════\n\n` +
-                `Graph-scoped API key created — it works only for ${contextId}\n` +
-                `and can be revoked anytime in Settings → API Keys.\n\n` +
-                `Claude (claude.ai / Desktop)\n` +
-                `  Settings → Connectors → Add custom connector, then paste this\n` +
-                `  URL (the key rides inside it — no header field needed):\n` +
-                `  ${connector.url}\n\n` +
+                `Scoped to this graph only; revoke it anytime in Settings → API Keys.\n` +
+                `It goes in the X-API-Key header — never in the URL.\n\n` +
                 `Claude Code\n` +
                 `  claude mcp add --transport http ${connectorName} \\\n` +
                 `    ${connector.endpoint} \\\n` +
@@ -440,16 +491,12 @@ export function ConsoleContent({ config }) {
                 `    "url": "${connector.endpoint}",\n` +
                 `    "headers": { "X-API-Key": "${connector.apiKey}" }\n` +
                 `  }\n\n` +
-                `Once connected, ask Claude questions like:\n` +
-                `${exampleLines}\n\n` +
-                `Clients without HTTP transport support can use the stdio bridge\n` +
-                `in proxy mode: https://github.com/RoboFinSystems/robosystems-mcp-client\n\n` +
-                `The connector URL contains the key — treat it like a password.`, true);
+                `Treat the key like a password. Shown once.`, true);
         }
         catch (error) {
-            addErrorMessage(`Failed to create connector key: ${error.message || 'Unknown error'}\n\n` +
-                `You can create an API key in Settings and connect with:\n` +
-                `  URL:    ${apiUrl}/v1/graphs/${contextId}/mcp\n` +
+            addErrorMessage(`Failed to create API key: ${error.message || 'Unknown error'}\n\n` +
+                `You can create a key in Settings and connect with:\n` +
+                `  URL:    ${endpoint}\n` +
                 `  Header: X-API-Key: <your key>`);
         }
     };
@@ -592,6 +639,7 @@ export function ConsoleContent({ config }) {
                     return;
                 case '/clear':
                     setTerminalMessages([]);
+                    conversationRef.current = [];
                     addSystemMessage('Console cleared.', true);
                     return;
                 case '/examples': {
@@ -602,7 +650,7 @@ export function ConsoleContent({ config }) {
                     return;
                 }
                 case '/mcp':
-                    await showMcpSetup();
+                    await showMcpSetup(command.slice(cmd.length).trim().toLowerCase());
                     return;
                 default:
                     addErrorMessage(`Unknown command: ${cmd}\n\nType /help for available commands.`);

package/lib/mcp-connector.d.ts

@@ -1,7 +1,5 @@
 export interface McpConnectorUrl {
-    /** Pasteable connector URL with the graph-scoped key embedded as `?token=` */
-    url: string;
-    /** Bare MCP endpoint URL (no credential) — for header-capable clients */
+    /** Bare per-graph MCP endpoint URL (no credential) */
     endpoint: string;
     /** The plaintext graph-scoped API key (returned once at mint) */
     apiKey: string;
@@ -10,18 +8,16 @@ export interface McpConnectorUrl {
     graphId: string;
 }
 /**
- * Mint a graph-scoped API key and assemble the MCP connector URL for it.
+ * Mint a graph-scoped API key for the per-graph MCP endpoint.
  *
- * The URL is for clients that cannot send custom headers (claude.ai /
- * Claude Desktop custom connectors): the scoped key travels as a `token`
- * query parameter, which the server honors only on the MCP endpoint and
- * only for keys scoped to that URL's graph — account-wide keys are
- * rejected there. The key works for exactly this graph (and its
- * subgraphs), is rejected on every account-level surface, and can be
- * revoked from Settings → API Keys like any other key.
- *
- * Header-capable clients (Claude Code, Cursor, VS Code) should use the
- * bare `endpoint` with the key in an `X-API-Key` header instead.
+ * For clients that cannot sign in (scripts, CI, editors without OAuth):
+ * the key goes in an `X-API-Key` header on `endpoint`. It works for
+ * exactly this graph (and its subgraphs), is rejected on every
+ * account-level surface, and can be revoked from Settings → API Keys like
+ * any other key. Credentials never travel in the URL — the `?token=`
+ * connector URL was the bridge to OAuth and the server no longer honors
+ * it. OAuth-capable clients need no key at all: they add `endpoint` (or
+ * the graph-agnostic `/v1/mcp`) and sign in.
  */
 export declare function createMcpConnectorUrl(graphId: string, options?: {
     apiUrl?: string;

package/lib/mcp-connector.js

@@ -1,17 +1,15 @@
 const DEFAULT_API_URL = 'https://api.robosystems.ai';
 /**
- * Mint a graph-scoped API key and assemble the MCP connector URL for it.
+ * Mint a graph-scoped API key for the per-graph MCP endpoint.
  *
- * The URL is for clients that cannot send custom headers (claude.ai /
- * Claude Desktop custom connectors): the scoped key travels as a `token`
- * query parameter, which the server honors only on the MCP endpoint and
- * only for keys scoped to that URL's graph — account-wide keys are
- * rejected there. The key works for exactly this graph (and its
- * subgraphs), is rejected on every account-level surface, and can be
- * revoked from Settings → API Keys like any other key.
- *
- * Header-capable clients (Claude Code, Cursor, VS Code) should use the
- * bare `endpoint` with the key in an `X-API-Key` header instead.
+ * For clients that cannot sign in (scripts, CI, editors without OAuth):
+ * the key goes in an `X-API-Key` header on `endpoint`. It works for
+ * exactly this graph (and its subgraphs), is rejected on every
+ * account-level surface, and can be revoked from Settings → API Keys like
+ * any other key. Credentials never travel in the URL — the `?token=`
+ * connector URL was the bridge to OAuth and the server no longer honors
+ * it. OAuth-capable clients need no key at all: they add `endpoint` (or
+ * the graph-agnostic `/v1/mcp`) and sign in.
  */
 export async function createMcpConnectorUrl(graphId, options = {}) {
     var _a, _b;
@@ -26,7 +24,6 @@ export async function createMcpConnectorUrl(graphId, options = {}) {
     }
     const endpoint = `${apiUrl}/v1/graphs/${graphId}/mcp`;
     return {
-        url: `${endpoint}?token=${response.data.key}`,
         endpoint,
         apiKey: response.data.key,
         keyName,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robosystems/core",
-  "version": "0.8.3",
+  "version": "0.8.5",
   "description": "Shared RoboSystems frontend core library (auth, contexts, task monitoring, UI components) for the RoboSystems Next.js apps",
   "license": "MIT",
   "private": false,