@sakupa/mcp 0.7.14 → 0.7.15

package/dist/bin.js

@@ -129,7 +129,7 @@ var FORBIDDEN_PATH_SEGMENTS = [
 var ALLOWED_HIDDEN_PATHS = [".well-known/"];
 
 // ../core/dist/domain/version.js
-var SAKUPA_MCP_VERSION = "0.7.14";
+var SAKUPA_MCP_VERSION = "0.7.15";
 
 // ../core/dist/domain/errors.js
 var HTTP_STATUS = {
@@ -460,9 +460,8 @@ var TEST_API_BASE_URL = "https://api-test.sakupa.com";
 function previewHostPatternFor(apiBaseUrl) {
   return environmentFor(apiBaseUrl) === "test" ? "{shortId}-test.sakupa.com" : "{shortId}.sakupa.com";
 }
-function loadMcpRuntimeConfig(env = process.env, cwd = process.cwd()) {
+function loadMcpRuntimeConfig(env = process.env) {
   const apiBaseUrl = (env["SAKUPA_API_URL"] ?? env["SAKUPA_API_BASE_URL"] ?? DEFAULT_API_BASE_URL).replace(/\/+$/, "");
-  const projectDir = env["SAKUPA_PROJECT_DIR"] ?? cwd;
   const testAccessToken = env["SAKUPA_TEST_ACCESS_TOKEN"]?.trim() ?? "";
   if (apiBaseUrl === TEST_API_BASE_URL) {
     if (testAccessToken.length === 0) {
@@ -470,14 +469,14 @@ function loadMcpRuntimeConfig(env = process.env, cwd = process.cwd()) {
         "The Sakupa Test API requires SAKUPA_TEST_ACCESS_TOKEN. Anonymous Test access is disabled."
       );
     }
-    return { apiBaseUrl, projectDir, testAccessToken };
+    return { apiBaseUrl, testAccessToken };
   }
   if (testAccessToken.length > 0) {
     throw new Error(
       `SAKUPA_TEST_ACCESS_TOKEN may only be used with ${TEST_API_BASE_URL}. Remove it before connecting to any other API.`
     );
   }
-  return { apiBaseUrl, projectDir };
+  return { apiBaseUrl };
 }
 function environmentFor(apiBaseUrl) {
   return apiBaseUrl === TEST_API_BASE_URL ? "test" : "production";
@@ -983,7 +982,7 @@ async function analyzeProject(projectDir, opts = {}) {
   if (opts.outputDir !== void 0) {
     outputDirRel = normalizeOutputDir(opts.outputDir);
     const abs = resolve(root, outputDirRel);
-    if (!abs.startsWith(root)) {
+    if (abs !== root && !abs.startsWith(root + sep)) {
       outputDirRel = ".";
       outputDirExists = false;
     } else {
@@ -1448,13 +1447,15 @@ var LocalGuidanceError = class extends SakupaError {
     super(code, message);
   }
 };
-var projectDirInput = z2.string().optional().describe(
-  "Absolute path of the user's PROJECT ROOT \u2014 the folder the user opened/works in (for framework projects: where package.json lives, NEVER the build-output subfolder like dist/out; the analyzer locates the output automatically). .sakupa/site.json lives here, so PASS THE SAME DIRECTORY EVERY TIME for the same project. When omitted the server falls back to its startup directory, which may not be where the user is working now."
+var projectDirInput = z2.string().describe(
+  "REQUIRED on every call: absolute path of the user's PROJECT ROOT \u2014 the folder the user opened/works in (for framework projects: where package.json lives, NEVER the build-output subfolder like dist/out; the analyzer locates the output automatically). .sakupa/site.json lives here, so PASS THE SAME DIRECTORY EVERY TIME for the same project. Only YOU know which directory the user is in \u2014 the server never guesses and refuses calls without it."
 );
 function withProjectDir(ctx, projectDirArg) {
   if (projectDirArg === void 0) {
-    const sticky = ctx.session.projectDir;
-    return sticky !== null ? { ...ctx, projectDir: sticky } : ctx;
+    throw new LocalGuidanceError(
+      "invalid_request",
+      "projectDir is REQUIRED on every call: pass the absolute path of the directory the user is CURRENTLY working in. The server never guesses a directory \u2014 a wrong guess once published one project's files over a different project's PAID site."
+    );
   }
   if (!isAbsolute(projectDirArg)) {
     throw new LocalGuidanceError(
@@ -1476,7 +1477,6 @@ function withProjectDir(ctx, projectDirArg) {
       `projectDir "${dir}" does not exist or is not a directory. Pass the absolute path of the directory the user is currently working in.`
     );
   }
-  ctx.session.projectDir = dir;
   return { ...ctx, projectDir: dir };
 }
 function requireSiteFile(ctx) {
@@ -2760,11 +2760,11 @@ Workflow:
    sanitized diagnostic report after the user explicitly confirms it.
 
 Project directory contract: ONE directory = ONE site (its .sakupa/site.json holds the
-binding). Every project-scoped tool accepts projectDir \u2014 ALWAYS pass the absolute path of
+binding). projectDir is REQUIRED on EVERY tool call \u2014 always pass the absolute path of
 the user's PROJECT ROOT, the SAME directory every time for the same project: the folder
 the user opened (for framework projects, where package.json lives \u2014 never the dist/out
-build folder; output is auto-detected). Without it the server falls back to its startup
-directory, which may be a different project than the one the user is looking at. After every deploy, TELL the user which environment it went to (deploy results carry an
+build folder; output is auto-detected). The server NEVER guesses a directory and refuses
+calls without one: only you can see which directory the user is actually in. After every deploy, TELL the user which environment it went to (deploy results carry an
 Explicit Environment line: TEST vs PRODUCTION). analyze, deploy, status,
 refresh, delete and unbind echo
 the directory they acted on \u2014 verify it matches the user's active project.
@@ -2800,12 +2800,7 @@ function createSakupaMcpServer(opts) {
     { name: "sakupa", version: MCP_VERSION },
     { instructions: instructionsFor(previewHostPatternFor(opts.apiBaseUrl)) }
   );
-  const ctx = {
-    client,
-    projectDir: opts.projectDir,
-    apiBaseUrl: opts.apiBaseUrl,
-    session: { projectDir: null }
-  };
+  const ctx = { client, apiBaseUrl: opts.apiBaseUrl };
   registerTools(server, ctx);
   registerBillingTools(server, ctx);
   registerLifecycleTools(server, ctx);
@@ -2819,7 +2814,7 @@ async function main() {
   const transport = new StdioServerTransport();
   await server.connect(transport);
   console.error(
-    `[sakupa-mcp] v${MCP_VERSION} connected (api: ${config.apiBaseUrl}, default project: ${config.projectDir}; tools accept per-call projectDir)`
+    `[sakupa-mcp] v${MCP_VERSION} connected (api: ${config.apiBaseUrl}; every tool call requires projectDir)`
   );
 }
 main().catch((err) => {

package/dist/index.js

@@ -124,7 +124,7 @@ var FORBIDDEN_PATH_SEGMENTS = [
 var ALLOWED_HIDDEN_PATHS = [".well-known/"];
 
 // ../core/dist/domain/version.js
-var SAKUPA_MCP_VERSION = "0.7.14";
+var SAKUPA_MCP_VERSION = "0.7.15";
 
 // ../core/dist/domain/errors.js
 var HTTP_STATUS = {
@@ -459,9 +459,8 @@ var TEST_API_BASE_URL = "https://api-test.sakupa.com";
 function previewHostPatternFor(apiBaseUrl) {
   return environmentFor(apiBaseUrl) === "test" ? "{shortId}-test.sakupa.com" : "{shortId}.sakupa.com";
 }
-function loadMcpRuntimeConfig(env = process.env, cwd = process.cwd()) {
+function loadMcpRuntimeConfig(env = process.env) {
   const apiBaseUrl = (env["SAKUPA_API_URL"] ?? env["SAKUPA_API_BASE_URL"] ?? DEFAULT_API_BASE_URL).replace(/\/+$/, "");
-  const projectDir = env["SAKUPA_PROJECT_DIR"] ?? cwd;
   const testAccessToken = env["SAKUPA_TEST_ACCESS_TOKEN"]?.trim() ?? "";
   if (apiBaseUrl === TEST_API_BASE_URL) {
     if (testAccessToken.length === 0) {
@@ -469,14 +468,14 @@ function loadMcpRuntimeConfig(env = process.env, cwd = process.cwd()) {
         "The Sakupa Test API requires SAKUPA_TEST_ACCESS_TOKEN. Anonymous Test access is disabled."
       );
     }
-    return { apiBaseUrl, projectDir, testAccessToken };
+    return { apiBaseUrl, testAccessToken };
   }
   if (testAccessToken.length > 0) {
     throw new Error(
       `SAKUPA_TEST_ACCESS_TOKEN may only be used with ${TEST_API_BASE_URL}. Remove it before connecting to any other API.`
     );
   }
-  return { apiBaseUrl, projectDir };
+  return { apiBaseUrl };
 }
 function environmentFor(apiBaseUrl) {
   return apiBaseUrl === TEST_API_BASE_URL ? "test" : "production";
@@ -1150,7 +1149,7 @@ async function analyzeProject(projectDir, opts = {}) {
   if (opts.outputDir !== void 0) {
     outputDirRel = normalizeOutputDir(opts.outputDir);
     const abs = resolve(root, outputDirRel);
-    if (!abs.startsWith(root)) {
+    if (abs !== root && !abs.startsWith(root + sep)) {
       outputDirRel = ".";
       outputDirExists = false;
     } else {
@@ -1329,13 +1328,15 @@ var LocalGuidanceError = class extends SakupaError {
     super(code, message);
   }
 };
-var projectDirInput = z2.string().optional().describe(
-  "Absolute path of the user's PROJECT ROOT \u2014 the folder the user opened/works in (for framework projects: where package.json lives, NEVER the build-output subfolder like dist/out; the analyzer locates the output automatically). .sakupa/site.json lives here, so PASS THE SAME DIRECTORY EVERY TIME for the same project. When omitted the server falls back to its startup directory, which may not be where the user is working now."
+var projectDirInput = z2.string().describe(
+  "REQUIRED on every call: absolute path of the user's PROJECT ROOT \u2014 the folder the user opened/works in (for framework projects: where package.json lives, NEVER the build-output subfolder like dist/out; the analyzer locates the output automatically). .sakupa/site.json lives here, so PASS THE SAME DIRECTORY EVERY TIME for the same project. Only YOU know which directory the user is in \u2014 the server never guesses and refuses calls without it."
 );
 function withProjectDir(ctx, projectDirArg) {
   if (projectDirArg === void 0) {
-    const sticky = ctx.session.projectDir;
-    return sticky !== null ? { ...ctx, projectDir: sticky } : ctx;
+    throw new LocalGuidanceError(
+      "invalid_request",
+      "projectDir is REQUIRED on every call: pass the absolute path of the directory the user is CURRENTLY working in. The server never guesses a directory \u2014 a wrong guess once published one project's files over a different project's PAID site."
+    );
   }
   if (!isAbsolute(projectDirArg)) {
     throw new LocalGuidanceError(
@@ -1357,7 +1358,6 @@ function withProjectDir(ctx, projectDirArg) {
       `projectDir "${dir}" does not exist or is not a directory. Pass the absolute path of the directory the user is currently working in.`
     );
   }
-  ctx.session.projectDir = dir;
   return { ...ctx, projectDir: dir };
 }
 function requireSiteFile(ctx) {
@@ -2755,11 +2755,11 @@ Workflow:
    sanitized diagnostic report after the user explicitly confirms it.
 
 Project directory contract: ONE directory = ONE site (its .sakupa/site.json holds the
-binding). Every project-scoped tool accepts projectDir \u2014 ALWAYS pass the absolute path of
+binding). projectDir is REQUIRED on EVERY tool call \u2014 always pass the absolute path of
 the user's PROJECT ROOT, the SAME directory every time for the same project: the folder
 the user opened (for framework projects, where package.json lives \u2014 never the dist/out
-build folder; output is auto-detected). Without it the server falls back to its startup
-directory, which may be a different project than the one the user is looking at. After every deploy, TELL the user which environment it went to (deploy results carry an
+build folder; output is auto-detected). The server NEVER guesses a directory and refuses
+calls without one: only you can see which directory the user is actually in. After every deploy, TELL the user which environment it went to (deploy results carry an
 Explicit Environment line: TEST vs PRODUCTION). analyze, deploy, status,
 refresh, delete and unbind echo
 the directory they acted on \u2014 verify it matches the user's active project.
@@ -2795,12 +2795,7 @@ function createSakupaMcpServer(opts) {
     { name: "sakupa", version: MCP_VERSION },
     { instructions: instructionsFor(previewHostPatternFor(opts.apiBaseUrl)) }
   );
-  const ctx = {
-    client,
-    projectDir: opts.projectDir,
-    apiBaseUrl: opts.apiBaseUrl,
-    session: { projectDir: null }
-  };
+  const ctx = { client, apiBaseUrl: opts.apiBaseUrl };
   registerTools(server, ctx);
   registerBillingTools(server, ctx);
   registerLifecycleTools(server, ctx);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sakupa/mcp",
-  "version": "0.7.14",
+  "version": "0.7.15",
   "description": "Sakupa MCP server: publish AI-made static sites from your AI tool. AI-made pages, live in seconds.",
   "type": "module",
   "main": "dist/index.js",