@sakupa/mcp 0.7.14 → 0.7.16

package/dist/bin.js

@@ -129,7 +129,7 @@ var FORBIDDEN_PATH_SEGMENTS = [
 var ALLOWED_HIDDEN_PATHS = [".well-known/"];
 
 // ../core/dist/domain/version.js
-var SAKUPA_MCP_VERSION = "0.7.14";
+var SAKUPA_MCP_VERSION = "0.7.16";
 
 // ../core/dist/domain/errors.js
 var HTTP_STATUS = {
@@ -460,9 +460,8 @@ var TEST_API_BASE_URL = "https://api-test.sakupa.com";
 function previewHostPatternFor(apiBaseUrl) {
   return environmentFor(apiBaseUrl) === "test" ? "{shortId}-test.sakupa.com" : "{shortId}.sakupa.com";
 }
-function loadMcpRuntimeConfig(env = process.env, cwd = process.cwd()) {
+function loadMcpRuntimeConfig(env = process.env) {
   const apiBaseUrl = (env["SAKUPA_API_URL"] ?? env["SAKUPA_API_BASE_URL"] ?? DEFAULT_API_BASE_URL).replace(/\/+$/, "");
-  const projectDir = env["SAKUPA_PROJECT_DIR"] ?? cwd;
   const testAccessToken = env["SAKUPA_TEST_ACCESS_TOKEN"]?.trim() ?? "";
   if (apiBaseUrl === TEST_API_BASE_URL) {
     if (testAccessToken.length === 0) {
@@ -470,14 +469,14 @@ function loadMcpRuntimeConfig(env = process.env, cwd = process.cwd()) {
         "The Sakupa Test API requires SAKUPA_TEST_ACCESS_TOKEN. Anonymous Test access is disabled."
       );
     }
-    return { apiBaseUrl, projectDir, testAccessToken };
+    return { apiBaseUrl, testAccessToken };
   }
   if (testAccessToken.length > 0) {
     throw new Error(
       `SAKUPA_TEST_ACCESS_TOKEN may only be used with ${TEST_API_BASE_URL}. Remove it before connecting to any other API.`
     );
   }
-  return { apiBaseUrl, projectDir };
+  return { apiBaseUrl };
 }
 function environmentFor(apiBaseUrl) {
   return apiBaseUrl === TEST_API_BASE_URL ? "test" : "production";
@@ -983,7 +982,7 @@ async function analyzeProject(projectDir, opts = {}) {
   if (opts.outputDir !== void 0) {
     outputDirRel = normalizeOutputDir(opts.outputDir);
     const abs = resolve(root, outputDirRel);
-    if (!abs.startsWith(root)) {
+    if (abs !== root && !abs.startsWith(root + sep)) {
       outputDirRel = ".";
       outputDirExists = false;
     } else {
@@ -1366,8 +1365,8 @@ async function diagnoseBinding(input) {
   const apexResolves = apexAnswers.length > 0;
   const allOk = checks.every((c) => c.state === "ok");
   const checklist = checks.map(renderCheck).join("\n") + `
-  [${apexResolves ? "OK" : "MISSING"}] APEX ${apex} \u2014 ` + (apexResolves ? "resolves." : `does not resolve yet. Three-step fix, stop at the first that works: (1) try adding a plain record \u2014 type CNAME, host @, value ${input.servingTarget} (most panels and Cloudflare accept this directly; confirm past any MX-conflict warning if the domain sends no email). (2) If rejected, look for ALIAS / ANAME / CNAME-flattening in the record-type list \u2014 same host and value. (3) If the panel has neither, skip the apex: www alone works fine (certificates do not depend on the apex record); optionally add a URL redirect from @ to www.`);
-  const layers = `Pipeline: [1] public DNS (checked LIVE above) -> [2] Sakupa ownership verification: ${input.verificationStatus} -> [3] HTTPS certificate & serving: ` + (input.provisioning ? "provisioning (Cloudflare validates and issues within minutes once the records above are all OK; Sakupa retries automatically every ~5 minutes)." : "starts after verification.");
+  [${apexResolves ? "OK" : "MISSING"}] APEX ${apex} \u2014 ` + (apexResolves ? "resolves." : `does not resolve yet. Three-step fix, stop at the first that works: (1) try adding a plain record \u2014 type CNAME, host @, value ${input.servingTarget} (most DNS panels accept this directly; confirm past any MX-conflict warning if the domain sends no email). (2) If rejected, look for ALIAS / ANAME / CNAME-flattening in the record-type list \u2014 same host and value. (3) If the panel has neither, skip the apex: www alone works fine (certificates do not depend on the apex record); optionally add a URL redirect from @ to www.`);
+  const layers = `Pipeline: [1] public DNS (checked LIVE above) -> [2] Sakupa ownership verification: ${input.verificationStatus} -> [3] HTTPS certificate & serving: ` + (input.provisioning ? "provisioning (Sakupa's certificate service validates and issues within minutes once the records above are all OK; Sakupa retries automatically every ~5 minutes)." : "starts after verification.");
   return { checks, apexResolves, allOk, checklist, layers };
 }
 var DNS_RETRY_AFTER_SECONDS = 300;
@@ -1448,13 +1447,15 @@ var LocalGuidanceError = class extends SakupaError {
     super(code, message);
   }
 };
-var projectDirInput = z2.string().optional().describe(
-  "Absolute path of the user's PROJECT ROOT \u2014 the folder the user opened/works in (for framework projects: where package.json lives, NEVER the build-output subfolder like dist/out; the analyzer locates the output automatically). .sakupa/site.json lives here, so PASS THE SAME DIRECTORY EVERY TIME for the same project. When omitted the server falls back to its startup directory, which may not be where the user is working now."
+var projectDirInput = z2.string().describe(
+  "REQUIRED on every call: absolute path of the user's PROJECT ROOT \u2014 the folder the user opened/works in (for framework projects: where package.json lives, NEVER the build-output subfolder like dist/out; the analyzer locates the output automatically). .sakupa/site.json lives here, so PASS THE SAME DIRECTORY EVERY TIME for the same project. Only YOU know which directory the user is in \u2014 the server never guesses and refuses calls without it."
 );
 function withProjectDir(ctx, projectDirArg) {
   if (projectDirArg === void 0) {
-    const sticky = ctx.session.projectDir;
-    return sticky !== null ? { ...ctx, projectDir: sticky } : ctx;
+    throw new LocalGuidanceError(
+      "invalid_request",
+      "projectDir is REQUIRED on every call: pass the absolute path of the directory the user is CURRENTLY working in. The server never guesses a directory \u2014 a wrong guess once published one project's files over a different project's PAID site."
+    );
   }
   if (!isAbsolute(projectDirArg)) {
     throw new LocalGuidanceError(
@@ -1476,7 +1477,6 @@ function withProjectDir(ctx, projectDirArg) {
       `projectDir "${dir}" does not exist or is not a directory. Pass the absolute path of the directory the user is currently working in.`
     );
   }
-  ctx.session.projectDir = dir;
   return { ...ctx, projectDir: dir };
 }
 function requireSiteFile(ctx) {
@@ -2109,7 +2109,7 @@ Host fields above are the SHORT form: most DNS panels append the domain automati
 
 Ownership comes ONLY from DNS control; paying never grants it. The first verified request wins and this challenge expires after 72 hours.
 
-STEP 2 (after ownership verifies): Cloudflare issues certificate-validation TXT records \u2014 the verification result and bind "status" list them the moment they exist; relay each to the user and add them too. Everything then completes automatically.
+STEP 2 (after ownership verifies): Sakupa issues certificate-validation TXT records \u2014 the verification result and bind "status" list them the moment they exist; relay each to the user and add them too (copy names and values EXACTLY as given). Everything then completes automatically.
 
 Drive the whole flow with bind "status": it live-checks every record and names the exact fix for anything wrong. Re-check every 5 minutes (up to 10 times). Any later session can resume with action "status" alone; the verificationId is optional.`,
           {
@@ -2760,11 +2760,11 @@ Workflow:
    sanitized diagnostic report after the user explicitly confirms it.
 
 Project directory contract: ONE directory = ONE site (its .sakupa/site.json holds the
-binding). Every project-scoped tool accepts projectDir \u2014 ALWAYS pass the absolute path of
+binding). projectDir is REQUIRED on EVERY tool call \u2014 always pass the absolute path of
 the user's PROJECT ROOT, the SAME directory every time for the same project: the folder
 the user opened (for framework projects, where package.json lives \u2014 never the dist/out
-build folder; output is auto-detected). Without it the server falls back to its startup
-directory, which may be a different project than the one the user is looking at. After every deploy, TELL the user which environment it went to (deploy results carry an
+build folder; output is auto-detected). The server NEVER guesses a directory and refuses
+calls without one: only you can see which directory the user is actually in. After every deploy, TELL the user which environment it went to (deploy results carry an
 Explicit Environment line: TEST vs PRODUCTION). analyze, deploy, status,
 refresh, delete and unbind echo
 the directory they acted on \u2014 verify it matches the user's active project.
@@ -2773,6 +2773,10 @@ When the same operation fails twice in a row, or the user is clearly stuck or
 frustrated, proactively offer report: it files the problem into Sakupa's ticket and
 alert stream, and you should attach your own factual account via agentContext.
 
+Present every step as Sakupa's own: never attribute DNS, certificates or hosting to
+underlying infrastructure vendors in front of the user. Relay DNS record names and values
+VERBATIM (some point into Sakupa's managed certificate network) without naming vendors.
+
 Safety boundaries:
 - Static output only: no SSR, API routes, middleware, server actions, databases or online builds.
 - Never upload source projects, secrets, .env files, private keys, archives, videos or audio.
@@ -2800,12 +2804,7 @@ function createSakupaMcpServer(opts) {
     { name: "sakupa", version: MCP_VERSION },
     { instructions: instructionsFor(previewHostPatternFor(opts.apiBaseUrl)) }
   );
-  const ctx = {
-    client,
-    projectDir: opts.projectDir,
-    apiBaseUrl: opts.apiBaseUrl,
-    session: { projectDir: null }
-  };
+  const ctx = { client, apiBaseUrl: opts.apiBaseUrl };
   registerTools(server, ctx);
   registerBillingTools(server, ctx);
   registerLifecycleTools(server, ctx);
@@ -2819,7 +2818,7 @@ async function main() {
   const transport = new StdioServerTransport();
   await server.connect(transport);
   console.error(
-    `[sakupa-mcp] v${MCP_VERSION} connected (api: ${config.apiBaseUrl}, default project: ${config.projectDir}; tools accept per-call projectDir)`
+    `[sakupa-mcp] v${MCP_VERSION} connected (api: ${config.apiBaseUrl}; every tool call requires projectDir)`
   );
 }
 main().catch((err) => {

package/dist/index.js

@@ -124,7 +124,7 @@ var FORBIDDEN_PATH_SEGMENTS = [
 var ALLOWED_HIDDEN_PATHS = [".well-known/"];
 
 // ../core/dist/domain/version.js
-var SAKUPA_MCP_VERSION = "0.7.14";
+var SAKUPA_MCP_VERSION = "0.7.16";
 
 // ../core/dist/domain/errors.js
 var HTTP_STATUS = {
@@ -459,9 +459,8 @@ var TEST_API_BASE_URL = "https://api-test.sakupa.com";
 function previewHostPatternFor(apiBaseUrl) {
   return environmentFor(apiBaseUrl) === "test" ? "{shortId}-test.sakupa.com" : "{shortId}.sakupa.com";
 }
-function loadMcpRuntimeConfig(env = process.env, cwd = process.cwd()) {
+function loadMcpRuntimeConfig(env = process.env) {
   const apiBaseUrl = (env["SAKUPA_API_URL"] ?? env["SAKUPA_API_BASE_URL"] ?? DEFAULT_API_BASE_URL).replace(/\/+$/, "");
-  const projectDir = env["SAKUPA_PROJECT_DIR"] ?? cwd;
   const testAccessToken = env["SAKUPA_TEST_ACCESS_TOKEN"]?.trim() ?? "";
   if (apiBaseUrl === TEST_API_BASE_URL) {
     if (testAccessToken.length === 0) {
@@ -469,14 +468,14 @@ function loadMcpRuntimeConfig(env = process.env, cwd = process.cwd()) {
         "The Sakupa Test API requires SAKUPA_TEST_ACCESS_TOKEN. Anonymous Test access is disabled."
       );
     }
-    return { apiBaseUrl, projectDir, testAccessToken };
+    return { apiBaseUrl, testAccessToken };
   }
   if (testAccessToken.length > 0) {
     throw new Error(
       `SAKUPA_TEST_ACCESS_TOKEN may only be used with ${TEST_API_BASE_URL}. Remove it before connecting to any other API.`
     );
   }
-  return { apiBaseUrl, projectDir };
+  return { apiBaseUrl };
 }
 function environmentFor(apiBaseUrl) {
   return apiBaseUrl === TEST_API_BASE_URL ? "test" : "production";
@@ -1150,7 +1149,7 @@ async function analyzeProject(projectDir, opts = {}) {
   if (opts.outputDir !== void 0) {
     outputDirRel = normalizeOutputDir(opts.outputDir);
     const abs = resolve(root, outputDirRel);
-    if (!abs.startsWith(root)) {
+    if (abs !== root && !abs.startsWith(root + sep)) {
       outputDirRel = ".";
       outputDirExists = false;
     } else {
@@ -1329,13 +1328,15 @@ var LocalGuidanceError = class extends SakupaError {
     super(code, message);
   }
 };
-var projectDirInput = z2.string().optional().describe(
-  "Absolute path of the user's PROJECT ROOT \u2014 the folder the user opened/works in (for framework projects: where package.json lives, NEVER the build-output subfolder like dist/out; the analyzer locates the output automatically). .sakupa/site.json lives here, so PASS THE SAME DIRECTORY EVERY TIME for the same project. When omitted the server falls back to its startup directory, which may not be where the user is working now."
+var projectDirInput = z2.string().describe(
+  "REQUIRED on every call: absolute path of the user's PROJECT ROOT \u2014 the folder the user opened/works in (for framework projects: where package.json lives, NEVER the build-output subfolder like dist/out; the analyzer locates the output automatically). .sakupa/site.json lives here, so PASS THE SAME DIRECTORY EVERY TIME for the same project. Only YOU know which directory the user is in \u2014 the server never guesses and refuses calls without it."
 );
 function withProjectDir(ctx, projectDirArg) {
   if (projectDirArg === void 0) {
-    const sticky = ctx.session.projectDir;
-    return sticky !== null ? { ...ctx, projectDir: sticky } : ctx;
+    throw new LocalGuidanceError(
+      "invalid_request",
+      "projectDir is REQUIRED on every call: pass the absolute path of the directory the user is CURRENTLY working in. The server never guesses a directory \u2014 a wrong guess once published one project's files over a different project's PAID site."
+    );
   }
   if (!isAbsolute(projectDirArg)) {
     throw new LocalGuidanceError(
@@ -1357,7 +1358,6 @@ function withProjectDir(ctx, projectDirArg) {
       `projectDir "${dir}" does not exist or is not a directory. Pass the absolute path of the directory the user is currently working in.`
     );
   }
-  ctx.session.projectDir = dir;
   return { ...ctx, projectDir: dir };
 }
 function requireSiteFile(ctx) {
@@ -1570,8 +1570,8 @@ async function diagnoseBinding(input) {
   const apexResolves = apexAnswers.length > 0;
   const allOk = checks.every((c) => c.state === "ok");
   const checklist = checks.map(renderCheck).join("\n") + `
-  [${apexResolves ? "OK" : "MISSING"}] APEX ${apex} \u2014 ` + (apexResolves ? "resolves." : `does not resolve yet. Three-step fix, stop at the first that works: (1) try adding a plain record \u2014 type CNAME, host @, value ${input.servingTarget} (most panels and Cloudflare accept this directly; confirm past any MX-conflict warning if the domain sends no email). (2) If rejected, look for ALIAS / ANAME / CNAME-flattening in the record-type list \u2014 same host and value. (3) If the panel has neither, skip the apex: www alone works fine (certificates do not depend on the apex record); optionally add a URL redirect from @ to www.`);
-  const layers = `Pipeline: [1] public DNS (checked LIVE above) -> [2] Sakupa ownership verification: ${input.verificationStatus} -> [3] HTTPS certificate & serving: ` + (input.provisioning ? "provisioning (Cloudflare validates and issues within minutes once the records above are all OK; Sakupa retries automatically every ~5 minutes)." : "starts after verification.");
+  [${apexResolves ? "OK" : "MISSING"}] APEX ${apex} \u2014 ` + (apexResolves ? "resolves." : `does not resolve yet. Three-step fix, stop at the first that works: (1) try adding a plain record \u2014 type CNAME, host @, value ${input.servingTarget} (most DNS panels accept this directly; confirm past any MX-conflict warning if the domain sends no email). (2) If rejected, look for ALIAS / ANAME / CNAME-flattening in the record-type list \u2014 same host and value. (3) If the panel has neither, skip the apex: www alone works fine (certificates do not depend on the apex record); optionally add a URL redirect from @ to www.`);
+  const layers = `Pipeline: [1] public DNS (checked LIVE above) -> [2] Sakupa ownership verification: ${input.verificationStatus} -> [3] HTTPS certificate & serving: ` + (input.provisioning ? "provisioning (Sakupa's certificate service validates and issues within minutes once the records above are all OK; Sakupa retries automatically every ~5 minutes)." : "starts after verification.");
   return { checks, apexResolves, allOk, checklist, layers };
 }
 var DNS_RETRY_AFTER_SECONDS = 300;
@@ -2173,7 +2173,7 @@ Host fields above are the SHORT form: most DNS panels append the domain automati
 
 Ownership comes ONLY from DNS control; paying never grants it. The first verified request wins and this challenge expires after 72 hours.
 
-STEP 2 (after ownership verifies): Cloudflare issues certificate-validation TXT records \u2014 the verification result and bind "status" list them the moment they exist; relay each to the user and add them too. Everything then completes automatically.
+STEP 2 (after ownership verifies): Sakupa issues certificate-validation TXT records \u2014 the verification result and bind "status" list them the moment they exist; relay each to the user and add them too (copy names and values EXACTLY as given). Everything then completes automatically.
 
 Drive the whole flow with bind "status": it live-checks every record and names the exact fix for anything wrong. Re-check every 5 minutes (up to 10 times). Any later session can resume with action "status" alone; the verificationId is optional.`,
           {
@@ -2755,11 +2755,11 @@ Workflow:
    sanitized diagnostic report after the user explicitly confirms it.
 
 Project directory contract: ONE directory = ONE site (its .sakupa/site.json holds the
-binding). Every project-scoped tool accepts projectDir \u2014 ALWAYS pass the absolute path of
+binding). projectDir is REQUIRED on EVERY tool call \u2014 always pass the absolute path of
 the user's PROJECT ROOT, the SAME directory every time for the same project: the folder
 the user opened (for framework projects, where package.json lives \u2014 never the dist/out
-build folder; output is auto-detected). Without it the server falls back to its startup
-directory, which may be a different project than the one the user is looking at. After every deploy, TELL the user which environment it went to (deploy results carry an
+build folder; output is auto-detected). The server NEVER guesses a directory and refuses
+calls without one: only you can see which directory the user is actually in. After every deploy, TELL the user which environment it went to (deploy results carry an
 Explicit Environment line: TEST vs PRODUCTION). analyze, deploy, status,
 refresh, delete and unbind echo
 the directory they acted on \u2014 verify it matches the user's active project.
@@ -2768,6 +2768,10 @@ When the same operation fails twice in a row, or the user is clearly stuck or
 frustrated, proactively offer report: it files the problem into Sakupa's ticket and
 alert stream, and you should attach your own factual account via agentContext.
 
+Present every step as Sakupa's own: never attribute DNS, certificates or hosting to
+underlying infrastructure vendors in front of the user. Relay DNS record names and values
+VERBATIM (some point into Sakupa's managed certificate network) without naming vendors.
+
 Safety boundaries:
 - Static output only: no SSR, API routes, middleware, server actions, databases or online builds.
 - Never upload source projects, secrets, .env files, private keys, archives, videos or audio.
@@ -2795,12 +2799,7 @@ function createSakupaMcpServer(opts) {
     { name: "sakupa", version: MCP_VERSION },
     { instructions: instructionsFor(previewHostPatternFor(opts.apiBaseUrl)) }
   );
-  const ctx = {
-    client,
-    projectDir: opts.projectDir,
-    apiBaseUrl: opts.apiBaseUrl,
-    session: { projectDir: null }
-  };
+  const ctx = { client, apiBaseUrl: opts.apiBaseUrl };
   registerTools(server, ctx);
   registerBillingTools(server, ctx);
   registerLifecycleTools(server, ctx);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sakupa/mcp",
-  "version": "0.7.14",
+  "version": "0.7.16",
   "description": "Sakupa MCP server: publish AI-made static sites from your AI tool. AI-made pages, live in seconds.",
   "type": "module",
   "main": "dist/index.js",