@skyelight/mcp 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -0,0 +1,189 @@
+# Changelog
+
+Notable changes to `@skyelight/mcp`. Dates are npm publish dates.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this package follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+What a version number means here: the tools are the interface. A **minor** is a
+new tool, a new argument, or a new field in a result — an agent that ignores it
+keeps working. A **patch** is a fix or a wording change. A **major** would be
+removing a tool or an argument, or changing what an existing field means, and
+there has not been one.
+
+## 0.5.0 — unreleased
+
+### Added
+
+- **Seven tools for working with a project's history.** `whats_new` catches
+  you up since you last looked, from a bookmark kept per person per project.
+  `project_review` returns what a project settled, for a review or hand-off
+  document. `decision_log` quotes the threads where decisions were made and
+  returns the project's rules; `save_rule` keeps a new one (owners and
+  admins). `find_by_source` finds feedback by the file or component the build
+  plugin stamped. `find_similar` checks for an existing report, and
+  `merge_items` folds duplicates together. Needs a deployment with the
+  `/api/v1/review`, `/whats-new`, `/source`, `/similar`, `/decisions`,
+  `/rules` and `/items/merge` routes. `project_review` and `decision_log`
+  are paged (`section`, `offset`) so a result fits in an agent's context.
+
+- **Hosted server speaks MCP 2026-07-28.** Not in this package (its stdio
+  server keeps the `initialize` handshake), but worth knowing: the hosted
+  `/mcp` now answers `server/discover` and modern requests in that
+  revision's shape, which ChatGPT requires.
+
+- **The Skyelight mark and title.** `serverInfo` carries `title` and
+  `icons`, so clients that show a server's icon show ours. Each tool also
+  carries ChatGPT's status lines for while it runs and once it is done.
+
+- **Tool annotations.** Every tool says whether it only reads
+  (`readOnlyHint`), and `merge_items` that it hides items
+  (`destructiveHint`), so clients can ask before a write.
+
+- **Assigning and mentioning people (SKY-324).** `list_members` returns the
+  workspace's people. `assign` hands an item to one of them, or unassigns it
+  with `null`. `create_item` takes `assignee` and `mentions`, and
+  `post_update` takes `mentions`. People can be named by name, email, id or
+  `me`; an ambiguous name is refused with the candidates. They are notified
+  the way an assignment or a mention in the app notifies them. Needs a
+  deployment with the `/api/v1/members` and `/api/v1/items/assign` routes.
+
+- **A picker when several agents are installed.** `init` detected them all
+  along and then refused to choose: it printed the list and exited 1, as
+  though having two editors were an error. Most developers have more than
+  one, so the commonest case on the first command anybody runs was a dead
+  end. It asks now, with `a` for every agent at once.
+- **`--client all`**, the same thing without the question.
+- **`npx @skyelight/mcp remove`**, which there was no command for at all —
+  uninstalling meant knowing where five different agents keep their config
+  and editing each by hand. Defaults to every agent rather than asking
+  which one to forget, takes Codex's `oauth` sub-table with the server
+  (removing only the first leaves a table that parses as a server with no
+  url), and leaves `mcpServers` in place when it empties: it is the
+  client's key, not ours.
+- **Skyelight's own colours**, from `--accent` in the app's own tokens so the
+  terminal and the product are one blue rather than two that were each
+  chosen to look right alone. Everything degrades: 24-bit where `COLORTERM`
+  says so, the 256-colour cube otherwise, plain text under `NO_COLOR`, when
+  stdout is piped, or under `TERM=dumb`. Marks fall back to ASCII where the
+  locale is not UTF-8, because a console that cannot draw a glyph renders
+  corruption rather than plainness.
+- **The deployment in the header.** Running this against the wrong one is the
+  mistake with the least visible symptom — everything succeeds, against
+  somebody else's data — and nothing said which one before it happened.
+
+### Changed
+
+- **The help screen** lists the agents, the flags and the environment
+  variables in aligned columns, rather than two example commands.
+- **Registering several agents** reports one summary at the end, telling
+  "added" from "already set up" instead of reporting neither.
+
+## 0.4.1 — 2026-09-19
+
+### Fixed
+
+- **Two wrong permission claims in the README**, which is what npm serves on
+  the package page. It said a reviewer "reads and cannot write" — a reviewer
+  replies and raises items like every other role. It also said resolving stays
+  a person's call "for a thread you do not own", which read as a rule for
+  everyone; the actual rule touches only reviewers, who may move threads they
+  opened and nobody else's. Both are now taken from `convex/mcp/writes.ts`.
+- Documented the 0.4.0 tool surface, which the README had not caught up with:
+  the image blocks, merged duplicates, `assignee: "me"`, and the read ceiling.
+
+### Added
+
+- This changelog, and it ships in the package.
+
+## 0.4.0 — 2026-09-19
+
+Nine things the Skyelight web app had shown a person for months that the tool
+results did not carry.
+
+### Added
+
+- **`get_item` returns the pictures as pictures.** The screenshot taken when
+  the pin was left, and any images people attached to the thread, come back as
+  MCP `image` content blocks instead of links no agent tool can open. Capped at
+  four per call and 4MB each; anything skipped is named with its link and the
+  reason. The stdio transport fetches the storage URL, and the remote endpoint
+  reads its own storage directly.
+- **Merged duplicates leave the list**, and the item they were merged into
+  carries `reportCount`. Five reports of one problem used to read as five bugs.
+- **`list_workspaces` returns `you`** — the caller's own user id and name — and
+  `list_items` accepts `assignee: "me"`. "What is assigned to me" had no way to
+  be asked before.
+- **`get_item` carries `linear`**, naming the issue a thread was handed to and
+  who it was delegated to, so an agent stops starting work a Linear-hosted
+  agent is already finishing.
+- **`get_item` carries `attachments` and `reactions`.** Attachments cover the
+  thread and its replies, in reading order; reactions are counted by emoji
+  rather than listed one row per person.
+- **List rows use the classifier's one-line summary** where there is one, with
+  `excerptSource` saying whether the line is a machine summary or the
+  reporter's own words. Rows used to be the first 140 characters of whatever
+  somebody typed.
+- **The 2,000-item read ceiling states itself.** `capped` is set when it binds
+  and the narration calls the counts a floor rather than a total. The scan also
+  reads newest-first, so the items it keeps when it binds are the live ones.
+
+### Fixed
+
+- `set_status` returned a bare string where the server expected `{ text, data }`,
+  so a successful move answered with an empty content block and the model had
+  no way to tell it had worked.
+- `initialize` reported `0.1.0`. Both transports carried their own stale copy
+  of that literal while the package shipped 0.3.0. There is one `VERSION`
+  constant now, and a test asserts it matches `package.json`.
+- `status=deferred` was refused with a 400 by the API the stdio transport calls,
+  although every tool schema has offered `deferred` since it existed.
+
+## 0.3.0 — 2026-09-17
+
+### Added
+
+- Grok in the installer's client list, and a README that lists it.
+
+## 0.2.0 — 2026-09-09
+
+### Added
+
+- `npx @skyelight/mcp init` — finds the coding agent, registers the remote
+  server with it, and leaves sign-in to OAuth, so nothing is pasted and no key
+  is stored on disk.
+- The `ui://` item card, for clients that can render an MCP Apps resource. The
+  text result is complete on its own, so the card is strictly additive.
+
+## 0.1.4 — 2026-09-09
+
+### Added
+
+- The component that rendered the pinned element, where `@skyelight/build`
+  stamped it.
+
+## 0.1.3 — 2026-09-09
+
+### Added
+
+- Projects sort by real activity rather than by when the project record last
+  changed, so "anything new here?" gets a true answer.
+
+## 0.1.2 — 2026-09-08
+
+### Added
+
+- The source file and line behind a pin, and a repo permalink pinned to the
+  commit the page was built from.
+
+## 0.1.1 — 2026-09-08
+
+### Fixed
+
+- The README npm was serving.
+
+## 0.1.0 — 2026-09-08
+
+First release. An MCP server over stdio that reads the feedback people left on
+a running app — the thread, the page, the element they pointed at — and reports
+back on it (SKY-273).

package/README.md

@@ -4,13 +4,18 @@ An MCP server that lets a coding agent read the feedback people left on your
 running app — the thread, the page, and the element they were pointing at —
 and report back on it when the work is done.
 
-Works with anything that speaks MCP over stdio: Claude Code, Cursor, Grok, Codex.
+Two ways to connect, with the same seventeen tools either way:
 
-## Setup
+- **Remote, with OAuth** — the default. Your agent talks to Skyelight over
+  HTTP and you sign in once in the browser. Nothing is pasted and no key is
+  stored on disk.
+- **Local, with a token** — this package runs as a stdio server on your
+  machine and carries a personal token. For clients or machines where the
+  browser sign-in is not an option.
 
-**Get a personal access token.** In the Skyelight web app, go to your account
-settings → **API Keys** → create one. It is shown once, and you can give
-it an expiry.
+Coding agents need a paid seat (owner, admin or collaborator) on a Pro plan or
+above. A reviewer seat reads and comments in the web app but does not carry
+agent tools.
 
 ## The short way
 
@@ -18,19 +23,26 @@ it an expiry.
 npx @skyelight/mcp init
 ```
 
-Finds your coding agent, registers the remote server with it, and leaves the
-sign-in to OAuth — nothing is pasted and no key is stored on disk. It shows
-what it will change and waits; `--yes` skips that once you have read it.
+Finds your coding agents, registers Skyelight's remote server with them, and
+leaves the sign-in to OAuth — the first time the agent connects it opens a
+browser and you approve it there. It shows what it will change and waits;
+`--yes` skips that once you have read it.
 
-It knows Claude Code, Cursor, Grok, Codex and Windsurf. Name one with
-`--client cursor` when more than one is installed, and point at another deployment with
-`SKYELIGHT_URL=https://…`. The deployment tells the installer its own MCP URL
-and OAuth client over `/mcp/install-config`, so this package holds no
-environment-specific constants.
+It knows Claude Code, Cursor, Grok, Codex and Windsurf. With several
+installed it asks which; `--client cursor` or `--client all` answers in
+advance. `npx @skyelight/mcp remove` takes the entry out again. Point at
+another deployment with `SKYELIGHT_URL=https://…`; the deployment tells the
+installer its own MCP URL and OAuth client over `/mcp/install-config`, so this
+package holds no environment-specific constants.
 
-The token is yours, not a service account's: anything the agent writes is
-attributed to you, marked with the tool it came through. That is deliberate —
-see [Who a write belongs to](#who-a-write-belongs-to).
+The same setup, with a snippet per client, is in the Skyelight web app under
+account settings → **Coding Agents**.
+
+## With a token
+
+**Get a personal access token.** In the Skyelight web app, go to account
+settings → **API Keys** → create one. It is shown once, belongs to the
+organization you create it in, and can be given an expiry.
 
 Then add the server to your client:
 
@@ -58,9 +70,8 @@ claude mcp add skyelight \
   -- npx -y @skyelight/mcp
 ```
 
-The API host is the Convex deployment with `.convex.cloud` swapped for
-`.convex.site` — Convex serves HTTP actions from the latter. The web app shows
-the right one when you create the token.
+`SKYELIGHT_API_URL` is your Skyelight deployment's `.convex.site` host — the
+same host the MCP URL on the **Coding Agents** page uses, without `/mcp`.
 
 ### Credentials
 
@@ -72,32 +83,51 @@ Checked in order, so an existing setup keeps working:
 
 ### Binding a repo to a project
 
-If you can reach several projects, drop a `.skyelight.json` at the repo root:
+With the local server, if you can reach several projects, drop a
+`.skyelight.json` at the repo root:
 
 ```json
 { "projectId": "j57abc...", "projectName": "Checkout rebuild" }
 ```
 
-Tools then default to that project and nobody has to pass an id. Without it,
-`list_items` will ask you to call `list_projects` first rather than guess.
+Tools then default to that project and nobody has to pass an id. Without it
+(and always on the remote server), `list_items` asks for a project and the
+agent calls `list_projects` first rather than guess.
 
 ## Tools
 
-| Tool              | What it is for                                                  |
-| ----------------- | --------------------------------------------------------------- |
-| `list_workspaces` | Which workspaces this credential can reach.                     |
-| `list_projects`   | The projects inside them, with the ids the other tools take.    |
-| `list_items`      | What is outstanding. Filter by page, type, status, assignee.    |
-| `search_items`    | Find items whose thread mentions some text, replies included.   |
-| `get_item`        | Everything needed to work one item: thread, page, anchor, code. |
-| `post_update`     | Report back on the thread the feedback came from.               |
-| `create_item`     | Raise a new item — an audit finding, something you noticed.     |
-| `set_status`      | Move an item to open, deferred or resolved.                     |
+| Tool              | What it is for                                                          |
+| ----------------- | ----------------------------------------------------------------------- |
+| `list_workspaces` | Which workspaces this credential can reach, and who you are.            |
+| `list_projects`   | The projects inside them, with the ids the other tools take.            |
+| `list_items`      | What is outstanding. Filter by page, type, status, assignee.            |
+| `search_items`    | Find items whose thread mentions some text, replies included.           |
+| `get_item`        | Everything needed to work one item: thread, page, anchor, code, images. |
+| `post_update`     | Report back on the thread the feedback came from.                       |
+| `create_item`     | Raise a new item — an audit finding, something you noticed.             |
+| `set_status`      | Move an item to open, deferred or resolved.                             |
+| `list_members`    | Who is in the workspace, so you can name an assignee or a mention.      |
+| `assign`          | Hand an item to a person, or unassign it.                               |
+| `whats_new`       | What changed since you last looked, from your own bookmark.             |
+| `project_review`  | Where a project landed, for a wrap-up or hand-off document.             |
+| `decision_log`    | What the team decided in its threads, quoted, and its current rules.    |
+| `save_rule`       | Keep an agreed rule in the project context (owners and admins).         |
+| `find_by_source`  | Feedback on a file or component before you edit it, or the hot spots.   |
+| `find_similar`    | Check for an existing report before creating one.                       |
+| `merge_items`     | Fold duplicate items into one.                                          |
 
 `list_items` leads with a summary — totals, breakdown by type and by page — so
 an agent can tell you the shape of the work before pulling any of it. Rows are
 stubs; `get_item` is where the thread and the anchor live.
 
+**"What is assigned to me."** `list_workspaces` returns your own user id, and
+`list_items` takes `assignee: "me"`, so the most ordinary question anyone asks
+an agent needs no id looked up by hand.
+
+**Merged duplicates do not appear twice.** When somebody merges five reports of
+one problem in the web app, the duplicates leave the list and the item they were
+merged into says `5 reports`. A list that shows all five reads as five bugs.
+
 ## What the agent sees
 
 ```
@@ -107,12 +137,40 @@ Busiest pages: /checkout (8), /settings (4).
 
 2 matches:
 - The pay button does nothing on the second click
-  bug · open · /checkout · unassigned · 2 replies — id i1
+  bug · open · /checkout · unassigned · 2 replies · 5 reports — id i1
 ```
 
 Deliberately prose rather than JSON. A tool that returns a bare array invites a
 model to read the array out; this one invites it to summarise.
 
+A row's line is the one-sentence summary Skyelight's classifier wrote, where
+there is one, rather than the first 140 characters of whatever somebody typed —
+four truncated paragraphs are not something you can choose between.
+
+One call reads the 2,000 most recent items in a project. Past that the result
+says so, in words, rather than presenting a slice as the total.
+
+### The pictures
+
+`get_item` returns the screenshot taken when the pin was left, and any images
+people attached to the thread, as **image content blocks** — things a model can
+actually look at, not links it cannot open.
+
+```
+Screenshot of the page when this was pinned: attached below.
+2 images attached to this thread: also below.
+```
+
+Capped at four per call. Anything too large to inline comes back as its link
+with the reason, so a picture never disappears silently.
+
+### What somebody else already did
+
+`get_item` also names the Linear issue a thread was handed to, and who it was
+delegated to, so an agent does not start work a Linear-hosted agent is
+finishing. Reactions come back counted by emoji — a thread with one comment and
+nine thumbs up is not a thread with one comment.
+
 ### Where the code is
 
 If the app was built with [`@skyelight/build`](https://www.npmjs.com/package/@skyelight/build),
@@ -128,26 +186,24 @@ deployment, which branch the code it wants is actually on.
 
 ## Who a write belongs to
 
-Every write is **a person's**. A token carries your access, so a reply the
-agent posts is yours, with the tool it came through shown as a mark beside the
-timestamp rather than as the author.
+Every write is **a person's**. Your sign-in or token carries your access, so a
+reply the agent posts is yours. Over the remote server, the editor it came
+through is shown as a mark beside the timestamp rather than as the author.
 
-There is no service-account mode. Synthetic agent identities existed and were
-removed: a workspace should not grow a member for every tool somebody plugs in,
-and a reply nobody is accountable for is worse than one attributed plainly.
-
-Workspace API keys (`sk_live_...`) used to be a second way in, for scripts and
-CI. They are gone — a credential that outlives whoever minted it is one nobody
-is accountable for, and the write tools already refused them for exactly that
-reason. A personal token is the only credential the API accepts.
+There is no service-account mode, and workspace API keys (`sk_live_...`) no
+longer work. The API accepts two credentials, both of which are you: an OAuth
+sign-in and a personal token (`sky_...`).
 
 ## Permissions
 
-The server enforces nothing; the API does. Whatever your account can do in the
-web app, the agent can do through your token, and nothing more:
-
-- A **reviewer** reads and cannot write.
-- A **project-bound** credential answers 404 outside its project rather than
-  reporting that something exists but is forbidden.
-- Resolving stays a person's call in the web app for a thread you do not own;
-  `set_status` obeys the same rule.
+The server enforces nothing; the API does. The agent can do what your account
+can do in that workspace, and nothing more:
+
+- Agent tools need a **paid seat** (owner, admin or collaborator) in an
+  organization on **Pro or above**. A reviewer seat, or a Free plan, is
+  refused with the reason — the workspace is listed and marked rather than
+  hidden, so you are told which gate closed instead of being told it does not
+  exist.
+- Owners, admins and collaborators read, reply, raise items and change any
+  thread's status.
+- A token only reaches workspaces in the organization it was created in.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@skyelight/mcp",
-  "version": "0.4.0",
-  "description": "MCP server for Skyelight \u2014 read feedback items from your project as an agent",
+  "version": "0.5.0",
+  "description": "MCP server for Skyelight — read feedback items from your project as an agent",
   "type": "module",
   "bin": {
     "skyelight-mcp": "./src/index.js"
@@ -10,6 +10,7 @@
   "files": [
     "LICENSE",
     "README.md",
+    "CHANGELOG.md",
     "src"
   ],
   "engines": {
@@ -25,15 +26,7 @@
     "feedback"
   ],
   "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/plastrlab/skyelight.git",
-    "directory": "integrations/skyelight-mcp"
-  },
-  "homepage": "https://github.com/plastrlab/skyelight/tree/main/integrations/skyelight-mcp#readme",
-  "bugs": {
-    "url": "https://github.com/plastrlab/skyelight/issues"
-  },
+  "homepage": "https://skyelight.ai",
   "publishConfig": {
     "access": "public"
   }

package/src/brand.d.ts

@@ -0,0 +1,9 @@
+/** Types for brand.js; see tools.d.ts for why the package ships these. */
+
+export declare const ICONS: Array<{
+  src: string;
+  mimeType: string;
+  sizes: string[];
+}>;
+export declare const ICON_PNG_BASE64: string;
+export declare const STATUS: Record<string, [string, string]>;

package/src/brand.js

@@ -0,0 +1,64 @@
+/**
+ * How Skyelight shows up inside an agent: its icon, and the words ChatGPT
+ * shows while a tool runs.
+ *
+ * The icon is embedded rather than linked. A link would name one host, and
+ * the same package serves QA, production and local deployments; a data URI
+ * is the same everywhere and needs no request. The mark from
+ * `public/favicon.png` (258 by 258), about 4 KB.
+ *
+ * Nothing here can animate while a tool runs. Clients draw their own
+ * loading state and give a server no way into it; the icon sits beside the
+ * connector and its tool calls, and ChatGPT's status line is the only text
+ * a server gets to put in that moment.
+ */
+
+/** The mark itself, for a server that serves it at a URL instead. */
+export const ICON_PNG_BASE64 =
+  "iVBORw0KGgoAAAANSUhEUgAAAQIAAAECCAYAAAAVT9lQAAAACXBIWXMAAAsTAAALEwEAmpwYAAABaWlDQ1BEaXNwbGF5IFAzAAB4nHWQvUvDUBTFT6tS0DqIDh0cMolD1NIKdnFoKxRFMFQFq1OafgltfCQpUnETVyn4H1jBWXCwiFRwcXAQRAcR3Zw6KbhoeN6XVNoi3sfl/Ticc7lcwBtQGSv2AijplpFMxKS11Lrke4OHnlOqZrKooiwK/v276/PR9d5PiFlNu3YQ2U9cl84ul3aeAlN//V3Vn8maGv3f1EGNGRbgkYmVbYsJ3iUeMWgp4qrgvMvHgtMunzuelWSc+JZY0gpqhrhJLKc79HwHl4plrbWD2N6f1VeXxRzqUcxhEyYYilBRgQQF4X/8044/ji1yV2BQLo8CLMpESRETssTz0KFhEjJxCEHqkLhz634PrfvJbW3vFZhtcM4v2tpCAzidoZPV29p4BBgaAG7qTDVUR+qh9uZywPsJMJgChu8os2HmwiF3e38M6Hvh/GMM8B0CdpXzryPO7RqFn4Er/QcXKWq8MSlPPgAAAA50RVh0U29mdHdhcmUARmlnbWGesZZjAAAOuElEQVR4Ae3dzY4c1RXA8dOGKFEkpNkniPETYF4gbj9AFHgCzDIr8DJSiMchrBmeAPsJIIusPayyC8MDJO4oO6JEA0QRC9vNvTN1YGbcH/Vx7q1z7/3/pFIPQjDlcde/zq3uqRYBAAAAAAAAAAAAAAAAAAAAAAAAAAAAgCsWgqYcPVkf/FTk4KnI4aZ//7LI6nc3FytBUwhBxT58sr71TGQZvnx9LXJLLg7+g57/+Wl4cqzC4+fh8fT9m4sTQbUIQUXi2f6lcMCHg/7tsL0p/Q/6XsKT5SQ8PHoeHo+YGqpCCCrQnfnjwX9XjA/+bcIT52HYHjEp1IEQFOyDJ+tlOPjvry/G/7mswpPowR9uLh4KikUIChSWAIc3RD6ZOQDXrcI+3QsTwmeC4hCCgnTXAN4Na/T3JNMSYKi4ZAj794BrCGUhBIUIEbgV/rI+lS0v+znDcqEwhKAAH/xz/e7z53IshQlPruNuOjgTuEYInPvjk/VH64ulQKlWYf/vsFTwjRA4Fa8HhItvnzq7IDgWMXCOEDgUIxD+Yh7LxbsBaxFj8FaIwanAHULgTKURUGfdZEAMnCEEjlQeAUUMHCIETjQSAUUMnCEEDjQWAUUMHCEEM2s0AooYOEEIZtR4BBQxcIAQzIQIXEEMZkYIZkAENiIGMyIEmRGBnYjBTAhBRkSgF2IwA0KQCREYhBhkRggyIAKjEIOMCEFiRGASYpAJIUiICJggBhkQgkSIgClikNgNgbnlF0TA2PnPM963UZAEITAWIxDOXo+ffEcELH33XA7++o08Dj9ffq4JsDQwpBGQbhK4+bOLDdOECMjf/nfxGJyFJ+2dkzdYJlgiBEauR0ARg2muRUARA2OEwMC2CChiMM6WCChiYIgQTLQvAooYDLMnAooYGCEEE/SNgCIG/fSMgCIGBgjBSEMjoIjBbgMjoIjBRIRghLERUMRgs5ERUMRgAkIw0NQIKGJw1cQIKGIwEiEYwCoCihhcMIqAIgYjEIKerCOgWo+BcQQUMRiIEPSQKgKq1RgkioAiBgMQgj1SR0C1FoPEEVDEoCdCsEOuCKhWYpApAooY9EAItsgdAVV7DDJHQBGDPQjBBnNFQNUag5kioIjBDoTgmrkjoGqLwcwRUMRgC0JwiZcIqFpi4CQCihhsQAg63iKgSo+BswgoYnANIRC/EVClxsBpBBQxuKT5EHiPgCotBs4joIhBp+kQlBIBVUoMComAIgbScAhKi4DyHoPCIqCaj0GTISg1AsprDAqNgGo6Bs2FoPQIKG8xKDwCqtkYNBWCWiKgvMSgkgioJmPQTAhqi4CaOwaVRUA1F4MmQlBrBNRcMag0AqqpGFQfgtojoHLHoPIIqGZiUHUIWomAyhWDRiKgmohBtSFoLQIqdQwai4CqPgZVhqDVCKhUMWg0AqrqGFQXgtYjoKxj0HgEVLUxqCoEROAqqxgQgSuqjEE1ISACm02NARHYqLoYVBECIrDb2BgQgZ2qikHxISAC/QyNARHopZoYFB0CIjBM3xgQgUGqiEGxISAC4+yLAREYpfgYFBkCIjDNthgQgUmKjkFxISACNq7HgAiYKDYGRYWACNjSGBABU0XGoJgQEIE0Xv2JyL+fEQFjxcWgiBAQgUSehu0/Yft52F4R2CoqBu5DQAQS0Qg86/75FSEG9oqJgesQEIFErkdAEYMUioiB2xAQgUS2RUARgxTcx8BlCIhAIvsioIhBCq5j4C4ERCCRvhFQxCAFtzFwFQIikMjQCChikILLGLgJARFIZGwEFDFIwV0MXISACCQyNQKKGKTgKgazh4AIJGIVAUUMUnATg1lDQAQSsY6AIgYpuIjBbCEgAomkioAiBinMHoNZQkAEEkkdAUUMUpg1BtlDQAQSyRUBRQxSmC0GWUNABBLJHQFFDFKYJQbZQkAEEpkrAooYpJA9BllCQAQSmTsCihikEGPwRojBSjK4IRkQgQS8RCD6tttg6fzkGU6ih5JB8hD86ov1R0IEbHmKgCIGKRx2MTiQxJKGIETgfhhv3hPY8RgBRQxSiDH4RBJLdo0gjjThD/BEYMdzBC7jmoG5cKDeC9cLjiWRZBNBd10AVkqJQMRkYC4cT/dTXi9IEoK4JAgPhwIbJUVAEQNrBymXCOZLA5YExkqMwGUsE0ylWiLYTwQLuS+wUXoEIiYDU90SwfxVBNMQnE8Da7krmK6GCChiYClGwPyVONuJgGnARk0RUMTATJgK3rWeCsxCwDRgpMYIKGJgJUbgrhiymwiYBqarOQKKGJgIU8FvxJBZCMI0sBSM10IEFDGwsAxT+FKMmIQg7NCbwvsGxmspAooYWHhTjNhMBAvbMaUpLUZAEYNJwvLgbTFiEgKWBSO1HAFFDKY4CNO4yW/2Tg5BtyOHgmGIwI+IwRRLMWAxESwFwxCBFxGDsZZiwCIEtwX9EYHtiMFg4TrB62JgcgjWF29uQB9EYD9iMNShxbsMLSYCbkPWBxHojxgMdSgTTQpBVyImgn2IwHDEYIjJJ+OpE8GhYDciMB4x6Gv2pQHTwC5EYDpi0IeLawTYhAjYIQbJEYIUiIA9YrBVeOXuNZmIEFgjAukQg40WIl/LRITAEhFIjxhsciYTTQ3B5B2oBhHIhxiYIwQWiEB+xOCylUw0KQS5PrLZNSIwH2KgVjLR5GsEC4OdKBYRmB8xiFYykcXFws+lRUTAj7ZjcGYxmVuE4FRaQwT8aTQGC6PjjxAMRQT8ajMGX4oBqxC08eoBEfCvvRh8JgYmhyCsT2IE6p8KiEA52olBvD5wIgZM3lkY1il/lpoRgfK0EQOTaSCyeovxQ6l1eUAEylV5DCxPwCYhqHZ5QATKV28MVuG4czcRxDo9kJoQgXrUGYMTMWQWgu6ixYnUgAjUp7IYWJ94TX8NuYqpgAjUq54YPLT+PR/TEBQ/FRCB+lUQgxQnXPMbkxQ7FRCBdhQcg3h8pfitX/MQdFOB2dXMLIhAe8qMwSpsx5JAkluVhWrdk1LeV0AE2lVYDLppIMlxlSQEcXQpYolABFBODOIFwoeSSLKbl4adPg4x+Fi8IgJQ/mOw6qbsZFLfxfhIPL7jkAjgOr8xOAsRuJNqSaCShiDufPhDvCWebmdGBLCNwxiE4+edHPcGTf65Bt31gjvi4eIhEcA+jmIQlwOWv0+wS5YPOHERAyKAvhzEoHuFIMlLhVu+Xz7LL9a31iKPJfenKBMBjPFKt2XWReBIMsoagih7DIgApsgcgzki0H3f/LLFgAjAQqYYzBWB7nvPI3kMiAAsJY7BnBHovv98ksWACCCFRDGYOwLdPszLPAZEACkZx8BDBLr9mJ9ZDIgAcjCKgZcIRC5CEE2OARFAThNj4CkCkZsQRKNjQAQwh5Ex8BaByFUIosExIAKY08AYeIxA5C4EUe8YEAF40DMGXiMQuQxBtDcGRACe7ImB5whEbkMQbY0BEYBHW2LgPQKR6xBEL8SACMCzazEoIQKR+xBEP8TgaYgBEYB3XQxKiUCU5X4EU4Uf5un5/Qz+K2dEwNj/Bda+DRH4ppwIREWEIDqPwVMndzqqxVdh+zJs/xIYWjwPEbhdTgSiIpYGly3/MtPNTWoTI/D3S//8y7C9KpjoPAK/LisCUXEhiIjBRNcjoIjBJKVGICoyBBExGGlbBBQxGKXkCETFhiAiBgPti4AiBoOUHoGo6BBExKCnvhFQxKCXGiIQFR+CiBjsMTQCihjsVEsEoipCEBGDLcZGQBGDjWqKQFRNCCJicM3UCChicEVtEYiqCkFEDDpWEVDE4FyNEYiqC0HUfAysI6Aaj0GtEYiqDEHUbAxSRUA1GoOaIxBVG4KouRikjoBqLAa1RyCqOgRRMzHIFQHVSAxaiEBUfQii6mOQOwKq8hi0EoGoiRBE1cZgrgioSmPQUgSiZkIQVReDuSOgKotBaxGImgpBVE0MvERAVRKDFiMQNReCqPgYeIuAKjwGrUYgajIEUbEx8BoBVWgMWo5A1GwIouJi4D0CqrAYtB6BqOkQRMXEoJQIqEJiQAQuNB+CyH0MSouAch4DIvAjQtBxG4NSI6CcxoAIXEUILnEXg9IjoJzFgAi8iBBc4yYGtURAOYkBEdiMEGwwewxqi4CaOQZEYDtCsMVsMag1AmqmGBCB3QjBDtljUHsEVOYYEIH9CMEe2WLQSgRUphgQgX4IQQ/JY9BaBFTiGBCB/ghBT8li0GoEVKIYEIFhCMEA5jFoPQLKOAZEYDhCMJBZDIjAVUYxIALjEIIRJseACGw2MQZEYDxCMNLoGBCB3UbGgAhMQwgmGBwDItDPwBgQgekIwUS9Y0AEhukZAyJggxAY2BsDIjDOnhgQATuEwMjWGBCBabbEgAjYIgSGXogBEbBxLQZEwB4hMPZDDL4KMSACdroYEIE0CEECy09CDP4RYrBu7CPZE1v8IkTgt0QghRsCcyfvLE4XL8mdkNkzgYlwxiICCTERJLQ8CpPBMyaDqc4j8CcikBIhSIwYTEME8iAEGRCDcYhAPoQgE2IwDBHIixBkRAz6IQL5EYLMiMFuRGAehGAGxGAzIjAfQjATYnAVEZgXIZgRMbhABOZHCGbWegyIgA+EwIFWY0AE/CAETrQWAyLgCyFwpJUYEAF/CIEztceACPhECByqNQZEwC9C4FSIwWEXg0OpwGIt904+XBwLXCIEjlURg4WchQi8FSaBE4Fb3KHIsZOjxWrxkrwRav1ISrSQ8/0nAv4xERRi+fv10VrkvhQiPLE+lpflKMSM27UVgBAUpIilQpwC1vIOU0BZCEGBlu+v755PB56CcHEtIE4Bx0wB5SEEBTtfLizk7dmDsJCH4VrAg3hNQ1AkQlCBWSYEJoCqEIKKhAlhGR7uhinhdpIoxINf5LPw/34UAnBKAOpBCCoV350oz2QZvrwdpoVbo8JwcdY/DV99KTEAHPzVIgSNCGE4kKchCPEDWhchCvr25YW8Fr7+Onx1cYA/l5XcCNvLsmLNDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0K7vAU7PQZUgFNryAAAAAElFTkSuQmCC";
+
+/**
+ * Embedded, for the stdio package, which runs on the person's machine and
+ * has no URL of its own. The hosted server links to `/mcp/icon.png`
+ * instead, because revision 2026-07-28 repeats the server's identity in
+ * every result and an embedded image would ride along on each one.
+ */
+export const ICONS = [
+  {
+    src: `data:image/png;base64,${ICON_PNG_BASE64}`,
+    mimeType: "image/png",
+    sizes: ["258x258"],
+  },
+];
+
+/**
+ * ChatGPT's line under a running tool, then under a finished one
+ * (`openai/toolInvocation/invoking` and `invoked`, 64 characters at most).
+ * Other clients ignore these keys. Present tense while it runs, past once
+ * done, and never a number: the text is fixed per tool, not per call.
+ */
+export const STATUS = {
+  list_workspaces: [
+    "Looking up your Skyelight workspaces",
+    "Found your workspaces",
+  ],
+  list_projects: ["Looking up Skyelight projects", "Found your projects"],
+  list_items: ["Reading Skyelight feedback", "Read the feedback"],
+  search_items: ["Searching Skyelight feedback", "Searched the feedback"],
+  get_item: ["Opening the thread", "Opened the thread"],
+  list_members: ["Looking up the team", "Found the team"],
+  post_update: ["Replying on the thread", "Replied on the thread"],
+  create_item: ["Creating a thread", "Created the thread"],
+  set_status: ["Updating the thread", "Updated the thread"],
+  assign: ["Assigning the thread", "Assigned the thread"],
+  project_review: [
+    "Reading the project's history",
+    "Read the project's history",
+  ],
+  whats_new: ["Checking what's new", "Caught up"],
+  find_by_source: ["Finding feedback by file", "Found feedback by file"],
+  find_similar: ["Checking for similar reports", "Checked for similar reports"],
+  merge_items: ["Merging duplicates", "Merged the duplicates"],
+  decision_log: ["Reading the decisions", "Read the decisions"],
+  save_rule: ["Saving the rule", "Saved the rule"],
+};