@skyelight/mcp 0.4.1 → 0.5.1

package/CHANGELOG.md

@@ -11,6 +11,84 @@ keeps working. A **patch** is a fix or a wording change. A **major** would be
 removing a tool or an argument, or changing what an existing field means, and
 there has not been one.
 
+## 0.5.1 — unreleased
+
+### Changed
+
+- **Skyelight's own address.** `npx @skyelight/mcp init` registers
+  `https://app.skyelight.ai/mcp` by default, instead of the deployment's
+  `.convex.site` host, and the README gives `https://app.skyelight.ai` as
+  `SKYELIGHT_API_URL`. Servers registered with the old address keep
+  working; re-run `init` to move to the new one.
+
+## 0.5.0 — 2026-09-29
+
+### Added
+
+- **Seven tools for working with a project's history.** `whats_new` catches
+  you up since you last looked, from a bookmark kept per person per project.
+  `project_review` returns what a project settled, for a review or hand-off
+  document. `decision_log` quotes the threads where decisions were made and
+  returns the project's rules; `save_rule` keeps a new one (owners and
+  admins). `find_by_source` finds feedback by the file or component the build
+  plugin stamped. `find_similar` checks for an existing report, and
+  `merge_items` folds duplicates together. Needs a deployment with the
+  `/api/v1/review`, `/whats-new`, `/source`, `/similar`, `/decisions`,
+  `/rules` and `/items/merge` routes. `project_review` and `decision_log`
+  are paged (`section`, `offset`) so a result fits in an agent's context.
+
+- **Hosted server speaks MCP 2026-07-28.** Not in this package (its stdio
+  server keeps the `initialize` handshake), but worth knowing: the hosted
+  `/mcp` now answers `server/discover` and modern requests in that
+  revision's shape, which ChatGPT requires.
+
+- **The Skyelight mark and title.** `serverInfo` carries `title` and
+  `icons`, so clients that show a server's icon show ours. Each tool also
+  carries ChatGPT's status lines for while it runs and once it is done.
+
+- **Tool annotations.** Every tool says whether it only reads
+  (`readOnlyHint`), and `merge_items` that it hides items
+  (`destructiveHint`), so clients can ask before a write.
+
+- **Assigning and mentioning people (SKY-324).** `list_members` returns the
+  workspace's people. `assign` hands an item to one of them, or unassigns it
+  with `null`. `create_item` takes `assignee` and `mentions`, and
+  `post_update` takes `mentions`. People can be named by name, email, id or
+  `me`; an ambiguous name is refused with the candidates. They are notified
+  the way an assignment or a mention in the app notifies them. Needs a
+  deployment with the `/api/v1/members` and `/api/v1/items/assign` routes.
+
+- **A picker when several agents are installed.** `init` detected them all
+  along and then refused to choose: it printed the list and exited 1, as
+  though having two editors were an error. Most developers have more than
+  one, so the commonest case on the first command anybody runs was a dead
+  end. It asks now, with `a` for every agent at once.
+- **`--client all`**, the same thing without the question.
+- **`npx @skyelight/mcp remove`**, which there was no command for at all —
+  uninstalling meant knowing where five different agents keep their config
+  and editing each by hand. Defaults to every agent rather than asking
+  which one to forget, takes Codex's `oauth` sub-table with the server
+  (removing only the first leaves a table that parses as a server with no
+  url), and leaves `mcpServers` in place when it empties: it is the
+  client's key, not ours.
+- **Skyelight's own colours**, from `--accent` in the app's own tokens so the
+  terminal and the product are one blue rather than two that were each
+  chosen to look right alone. Everything degrades: 24-bit where `COLORTERM`
+  says so, the 256-colour cube otherwise, plain text under `NO_COLOR`, when
+  stdout is piped, or under `TERM=dumb`. Marks fall back to ASCII where the
+  locale is not UTF-8, because a console that cannot draw a glyph renders
+  corruption rather than plainness.
+- **The deployment in the header.** Running this against the wrong one is the
+  mistake with the least visible symptom — everything succeeds, against
+  somebody else's data — and nothing said which one before it happened.
+
+### Changed
+
+- **The help screen** lists the agents, the flags and the environment
+  variables in aligned columns, rather than two example commands.
+- **Registering several agents** reports one summary at the end, telling
+  "added" from "already set up" instead of reporting neither.
+
 ## 0.4.1 — 2026-09-19
 
 ### Fixed

package/README.md

@@ -4,13 +4,18 @@ An MCP server that lets a coding agent read the feedback people left on your
 running app — the thread, the page, and the element they were pointing at —
 and report back on it when the work is done.
 
-Works with anything that speaks MCP over stdio: Claude Code, Cursor, Grok, Codex.
+Two ways to connect, with the same seventeen tools either way:
 
-## Setup
+- **Remote, with OAuth** — the default. Your agent talks to Skyelight over
+  HTTP and you sign in once in the browser. Nothing is pasted and no key is
+  stored on disk.
+- **Local, with a token** — this package runs as a stdio server on your
+  machine and carries a personal token. For clients or machines where the
+  browser sign-in is not an option.
 
-**Get a personal access token.** In the Skyelight web app, go to your account
-settings → **API Keys** → create one. It is shown once, and you can give
-it an expiry.
+Coding agents need a paid seat (owner, admin or collaborator) on a Pro plan or
+above. A reviewer seat reads and comments in the web app but does not carry
+agent tools.
 
 ## The short way
 
@@ -18,19 +23,26 @@ it an expiry.
 npx @skyelight/mcp init
 ```
 
-Finds your coding agent, registers the remote server with it, and leaves the
-sign-in to OAuth — nothing is pasted and no key is stored on disk. It shows
-what it will change and waits; `--yes` skips that once you have read it.
+Finds your coding agents, registers Skyelight's remote server with them, and
+leaves the sign-in to OAuth — the first time the agent connects it opens a
+browser and you approve it there. It shows what it will change and waits;
+`--yes` skips that once you have read it.
 
-It knows Claude Code, Cursor, Grok, Codex and Windsurf. Name one with
-`--client cursor` when more than one is installed, and point at another deployment with
-`SKYELIGHT_URL=https://…`. The deployment tells the installer its own MCP URL
-and OAuth client over `/mcp/install-config`, so this package holds no
-environment-specific constants.
+It knows Claude Code, Cursor, Grok, Codex and Windsurf. With several
+installed it asks which; `--client cursor` or `--client all` answers in
+advance. `npx @skyelight/mcp remove` takes the entry out again. Point at
+another deployment with `SKYELIGHT_URL=https://…`; the deployment tells the
+installer its own MCP URL and OAuth client over `/mcp/install-config`, so this
+package holds no environment-specific constants.
 
-The token is yours, not a service account's: anything the agent writes is
-attributed to you, marked with the tool it came through. That is deliberate —
-see [Who a write belongs to](#who-a-write-belongs-to).
+The same setup, with a snippet per client, is in the Skyelight web app under
+account settings → **Coding Agents**.
+
+## With a token
+
+**Get a personal access token.** In the Skyelight web app, go to account
+settings → **API Keys** → create one. It is shown once, belongs to the
+organization you create it in, and can be given an expiry.
 
 Then add the server to your client:
 
@@ -41,7 +53,7 @@ Then add the server to your client:
       "command": "npx",
       "args": ["-y", "@skyelight/mcp"],
       "env": {
-        "SKYELIGHT_API_URL": "https://<deployment>.convex.site",
+        "SKYELIGHT_API_URL": "https://app.skyelight.ai",
         "SKYELIGHT_API_TOKEN": "sky_..."
       }
     }
@@ -53,14 +65,14 @@ Claude Code users can skip the file:
 
 ```bash
 claude mcp add skyelight \
-  --env SKYELIGHT_API_URL=https://<deployment>.convex.site \
+  --env SKYELIGHT_API_URL=https://app.skyelight.ai \
   --env SKYELIGHT_API_TOKEN=sky_... \
   -- npx -y @skyelight/mcp
 ```
 
-The API host is the Convex deployment with `.convex.cloud` swapped for
-`.convex.site` — Convex serves HTTP actions from the latter. The web app shows
-the right one when you create the token.
+`SKYELIGHT_API_URL` is `https://app.skyelight.ai`, the same host as the MCP
+URL on the **Coding Agents** page (`https://app.skyelight.ai/mcp`), without
+`/mcp`. A deployment's `.convex.site` host also works.
 
 ### Credentials
 
@@ -72,14 +84,16 @@ Checked in order, so an existing setup keeps working:
 
 ### Binding a repo to a project
 
-If you can reach several projects, drop a `.skyelight.json` at the repo root:
+With the local server, if you can reach several projects, drop a
+`.skyelight.json` at the repo root:
 
 ```json
 { "projectId": "j57abc...", "projectName": "Checkout rebuild" }
 ```
 
-Tools then default to that project and nobody has to pass an id. Without it,
-`list_items` will ask you to call `list_projects` first rather than guess.
+Tools then default to that project and nobody has to pass an id. Without it
+(and always on the remote server), `list_items` asks for a project and the
+agent calls `list_projects` first rather than guess.
 
 ## Tools
 
@@ -93,6 +107,15 @@ Tools then default to that project and nobody has to pass an id. Without it,
 | `post_update`     | Report back on the thread the feedback came from.                       |
 | `create_item`     | Raise a new item — an audit finding, something you noticed.             |
 | `set_status`      | Move an item to open, deferred or resolved.                             |
+| `list_members`    | Who is in the workspace, so you can name an assignee or a mention.      |
+| `assign`          | Hand an item to a person, or unassign it.                               |
+| `whats_new`       | What changed since you last looked, from your own bookmark.             |
+| `project_review`  | Where a project landed, for a wrap-up or hand-off document.             |
+| `decision_log`    | What the team decided in its threads, quoted, and its current rules.    |
+| `save_rule`       | Keep an agreed rule in the project context (owners and admins).         |
+| `find_by_source`  | Feedback on a file or component before you edit it, or the hot spots.   |
+| `find_similar`    | Check for an existing report before creating one.                       |
+| `merge_items`     | Fold duplicate items into one.                                          |
 
 `list_items` leads with a summary — totals, breakdown by type and by page — so
 an agent can tell you the shape of the work before pulling any of it. Rows are
@@ -164,31 +187,24 @@ deployment, which branch the code it wants is actually on.
 
 ## Who a write belongs to
 
-Every write is **a person's**. A token carries your access, so a reply the
-agent posts is yours, with the tool it came through shown as a mark beside the
-timestamp rather than as the author.
-
-There is no service-account mode. Synthetic agent identities existed and were
-removed: a workspace should not grow a member for every tool somebody plugs in,
-and a reply nobody is accountable for is worse than one attributed plainly.
+Every write is **a person's**. Your sign-in or token carries your access, so a
+reply the agent posts is yours. Over the remote server, the editor it came
+through is shown as a mark beside the timestamp rather than as the author.
 
-Workspace API keys (`sk_live_...`) used to be a second way in, for scripts and
-CI. They are gone — a credential that outlives whoever minted it is one nobody
-is accountable for, and the write tools already refused them for exactly that
-reason. A personal token is the only credential the API accepts.
+There is no service-account mode, and workspace API keys (`sk_live_...`) no
+longer work. The API accepts two credentials, both of which are you: an OAuth
+sign-in and a personal token (`sky_...`).
 
 ## Permissions
 
-The server enforces nothing; the API does. Whatever your account can do in the
-web app, the agent can do through your token, and nothing more:
-
-- **Owner, admin, collaborator and reviewer** all read and write — a reviewer
-  can reply on a thread and raise one, which is what a client seat is for.
-- A **reviewer** can only `set_status` on threads they opened themselves. Every
-  other role can move anyone's. It is the rule the web app already applies:
-  closing someone else's report is a decision about their report.
-- A **project-bound** credential answers 404 outside its project rather than
-  reporting that something exists but is forbidden.
-- Workspaces your plan or seat does not cover are **listed and marked** rather
-  than hidden, with the reason, so a client can see the workspace they know
-  exists and be told which gate closed instead of being told it is missing.
+The server enforces nothing; the API does. The agent can do what your account
+can do in that workspace, and nothing more:
+
+- Agent tools need a **paid seat** (owner, admin or collaborator) in an
+  organization on **Pro or above**. A reviewer seat, or a Free plan, is
+  refused with the reason — the workspace is listed and marked rather than
+  hidden, so you are told which gate closed instead of being told it does not
+  exist.
+- Owners, admins and collaborators read, reply, raise items and change any
+  thread's status.
+- A token only reaches workspaces in the organization it was created in.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@skyelight/mcp",
-  "version": "0.4.1",
-  "description": "MCP server for Skyelight \u2014 read feedback items from your project as an agent",
+  "version": "0.5.1",
+  "description": "MCP server for Skyelight — read feedback items from your project as an agent",
   "type": "module",
   "bin": {
     "skyelight-mcp": "./src/index.js"
@@ -26,15 +26,7 @@
     "feedback"
   ],
   "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/plastrlab/skyelight.git",
-    "directory": "integrations/skyelight-mcp"
-  },
-  "homepage": "https://github.com/plastrlab/skyelight/tree/main/integrations/skyelight-mcp#readme",
-  "bugs": {
-    "url": "https://github.com/plastrlab/skyelight/issues"
-  },
+  "homepage": "https://skyelight.ai",
   "publishConfig": {
     "access": "public"
   }

package/src/brand.d.ts

@@ -0,0 +1,9 @@
+/** Types for brand.js; see tools.d.ts for why the package ships these. */
+
+export declare const ICONS: Array<{
+  src: string;
+  mimeType: string;
+  sizes: string[];
+}>;
+export declare const ICON_PNG_BASE64: string;
+export declare const STATUS: Record<string, [string, string]>;

package/src/brand.js

@@ -0,0 +1,64 @@
+/**
+ * How Skyelight shows up inside an agent: its icon, and the words ChatGPT
+ * shows while a tool runs.
+ *
+ * The icon is embedded rather than linked. A link would name one host, and
+ * the same package serves QA, production and local deployments; a data URI
+ * is the same everywhere and needs no request. The mark from
+ * `public/favicon.png` (258 by 258), about 4 KB.
+ *
+ * Nothing here can animate while a tool runs. Clients draw their own
+ * loading state and give a server no way into it; the icon sits beside the
+ * connector and its tool calls, and ChatGPT's status line is the only text
+ * a server gets to put in that moment.
+ */
+
+/** The mark itself, for a server that serves it at a URL instead. */
+export const ICON_PNG_BASE64 =
+  "iVBORw0KGgoAAAANSUhEUgAAAQIAAAECCAYAAAAVT9lQAAAACXBIWXMAAAsTAAALEwEAmpwYAAABaWlDQ1BEaXNwbGF5IFAzAAB4nHWQvUvDUBTFT6tS0DqIDh0cMolD1NIKdnFoKxRFMFQFq1OafgltfCQpUnETVyn4H1jBWXCwiFRwcXAQRAcR3Zw6KbhoeN6XVNoi3sfl/Ticc7lcwBtQGSv2AijplpFMxKS11Lrke4OHnlOqZrKooiwK/v276/PR9d5PiFlNu3YQ2U9cl84ul3aeAlN//V3Vn8maGv3f1EGNGRbgkYmVbYsJ3iUeMWgp4qrgvMvHgtMunzuelWSc+JZY0gpqhrhJLKc79HwHl4plrbWD2N6f1VeXxRzqUcxhEyYYilBRgQQF4X/8044/ji1yV2BQLo8CLMpESRETssTz0KFhEjJxCEHqkLhz634PrfvJbW3vFZhtcM4v2tpCAzidoZPV29p4BBgaAG7qTDVUR+qh9uZywPsJMJgChu8os2HmwiF3e38M6Hvh/GMM8B0CdpXzryPO7RqFn4Er/QcXKWq8MSlPPgAAAA50RVh0U29mdHdhcmUARmlnbWGesZZjAAAOuElEQVR4Ae3dzY4c1RXA8dOGKFEkpNkniPETYF4gbj9AFHgCzDIr8DJSiMchrBmeAPsJIIusPayyC8MDJO4oO6JEA0QRC9vNvTN1YGbcH/Vx7q1z7/3/pFIPQjDlcde/zq3uqRYBAAAAAAAAAAAAAAAAAAAAAAAAAAAAgCsWgqYcPVkf/FTk4KnI4aZ//7LI6nc3FytBUwhBxT58sr71TGQZvnx9LXJLLg7+g57/+Wl4cqzC4+fh8fT9m4sTQbUIQUXi2f6lcMCHg/7tsL0p/Q/6XsKT5SQ8PHoeHo+YGqpCCCrQnfnjwX9XjA/+bcIT52HYHjEp1IEQFOyDJ+tlOPjvry/G/7mswpPowR9uLh4KikUIChSWAIc3RD6ZOQDXrcI+3QsTwmeC4hCCgnTXAN4Na/T3JNMSYKi4ZAj794BrCGUhBIUIEbgV/rI+lS0v+znDcqEwhKAAH/xz/e7z53IshQlPruNuOjgTuEYInPvjk/VH64ulQKlWYf/vsFTwjRA4Fa8HhItvnzq7IDgWMXCOEDgUIxD+Yh7LxbsBaxFj8FaIwanAHULgTKURUGfdZEAMnCEEjlQeAUUMHCIETjQSAUUMnCEEDjQWAUUMHCEEM2s0AooYOEEIZtR4BBQxcIAQzIQIXEEMZkYIZkAENiIGMyIEmRGBnYjBTAhBRkSgF2IwA0KQCREYhBhkRggyIAKjEIOMCEFiRGASYpAJIUiICJggBhkQgkSIgClikNgNgbnlF0TA2PnPM963UZAEITAWIxDOXo+ffEcELH33XA7++o08Dj9ffq4JsDQwpBGQbhK4+bOLDdOECMjf/nfxGJyFJ+2dkzdYJlgiBEauR0ARg2muRUARA2OEwMC2CChiMM6WCChiYIgQTLQvAooYDLMnAooYGCEEE/SNgCIG/fSMgCIGBgjBSEMjoIjBbgMjoIjBRIRghLERUMRgs5ERUMRgAkIw0NQIKGJw1cQIKGIwEiEYwCoCihhcMIqAIgYjEIKerCOgWo+BcQQUMRiIEPSQKgKq1RgkioAiBgMQgj1SR0C1FoPEEVDEoCdCsEOuCKhWYpApAooY9EAItsgdAVV7DDJHQBGDPQjBBnNFQNUag5kioIjBDoTgmrkjoGqLwcwRUMRgC0JwiZcIqFpi4CQCihhsQAg63iKgSo+BswgoYnANIRC/EVClxsBpBBQxuKT5EHiPgCotBs4joIhBp+kQlBIBVUoMComAIgbScAhKi4DyHoPCIqCaj0GTISg1AsprDAqNgGo6Bs2FoPQIKG8xKDwCqtkYNBWCWiKgvMSgkgioJmPQTAhqi4CaOwaVRUA1F4MmQlBrBNRcMag0AqqpGFQfgtojoHLHoPIIqGZiUHUIWomAyhWDRiKgmohBtSFoLQIqdQwai4CqPgZVhqDVCKhUMWg0AqrqGFQXgtYjoKxj0HgEVLUxqCoEROAqqxgQgSuqjEE1ISACm02NARHYqLoYVBECIrDb2BgQgZ2qikHxISAC/QyNARHopZoYFB0CIjBM3xgQgUGqiEGxISAC4+yLAREYpfgYFBkCIjDNthgQgUmKjkFxISACNq7HgAiYKDYGRYWACNjSGBABU0XGoJgQEIE0Xv2JyL+fEQFjxcWgiBAQgUSehu0/Yft52F4R2CoqBu5DQAQS0Qg86/75FSEG9oqJgesQEIFErkdAEYMUioiB2xAQgUS2RUARgxTcx8BlCIhAIvsioIhBCq5j4C4ERCCRvhFQxCAFtzFwFQIikMjQCChikILLGLgJARFIZGwEFDFIwV0MXISACCQyNQKKGKTgKgazh4AIJGIVAUUMUnATg1lDQAQSsY6AIgYpuIjBbCEgAomkioAiBinMHoNZQkAEEkkdAUUMUpg1BtlDQAQSyRUBRQxSmC0GWUNABBLJHQFFDFKYJQbZQkAEEpkrAooYpJA9BllCQAQSmTsCihikEGPwRojBSjK4IRkQgQS8RCD6tttg6fzkGU6ih5JB8hD86ov1R0IEbHmKgCIGKRx2MTiQxJKGIETgfhhv3hPY8RgBRQxSiDH4RBJLdo0gjjThD/BEYMdzBC7jmoG5cKDeC9cLjiWRZBNBd10AVkqJQMRkYC4cT/dTXi9IEoK4JAgPhwIbJUVAEQNrBymXCOZLA5YExkqMwGUsE0ylWiLYTwQLuS+wUXoEIiYDU90SwfxVBNMQnE8Da7krmK6GCChiYClGwPyVONuJgGnARk0RUMTATJgK3rWeCsxCwDRgpMYIKGJgJUbgrhiymwiYBqarOQKKGJgIU8FvxJBZCMI0sBSM10IEFDGwsAxT+FKMmIQg7NCbwvsGxmspAooYWHhTjNhMBAvbMaUpLUZAEYNJwvLgbTFiEgKWBSO1HAFFDKY4CNO4yW/2Tg5BtyOHgmGIwI+IwRRLMWAxESwFwxCBFxGDsZZiwCIEtwX9EYHtiMFg4TrB62JgcgjWF29uQB9EYD9iMNShxbsMLSYCbkPWBxHojxgMdSgTTQpBVyImgn2IwHDEYIjJJ+OpE8GhYDciMB4x6Gv2pQHTwC5EYDpi0IeLawTYhAjYIQbJEYIUiIA9YrBVeOXuNZmIEFgjAukQg40WIl/LRITAEhFIjxhsciYTTQ3B5B2oBhHIhxiYIwQWiEB+xOCylUw0KQS5PrLZNSIwH2KgVjLR5GsEC4OdKBYRmB8xiFYykcXFws+lRUTAj7ZjcGYxmVuE4FRaQwT8aTQGC6PjjxAMRQT8ajMGX4oBqxC08eoBEfCvvRh8JgYmhyCsT2IE6p8KiEA52olBvD5wIgZM3lkY1il/lpoRgfK0EQOTaSCyeovxQ6l1eUAEylV5DCxPwCYhqHZ5QATKV28MVuG4czcRxDo9kJoQgXrUGYMTMWQWgu6ixYnUgAjUp7IYWJ94TX8NuYqpgAjUq54YPLT+PR/TEBQ/FRCB+lUQgxQnXPMbkxQ7FRCBdhQcg3h8pfitX/MQdFOB2dXMLIhAe8qMwSpsx5JAkluVhWrdk1LeV0AE2lVYDLppIMlxlSQEcXQpYolABFBODOIFwoeSSLKbl4adPg4x+Fi8IgJQ/mOw6qbsZFLfxfhIPL7jkAjgOr8xOAsRuJNqSaCShiDufPhDvCWebmdGBLCNwxiE4+edHPcGTf65Bt31gjvi4eIhEcA+jmIQlwOWv0+wS5YPOHERAyKAvhzEoHuFIMlLhVu+Xz7LL9a31iKPJfenKBMBjPFKt2XWReBIMsoagih7DIgApsgcgzki0H3f/LLFgAjAQqYYzBWB7nvPI3kMiAAsJY7BnBHovv98ksWACCCFRDGYOwLdPszLPAZEACkZx8BDBLr9mJ9ZDIgAcjCKgZcIRC5CEE2OARFAThNj4CkCkZsQRKNjQAQwh5Ex8BaByFUIosExIAKY08AYeIxA5C4EUe8YEAF40DMGXiMQuQxBtDcGRACe7ImB5whEbkMQbY0BEYBHW2LgPQKR6xBEL8SACMCzazEoIQKR+xBEP8TgaYgBEYB3XQxKiUCU5X4EU4Uf5un5/Qz+K2dEwNj/Bda+DRH4ppwIREWEIDqPwVMndzqqxVdh+zJs/xIYWjwPEbhdTgSiIpYGly3/MtPNTWoTI/D3S//8y7C9KpjoPAK/LisCUXEhiIjBRNcjoIjBJKVGICoyBBExGGlbBBQxGKXkCETFhiAiBgPti4AiBoOUHoGo6BBExKCnvhFQxKCXGiIQFR+CiBjsMTQCihjsVEsEoipCEBGDLcZGQBGDjWqKQFRNCCJicM3UCChicEVtEYiqCkFEDDpWEVDE4FyNEYiqC0HUfAysI6Aaj0GtEYiqDEHUbAxSRUA1GoOaIxBVG4KouRikjoBqLAa1RyCqOgRRMzHIFQHVSAxaiEBUfQii6mOQOwKq8hi0EoGoiRBE1cZgrgioSmPQUgSiZkIQVReDuSOgKotBaxGImgpBVE0MvERAVRKDFiMQNReCqPgYeIuAKjwGrUYgajIEUbEx8BoBVWgMWo5A1GwIouJi4D0CqrAYtB6BqOkQRMXEoJQIqEJiQAQuNB+CyH0MSouAch4DIvAjQtBxG4NSI6CcxoAIXEUILnEXg9IjoJzFgAi8iBBc4yYGtURAOYkBEdiMEGwwewxqi4CaOQZEYDtCsMVsMag1AmqmGBCB3QjBDtljUHsEVOYYEIH9CMEe2WLQSgRUphgQgX4IQQ/JY9BaBFTiGBCB/ghBT8li0GoEVKIYEIFhCMEA5jFoPQLKOAZEYDhCMJBZDIjAVUYxIALjEIIRJseACGw2MQZEYDxCMNLoGBCB3UbGgAhMQwgmGBwDItDPwBgQgekIwUS9Y0AEhukZAyJggxAY2BsDIjDOnhgQATuEwMjWGBCBabbEgAjYIgSGXogBEbBxLQZEwB4hMPZDDL4KMSACdroYEIE0CEECy09CDP4RYrBu7CPZE1v8IkTgt0QghRsCcyfvLE4XL8mdkNkzgYlwxiICCTERJLQ8CpPBMyaDqc4j8CcikBIhSIwYTEME8iAEGRCDcYhAPoQgE2IwDBHIixBkRAz6IQL5EYLMiMFuRGAehGAGxGAzIjAfQjATYnAVEZgXIZgRMbhABOZHCGbWegyIgA+EwIFWY0AE/CAETrQWAyLgCyFwpJUYEAF/CIEztceACPhECByqNQZEwC9C4FSIwWEXg0OpwGIt904+XBwLXCIEjlURg4WchQi8FSaBE4Fb3KHIsZOjxWrxkrwRav1ISrSQ8/0nAv4xERRi+fv10VrkvhQiPLE+lpflKMSM27UVgBAUpIilQpwC1vIOU0BZCEGBlu+v755PB56CcHEtIE4Bx0wB5SEEBTtfLizk7dmDsJCH4VrAg3hNQ1AkQlCBWSYEJoCqEIKKhAlhGR7uhinhdpIoxINf5LPw/34UAnBKAOpBCCoV350oz2QZvrwdpoVbo8JwcdY/DV99KTEAHPzVIgSNCGE4kKchCPEDWhchCvr25YW8Fr7+Onx1cYA/l5XcCNvLsmLNDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0K7vAU7PQZUgFNryAAAAAElFTkSuQmCC";
+
+/**
+ * Embedded, for the stdio package, which runs on the person's machine and
+ * has no URL of its own. The hosted server links to `/mcp/icon.png`
+ * instead, because revision 2026-07-28 repeats the server's identity in
+ * every result and an embedded image would ride along on each one.
+ */
+export const ICONS = [
+  {
+    src: `data:image/png;base64,${ICON_PNG_BASE64}`,
+    mimeType: "image/png",
+    sizes: ["258x258"],
+  },
+];
+
+/**
+ * ChatGPT's line under a running tool, then under a finished one
+ * (`openai/toolInvocation/invoking` and `invoked`, 64 characters at most).
+ * Other clients ignore these keys. Present tense while it runs, past once
+ * done, and never a number: the text is fixed per tool, not per call.
+ */
+export const STATUS = {
+  list_workspaces: [
+    "Looking up your Skyelight workspaces",
+    "Found your workspaces",
+  ],
+  list_projects: ["Looking up Skyelight projects", "Found your projects"],
+  list_items: ["Reading Skyelight feedback", "Read the feedback"],
+  search_items: ["Searching Skyelight feedback", "Searched the feedback"],
+  get_item: ["Opening the thread", "Opened the thread"],
+  list_members: ["Looking up the team", "Found the team"],
+  post_update: ["Replying on the thread", "Replied on the thread"],
+  create_item: ["Creating a thread", "Created the thread"],
+  set_status: ["Updating the thread", "Updated the thread"],
+  assign: ["Assigning the thread", "Assigned the thread"],
+  project_review: [
+    "Reading the project's history",
+    "Read the project's history",
+  ],
+  whats_new: ["Checking what's new", "Caught up"],
+  find_by_source: ["Finding feedback by file", "Found feedback by file"],
+  find_similar: ["Checking for similar reports", "Checked for similar reports"],
+  merge_items: ["Merging duplicates", "Merged the duplicates"],
+  decision_log: ["Reading the decisions", "Read the decisions"],
+  save_rule: ["Saving the rule", "Saved the rule"],
+};