@sota-io/mcp 1.4.1 → 1.5.0

package/dist/lib/archive-builder.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Archive Builder — turn AI-supplied source into a tar.gz ready for upload.
+ *
+ * Three input modes for the `deploy` MCP tool:
+ *   1. directory: string                     — existing CLI/Claude-Code flow
+ *   2. files: Record<string,string>          — inline source from AI agent
+ *   3. git_url: string + git_branch?: string — clone a public repo
+ *
+ * All three produce a tar.gz Buffer that the SDK uploads to
+ * `POST /v1/projects/:id/deploy` via multipart/form-data. The backend
+ * accepts the multipart upload identically regardless of source.
+ *
+ * Limits (deliberately generous — we want to lean permissive at launch):
+ *   files:    MAX_INLINE_FILES entries, MAX_INLINE_TOTAL_BYTES total
+ *   git_url:  MAX_CLONE_BYTES on disk after `git clone --depth=1`
+ *
+ * Security:
+ *   - Inline file paths are normalised + rejected if they contain ".." or
+ *     start with "/" or contain NUL.
+ *   - Symlinks are not honoured for inline files (we only write regular files).
+ *   - Git clone uses `--depth=1` and `--single-branch` to bound bandwidth.
+ *   - Both modes write to a fresh /tmp dir which is removed after tar.gz is read.
+ */
+/** Upper bound on inline file count (per single `deploy` call). */
+export declare const MAX_INLINE_FILES = 200;
+/** Upper bound on combined inline content length, in bytes. */
+export declare const MAX_INLINE_TOTAL_BYTES: number;
+/** Upper bound on a cloned git repo size (du -sb on the workdir), in bytes. */
+export declare const MAX_CLONE_BYTES: number;
+export declare class ArchiveBuilderError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+/**
+ * Pack a record of file paths → text content into a tar.gz Buffer.
+ *
+ * Each value is treated as UTF-8 text. Binary assets are not supported in
+ * this mode — use `archiveFromGitUrl` for that. The caller is responsible
+ * for including framework manifests (package.json, requirements.txt, or a
+ * Dockerfile) so the backend's auto-detection picks the right builder.
+ */
+export declare function archiveFromFiles(files: Record<string, string>): Buffer;
+/**
+ * `git clone --depth=1` the given URL (optionally on a specified branch),
+ * then pack the resulting workdir into a tar.gz Buffer. Only public repos
+ * are supported in v1 — there is no credential plumbing.
+ *
+ * Rejects URLs that don't begin with https://, http://, git://, ssh://, or
+ * the scp-like git@host:path form, to keep the surface predictable.
+ */
+export declare function archiveFromGitUrl(gitUrl: string, gitBranch?: string): Buffer;
+/**
+ * Pack an existing local directory into a tar.gz Buffer using the same
+ * ignore rules as the directory-mode `deploy` (excludes .git, node_modules,
+ * .env, .DS_Store). Exported so the deploy tool can re-use a single
+ * code path for archive construction.
+ */
+export declare function archiveFromDirectory(dir: string): Buffer;
+//# sourceMappingURL=archive-builder.d.ts.map

package/dist/lib/archive-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive-builder.d.ts","sourceRoot":"","sources":["../../src/lib/archive-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAcH,mEAAmE;AACnE,eAAO,MAAM,gBAAgB,MAAM,CAAC;AACpC,+DAA+D;AAC/D,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AACvD,+EAA+E;AAC/E,eAAO,MAAM,eAAe,QAAoB,CAAC;AAIjD,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAsCtE;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAsD5E;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQxD"}

package/dist/lib/archive-builder.js

@@ -0,0 +1,221 @@
+/**
+ * Archive Builder — turn AI-supplied source into a tar.gz ready for upload.
+ *
+ * Three input modes for the `deploy` MCP tool:
+ *   1. directory: string                     — existing CLI/Claude-Code flow
+ *   2. files: Record<string,string>          — inline source from AI agent
+ *   3. git_url: string + git_branch?: string — clone a public repo
+ *
+ * All three produce a tar.gz Buffer that the SDK uploads to
+ * `POST /v1/projects/:id/deploy` via multipart/form-data. The backend
+ * accepts the multipart upload identically regardless of source.
+ *
+ * Limits (deliberately generous — we want to lean permissive at launch):
+ *   files:    MAX_INLINE_FILES entries, MAX_INLINE_TOTAL_BYTES total
+ *   git_url:  MAX_CLONE_BYTES on disk after `git clone --depth=1`
+ *
+ * Security:
+ *   - Inline file paths are normalised + rejected if they contain ".." or
+ *     start with "/" or contain NUL.
+ *   - Symlinks are not honoured for inline files (we only write regular files).
+ *   - Git clone uses `--depth=1` and `--single-branch` to bound bandwidth.
+ *   - Both modes write to a fresh /tmp dir which is removed after tar.gz is read.
+ */
+import { execSync } from 'child_process';
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync, statSync, } from 'fs';
+import { tmpdir } from 'os';
+import { dirname, join, resolve, sep } from 'path';
+/** Upper bound on inline file count (per single `deploy` call). */
+export const MAX_INLINE_FILES = 200;
+/** Upper bound on combined inline content length, in bytes. */
+export const MAX_INLINE_TOTAL_BYTES = 10 * 1024 * 1024; // 10 MB
+/** Upper bound on a cloned git repo size (du -sb on the workdir), in bytes. */
+export const MAX_CLONE_BYTES = 200 * 1024 * 1024; // 200 MB
+/** Upper bound on path component count, to defeat absurd nesting attacks. */
+const MAX_PATH_DEPTH = 32;
+export class ArchiveBuilderError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'ArchiveBuilderError';
+    }
+}
+/**
+ * Pack a record of file paths → text content into a tar.gz Buffer.
+ *
+ * Each value is treated as UTF-8 text. Binary assets are not supported in
+ * this mode — use `archiveFromGitUrl` for that. The caller is responsible
+ * for including framework manifests (package.json, requirements.txt, or a
+ * Dockerfile) so the backend's auto-detection picks the right builder.
+ */
+export function archiveFromFiles(files) {
+    const entries = Object.entries(files);
+    if (entries.length === 0) {
+        throw new ArchiveBuilderError('empty_files', 'files map cannot be empty');
+    }
+    if (entries.length > MAX_INLINE_FILES) {
+        throw new ArchiveBuilderError('too_many_files', `files map has ${entries.length} entries (max ${MAX_INLINE_FILES})`);
+    }
+    let totalBytes = 0;
+    const sanitised = [];
+    for (const [rawPath, content] of entries) {
+        const safePath = sanitiseInlinePath(rawPath);
+        const buf = Buffer.from(content, 'utf8');
+        totalBytes += buf.byteLength;
+        if (totalBytes > MAX_INLINE_TOTAL_BYTES) {
+            throw new ArchiveBuilderError('inline_too_large', `combined content exceeds ${MAX_INLINE_TOTAL_BYTES} bytes`);
+        }
+        sanitised.push([safePath, buf]);
+    }
+    const workdir = mkdtempSync(join(tmpdir(), 'sota-inline-'));
+    try {
+        for (const [path, buf] of sanitised) {
+            const abs = join(workdir, path);
+            mkdirSync(dirname(abs), { recursive: true });
+            writeFileSync(abs, buf);
+        }
+        return tarGzWorkdir(workdir);
+    }
+    finally {
+        rmSync(workdir, { recursive: true, force: true });
+    }
+}
+/**
+ * `git clone --depth=1` the given URL (optionally on a specified branch),
+ * then pack the resulting workdir into a tar.gz Buffer. Only public repos
+ * are supported in v1 — there is no credential plumbing.
+ *
+ * Rejects URLs that don't begin with https://, http://, git://, ssh://, or
+ * the scp-like git@host:path form, to keep the surface predictable.
+ */
+export function archiveFromGitUrl(gitUrl, gitBranch) {
+    const url = gitUrl.trim();
+    if (!isPlausibleGitURL(url)) {
+        throw new ArchiveBuilderError('bad_git_url', `git_url must look like a URL (https://, git://, ssh://, or git@host:path) — got: ${url.slice(0, 80)}`);
+    }
+    if (url.length > 2000) {
+        throw new ArchiveBuilderError('bad_git_url', 'git_url too long (max 2000 chars)');
+    }
+    const branch = gitBranch ? gitBranch.trim() : '';
+    if (branch && !/^[\w./\-]{1,255}$/.test(branch)) {
+        throw new ArchiveBuilderError('bad_git_branch', 'git_branch contains invalid characters or exceeds 255 chars');
+    }
+    const workdir = mkdtempSync(join(tmpdir(), 'sota-git-'));
+    try {
+        // Cap clone bandwidth/time. `--depth=1` cuts history to the tip commit.
+        // `--single-branch` avoids fetching all refs.
+        const args = ['clone', '--depth=1', '--single-branch'];
+        if (branch) {
+            args.push('--branch', branch);
+        }
+        args.push('--', url, workdir);
+        try {
+            execSync(`git ${args.map(shellQuote).join(' ')}`, {
+                stdio: 'pipe',
+                timeout: 120_000,
+            });
+        }
+        catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            throw new ArchiveBuilderError('git_clone_failed', `git clone failed (URL=${url.slice(0, 120)}${branch ? `, branch=${branch}` : ''}): ${detail.slice(0, 300)}`);
+        }
+        // Hard size cap: refuse repos that ballooned past MAX_CLONE_BYTES.
+        const sizeBytes = duBytes(workdir);
+        if (sizeBytes > MAX_CLONE_BYTES) {
+            throw new ArchiveBuilderError('clone_too_large', `cloned repo is ${(sizeBytes / 1024 / 1024).toFixed(1)} MB (max ${(MAX_CLONE_BYTES / 1024 / 1024).toFixed(0)} MB)`);
+        }
+        return tarGzWorkdir(workdir);
+    }
+    finally {
+        rmSync(workdir, { recursive: true, force: true });
+    }
+}
+/**
+ * Pack an existing local directory into a tar.gz Buffer using the same
+ * ignore rules as the directory-mode `deploy` (excludes .git, node_modules,
+ * .env, .DS_Store). Exported so the deploy tool can re-use a single
+ * code path for archive construction.
+ */
+export function archiveFromDirectory(dir) {
+    const abs = resolve(dir);
+    try {
+        statSync(abs);
+    }
+    catch {
+        throw new ArchiveBuilderError('not_found', `Directory not found: ${abs}`);
+    }
+    return tarGzWorkdir(abs);
+}
+function tarGzWorkdir(workdir) {
+    const archivePath = join(tmpdir(), `sota-deploy-${Date.now()}-${process.pid}.tar.gz`);
+    try {
+        execSync(`tar -czf ${shellQuote(archivePath)} --exclude='.git' --exclude='node_modules' --exclude='.env' --exclude='.DS_Store' -C ${shellQuote(workdir)} .`, { stdio: 'pipe' });
+        return readFileSync(archivePath);
+    }
+    finally {
+        try {
+            rmSync(archivePath, { force: true });
+        }
+        catch {
+            // best-effort cleanup
+        }
+    }
+}
+function sanitiseInlinePath(raw) {
+    if (!raw || typeof raw !== 'string') {
+        throw new ArchiveBuilderError('bad_path', 'file path must be a non-empty string');
+    }
+    if (raw.includes('\0')) {
+        throw new ArchiveBuilderError('bad_path', 'file path contains NUL byte');
+    }
+    if (raw.length > 1024) {
+        throw new ArchiveBuilderError('bad_path', `file path too long (max 1024 chars): ${raw.slice(0, 80)}…`);
+    }
+    // Strip leading "./" and "/"; reject ".." segments.
+    let p = raw.replace(/^\.?\//, '').replace(/\\/g, '/');
+    if (p.startsWith('/')) {
+        p = p.slice(1);
+    }
+    if (p === '' || p === '.' || p === '..') {
+        throw new ArchiveBuilderError('bad_path', `invalid file path: ${raw}`);
+    }
+    const segments = p.split('/');
+    if (segments.length > MAX_PATH_DEPTH) {
+        throw new ArchiveBuilderError('bad_path', `path too deep (${segments.length} segments, max ${MAX_PATH_DEPTH}): ${raw}`);
+    }
+    for (const seg of segments) {
+        if (seg === '' || seg === '.' || seg === '..') {
+            throw new ArchiveBuilderError('bad_path', `invalid path segment in: ${raw}`);
+        }
+    }
+    return segments.join(sep);
+}
+function isPlausibleGitURL(s) {
+    if (s.startsWith('https://') || s.startsWith('http://'))
+        return true;
+    if (s.startsWith('git://'))
+        return true;
+    if (s.startsWith('ssh://'))
+        return true;
+    if (s.startsWith('git@') && s.includes(':'))
+        return true;
+    return false;
+}
+function shellQuote(arg) {
+    // Single-quote and escape any embedded single quotes for safe shell pasting.
+    return `'${arg.replace(/'/g, `'\\''`)}'`;
+}
+function duBytes(dir) {
+    try {
+        const out = execSync(`du -sb ${shellQuote(dir)}`, { stdio: ['ignore', 'pipe', 'pipe'] })
+            .toString()
+            .trim();
+        const n = parseInt(out.split(/\s+/)[0] ?? '0', 10);
+        return Number.isFinite(n) ? n : 0;
+    }
+    catch {
+        return 0;
+    }
+}
+//# sourceMappingURL=archive-builder.js.map

package/dist/lib/archive-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive-builder.js","sourceRoot":"","sources":["../../src/lib/archive-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EACL,WAAW,EACX,SAAS,EACT,aAAa,EACb,YAAY,EACZ,MAAM,EACN,QAAQ,GACT,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAEnD,mEAAmE;AACnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AACpC,+DAA+D;AAC/D,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ;AAChE,+EAA+E;AAC/E,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,SAAS;AAC3D,6EAA6E;AAC7E,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,IAAI,CAAS;IACtB,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA6B;IAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,mBAAmB,CAAC,aAAa,EAAE,2BAA2B,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACtC,MAAM,IAAI,mBAAmB,CAC3B,gBAAgB,EAChB,iBAAiB,OAAO,CAAC,MAAM,iBAAiB,gBAAgB,GAAG,CACpE,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,OAAO,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC;QAC7B,IAAI,UAAU,GAAG,sBAAsB,EAAE,CAAC;YACxC,MAAM,IAAI,mBAAmB,CAC3B,kBAAkB,EAClB,4BAA4B,sBAAsB,QAAQ,CAC3D,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,SAAS,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAChC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7C,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,SAAkB;IAClE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,mBAAmB,CAC3B,aAAa,EACb,oFAAoF,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CACvG,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,mBAAmB,CAAC,aAAa,EAAE,mCAAmC,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,IAAI,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,mBAAmB,CAC3B,gBAAgB,EAChB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,wEAAwE;QACxE,8CAA8C;QAC9C,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;QACvD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC;YACH,QAAQ,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE;gBAChD,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,MAAM,IAAI,mBAAmB,CAC3B,kBAAkB,EAClB,yBAAyB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC5G,CAAC;QACJ,CAAC;QAED,mEAAmE;QACnE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,SAAS,GAAG,eAAe,EAAE,CAAC;YAChC,MAAM,IAAI,mBAAmB,CAC3B,iBAAiB,EACjB,kBAAkB,CAAC,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,eAAe,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CACnH,CAAC;QACJ,CAAC;QAED,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC;QACH,QAAQ,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAE,wBAAwB,GAAG,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC;IACtF,IAAI,CAAC;QACH,QAAQ,CACN,YAAY,UAAU,CAAC,WAAW,CAAC,wFAAwF,UAAU,CAAC,OAAO,CAAC,IAAI,EAClJ,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;QACF,OAAO,YAAY,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,mBAAmB,CAAC,UAAU,EAAE,sCAAsC,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,mBAAmB,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,mBAAmB,CAAC,UAAU,EAAE,wCAAwC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IACzG,CAAC;IACD,oDAAoD;IACpD,IAAI,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,mBAAmB,CAAC,UAAU,EAAE,sBAAsB,GAAG,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,QAAQ,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QACrC,MAAM,IAAI,mBAAmB,CAC3B,UAAU,EACV,kBAAkB,QAAQ,CAAC,MAAM,kBAAkB,cAAc,MAAM,GAAG,EAAE,CAC7E,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAC9C,MAAM,IAAI,mBAAmB,CAAC,UAAU,EAAE,4BAA4B,GAAG,EAAE,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS;IAClC,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,6EAA6E;IAC7E,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC3C,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;aACrF,QAAQ,EAAE;aACV,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QACnD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/tools/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/tools/deploy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAKpE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,QAoEvE"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/tools/deploy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAW1C,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,QAyIvE"}

package/dist/tools/deploy.js

@@ -1,52 +1,122 @@
 import { z } from 'zod';
-import { execSync } from 'child_process';
-import { existsSync } from 'fs';
-import { resolve } from 'path';
+import { archiveFromDirectory, archiveFromFiles, archiveFromGitUrl, ArchiveBuilderError, MAX_INLINE_FILES, MAX_INLINE_TOTAL_BYTES, MAX_CLONE_BYTES, } from '../lib/archive-builder.js';
 export function registerDeployTool(server, client) {
     server.registerTool('deploy', {
-        description: `Deploy an application to sota.io. Creates a tar.gz archive of the specified directory and uploads it (max 50 MB). The platform auto-detects your framework and builds a Docker image automatically:
+        description: `Deploy an application to sota.io. The platform auto-detects your framework and builds a Docker image automatically:
 
 - Next.js: Detected via next.config.js/ts. Add output: 'standalone' to next.config for optimal builds.
 - Node.js: Detected via package.json with a "start" script. Works with Express, Fastify, Koa, Hapi, etc.
 - Python: Detected via requirements.txt or pyproject.toml. Works with Flask, FastAPI, Django.
 - Custom Dockerfile: If a Dockerfile exists in the project root, it takes priority over auto-detection. Use this for Go, Rust, Java, or any other language. The EXPOSE directive in the Dockerfile is used to detect the app port automatically.
 
+THREE WAYS to supply the source code — pick EXACTLY ONE:
+
+1. **files** (inline source from AI):
+   Pass a map of relative paths to UTF-8 text content. Best when you've just
+   generated a small app in this conversation and want to deploy it without
+   any filesystem step. Up to ${MAX_INLINE_FILES} files, ${MAX_INLINE_TOTAL_BYTES / 1024 / 1024} MB total. Include
+   the framework manifest (package.json, requirements.txt, or Dockerfile)
+   so auto-detection works.
+
+2. **git_url** (clone a public repo):
+   Pass an https://, git://, ssh://, or git@host:path URL. We shallow-clone
+   it (--depth=1 --single-branch) on the server and deploy. Optional
+   git_branch picks a non-default branch. Only public repos are supported in
+   v1. Max ${MAX_CLONE_BYTES / 1024 / 1024} MB after clone.
+
+3. **directory** (local filesystem):
+   Pass an absolute path. Only works when the MCP client has filesystem
+   access (Claude Code / CLI; not Claude.ai web). Defaults to the current
+   working directory when omitted.
+
 IMPORTANT: Your app MUST listen on the PORT environment variable. For auto-detected frameworks (Next.js, Node.js, Python) PORT is 8080. For custom Dockerfiles, the port is auto-detected from the EXPOSE directive (e.g. EXPOSE 3000 sets PORT=3000). If no EXPOSE is found, it defaults to 8080.
 
 Every project includes a managed PostgreSQL 17 database. Six environment variables are auto-injected into your container — no manual database configuration needed: DATABASE_URL (full connection string), PGHOST, PGPORT, PGUSER, PGPASSWORD, and PGDATABASE. Libraries that follow libpq conventions (node-postgres, pgx, psycopg2, Django) pick up the PG* variables automatically with no configuration. If your app needs database migrations, run them on startup.
 
-Deployments use blue-green strategy for zero downtime. The old container keeps running until the new one passes health checks (60s timeout). Use get-logs to monitor build progress. Files matching .gitignore and .sotaignore are excluded from the archive.`,
+Deployments use blue-green strategy for zero downtime. The old container keeps running until the new one passes health checks (60s timeout). Use get-logs to monitor build progress. Files matching .gitignore, .git/, node_modules/, .env, and .DS_Store are excluded from the archive.`,
         inputSchema: {
-            project_id: z.string().describe('Project ID (UUID) to deploy to. Use list-projects to find the ID'),
-            directory: z.string().optional().describe('Absolute path to the directory to deploy. Defaults to current working directory. Must contain your app source code (package.json, requirements.txt, or Dockerfile)'),
+            project_id: z.string().describe('Project ID (UUID) to deploy to. Use list-projects to find the ID.'),
+            files: z
+                .record(z.string(), z.string())
+                .optional()
+                .describe(`Map of relative file paths to UTF-8 text content. Use when generating an app inline (e.g. from a Claude.ai web conversation). Include a framework manifest so auto-detection works. Mutually exclusive with git_url and directory.`),
+            git_url: z
+                .string()
+                .optional()
+                .describe('Public git repository URL to clone (https://, git://, ssh://, or git@host:path). Mutually exclusive with files and directory.'),
+            git_branch: z
+                .string()
+                .optional()
+                .describe('Optional branch name when using git_url. Defaults to the repository default branch.'),
+            directory: z
+                .string()
+                .optional()
+                .describe('Absolute path to a local directory (only useful when the MCP client has filesystem access — e.g. Claude Code). Defaults to the current working directory when no other mode is given. Mutually exclusive with files and git_url.'),
         },
         annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
-    }, async ({ project_id, directory }) => {
-        const dir = directory ? resolve(directory) : process.cwd();
-        if (!existsSync(dir)) {
+    }, async ({ project_id, files, git_url, git_branch, directory }) => {
+        // Mutual-exclusivity check: at most one mode set. When zero are set we
+        // fall back to directory mode with cwd (legacy CLI behaviour).
+        const modesSet = [files !== undefined, git_url !== undefined, directory !== undefined].filter(Boolean).length;
+        if (modesSet > 1) {
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: 'Error: deploy accepts exactly one of `files`, `git_url`, or `directory`. Pick the mode that matches your environment (files for inline AI-generated code, git_url for a public repo, directory for a local path).',
+                    },
+                ],
+                isError: true,
+            };
+        }
+        if (git_branch && !git_url) {
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: 'Error: `git_branch` only makes sense together with `git_url`.',
+                    },
+                ],
+                isError: true,
+            };
+        }
+        let archiveBuffer;
+        let modeDescription;
+        try {
+            if (files !== undefined) {
+                archiveBuffer = archiveFromFiles(files);
+                modeDescription = `inline files (${Object.keys(files).length} entries)`;
+            }
+            else if (git_url !== undefined) {
+                archiveBuffer = archiveFromGitUrl(git_url, git_branch);
+                modeDescription = `git clone (${git_url}${git_branch ? ` @ ${git_branch}` : ''})`;
+            }
+            else {
+                const dir = directory || process.cwd();
+                archiveBuffer = archiveFromDirectory(dir);
+                modeDescription = `directory (${dir})`;
+            }
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            const code = error instanceof ArchiveBuilderError ? ` [${error.code}]` : '';
             return {
                 content: [
                     {
                         type: 'text',
-                        text: `Error: Directory not found: ${dir}`,
+                        text: `Deploy failed during archive construction${code}: ${detail}`,
                     },
                 ],
                 isError: true,
             };
         }
         try {
-            // Create tar.gz archive using system tar (excludes common ignores)
-            const archivePath = `/tmp/sota-deploy-${Date.now()}.tar.gz`;
-            execSync(`tar -czf ${archivePath} --exclude='.git' --exclude='node_modules' --exclude='.env' --exclude='.DS_Store' -C ${dir} .`, { stdio: 'pipe' });
-            const { readFileSync, unlinkSync } = await import('fs');
-            const archiveBuffer = readFileSync(archivePath);
-            unlinkSync(archivePath);
             const deployment = await client.deploy(project_id, archiveBuffer);
             return {
                 content: [
                     {
                         type: 'text',
-                        text: `Deployment started:\n  ID: ${deployment.id}\n  Status: ${deployment.status}\n  URL: ${deployment.url || 'pending'}\n\nUse get-logs to check build progress.`,
+                        text: `Deployment started (${modeDescription}):\n  ID: ${deployment.id}\n  Status: ${deployment.status}\n  URL: ${deployment.url || 'pending'}\n\nUse get-logs to check build progress.`,
                     },
                 ],
             };
@@ -56,7 +126,7 @@ Deployments use blue-green strategy for zero downtime. The old container keeps r
                 content: [
                     {
                         type: 'text',
-                        text: `Deploy failed: ${error instanceof Error ? error.message : String(error)}`,
+                        text: `Deploy failed during upload: ${error instanceof Error ? error.message : String(error)}`,
                     },
                 ],
                 isError: true,

package/dist/tools/deploy.js.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.js","sourceRoot":"","sources":["../../src/tools/deploy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAG/B,MAAM,UAAU,kBAAkB,CAAC,MAAiB,EAAE,MAAkB;IACtE,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE;QAC5B,WAAW,EAAE;;;;;;;;;;;8PAW6O;QAC1P,WAAW,EAAE;YACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kEAAkE,CAAC;YACnG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oKAAoK,CAAC;SAChN;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;KACzG,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAE3D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,+BAA+B,GAAG,EAAE;qBAC3C;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,mEAAmE;YACnE,MAAM,WAAW,GAAG,oBAAoB,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC;YAC5D,QAAQ,CACN,YAAY,WAAW,wFAAwF,GAAG,IAAI,EACtH,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;YAEF,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;YACxD,MAAM,aAAa,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;YAChD,UAAU,CAAC,WAAW,CAAC,CAAC;YAExB,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAElE,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,8BAA8B,UAAU,CAAC,EAAE,eAAe,UAAU,CAAC,MAAM,YAAY,UAAU,CAAC,GAAG,IAAI,SAAS,2CAA2C;qBACpK;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,kBAAkB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;qBACjF;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"deploy.js","sourceRoot":"","sources":["../../src/tools/deploy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,GAChB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,UAAU,kBAAkB,CAAC,MAAiB,EAAE,MAAkB;IACtE,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE;QAC5B,WAAW,EAAE;;;;;;;;;;;;gCAYe,gBAAgB,WAAW,sBAAsB,GAAG,IAAI,GAAG,IAAI;;;;;;;;aAQlF,eAAe,GAAG,IAAI,GAAG,IAAI;;;;;;;;;;;yRAW+O;QACrR,WAAW,EAAE;YACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mEAAmE,CAAC;YACpG,KAAK,EAAE,CAAC;iBACL,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;iBAC9B,QAAQ,EAAE;iBACV,QAAQ,CACP,oOAAoO,CACrO;YACH,OAAO,EAAE,CAAC;iBACP,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,+HAA+H,CAChI;YACH,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,qFAAqF,CAAC;YAClG,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,kOAAkO,CACnO;SACJ;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;KACzG,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE;QACjE,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,OAAO,KAAK,SAAS,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC9G,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjB,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,mNAAmN;qBAC1N;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,+DAA+D;qBACtE;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,IAAI,aAAqB,CAAC;QAC1B,IAAI,eAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,aAAa,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBACxC,eAAe,GAAG,iBAAiB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,WAAW,CAAC;YAC1E,CAAC;iBAAM,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBACjC,aAAa,GAAG,iBAAiB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;gBACvD,eAAe,GAAG,cAAc,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;YACpF,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBACvC,aAAa,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;gBAC1C,eAAe,GAAG,cAAc,GAAG,GAAG,CAAC;YACzC,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,IAAI,GAAG,KAAK,YAAY,mBAAmB,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,4CAA4C,IAAI,KAAK,MAAM,EAAE;qBACpE;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAClE,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,uBAAuB,eAAe,aAAa,UAAU,CAAC,EAAE,eAAe,UAAU,CAAC,MAAM,YAAY,UAAU,CAAC,GAAG,IAAI,SAAS,2CAA2C;qBACzL;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,gCAAgC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;qBAC/F;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/projects.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"projects.d.ts","sourceRoot":"","sources":["../../src/tools/projects.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,QAoEzE"}
+{"version":3,"file":"projects.d.ts","sourceRoot":"","sources":["../../src/tools/projects.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,QA6EzE"}

package/dist/tools/projects.js

@@ -18,18 +18,27 @@ export function registerProjectTools(server, client) {
         };
     });
     server.registerTool('create-project', {
-        description: 'Create a new project on sota.io. Each project automatically provisions: (1) a managed PostgreSQL 17 database accessible via the DATABASE_URL environment variable (auto-injected, no configuration needed), (2) PgBouncer connection pooling (pool size 20, max 100 clients), (3) automatic daily database backups with 7-day retention, (4) a live URL at https://{slug}.sota.io with automatic HTTPS via Let\'s Encrypt. The project slug is auto-generated from the name (lowercase, hyphens, max 63 chars) and is immutable after creation. Supported frameworks: Next.js, Node.js (Express/Fastify/Koa), Python (Flask/FastAPI/Django), or any language via custom Dockerfile. You can also add up to 5 custom domains per project with automatic HTTPS (via API: POST /v1/projects/:id/domains with {domain: "yourdomain.com"}). DNS: A record to 23.88.45.28 for apex domains, CNAME to {slug}.sota.io for subdomains.',
+        description: 'Create a new project on sota.io. Each project automatically provisions: (1) a managed PostgreSQL 17 database accessible via the DATABASE_URL environment variable (auto-injected, no configuration needed), (2) PgBouncer connection pooling (pool size 20, max 100 clients), (3) automatic daily database backups with 7-day retention, (4) a live URL at https://{slug}.sota.io with automatic HTTPS via Let\'s Encrypt. The project slug is auto-generated from the name (lowercase, hyphens, max 63 chars) and is immutable after creation. Supported frameworks: Next.js, Node.js (Express/Fastify/Koa), Python (Flask/FastAPI/Django), or any language via custom Dockerfile. You can also add up to 5 custom domains per project with automatic HTTPS (via API: POST /v1/projects/:id/domains with {domain: "yourdomain.com"}). DNS: A record to 23.88.45.28 for apex domains, CNAME to {slug}.sota.io for subdomains.\n\nOptionally associate the project with a public git repository at create-time by passing `git_url` (and optional `git_branch`). The association is informational — it shows up in the dashboard and the `sota deploy --git` CLI flag can default to it — but does NOT enable auto-deploy-on-push yet.',
         inputSchema: {
             name: z.string().describe('Name for the new project. A URL slug will be auto-generated (e.g. "My Cool App" becomes my-cool-app.sota.io)'),
+            git_url: z.string().optional().describe('Optional git repository URL to associate with this project (https://, git://, ssh://, or git@host:path). Informational only — does not trigger an automatic deploy.'),
+            git_branch: z.string().optional().describe('Optional branch name (defaults to the repository default branch when omitted). Only meaningful when `git_url` is also set.'),
         },
         annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
-    }, async ({ name }) => {
-        const project = await client.createProject({ name });
+    }, async ({ name, git_url, git_branch }) => {
+        const project = await client.createProject({
+            name,
+            git_url,
+            git_branch,
+        });
+        const gitLine = project.git_url
+            ? `\n  Git: ${project.git_url}${project.git_branch ? ` @ ${project.git_branch}` : ''}`
+            : '';
         return {
             content: [
                 {
                     type: 'text',
-                    text: `Project created:\n  Name: ${project.name}\n  Slug: ${project.slug}\n  ID: ${project.id}\n  URL: https://${project.slug}.sota.io`,
+                    text: `Project created:\n  Name: ${project.name}\n  Slug: ${project.slug}\n  ID: ${project.id}\n  URL: https://${project.slug}.sota.io${gitLine}`,
                 },
             ],
         };

package/dist/tools/projects.js.map

@@ -1 +1 @@
-{"version":3,"file":"projects.js","sourceRoot":"","sources":["../../src/tools/projects.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,MAAkB;IACxE,MAAM,CAAC,YAAY,CAAC,eAAe,EAAE;QACnC,WAAW,EAAE,6aAA6a;QAC1b,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;KACxG,EAAE,KAAK,IAAI,EAAE;QACZ,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,EAAE,EAAE,CAC7C,CAAC;QACF,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;wBACzB,CAAC,CAAC,sDAAsD;wBACxD,CAAC,CAAC,cAAc,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACrC;aACF;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CAAC,gBAAgB,EAAE;QACpC,WAAW,EAAE,+3BAA+3B;QAC54B,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8GAA8G,CAAC;SAC1I;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;KAC1G,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;QACpB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,6BAA6B,OAAO,CAAC,IAAI,aAAa,OAAO,CAAC,IAAI,WAAW,OAAO,CAAC,EAAE,oBAAoB,OAAO,CAAC,IAAI,UAAU;iBACxI;aACF;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CAAC,gBAAgB,EAAE;QACpC,WAAW,EAAE,+QAA+Q;QAC5R,WAAW,EAAE;YACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+DAA+D,CAAC;SACjG;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;KACxG,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;YACvC,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,WAAW,UAAU,wBAAwB;qBACpD;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,kBAAkB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;qBACjF;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"projects.js","sourceRoot":"","sources":["../../src/tools/projects.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,MAAkB;IACxE,MAAM,CAAC,YAAY,CAAC,eAAe,EAAE;QACnC,WAAW,EAAE,6aAA6a;QAC1b,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;KACxG,EAAE,KAAK,IAAI,EAAE;QACZ,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,EAAE,EAAE,CAC7C,CAAC;QACF,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;wBACzB,CAAC,CAAC,sDAAsD;wBACxD,CAAC,CAAC,cAAc,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACrC;aACF;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CAAC,gBAAgB,EAAE;QACpC,WAAW,EAAE,uqCAAuqC;QACprC,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8GAA8G,CAAC;YACzI,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qKAAqK,CAAC;YAC9M,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4HAA4H,CAAC;SACzK;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;KAC1G,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE;QACzC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC;YACzC,IAAI;YACJ,OAAO;YACP,UAAU;SACX,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO;YAC7B,CAAC,CAAC,YAAY,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YACtF,CAAC,CAAC,EAAE,CAAC;QACP,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,6BAA6B,OAAO,CAAC,IAAI,aAAa,OAAO,CAAC,IAAI,WAAW,OAAO,CAAC,EAAE,oBAAoB,OAAO,CAAC,IAAI,WAAW,OAAO,EAAE;iBAClJ;aACF;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CAAC,gBAAgB,EAAE;QACpC,WAAW,EAAE,+QAA+Q;QAC5R,WAAW,EAAE;YACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+DAA+D,CAAC;SACjG;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;KACxG,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;YACvC,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,WAAW,UAAU,wBAAwB;qBACpD;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,kBAAkB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;qBACjF;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@sota-io/mcp",
-  "version": "1.4.1",
+  "version": "1.5.0",
   "mcpName": "io.sota/mcp",
-  "description": "MCP server for sota.io \u2014 EU-native DevOps PaaS. Deploy web apps via AI agents with managed PostgreSQL, zero-downtime deploys, and automatic HTTPS. Supports Next.js, Node.js, Python, and custom Dockerfiles.",
+  "description": "MCP server for sota.io — EU-native DevOps PaaS. Deploy web apps via AI agents with managed PostgreSQL, zero-downtime deploys, and automatic HTTPS. Supports Next.js, Node.js, Python, and custom Dockerfiles.",
   "type": "module",
   "main": "dist/index.js",
   "bin": {
@@ -18,7 +18,8 @@
     "start": "node dist/index.js",
     "dev": "tsx src/index.ts",
     "prepublishOnly": "npm run build",
-    "start:http": "node dist/http.js"
+    "start:http": "node dist/http.js",
+    "test": "npm run build && node --test test/*.test.mjs"
   },
   "repository": {
     "type": "git",
@@ -40,21 +41,21 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.27.0",
-    "@sota-io/sdk": "^1.1.0",
-    "zod": "^3.25.0",
+    "@sota-io/sdk": "^1.3.0",
     "express": "^4.21.0",
     "jose": "^5.9.0",
-    "pg": "^8.13.0"
+    "pg": "^8.13.0",
+    "zod": "^3.25.0"
   },
   "devDependencies": {
+    "@types/express": "^4.17.21",
     "@types/node": "^22.0.0",
+    "@types/pg": "^8.11.0",
     "tsx": "^4.0.0",
-    "typescript": "^5.7.0",
-    "@types/express": "^4.17.21",
-    "@types/pg": "^8.11.0"
+    "typescript": "^5.7.0"
   },
   "engines": {
     "node": ">=20.0.0"
   },
   "license": "MIT"
-}
+}