@subseam/mcp 0.4.1 → 0.4.11

package/README.md

@@ -12,9 +12,8 @@ and the rest. It runs on your machine and talks to the subseam service over HTTP
 ## What you need
 
 - Node.js 22 or later, and npm.
-- A GitHub account, and a subseam organization that someone has added you to. The org's owner
-  gives you its id (a UUID); that is your **tenant id**.
-- The subseam API URL: `https://subseam.theconstructory.com/api`.
+- A GitHub account, and a subseam organization that someone has added you to.
+- The subseam API URL: `https://subseam.theconstructory.com/subseam`.
 
 ## 1. Sign in
 
@@ -54,15 +53,19 @@ npm install @subseam/mcp
 
 ## 4. Register it with your agent
 
-For Claude Code, with your tenant id in place of `<tenant id>`:
+For Claude Code:
 
 ```
-claude mcp add-json --scope user subseam '{"command":"node","args":["'"$HOME"'/.subseam/mcp/node_modules/@subseam/mcp/dist/main.js"],"env":{"SUBSEAM_URL":"https://subseam.theconstructory.com/api","SUBSEAM_TENANT":"<tenant id>"}}'
+claude mcp add-json --scope user subseam '{"command":"node","args":["'"$HOME"'/.subseam/mcp/node_modules/@subseam/mcp/dist/main.js"],"env":{"SUBSEAM_URL":"https://subseam.theconstructory.com/subseam"}}'
 ```
 
 `claude mcp list` should show `subseam ... Connected`. Any other MCP host: run
-`node ~/.subseam/mcp/node_modules/@subseam/mcp/dist/main.js` over stdio with the same two
-environment variables.
+`node ~/.subseam/mcp/node_modules/@subseam/mcp/dist/main.js` over stdio with the same
+environment.
+
+The server acts for your organization. If you belong to several, it mounts only
+`subseam_unavailable`, which lists each one's name and id: add `"SUBSEAM_TENANT":"<id>"` to the
+`env` above for the one this agent works in.
 
 ## 5. Check it works
 

package/dist/main.js

@@ -24036,10 +24036,11 @@ function requireEnv(env, name, purpose) {
 function loadConfig2(env = process.env, sources = realTokenSources()) {
   return Object.freeze({
     get url() {
-      return requireEnv(env, "SUBSEAM_URL", "to reach the hosted service, e.g. https://app.subseam.dev");
+      return requireEnv(env, "SUBSEAM_URL", "to reach the hosted service, e.g. https://subseam.theconstructory.com/subseam");
     },
     get tenantId() {
-      return requireEnv(env, "SUBSEAM_TENANT", "as the organization id the channel acts for (a UUID)");
+      const value = env["SUBSEAM_TENANT"];
+      return value === void 0 || value === "" ? void 0 : value;
     },
     get token() {
       return resolveTenantToken(sources);
@@ -28203,14 +28204,35 @@ async function requireRepo(env, readOrigin2) {
   throw new Error(`SUBSEAM_REPO unset; git remote origin = ${seen} did not parse as owner/name`);
 }
 
+// src/account.ts
+init_esm_shims();
+var AccountChoiceError = class extends Error {
+};
+async function resolveAccount(config3) {
+  if (config3.tenantId !== void 0) return config3.tenantId;
+  const url2 = `${config3.url.replace(/\/$/, "")}/me`;
+  const response = await fetch(url2, { headers: { authorization: `Bearer ${config3.token}` } });
+  if (!response.ok) {
+    throw new Error(
+      `account lookup (GET ${url2}) failed: ${response.status} ${response.statusText}. ` + (response.status === 401 ? "Check the stored token (SUBSEAM_TOKEN or ~/.subseam/token) is valid." : await response.text().catch(() => ""))
+    );
+  }
+  const body2 = await response.json();
+  const orgs = (body2.accounts ?? []).filter((a) => a.kind === "org");
+  if (orgs.length <= 1) return orgs[0]?.accountId ?? null;
+  const listed = orgs.map((a) => `${a.handle ?? "(no handle)"} ${a.accountId}`).join("; ");
+  throw new AccountChoiceError(`this token's account belongs to ${orgs.length} organizations (${listed}). Set SUBSEAM_TENANT to the id of the one this session acts for.`);
+}
+
 // src/discovery-failure.ts
 init_esm_shims();
 var DISCOVERY_FAILURE_TOOL = "subseam_unavailable";
-function discoveryFailureText(url2, reason) {
-  return `subseam is unavailable this session: capability discovery failed, so no subseam tools are mounted. Tried GET ${url2.replace(/\/$/, "")}/capabilities \u2014 ${reason}. Check SUBSEAM_URL is your subseam API URL and that it is reachable, then restart the MCP server.`;
+function discoveryFailureText(url2, reason, path7 = "/capabilities", advice = REACHABILITY_ADVICE) {
+  return `subseam is unavailable this session: capability discovery failed, so no subseam tools are mounted. Tried GET ${url2.replace(/\/$/, "")}${path7} \u2014 ${reason}. ${advice}`;
 }
-function mountDiscoveryFailure(server, url2, reason) {
-  const text = discoveryFailureText(url2, reason);
+var REACHABILITY_ADVICE = "Check SUBSEAM_URL is your subseam API URL and that it is reachable, then restart the MCP server.";
+function mountDiscoveryFailure(server, url2, reason, path7, advice) {
+  const text = discoveryFailureText(url2, reason, path7, advice);
   server.registerTool(DISCOVERY_FAILURE_TOOL, { description: text, inputSchema: {} }, () => ({
     content: [{ type: "text", text }],
     isError: true
@@ -29683,10 +29705,13 @@ init_esm_shims();
 init_esm_shims();
 
 // src/gateway.ts
+function accountHeader(config3) {
+  return config3.tenantId === void 0 ? {} : { [TENANT_HEADER]: config3.tenantId };
+}
 async function fetchEnabledCapabilities(config3) {
   const base = config3.url.replace(/\/$/, "");
   const response = await fetch(`${base}/capabilities`, {
-    headers: { authorization: `Bearer ${config3.token}`, [TENANT_HEADER]: config3.tenantId }
+    headers: { authorization: `Bearer ${config3.token}`, ...accountHeader(config3) }
   });
   if (!response.ok) {
     const detail = await response.text().catch(() => "");
@@ -29706,7 +29731,7 @@ function createGatewayClient(config3) {
         headers: {
           "content-type": "application/json",
           authorization: `Bearer ${config3.token}`,
-          [TENANT_HEADER]: config3.tenantId
+          ...accountHeader(config3)
         },
         body: JSON.stringify(input12)
       });
@@ -30699,10 +30724,11 @@ var input2 = external_exports.object({
   source: external_exports.record(external_exports.unknown()).optional(),
   nlIntent: external_exports.string().min(1).optional(),
   createdBy: external_exports.string().min(1).optional(),
-  // OPTIONAL IN THE SCHEMA, MANDATORY IN EFFECT (the shape `invoke-define-admit-route.ts` takes):
-  // the `source` arm's admission is `authored`, and Core refuses a blank basis with a typed
+  // OPTIONAL IN THE SCHEMA, MANDATORY IN EFFECT ON `source` (the shape `invoke-define-admit-route.ts`
+  // takes): the `source` arm's admission is `authored`, and Core refuses a blank basis with a typed
   // MISSING_BASIS carrying its repair hint. Declaring it required here would trade that named
-  // refusal for a Zod 400 with nothing to act on, and the `dry_run`/`mine` arms need none.
+  // refusal for a Zod 400 with nothing to act on, and the `dry_run`/`mine` arms need none. The
+  // `nlIntent` arm forwards it when given and otherwise cites its own sentence.
   basis: external_exports.string().min(1).optional(),
   dry_run: external_exports.boolean().optional(),
   mine: external_exports.object({
@@ -30714,7 +30740,7 @@ var input2 = external_exports.object({
 });
 var defineTool = {
   name: "define",
-  description: "Write a definition into this tenant's governing corpus. Pass exactly one of `source` (the SDL definition object \u2014 deterministic, no LLM) or `nlIntent` (a natural-language intent, authored through the CEGIS loop), plus `repo` (org-qualified) and optional `commit` (defaults to resolved tip). With `source`, pass `basis` too: free text citing what the definition stood on \u2014 the source doc plus its section (there is no fixed vocabulary). It is required in effect on this arm; an admission that cites nothing is refused. `nlIntent` supplies its own. `dry_run: true` with `source` validates against the live graph and admits NOTHING, returning per-gate errors with repair hints. `dry_run: true` with `source` and no `repo` answers only whether the language can say it (bind, capability and strength are deferred until a repo is named). `mine: {repo}` submits a whole-repo candidate mining pass instead (async \u2014 poll with `mine: {jobId}`). New versions land defaulted until approved. `gap: { construct, witness, issue }` records a construct the language cannot say yet (witness is the file:line that needed it) and admits nothing.",
+  description: "Write a definition into this tenant's governing corpus. Pass exactly one of `source` (the SDL definition object \u2014 deterministic, no LLM) or `nlIntent` (a natural-language intent, authored through the CEGIS loop), plus `repo` (org-qualified) and optional `commit` (defaults to resolved tip). Pass `basis` on either arm: free text citing what the definition stood on \u2014 the source doc plus its section (there is no fixed vocabulary), or `capture-note:<id>` for a captured note, which also marks that note formalized. It is required in effect with `source`; an admission that cites nothing is refused. With `nlIntent` it defaults to the intent sentence. `dry_run: true` with `source` validates against the live graph and admits NOTHING, returning per-gate errors with repair hints. `dry_run: true` with `source` and no `repo` answers only whether the language can say it (bind, capability and strength are deferred until a repo is named). `mine: {repo}` submits a whole-repo candidate mining pass instead (async \u2014 poll with `mine: {jobId}`). New versions land defaulted until approved. `gap: { construct, witness, issue }` records a construct the language cannot say yet (witness is the file:line that needed it) and admits nothing.",
   capability: "define",
   inputSchema: input2.shape,
   async handler(raw, ctx) {
@@ -30763,7 +30789,8 @@ var defineTool = {
         repo: args2.repo,
         nlIntent: args2.nlIntent,
         ...args2.commit !== void 0 ? { commit: args2.commit } : {},
-        ...args2.createdBy !== void 0 ? { createdBy: args2.createdBy } : {}
+        ...args2.createdBy !== void 0 ? { createdBy: args2.createdBy } : {},
+        ...args2.basis !== void 0 ? { basis: args2.basis } : {}
       };
       const wire = await ctx.gateway.invoke("define-author", payload2);
       const body2 = readBody(authorBody, wire, "define", "define-author");
@@ -31591,6 +31618,7 @@ var defineInboxTool = {
 };
 var LABELS = {
   drift: "drift",
+  draft: "draft",
   "refinement-pending": "refinement",
   "snooze-expired": "snooze expired",
   "snooze-expiring": "snooze due",
@@ -31606,6 +31634,8 @@ var HOW = {
   // parsing a number back out of a sentence to put it in a tool call is precisely the guessed
   // content the ruling forbids. So the call is named with the id it does hold and the remaining
   // arguments are stated as arguments the caller supplies.
+  // A first draft is version 1, so the call is complete.
+  draft: (item) => `define_ratify {kind:'ratify-version', definitionId:'${item.id}', version:1, status:'ratified'|'corrected'}`,
   "refinement-pending": (item) => `define_ratify {kind:'ratify-version', definitionId:'${item.id}', version:\u2026, status:'ratified'|'corrected'} \u2014 supply the version shown in this line`,
   // The read shows the alteration, verdict and definition; the adjudication follows it.
   proposal: (item) => `define_proposal_read {taskId:'${item.id}'}, then define_adjudicate {taskId:'${item.id}', decision:'accept'|'reject', reason:\u2026}`
@@ -31981,7 +32011,7 @@ function renderCapture(n) {
   const anchor = onPackage ? `attached to the package holding ${n.path}` : n.anchorKind === "concept" ? `concept ${n.conceptId}` : n.anchorKind === "path" ? `path ${n.path}` : n.anchorKind === "repo" ? `repo ${n.repoId}` : "unanchored";
   const chan = n.channel !== null ? ` [${n.channel}]` : "";
   return `capture: note ${n.id} stored (${anchor})${chan}.
-To draft it as a definition, call \`define\` with this repo as \`repo\`, \`basis: "capture-note:${n.id}"\` and the definition as an SDL \`source\`.`;
+To draft it as a definition, call \`define\` with this repo as \`repo\`, \`basis: "capture-note:${n.id}"\`, and either \`nlIntent\` (the note in your words) or an SDL \`source\`.`;
 }
 
 // ../capture/src/tool/capture-list.ts
@@ -48306,7 +48336,7 @@ var workReadTools = createWorkReadToolProviders({ capability: "work" });
 var bundledProviders = [src_default2, src_default, tension_default, ...defineTools, ...decisionTools, ...captureTools, ...buildTools, secureTool, ...workTools, ...workReadTools];
 
 // package.json
-var version2 = "0.4.1";
+var version2 = "0.4.11";
 
 // src/server.ts
 var SERVER_VERSION = version2;
@@ -48315,9 +48345,20 @@ function selectEntitled(providers, enabled) {
 }
 async function createServer(config3, cwd, initialWorkspaceId) {
   const server = new McpServer({ name: "subseam", version: SERVER_VERSION });
+  let session;
+  try {
+    const account = await resolveAccount(config3);
+    session = { url: config3.url, token: config3.token, tenantId: account ?? void 0 };
+  } catch (err2) {
+    const reason = err2 instanceof Error ? err2.message : String(err2);
+    process.stderr.write(`subseam-mcp: account lookup failed; mounting only ${DISCOVERY_FAILURE_TOOL}. ${reason}
+`);
+    mountDiscoveryFailure(server, config3.url, reason, "/me", err2 instanceof AccountChoiceError ? "Then restart the MCP server." : void 0);
+    return server;
+  }
   let enabled = [];
   try {
-    enabled = await fetchEnabledCapabilities(config3);
+    enabled = await fetchEnabledCapabilities(session);
   } catch (err2) {
     const reason = err2 instanceof Error ? err2.message : String(err2);
     process.stderr.write(
@@ -48328,7 +48369,7 @@ async function createServer(config3, cwd, initialWorkspaceId) {
     return server;
   }
   const providers = bundledProviders.map((p, i) => assertToolProvider(p, `bundled provider [${i}]`));
-  const ctx = { cwd, tenantId: config3.tenantId, gateway: createGatewayClient(config3), enabledCapabilities: enabled, workspace: createWorkspaceBinding(initialWorkspaceId) };
+  const ctx = { cwd, tenantId: session.tenantId ?? null, gateway: createGatewayClient(session), enabledCapabilities: enabled, workspace: createWorkspaceBinding(initialWorkspaceId) };
   mountProviders(server, selectEntitled(providers, enabled), ctx);
   return server;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@subseam/mcp",
-  "version": "0.4.1",
+  "version": "0.4.11",
   "private": false,
   "type": "module",
   "bin": {