@subseam/mcp 0.4.2 → 0.4.12

package/README.md

@@ -12,9 +12,8 @@ and the rest. It runs on your machine and talks to the subseam service over HTTP
 ## What you need
 
 - Node.js 22 or later, and npm.
-- A GitHub account, and a subseam organization that someone has added you to. The org's owner
-  gives you its id (a UUID); that is your **tenant id**.
-- The subseam API URL: `https://subseam.theconstructory.com/api`.
+- A GitHub account, and a subseam organization that someone has added you to.
+- The subseam API URL: `https://subseam.theconstructory.com/subseam`.
 
 ## 1. Sign in
 
@@ -37,12 +36,13 @@ S='<the cookie value>'; C=$(openssl rand -hex 16)
 mkdir -p ~/.subseam && curl -s -X POST https://subseam.theconstructory.com/tokens \
   -H "cookie: __Host-subseam_session=$S; subseam_csrf=$C" -H "x-csrf-token: $C" \
   -H 'content-type: application/json' -d '{"label":"my-machine"}' \
-  | node -e 'process.stdin.on("data",d=>process.stdout.write(JSON.parse(d).token))' > ~/.subseam/token
+  | node -e 'let b="";process.stdin.on("data",d=>b+=d).on("end",()=>{let t;try{t=JSON.parse(b).token}catch{}if(typeof t==="string")process.stdout.write(t);else{console.error("subseam refused the token request: "+b);process.exit(1)}})' > ~/.subseam/token
 chmod 600 ~/.subseam/token
 ```
 
-`~/.subseam/token` now holds one line starting `cpt_`. If it is empty, the session cookie was
-wrong or expired: sign in again and repeat. The server also accepts the token in the
+`~/.subseam/token` now holds one line starting `cpt_`. If the command prints "subseam refused the
+token request" with the server's answer, the session cookie was wrong or expired: sign in again and
+repeat. The server also accepts the token in the
 `SUBSEAM_TOKEN` environment variable instead of the file.
 
 ## 3. Install
@@ -54,15 +54,19 @@ npm install @subseam/mcp
 
 ## 4. Register it with your agent
 
-For Claude Code, with your tenant id in place of `<tenant id>`:
+For Claude Code:
 
 ```
-claude mcp add-json --scope user subseam '{"command":"node","args":["'"$HOME"'/.subseam/mcp/node_modules/@subseam/mcp/dist/main.js"],"env":{"SUBSEAM_URL":"https://subseam.theconstructory.com/api","SUBSEAM_TENANT":"<tenant id>"}}'
+claude mcp add-json --scope user subseam '{"command":"node","args":["'"$HOME"'/.subseam/mcp/node_modules/@subseam/mcp/dist/main.js"],"env":{"SUBSEAM_URL":"https://subseam.theconstructory.com/subseam"}}'
 ```
 
 `claude mcp list` should show `subseam ... Connected`. Any other MCP host: run
-`node ~/.subseam/mcp/node_modules/@subseam/mcp/dist/main.js` over stdio with the same two
-environment variables.
+`node ~/.subseam/mcp/node_modules/@subseam/mcp/dist/main.js` over stdio with the same
+environment.
+
+The server acts for your organization. If you belong to several, it mounts only
+`subseam_unavailable`, which lists each one's name and id: add `"SUBSEAM_TENANT":"<id>"` to the
+`env` above for the one this agent works in.
 
 ## 5. Check it works
 

package/dist/main.js

@@ -24036,10 +24036,11 @@ function requireEnv(env, name, purpose) {
 function loadConfig2(env = process.env, sources = realTokenSources()) {
   return Object.freeze({
     get url() {
-      return requireEnv(env, "SUBSEAM_URL", "to reach the hosted service, e.g. https://app.subseam.dev");
+      return requireEnv(env, "SUBSEAM_URL", "to reach the hosted service, e.g. https://subseam.theconstructory.com/subseam");
     },
     get tenantId() {
-      return requireEnv(env, "SUBSEAM_TENANT", "as the organization id the channel acts for (a UUID)");
+      const value = env["SUBSEAM_TENANT"];
+      return value === void 0 || value === "" ? void 0 : value;
     },
     get token() {
       return resolveTenantToken(sources);
@@ -28203,14 +28204,35 @@ async function requireRepo(env, readOrigin2) {
   throw new Error(`SUBSEAM_REPO unset; git remote origin = ${seen} did not parse as owner/name`);
 }
 
+// src/account.ts
+init_esm_shims();
+var AccountChoiceError = class extends Error {
+};
+async function resolveAccount(config3) {
+  if (config3.tenantId !== void 0) return config3.tenantId;
+  const url2 = `${config3.url.replace(/\/$/, "")}/me`;
+  const response = await fetch(url2, { headers: { authorization: `Bearer ${config3.token}` } });
+  if (!response.ok) {
+    throw new Error(
+      `account lookup (GET ${url2}) failed: ${response.status} ${response.statusText}. ` + (response.status === 401 ? "Check the stored token (SUBSEAM_TOKEN or ~/.subseam/token) is valid." : await response.text().catch(() => ""))
+    );
+  }
+  const body2 = await response.json();
+  const orgs = (body2.accounts ?? []).filter((a) => a.kind === "org");
+  if (orgs.length <= 1) return orgs[0]?.accountId ?? null;
+  const listed = orgs.map((a) => `${a.handle ?? "(no handle)"} ${a.accountId}`).join("; ");
+  throw new AccountChoiceError(`this token's account belongs to ${orgs.length} organizations (${listed}). Set SUBSEAM_TENANT to the id of the one this session acts for.`);
+}
+
 // src/discovery-failure.ts
 init_esm_shims();
 var DISCOVERY_FAILURE_TOOL = "subseam_unavailable";
-function discoveryFailureText(url2, reason) {
-  return `subseam is unavailable this session: capability discovery failed, so no subseam tools are mounted. Tried GET ${url2.replace(/\/$/, "")}/capabilities \u2014 ${reason}. Check SUBSEAM_URL is your subseam API URL and that it is reachable, then restart the MCP server.`;
+function discoveryFailureText(url2, reason, path7 = "/capabilities", advice = REACHABILITY_ADVICE) {
+  return `subseam is unavailable this session: capability discovery failed, so no subseam tools are mounted. Tried GET ${url2.replace(/\/$/, "")}${path7} \u2014 ${reason}. ${advice}`;
 }
-function mountDiscoveryFailure(server, url2, reason) {
-  const text = discoveryFailureText(url2, reason);
+var REACHABILITY_ADVICE = "Check SUBSEAM_URL is your subseam API URL and that it is reachable, then restart the MCP server.";
+function mountDiscoveryFailure(server, url2, reason, path7, advice) {
+  const text = discoveryFailureText(url2, reason, path7, advice);
   server.registerTool(DISCOVERY_FAILURE_TOOL, { description: text, inputSchema: {} }, () => ({
     content: [{ type: "text", text }],
     isError: true
@@ -29683,10 +29705,13 @@ init_esm_shims();
 init_esm_shims();
 
 // src/gateway.ts
+function accountHeader(config3) {
+  return config3.tenantId === void 0 ? {} : { [TENANT_HEADER]: config3.tenantId };
+}
 async function fetchEnabledCapabilities(config3) {
   const base = config3.url.replace(/\/$/, "");
   const response = await fetch(`${base}/capabilities`, {
-    headers: { authorization: `Bearer ${config3.token}`, [TENANT_HEADER]: config3.tenantId }
+    headers: { authorization: `Bearer ${config3.token}`, ...accountHeader(config3) }
   });
   if (!response.ok) {
     const detail = await response.text().catch(() => "");
@@ -29706,7 +29731,7 @@ function createGatewayClient(config3) {
         headers: {
           "content-type": "application/json",
           authorization: `Bearer ${config3.token}`,
-          [TENANT_HEADER]: config3.tenantId
+          ...accountHeader(config3)
         },
         body: JSON.stringify(input12)
       });
@@ -48311,7 +48336,7 @@ var workReadTools = createWorkReadToolProviders({ capability: "work" });
 var bundledProviders = [src_default2, src_default, tension_default, ...defineTools, ...decisionTools, ...captureTools, ...buildTools, secureTool, ...workTools, ...workReadTools];
 
 // package.json
-var version2 = "0.4.2";
+var version2 = "0.4.12";
 
 // src/server.ts
 var SERVER_VERSION = version2;
@@ -48320,9 +48345,20 @@ function selectEntitled(providers, enabled) {
 }
 async function createServer(config3, cwd, initialWorkspaceId) {
   const server = new McpServer({ name: "subseam", version: SERVER_VERSION });
+  let session;
+  try {
+    const account = await resolveAccount(config3);
+    session = { url: config3.url, token: config3.token, tenantId: account ?? void 0 };
+  } catch (err2) {
+    const reason = err2 instanceof Error ? err2.message : String(err2);
+    process.stderr.write(`subseam-mcp: account lookup failed; mounting only ${DISCOVERY_FAILURE_TOOL}. ${reason}
+`);
+    mountDiscoveryFailure(server, config3.url, reason, "/me", err2 instanceof AccountChoiceError ? "Then restart the MCP server." : void 0);
+    return server;
+  }
   let enabled = [];
   try {
-    enabled = await fetchEnabledCapabilities(config3);
+    enabled = await fetchEnabledCapabilities(session);
   } catch (err2) {
     const reason = err2 instanceof Error ? err2.message : String(err2);
     process.stderr.write(
@@ -48333,7 +48369,7 @@ async function createServer(config3, cwd, initialWorkspaceId) {
     return server;
   }
   const providers = bundledProviders.map((p, i) => assertToolProvider(p, `bundled provider [${i}]`));
-  const ctx = { cwd, tenantId: config3.tenantId, gateway: createGatewayClient(config3), enabledCapabilities: enabled, workspace: createWorkspaceBinding(initialWorkspaceId) };
+  const ctx = { cwd, tenantId: session.tenantId ?? null, gateway: createGatewayClient(session), enabledCapabilities: enabled, workspace: createWorkspaceBinding(initialWorkspaceId) };
   mountProviders(server, selectEntitled(providers, enabled), ctx);
   return server;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@subseam/mcp",
-  "version": "0.4.2",
+  "version": "0.4.12",
   "private": false,
   "type": "module",
   "bin": {