@tacitai/mcp-server 0.1.1 → 0.2.0

package/dist/index.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-"use strict";
 // SPDX-License-Identifier: MIT
 /**
  * @tacit/mcp-server — stdio MCP server
@@ -22,54 +21,48 @@
  *   `tacit-mcp-server setup` is reserved for MV-1057h setup wizard.
  *   Currently prints a placeholder message and exits 0.
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-const index_js_1 = require("@modelcontextprotocol/sdk/server/index.js");
-const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");
-const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
-const semver = __importStar(require("semver"));
-const path = __importStar(require("path"));
-const fs = __importStar(require("fs"));
-// Tool handlers
-const search_js_1 = require("./tools/search.js");
-const synthesize_js_1 = require("./tools/synthesize.js");
-const recall_js_1 = require("./tools/recall.js");
-const artifacts_js_1 = require("./tools/artifacts.js");
-const ingest_js_1 = require("./tools/ingest.js");
-// Setup wizard (MV-1057h)
-const setup_js_1 = require("./setup.js");
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import * as semver from 'semver';
+import * as path from 'path';
+import * as fs from 'fs';
+import * as os from 'os';
+import { fileURLToPath } from 'url';
+import { TacitClient, getClient as getModuleClient } from './client.js';
+import { startHttpTransport } from './transport.js';
+// Tool registration modules
+import { registerSearchTools } from './tools/search.js';
+import { registerSynthesizeTools } from './tools/synthesize.js';
+import { registerConverseTools } from './tools/converse.js';
+import { registerConnectorWriteBackTools } from './tools/connector_write_back.js';
+import { registerRecallTools } from './tools/recall.js';
+import { registerArtifactTools } from './tools/artifacts.js';
+import { registerDraftTools } from './tools/drafts.js';
+import { registerIngestTools } from './tools/ingest.js';
+import { registerOutboxTools } from './tools/outbox.js';
+import { registerAnnotationTools } from './tools/annotations.js';
+import { registerExportTools } from './tools/export.js';
+import { registerMoveTools } from './tools/move.js';
+import { registerAgentTools } from './tools/agents.js';
+import { registerPyramidTools } from './tools/pyramid.js';
+import { registerSharingTools } from './tools/sharing.js';
+import { registerKbTools } from './tools/kb.js';
+import { registerLakeTools } from './tools/lake.js';
+import { registerWebUrlTools } from './tools/web-url.js';
+import { registerWorkspaceTools } from './tools/workspaces.js';
+import { registerChronicleTools } from './tools/chronicle.js';
+import { registerCrewTools } from './tools/crews.js';
+import { registerPeopleTools } from './tools/people.js';
+import { registerLakeStructureTools } from './tools/lake-structure.js';
+import { registerResearchTools } from './tools/research.js';
+import { registerGmTools } from './tools/gm.js';
+import { registerPrompts } from './prompts.js';
+import { getRequestPrincipal } from './client.js';
+// Setup wizard (MV-1057h / W5)
+import { setup, profileToEnvVar } from './setup.js';
+// ─── ESM __dirname replacement ───────────────────────────────────────────────
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
 // ─── Compatibility guard ──────────────────────────────────────────────────────
 function checkCompatibility() {
     const pkgPath = path.join(__dirname, '..', 'package.json');
@@ -78,13 +71,11 @@ function checkCompatibility() {
         pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
     }
     catch {
-        // Non-fatal if package.json cannot be read at runtime.
         return;
     }
     const compat = pkg['compatibility'];
     const coreArtifactRange = compat?.['coreArtifact'];
     if (typeof coreArtifactRange === 'string') {
-        // Print range for oracle D4 grep.
         process.stderr.write(`COMPAT_RANGE: ${coreArtifactRange}\n`);
         const coreVersion = process.env['TACIT_CORE_VERSION'];
         if (coreVersion) {
@@ -97,69 +88,100 @@ function checkCompatibility() {
         }
     }
 }
-// ─── Tool registry ────────────────────────────────────────────────────────────
-const TOOLS = [
-    search_js_1.SEARCH_TOOL_DEF,
-    synthesize_js_1.SYNTHESIZE_TOOL_DEF,
-    recall_js_1.RECALL_TOOL_DEF,
-    artifacts_js_1.ARTIFACT_LIST_TOOL_DEF,
-    artifacts_js_1.ARTIFACT_CREATE_TOOL_DEF,
-    artifacts_js_1.ARTIFACT_UPDATE_TOOL_DEF,
-    artifacts_js_1.ARTIFACT_PUBLISH_TOOL_DEF,
-    ingest_js_1.INGEST_FILE_TOOL_DEF,
-    ingest_js_1.INGEST_URL_TOOL_DEF,
-];
-async function dispatchTool(name, args) {
-    switch (name) {
-        case 'tacit_search':
-            return (0, search_js_1.handleSearch)(args);
-        case 'tacit_synthesize':
-        case 'tacit_ask':
-        case 'tacit_compose':
-            return (0, synthesize_js_1.handleSynthesize)(args);
-        case 'tacit_recall':
-            return (0, recall_js_1.handleRecall)(args);
-        case 'tacit_artifact_list':
-            return (0, artifacts_js_1.handleArtifactList)(args);
-        case 'tacit_artifact_create':
-            return (0, artifacts_js_1.handleArtifactCreate)(args);
-        case 'tacit_artifact_update':
-            return (0, artifacts_js_1.handleArtifactUpdate)(args);
-        case 'tacit_artifact_publish':
-            return (0, artifacts_js_1.handleArtifactPublish)(args);
-        case 'tacit_ingest_file':
-            return (0, ingest_js_1.handleIngestFile)(args);
-        case 'tacit_ingest_url':
-            return (0, ingest_js_1.handleIngestUrl)(args);
-        default:
-            return {
-                content: [{ type: 'text', text: `Unknown tool: ${name}` }],
-                isError: true,
-            };
+// ─── Profile helpers ──────────────────────────────────────────────────────────
+function parseProfile(argv) {
+    for (let i = 0; i < argv.length; i++) {
+        if (argv[i] === '--profile' && argv[i + 1] && !argv[i + 1].startsWith('--')) {
+            return argv[i + 1];
+        }
+    }
+    return 'tacit';
+}
+function checkProfileExpiry(profile) {
+    const metaPath = path.join(os.homedir(), '.tacit', 'profiles', `${profile}.json`);
+    if (!fs.existsSync(metaPath)) {
+        return;
+    }
+    let meta;
+    try {
+        meta = JSON.parse(fs.readFileSync(metaPath, 'utf-8'));
+    }
+    catch {
+        return;
+    }
+    const expiresAt = typeof meta['expires_at'] === 'string' ? meta['expires_at'] : null;
+    if (!expiresAt)
+        return;
+    const expiresMs = Date.parse(expiresAt);
+    if (Number.isNaN(expiresMs))
+        return;
+    const nowMs = Date.now();
+    const diffDays = Math.floor((expiresMs - nowMs) / (1000 * 60 * 60 * 24));
+    if (diffDays < 14) {
+        const apiUrl = typeof meta['api_url'] === 'string' ? meta['api_url'] : 'https://beta.tacitai.app';
+        process.stderr.write(`[TACIT] Developer token expires in ${diffDays} day${diffDays === 1 ? '' : 's'}. ` +
+            `Run: npx @tacitai/mcp-server setup --api-url ${apiUrl}\n`);
     }
 }
 // ─── Main ─────────────────────────────────────────────────────────────────────
 async function run() {
-    // Handle setup subcommand before starting stdio transport (MV-1057h).
     if (process.argv[2] === 'setup') {
-        await (0, setup_js_1.setup)(process.argv.slice(3));
+        await setup(process.argv.slice(3));
         return;
     }
-    // Compatibility guard — exits non-zero on version mismatch.
+    const profile = parseProfile(process.argv.slice(2));
+    const envVarName = profileToEnvVar(profile);
+    if (envVarName !== 'TACIT_TOKEN' && process.env[envVarName] && !process.env['TACIT_TOKEN']) {
+        process.env['TACIT_TOKEN'] = process.env[envVarName];
+    }
+    checkProfileExpiry(profile);
     checkCompatibility();
-    const server = new index_js_1.Server({ name: '@tacitai/mcp-server', version: '0.1.0' }, { capabilities: { tools: {} } });
-    // tools/list
-    server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => ({
-        tools: TOOLS,
-    }));
-    // tools/call
-    server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
-        const { name, arguments: args } = request.params;
-        const result = await dispatchTool(name, args ?? {});
-        return result;
-    });
-    // Wire stdio transport — NOT an HTTP server (D-4/D-10).
-    const transport = new stdio_js_1.StdioServerTransport();
+    const server = new McpServer({ name: '@tacitai/mcp-server', version: '0.2.0' }, { capabilities: { tools: {}, prompts: {} } });
+    const isHttpMode = process.env['MCP_TRANSPORT'] === 'http';
+    let clientInstance = null;
+    const getClient = async () => {
+        if (isHttpMode) {
+            // Per-request client via AsyncLocalStorage (caller's token)
+            return getModuleClient();
+        }
+        if (!clientInstance) {
+            clientInstance = new TacitClient();
+            await clientInstance.initialize();
+        }
+        return clientInstance;
+    };
+    // Register all tool modules
+    registerSearchTools(server, getClient);
+    registerSynthesizeTools(server, getClient);
+    registerConverseTools(server, getClient);
+    registerConnectorWriteBackTools(server, getClient);
+    registerRecallTools(server, getClient);
+    registerArtifactTools(server, getClient);
+    registerDraftTools(server, getClient);
+    registerIngestTools(server, getClient);
+    registerOutboxTools(server);
+    registerAnnotationTools(server, getClient);
+    registerExportTools(server, getClient);
+    registerMoveTools(server, getClient);
+    registerAgentTools(server, getClient);
+    registerPyramidTools(server, getClient);
+    registerSharingTools(server, getClient);
+    registerKbTools(server, getClient);
+    registerLakeTools(server, getClient);
+    registerWebUrlTools(server);
+    registerWorkspaceTools(server, getClient);
+    registerChronicleTools(server, getClient);
+    registerCrewTools(server, getClient);
+    registerPeopleTools(server, getClient);
+    registerLakeStructureTools(server, getClient);
+    registerGmTools(server, getClient);
+    registerResearchTools(server, getClient, getRequestPrincipal);
+    registerPrompts(server);
+    if (process.env['MCP_TRANSPORT'] === 'http') {
+        await startHttpTransport(server);
+        return;
+    }
+    const transport = new StdioServerTransport();
     await server.connect(transport);
 }
 run().catch((err) => {

package/dist/oauth.d.ts

@@ -0,0 +1,115 @@
+/**
+ * OAuth 2.0 Authorization Server for MCP (FEAT-176).
+ *
+ * Authorization code flow with PKCE S256. In-memory stores for auth codes
+ * and access tokens — process restart voids all grants.
+ *
+ * Security invariants:
+ *  - PINs, auth codes, and token values are NEVER logged.
+ *  - OAuth path NEVER falls back to process.env.TACIT_TOKEN.
+ *  - Unknown client_id → 400 (never redirect to unregistered URI).
+ *  - code_challenge_method must be S256 (plain rejected).
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+export interface OAuthClient {
+    client_id: string;
+    client_secret?: string;
+    redirect_uris: string[];
+    client_name: string;
+}
+export interface OAuthTokenInfo {
+    user_email: string;
+    workspace_id: string;
+    tacit_token: string;
+    client_id: string;
+}
+interface AuthCodeEntry {
+    client_id: string;
+    redirect_uri: string;
+    code_challenge: string;
+    user_email: string;
+    workspace_id: string;
+    tacit_token: string;
+    state: string;
+    created_at: number;
+}
+interface CsrfEntry {
+    created_at: number;
+    client_id: string;
+    redirect_uri: string;
+    code_challenge: string;
+    code_challenge_method: string;
+    state: string;
+    scope: string;
+}
+export declare function getTokenTtlSeconds(): number;
+export declare function isOAuthEnabled(): boolean;
+export declare function getRegisteredClients(): OAuthClient[];
+export declare function resetClientRegistry(): void;
+export declare function findClient(client_id: string): OAuthClient | undefined;
+export declare function validateRedirectUri(client: OAuthClient, redirect_uri: string): boolean;
+export declare function registerDynamicClient(params: {
+    redirect_uris: string[];
+    client_name?: string;
+    token_endpoint_auth_method?: string;
+}): {
+    client_id: string;
+    client_secret: string;
+    client_id_issued_at: number;
+    redirect_uris: string[];
+    client_name: string;
+    token_endpoint_auth_method: string;
+};
+export declare function issueAuthCode(params: {
+    client_id: string;
+    redirect_uri: string;
+    code_challenge: string;
+    user_email: string;
+    workspace_id: string;
+    tacit_token: string;
+    state: string;
+}): string;
+export declare function consumeAuthCode(code: string): AuthCodeEntry | null;
+export declare function issueAccessToken(params: {
+    client_id: string;
+    user_email: string;
+    workspace_id: string;
+    tacit_token: string;
+}): {
+    access_token: string;
+    expires_in: number;
+};
+export declare function validateOAuthToken(token: string): OAuthTokenInfo | null;
+export declare function verifyPkce(code_verifier: string, code_challenge: string): boolean;
+export declare function generateCsrfToken(params: {
+    client_id: string;
+    redirect_uri: string;
+    code_challenge: string;
+    code_challenge_method: string;
+    state: string;
+    scope: string;
+}): string;
+export declare function consumeCsrfToken(token: string): CsrfEntry | null;
+export declare function checkLoginRateLimit(email: string): boolean;
+export declare function getAuthorizationServerMetadata(issuer: string): Record<string, unknown>;
+export declare function getProtectedResourceMetadata(resource: string, issuer: string): Record<string, unknown>;
+export declare function renderLoginPage(params: {
+    client_name: string;
+    csrf_token: string;
+    error?: string;
+}): string;
+export declare function handleAuthorizeGet(req: IncomingMessage, res: ServerResponse): Promise<void>;
+export declare function handleAuthorizePost(req: IncomingMessage, res: ServerResponse, apiUrl: string): Promise<void>;
+export declare function handleTokenExchange(req: IncomingMessage, res: ServerResponse): Promise<void>;
+export declare function handleClientRegistration(req: IncomingMessage, res: ServerResponse): Promise<void>;
+export declare function handleDiscovery(res: ServerResponse, issuer: string): void;
+export declare function handleProtectedResource(res: ServerResponse, resource: string, issuer: string): void;
+export declare function startCleanupInterval(): void;
+export declare function stopCleanupInterval(): void;
+export declare function _testClearStores(): void;
+export declare function _testGetStoreSize(): {
+    codes: number;
+    tokens: number;
+    csrf: number;
+};
+export {};