@tacitai/mcp-server 0.3.1 → 0.3.2

package/dist/setup.d.ts

@@ -6,10 +6,13 @@
  *
  * Contract (§2.1 of sparc_specification.md, Phase-2 QE resolutions + W5 device-auth):
  *   F1 smoke   — calls tacit_synthesize via getClient()/postSSE; exits non-zero on empty/error.
- *   F2 env-ref — writes TACIT_TOKEN_* as the LITERAL placeholder "${TACIT_TOKEN_*}" (never the real value).
+ *   F2 token   — when token is obtained (device-auth or --token), writes it directly to mcp.json
+ *                (file is 0600). Falls back to env-var placeholder "${TACIT_TOKEN_*}" when token
+ *                came from the environment.
  *   Merge      — deep-merges ONLY mcpServers[profile]; all other keys preserved.
  *   Idempotent — same --api-url + --profile → byte-identical mcp.json.
- *   Secrets    — token NEVER written to any output stream.
+ *   Secrets    — token written to mcp.json (0600) when obtained via device-auth or --token;
+ *                NEVER printed to stdout/stderr (dry-run output is redacted).
  *
  * W5 additions:
  *   --profile <name>  — profile name (default: 'tacit'); drives env-var name + mcp.json key.

package/dist/setup.js

@@ -7,10 +7,13 @@
  *
  * Contract (§2.1 of sparc_specification.md, Phase-2 QE resolutions + W5 device-auth):
  *   F1 smoke   — calls tacit_synthesize via getClient()/postSSE; exits non-zero on empty/error.
- *   F2 env-ref — writes TACIT_TOKEN_* as the LITERAL placeholder "${TACIT_TOKEN_*}" (never the real value).
+ *   F2 token   — when token is obtained (device-auth or --token), writes it directly to mcp.json
+ *                (file is 0600). Falls back to env-var placeholder "${TACIT_TOKEN_*}" when token
+ *                came from the environment.
  *   Merge      — deep-merges ONLY mcpServers[profile]; all other keys preserved.
  *   Idempotent — same --api-url + --profile → byte-identical mcp.json.
- *   Secrets    — token NEVER written to any output stream.
+ *   Secrets    — token written to mcp.json (0600) when obtained via device-auth or --token;
+ *                NEVER printed to stdout/stderr (dry-run output is redacted).
  *
  * W5 additions:
  *   --profile <name>  — profile name (default: 'tacit'); drives env-var name + mcp.json key.
@@ -128,16 +131,19 @@ function readExistingConfig() {
 }
 /**
  * Build the MCP server entry for a given profile.
- * The env-var placeholder is the LITERAL string "${TACIT_TOKEN_*}" — never the real value.
+ *
+ * When `token` is provided (device-auth or --token), the actual token is written
+ * to mcp.json so the user doesn't need to set an env var. mcp.json is written
+ * with mode 0600 (owner-only), consistent with how CLI tools store auth tokens
+ * (e.g. ~/.npmrc). When `token` is null, the env-var placeholder is written
+ * so Claude Code expands ${VAR} at launch.
  */
-function buildProfileEntry(apiUrl, envVarName) {
+function buildProfileEntry(apiUrl, envVarName, token) {
     return {
         command: 'npx',
         args: ['-y', '@tacitai/mcp-server'],
         env: {
-            // F2: literal placeholder — Claude Code expands ${VAR} at launch; real token NEVER on disk.
-            [envVarName]: `\${${envVarName}}`,
-            // TACIT_API_URL is a non-secret URL; written as-is.
+            TACIT_TOKEN: token ?? `\${${envVarName}}`,
             TACIT_API_URL: apiUrl,
         },
     };
@@ -380,15 +386,22 @@ export async function setup(argv) {
     }
     // Final env-var name derived from (possibly updated) profile.
     const envVarName = profileToEnvVar(profile);
-    const profileEntry = buildProfileEntry(apiUrl, envVarName);
+    // Pass the actual token when we have it (device-auth or --token);
+    // fall back to env-var placeholder when the token came from the environment.
+    const resolvedToken = token ?? null;
+    const profileEntry = buildProfileEntry(apiUrl, envVarName, resolvedToken);
     const existing = readExistingConfig();
     const merged = mergeConfig(existing, profile, profileEntry);
     const output = configToBytes(merged);
     // D10: emit confirmation string BEFORE writing (also printed in dry-run).
     process.stdout.write(`Writing tacit entry to ~/.claude/mcp.json (profile: ${profile})...\n`);
     if (opts.dryRun) {
+        // Redact any literal token in dry-run preview to avoid leaking secrets to stdout.
+        const redacted = resolvedToken
+            ? configToBytes(mergeConfig(existing, profile, buildProfileEntry(apiUrl, envVarName, null)))
+            : output;
         process.stdout.write('(dry-run) Would write:\n');
-        process.stdout.write(output);
+        process.stdout.write(redacted);
         process.exit(0);
         return;
     }
@@ -399,16 +412,21 @@ export async function setup(argv) {
     }
     const dest = mcpJsonPath();
     fs.writeFileSync(dest, output, { encoding: 'utf-8', mode: 0o600 });
+    // Ensure 0600 even when the file pre-existed with looser permissions.
+    fs.chmodSync(dest, 0o600);
     // AC-12: write ~/.tacit/profiles/<profile>.json metadata (token NOT included).
     if (expiresAt) {
         writeProfileMetadata(profile, expiresAt, apiUrl);
     }
-    // AC-11: print export snippet to stdout so user can set the env var.
-    // Token itself is NOT printed here — user must have received it through the device flow.
-    process.stdout.write(`\nSetup complete. Add this to your shell profile:\n` +
-        `  export ${envVarName}=<your-token>\n` +
-        `\nOr for this session:\n` +
-        `  export ${envVarName}=<your-token>\n`);
+    if (resolvedToken) {
+        process.stdout.write(`\nSetup complete. Your token has been saved to ~/.claude/mcp.json.\n` +
+            `Start a new Claude Code session to connect.\n`);
+    }
+    else {
+        process.stdout.write(`\nSetup complete. Add this to your shell profile:\n` +
+            `  export ${envVarName}=<your-token>\n` +
+            `\nThen start a new Claude Code session to connect.\n`);
+    }
     if (opts.smoke) {
         await runSmoke(apiUrl, token);
         // runSmoke calls process.exit internally; return here for type safety.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tacitai/mcp-server",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "stdio MCP server wrapping Tacit /api/v1 REST/SSE API",
   "license": "MIT",
   "repository": {