@tacitai/mcp-server 0.4.0 → 0.6.0

package/dist/prompts.js

@@ -1,10 +1,51 @@
 // SPDX-License-Identifier: MIT
 import { z } from 'zod';
-const ASSISTANT_SYSTEM_PROMPT = "You are TACIT's workspace assistant. Answer from the user's workspace through TACIT tools. " +
+const ASSISTANT_SYSTEM_PROMPT_STATIC = "You are TACIT's workspace assistant. Answer from the user's workspace through TACIT tools. " +
     'Prefer a single read tool for direct lookups, synthesis for open questions, and ask before any write or dispatch.';
 function userText(text) {
     return { messages: [{ role: 'user', content: { type: 'text', text } }] };
 }
+function buildAssistantSystemPrompt(state) {
+    const name = state?.name || 'this workspace';
+    const lines = [];
+    lines.push(`You are the workspace assistant for ${name}. You help the team find, organize, and act on their business knowledge through natural language.`);
+    lines.push('');
+    lines.push('## Your personality');
+    lines.push('');
+    lines.push(`- Warm but direct. You know ${name} well and you are here to help.`);
+    lines.push('- Refer to the workspace by name. When citing answers, name the collection or source they came from.');
+    lines.push('- Never list tool names, API endpoints, or technical identifiers. Translate everything into plain language.');
+    lines.push('- Celebrate when something works — say which collection or source an answer came from rather than returning a silent result.');
+    lines.push('');
+    lines.push('## How you work');
+    lines.push('');
+    lines.push('- Questions about the business → search and synthesize from workspace knowledge, always citing sources.');
+    lines.push('- Requests to add content → ingest URLs, files, or text into the workspace.');
+    lines.push('- Organizing work → create collections, portfolios, programs, dossiers — whatever structure the user describes.');
+    lines.push('- Daily operations → morning briefs (with email triage and Slack synthesis when connected), meeting prep, draft replies.');
+    lines.push('- Business workflows → sales proposals, research and publishing, audits, weekly reviews.');
+    lines.push('- Delegation → dispatch crews for complex deliverables; nothing executes without the user\'s approval.');
+    lines.push('');
+    lines.push('## Progressive disclosure');
+    lines.push('');
+    lines.push('Introduce capabilities as they become relevant, not all at once. A user asking their first question does not need to hear about crew delegation. A user building their third report is ready to learn about voice profiles.');
+    lines.push('');
+    lines.push('When suggesting what to try next, frame it around what they just accomplished:');
+    lines.push('- After their first search: "Now that you have seen what is here — want to add something new?"');
+    lines.push('- After ingesting content: "Good — that is in your workspace now. Want to organize it into a collection?"');
+    lines.push('- After connecting tools: "Your Slack and email are flowing in. Try asking for a morning brief."');
+    lines.push('');
+    lines.push('## Safety');
+    lines.push('');
+    lines.push('- Never modify or delete content without explicit approval.');
+    lines.push('- Crew tasks require the user to approve before execution.');
+    lines.push('- When unsure about a destructive action, ask first.');
+    lines.push('');
+    lines.push('## Technical routing');
+    lines.push('');
+    lines.push('Prefer a single read tool for direct lookups, synthesis for open questions, and ask before any write or dispatch.');
+    return lines.join('\n');
+}
 async function fetchWorkspaceState(client) {
     await client.initialize();
     const wsName = client.workspaceName || 'your workspace';
@@ -63,7 +104,19 @@ const EXPERIENCES = [
     { id: 'operating_rhythm', num: 9, name: 'Your Operating Rhythm', tier: 3, tierName: 'Agentic Mastery', action: 'Set up weekly reviews, delegate recurring work to crews, and build your voice profile.', signal: 'Return for second session with intent; establish a routine' },
 ];
 export function registerPrompts(server, getClientFn) {
-    server.prompt('assistant_system', 'System prompt for the TACIT workspace assistant.', () => userText(ASSISTANT_SYSTEM_PROMPT));
+    server.prompt('assistant_system', 'System prompt for the TACIT workspace assistant — includes persona, progressive disclosure, and safety rules.', async () => {
+        if (getClientFn) {
+            try {
+                const client = await getClientFn();
+                const state = await fetchWorkspaceState(client);
+                return userText(buildAssistantSystemPrompt(state));
+            }
+            catch {
+                // fall through to static prompt
+            }
+        }
+        return userText(ASSISTANT_SYSTEM_PROMPT_STATIC);
+    });
     server.prompt('lookup', 'Fetch a specific item or list using a single TACIT read tool.', { request: z.string().describe('What to look up, e.g. "list programs"') }, ({ request }) => userText(`Use exactly one TACIT read tool to answer, without synthesis. Request: ${request}`));
     server.prompt('synthesis', 'Answer a question with grounded synthesis and citations.', { question: z.string().describe('The question to answer') }, ({ question }) => userText(`Call tacit_synthesize for this question and cite the sources it returns. Question: ${question}`));
     if (!getClientFn)

package/dist/setup.js

@@ -33,6 +33,7 @@ import * as path from 'path';
 import * as os from 'os';
 import * as http from 'http';
 import * as crypto from 'crypto';
+import * as readline from 'readline';
 import { execFile } from 'child_process';
 import { TacitClient, TacitApiError } from './client.js';
 function parseArgs(argv) {
@@ -314,6 +315,81 @@ async function deviceAuthFlow(apiUrl) {
         });
     });
 }
+function prompt(question, hidden = false) {
+    return new Promise((resolve) => {
+        const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+        if (hidden && process.stdin.isTTY) {
+            process.stderr.write(question);
+            const stdin = process.stdin;
+            stdin.setRawMode(true);
+            stdin.resume();
+            stdin.setEncoding('utf-8');
+            let input = '';
+            const onData = (ch) => {
+                if (ch === '\n' || ch === '\r' || ch === '\u0004') {
+                    stdin.setRawMode(false);
+                    stdin.pause();
+                    stdin.removeListener('data', onData);
+                    rl.close();
+                    process.stderr.write('\n');
+                    resolve(input);
+                }
+                else if (ch === '\u007F' || ch === '\b') {
+                    if (input.length > 0)
+                        input = input.slice(0, -1);
+                }
+                else if (ch === '\u0003') {
+                    process.exit(1);
+                }
+                else {
+                    input += ch;
+                }
+            };
+            stdin.on('data', onData);
+        }
+        else {
+            rl.question(question, (answer) => {
+                rl.close();
+                resolve(answer.trim());
+            });
+        }
+    });
+}
+async function loginFlow(apiUrl) {
+    process.stderr.write('\n  Log in with your TACIT credentials.\n\n');
+    const email = await prompt('  Email: ');
+    const pin = await prompt('  PIN:   ', true);
+    if (!email || !pin) {
+        process.stderr.write('Error: email and PIN are required.\n');
+        process.exit(1);
+    }
+    const loginUrl = apiUrl.endsWith('/api/v1')
+        ? `${apiUrl}/auth/login`
+        : `${apiUrl}/api/v1/auth/login`;
+    const res = await fetch(loginUrl, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email, pin }),
+    });
+    if (!res.ok) {
+        const body = await res.text().catch(() => '');
+        if (res.status === 401) {
+            process.stderr.write('\n  Login failed — check your email and PIN.\n');
+        }
+        else {
+            process.stderr.write(`\n  Login failed (${res.status}): ${body}\n`);
+        }
+        process.exit(1);
+    }
+    const data = await res.json();
+    const token = typeof data['session_token'] === 'string' ? data['session_token'] : '';
+    const workspaceName = typeof data['workspace_name'] === 'string' ? data['workspace_name'] : '';
+    if (!token) {
+        process.stderr.write('Error: login returned no session token.\n');
+        process.exit(1);
+    }
+    return { token, workspaceName };
+}
 // ─── Smoke synthesis ──────────────────────────────────────────────────────────
 const SMOKE_QUERY = 'What is in this knowledge base?';
 async function runSmoke(apiUrl, token) {
@@ -348,15 +424,8 @@ async function runSmoke(apiUrl, token) {
 // ─── Main export ──────────────────────────────────────────────────────────────
 export async function setup(argv) {
     const opts = parseArgs(argv);
-    // Resolve api-url: flag > env.
-    const apiUrl = opts.apiUrl ?? process.env['TACIT_API_URL'] ?? null;
-    if (!apiUrl) {
-        process.stderr.write('Error: no API URL configured.\n' +
-            'Provide --api-url <url> or set TACIT_API_URL environment variable.\n' +
-            'Example: npx @tacitai/mcp-server setup --api-url https://tacit-beta-prod.fly.dev --token <your-token>\n' +
-            '\nGet your token from: https://beta.tacitai.app → Settings → Bearer token\n');
-        process.exit(1);
-    }
+    // Resolve api-url: flag > env > default.
+    const apiUrl = opts.apiUrl ?? process.env['TACIT_API_URL'] ?? 'https://beta.tacitai.app';
     // Determine profile and token.
     let profile = opts.profile;
     let token = opts.token;
@@ -365,23 +434,27 @@ export async function setup(argv) {
     const envVarNameForProfile = profileToEnvVar(profile);
     const envToken = process.env[envVarNameForProfile] ?? process.env['TACIT_TOKEN'] ?? null;
     if (!token && !envToken && !opts.dryRun) {
-        // Neither --token nor env set and not a dry-run → run automated device-auth flow.
-        let deviceResult;
+        // Neither --token nor env set and not a dry-run → authenticate interactively.
+        // Try device-auth (browser flow) first; fall back to login prompt.
+        let authenticated = false;
         try {
-            deviceResult = await deviceAuthFlow(apiUrl);
+            const deviceResult = await deviceAuthFlow(apiUrl);
+            token = deviceResult.token;
+            expiresAt = deviceResult.expiresAt;
+            if (!opts.profileExplicit && deviceResult.workspaceName) {
+                profile = workspaceNameToProfile(deviceResult.workspaceName);
+            }
+            authenticated = true;
         }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            process.stderr.write(`Error during device authentication: ${msg}\n`);
-            process.exit(1);
-            return; // unreachable; satisfies TypeScript
+        catch {
+            // Device-auth not available — fall back to login prompt.
         }
-        // Token from device flow — use in memory only (NEVER log/write).
-        token = deviceResult.token;
-        expiresAt = deviceResult.expiresAt;
-        // AC-12: derive profile from workspace_name unless --profile was explicit.
-        if (!opts.profileExplicit && deviceResult.workspaceName) {
-            profile = workspaceNameToProfile(deviceResult.workspaceName);
+        if (!authenticated) {
+            const loginResult = await loginFlow(apiUrl);
+            token = loginResult.token;
+            if (!opts.profileExplicit && loginResult.workspaceName) {
+                profile = workspaceNameToProfile(loginResult.workspaceName);
+            }
         }
     }
     // Final env-var name derived from (possibly updated) profile.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tacitai/mcp-server",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "stdio MCP server wrapping Tacit /api/v1 REST/SSE API",
   "license": "MIT",
   "repository": {