@tacitai/mcp-server 0.5.0 → 0.6.1

package/dist/auth.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * HTTPS transport auth + rate limiting.
  *

package/dist/client.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * TacitClient — REST/SSE client over TACIT_API_URL.
  *

package/dist/index.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// SPDX-License-Identifier: MIT
 /**
  * @tacit/mcp-server — stdio MCP server
  *

package/dist/oauth.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * OAuth 2.0 Authorization Server for MCP (FEAT-176).
  *

package/dist/prompts.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 import { z } from 'zod';
 const ASSISTANT_SYSTEM_PROMPT_STATIC = "You are TACIT's workspace assistant. Answer from the user's workspace through TACIT tools. " +
     'Prefer a single read tool for direct lookups, synthesis for open questions, and ask before any write or dispatch.';

package/dist/setup.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * setup — wizard subcommand for @tacit/mcp-server
  *
@@ -33,6 +32,7 @@ import * as path from 'path';
 import * as os from 'os';
 import * as http from 'http';
 import * as crypto from 'crypto';
+import * as readline from 'readline';
 import { execFile } from 'child_process';
 import { TacitClient, TacitApiError } from './client.js';
 function parseArgs(argv) {
@@ -188,11 +188,24 @@ const DEVICE_AUTH_TIMEOUT_MS = 120_000;
  *   - Token plaintext is NEVER logged.
  *
  * Error paths:
- *   - Port 9123 occupied → print error + --token fallback instructions → exit 1 (AC-15).
- *   - 120s timeout → exit 1 (AC-15).
+ *   - /auth/device returns 404 → reject immediately (pre-flight probe).
+ *   - Port 9123 occupied → reject (caller falls back to loginFlow).
+ *   - 120s timeout → reject (caller falls back to loginFlow).
  *   - Browser open fails → print URL to stdout for manual copy-paste (AC-16 fallback).
  */
 async function deviceAuthFlow(apiUrl) {
+    // Pre-flight: check if /auth/device exists before opening a browser to it.
+    try {
+        const probe = await fetch(`${apiUrl}/auth/device`, { method: 'HEAD', redirect: 'manual' });
+        if (probe.status === 404) {
+            throw new Error('device-auth endpoint not available');
+        }
+    }
+    catch (err) {
+        if (err instanceof Error && err.message === 'device-auth endpoint not available')
+            throw err;
+        // Network error (e.g., no connectivity) — let device auth attempt anyway.
+    }
     // 1. Generate a cryptographically random state nonce (32 bytes, hex).
     const stateNonce = crypto.randomBytes(32).toString('hex');
     return new Promise((resolve, reject) => {
@@ -264,14 +277,6 @@ async function deviceAuthFlow(apiUrl) {
             }
         });
         server.on('error', (err) => {
-            if (err.code === 'EADDRINUSE') {
-                process.stderr.write(`Error: port ${DEVICE_AUTH_CALLBACK_PORT} is already in use.\n` +
-                    `Cannot start device-auth callback server.\n` +
-                    `Use --token <your-token> instead:\n` +
-                    `  npx @tacitai/mcp-server setup --api-url ${apiUrl} --token <your-token>\n` +
-                    `Get your token from: ${apiUrl}/settings\n`);
-                process.exit(1);
-            }
             cleanup();
             reject(err);
         });
@@ -302,18 +307,89 @@ async function deviceAuthFlow(apiUrl) {
                         `  ${deviceUrl}\n`);
                 }
             });
-            // 5. Timeout guard (AC-15).
+            // 5. Timeout guard (AC-15). Reject so main() falls back to loginFlow.
             timeoutHandle = setTimeout(() => {
                 cleanup();
-                process.stderr.write(`Error: device-auth timed out after ${DEVICE_AUTH_TIMEOUT_MS / 1000}s.\n` +
-                    `Use --token <your-token> instead:\n` +
-                    `  npx @tacitai/mcp-server setup --api-url ${apiUrl} --token <your-token>\n` +
-                    `Get your token from: ${apiUrl}/settings\n`);
-                process.exit(1);
+                reject(new Error(`device-auth timed out after ${DEVICE_AUTH_TIMEOUT_MS / 1000}s`));
             }, DEVICE_AUTH_TIMEOUT_MS);
         });
     });
 }
+function prompt(question, hidden = false) {
+    return new Promise((resolve) => {
+        const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+        if (hidden && process.stdin.isTTY) {
+            process.stderr.write(question);
+            const stdin = process.stdin;
+            stdin.setRawMode(true);
+            stdin.resume();
+            stdin.setEncoding('utf-8');
+            let input = '';
+            const onData = (ch) => {
+                if (ch === '\n' || ch === '\r' || ch === '\u0004') {
+                    stdin.setRawMode(false);
+                    stdin.pause();
+                    stdin.removeListener('data', onData);
+                    rl.close();
+                    process.stderr.write('\n');
+                    resolve(input);
+                }
+                else if (ch === '\u007F' || ch === '\b') {
+                    if (input.length > 0)
+                        input = input.slice(0, -1);
+                }
+                else if (ch === '\u0003') {
+                    process.exit(1);
+                }
+                else {
+                    input += ch;
+                }
+            };
+            stdin.on('data', onData);
+        }
+        else {
+            rl.question(question, (answer) => {
+                rl.close();
+                resolve(answer.trim());
+            });
+        }
+    });
+}
+async function loginFlow(apiUrl) {
+    process.stderr.write('\n  Log in with your TACIT credentials.\n\n');
+    const email = await prompt('  Email: ');
+    const pin = await prompt('  PIN:   ', true);
+    if (!email || !pin) {
+        process.stderr.write('Error: email and PIN are required.\n');
+        process.exit(1);
+    }
+    const loginUrl = apiUrl.endsWith('/api/v1')
+        ? `${apiUrl}/auth/login`
+        : `${apiUrl}/api/v1/auth/login`;
+    const res = await fetch(loginUrl, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email, pin }),
+    });
+    if (!res.ok) {
+        const body = await res.text().catch(() => '');
+        if (res.status === 401) {
+            process.stderr.write('\n  Login failed — check your email and PIN.\n');
+        }
+        else {
+            process.stderr.write(`\n  Login failed (${res.status}): ${body}\n`);
+        }
+        process.exit(1);
+    }
+    const data = await res.json();
+    const token = typeof data['session_token'] === 'string' ? data['session_token'] : '';
+    const workspaceName = typeof data['workspace_name'] === 'string' ? data['workspace_name'] : '';
+    if (!token) {
+        process.stderr.write('Error: login returned no session token.\n');
+        process.exit(1);
+    }
+    return { token, workspaceName };
+}
 // ─── Smoke synthesis ──────────────────────────────────────────────────────────
 const SMOKE_QUERY = 'What is in this knowledge base?';
 async function runSmoke(apiUrl, token) {
@@ -348,15 +424,8 @@ async function runSmoke(apiUrl, token) {
 // ─── Main export ──────────────────────────────────────────────────────────────
 export async function setup(argv) {
     const opts = parseArgs(argv);
-    // Resolve api-url: flag > env.
-    const apiUrl = opts.apiUrl ?? process.env['TACIT_API_URL'] ?? null;
-    if (!apiUrl) {
-        process.stderr.write('Error: no API URL configured.\n' +
-            'Provide --api-url <url> or set TACIT_API_URL environment variable.\n' +
-            'Example: npx @tacitai/mcp-server setup --api-url https://tacit-beta-prod.fly.dev --token <your-token>\n' +
-            '\nGet your token from: https://beta.tacitai.app → Settings → Bearer token\n');
-        process.exit(1);
-    }
+    // Resolve api-url: flag > env > default.
+    const apiUrl = opts.apiUrl ?? process.env['TACIT_API_URL'] ?? 'https://beta.tacitai.app';
     // Determine profile and token.
     let profile = opts.profile;
     let token = opts.token;
@@ -365,23 +434,27 @@ export async function setup(argv) {
     const envVarNameForProfile = profileToEnvVar(profile);
     const envToken = process.env[envVarNameForProfile] ?? process.env['TACIT_TOKEN'] ?? null;
     if (!token && !envToken && !opts.dryRun) {
-        // Neither --token nor env set and not a dry-run → run automated device-auth flow.
-        let deviceResult;
+        // Neither --token nor env set and not a dry-run → authenticate interactively.
+        // Try device-auth (browser flow) first; fall back to login prompt.
+        let authenticated = false;
         try {
-            deviceResult = await deviceAuthFlow(apiUrl);
+            const deviceResult = await deviceAuthFlow(apiUrl);
+            token = deviceResult.token;
+            expiresAt = deviceResult.expiresAt;
+            if (!opts.profileExplicit && deviceResult.workspaceName) {
+                profile = workspaceNameToProfile(deviceResult.workspaceName);
+            }
+            authenticated = true;
         }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            process.stderr.write(`Error during device authentication: ${msg}\n`);
-            process.exit(1);
-            return; // unreachable; satisfies TypeScript
+        catch {
+            // Device-auth not available — fall back to login prompt.
         }
-        // Token from device flow — use in memory only (NEVER log/write).
-        token = deviceResult.token;
-        expiresAt = deviceResult.expiresAt;
-        // AC-12: derive profile from workspace_name unless --profile was explicit.
-        if (!opts.profileExplicit && deviceResult.workspaceName) {
-            profile = workspaceNameToProfile(deviceResult.workspaceName);
+        if (!authenticated) {
+            const loginResult = await loginFlow(apiUrl);
+            token = loginResult.token;
+            if (!opts.profileExplicit && loginResult.workspaceName) {
+                profile = workspaceNameToProfile(loginResult.workspaceName);
+            }
         }
     }
     // Final env-var name derived from (possibly updated) profile.

package/dist/tools/agents.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * Agent tools — Claude CLI wrappers around the Agent Factory MCP surface.
  *

package/dist/tools/annotations.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * Annotation tools:
  *   tacit_annotate         — POST /api/v1/artifacts/:id/annotations

package/dist/tools/artifacts.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * Artifact tools:
  *   tacit_artifact_list    — GET  /api/v1/artifacts

package/dist/tools/connector_write_back.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 // MV-1531b W3: Connector write-back MCP tool
 import { z } from 'zod';
 export function registerConnectorWriteBackTools(server, getClientFn) {

package/dist/tools/converse.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * tacit_converse — conversational AI tool (MV-1523 W5)
  *

package/dist/tools/drafts.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * Draft tools (MV-1515n W5 / FEAT-142):
  *   tacit_draft_search — GET /api/v1/artifacts/drafts/search

package/dist/tools/errors.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 import { TacitApiError, TokenExpiredError } from '../client.js';
 export function success(data) {
     return { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] };

package/dist/tools/export.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * Export tool:
  *   tacit_export_to_git — POST /api/v1/export/git

package/dist/tools/github.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * GitHub connection tools — list, disconnect and reconnect GitHub sync
  * connections (BUG-305).

package/dist/tools/gm.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * GM (Gateway Manager) tools — unified content ingestion with classification
  * and human-approved placement across lake, KB, and pyramid surfaces.

package/dist/tools/ingest.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * Ingest tools:
  *   tacit_ingest_file        — POST /api/v1/portfolios/:id/ingest

package/dist/tools/kb.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * KB tools — CLI wrappers for knowledge collections, articles, categories,
  * and browse/promote flows on the Axum REST API.

package/dist/tools/lake.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * Lake tools — CLI wrappers for data lake source, sync, proposal,
  * classification, catalog, taxonomy, and subject-classification operations

package/dist/tools/move.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * Move tool:
  *   tacit_move — PATCH /api/v1/objects/:id/placement

package/dist/tools/outbox.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * FEAT-111 Wave 2 — Outbox MCP tools:
  *   tacit_outbox_write  — Write an envelope to the local outbox queue

package/dist/tools/pyramid.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * Pyramid tools — CLI wrappers for portfolio, program, dossier, and
  * value-stream CRUD on the Axum REST API.

package/dist/tools/recall.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * tacit_recall — Chronicle event recall (hybrid vector)
  * Route: POST /api/v1/mind/recall

package/dist/tools/registry.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * Compile-time tool classification. Governs which tools may be called over HTTPS.
  * Partition: 6 stdio_only + 17 admin_only + 2 gate_only + 121 https = 146.

package/dist/tools/research.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * Research tools (MV-1525) — scope discovery + grounded prompt assembly,
  * pyramid/KB placement with T3 confirmation, and async Gemini launch.

package/dist/tools/search.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * tacit_search — hybrid BM25+ANN+RRF search
  * Route: GET /api/v1/search?q=<term>

package/dist/tools/sharing.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * MV-1518b: Guest sharing MCP tools
  * tacit_shared_list  — list artifacts shared with the guest

package/dist/tools/skills.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * tacit_list_skills / tacit_run_skill — MCP skill orchestration (MV-1533 W6)
  *

package/dist/tools/synthesize.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * tacit_synthesize — canonical synthesis tool
  *

package/dist/tools/voice.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * Voice resonance tools — profile management, stats, sample upload,
  * and voice-applied composition via crew_compose + voice_mode.

package/dist/tools/web-url.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 import { z } from 'zod';
 import { getClient } from '../client.js';
 const ENTITY_TYPES = [

package/dist/tools/wiki.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * Wiki governance tools — validate articles against governance rules,
  * apply overrides, write to wiki repos, and author content via LLM.

package/dist/transport.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * HTTPS (Streamable HTTP) transport for external MCP clients.
  *

package/package.json

@@ -1,16 +1,14 @@
 {
   "name": "@tacitai/mcp-server",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "description": "stdio MCP server wrapping Tacit /api/v1 REST/SSE API",
-  "license": "MIT",
+  "license": "UNLICENSED",
+  "private": false,
   "repository": {
     "type": "git",
     "url": "git+https://github.com/scottkmcmillan/tacit.git",
     "directory": "packages/tacit-mcp-server"
   },
-  "publishConfig": {
-    "access": "public"
-  },
   "type": "module",
   "main": "dist/index.js",
   "bin": {

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Quarterback AI
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.