@tacitai/mcp-server 0.6.0 → 0.6.1

package/dist/auth.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * HTTPS transport auth + rate limiting.
  *

package/dist/client.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * TacitClient — REST/SSE client over TACIT_API_URL.
  *

package/dist/index.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// SPDX-License-Identifier: MIT
 /**
  * @tacit/mcp-server — stdio MCP server
  *

package/dist/oauth.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * OAuth 2.0 Authorization Server for MCP (FEAT-176).
  *

package/dist/prompts.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 import { z } from 'zod';
 const ASSISTANT_SYSTEM_PROMPT_STATIC = "You are TACIT's workspace assistant. Answer from the user's workspace through TACIT tools. " +
     'Prefer a single read tool for direct lookups, synthesis for open questions, and ask before any write or dispatch.';

package/dist/setup.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * setup — wizard subcommand for @tacit/mcp-server
  *
@@ -189,11 +188,24 @@ const DEVICE_AUTH_TIMEOUT_MS = 120_000;
  *   - Token plaintext is NEVER logged.
  *
  * Error paths:
- *   - Port 9123 occupied → print error + --token fallback instructions → exit 1 (AC-15).
- *   - 120s timeout → exit 1 (AC-15).
+ *   - /auth/device returns 404 → reject immediately (pre-flight probe).
+ *   - Port 9123 occupied → reject (caller falls back to loginFlow).
+ *   - 120s timeout → reject (caller falls back to loginFlow).
  *   - Browser open fails → print URL to stdout for manual copy-paste (AC-16 fallback).
  */
 async function deviceAuthFlow(apiUrl) {
+    // Pre-flight: check if /auth/device exists before opening a browser to it.
+    try {
+        const probe = await fetch(`${apiUrl}/auth/device`, { method: 'HEAD', redirect: 'manual' });
+        if (probe.status === 404) {
+            throw new Error('device-auth endpoint not available');
+        }
+    }
+    catch (err) {
+        if (err instanceof Error && err.message === 'device-auth endpoint not available')
+            throw err;
+        // Network error (e.g., no connectivity) — let device auth attempt anyway.
+    }
     // 1. Generate a cryptographically random state nonce (32 bytes, hex).
     const stateNonce = crypto.randomBytes(32).toString('hex');
     return new Promise((resolve, reject) => {
@@ -265,14 +277,6 @@ async function deviceAuthFlow(apiUrl) {
             }
         });
         server.on('error', (err) => {
-            if (err.code === 'EADDRINUSE') {
-                process.stderr.write(`Error: port ${DEVICE_AUTH_CALLBACK_PORT} is already in use.\n` +
-                    `Cannot start device-auth callback server.\n` +
-                    `Use --token <your-token> instead:\n` +
-                    `  npx @tacitai/mcp-server setup --api-url ${apiUrl} --token <your-token>\n` +
-                    `Get your token from: ${apiUrl}/settings\n`);
-                process.exit(1);
-            }
             cleanup();
             reject(err);
         });
@@ -303,14 +307,10 @@ async function deviceAuthFlow(apiUrl) {
                         `  ${deviceUrl}\n`);
                 }
             });
-            // 5. Timeout guard (AC-15).
+            // 5. Timeout guard (AC-15). Reject so main() falls back to loginFlow.
             timeoutHandle = setTimeout(() => {
                 cleanup();
-                process.stderr.write(`Error: device-auth timed out after ${DEVICE_AUTH_TIMEOUT_MS / 1000}s.\n` +
-                    `Use --token <your-token> instead:\n` +
-                    `  npx @tacitai/mcp-server setup --api-url ${apiUrl} --token <your-token>\n` +
-                    `Get your token from: ${apiUrl}/settings\n`);
-                process.exit(1);
+                reject(new Error(`device-auth timed out after ${DEVICE_AUTH_TIMEOUT_MS / 1000}s`));
             }, DEVICE_AUTH_TIMEOUT_MS);
         });
     });

package/dist/tools/agents.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * Agent tools — Claude CLI wrappers around the Agent Factory MCP surface.
  *

package/dist/tools/annotations.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * Annotation tools:
  *   tacit_annotate         — POST /api/v1/artifacts/:id/annotations

package/dist/tools/artifacts.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * Artifact tools:
  *   tacit_artifact_list    — GET  /api/v1/artifacts

package/dist/tools/connector_write_back.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 // MV-1531b W3: Connector write-back MCP tool
 import { z } from 'zod';
 export function registerConnectorWriteBackTools(server, getClientFn) {

package/dist/tools/converse.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * tacit_converse — conversational AI tool (MV-1523 W5)
  *

package/dist/tools/drafts.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * Draft tools (MV-1515n W5 / FEAT-142):
  *   tacit_draft_search — GET /api/v1/artifacts/drafts/search

package/dist/tools/errors.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 import { TacitApiError, TokenExpiredError } from '../client.js';
 export function success(data) {
     return { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] };

package/dist/tools/export.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * Export tool:
  *   tacit_export_to_git — POST /api/v1/export/git

package/dist/tools/github.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * GitHub connection tools — list, disconnect and reconnect GitHub sync
  * connections (BUG-305).

package/dist/tools/gm.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * GM (Gateway Manager) tools — unified content ingestion with classification
  * and human-approved placement across lake, KB, and pyramid surfaces.

package/dist/tools/ingest.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * Ingest tools:
  *   tacit_ingest_file        — POST /api/v1/portfolios/:id/ingest

package/dist/tools/kb.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * KB tools — CLI wrappers for knowledge collections, articles, categories,
  * and browse/promote flows on the Axum REST API.

package/dist/tools/lake.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * Lake tools — CLI wrappers for data lake source, sync, proposal,
  * classification, catalog, taxonomy, and subject-classification operations

package/dist/tools/move.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * Move tool:
  *   tacit_move — PATCH /api/v1/objects/:id/placement

package/dist/tools/outbox.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * FEAT-111 Wave 2 — Outbox MCP tools:
  *   tacit_outbox_write  — Write an envelope to the local outbox queue

package/dist/tools/pyramid.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * Pyramid tools — CLI wrappers for portfolio, program, dossier, and
  * value-stream CRUD on the Axum REST API.

package/dist/tools/recall.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * tacit_recall — Chronicle event recall (hybrid vector)
  * Route: POST /api/v1/mind/recall

package/dist/tools/registry.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * Compile-time tool classification. Governs which tools may be called over HTTPS.
  * Partition: 6 stdio_only + 17 admin_only + 2 gate_only + 121 https = 146.

package/dist/tools/research.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * Research tools (MV-1525) — scope discovery + grounded prompt assembly,
  * pyramid/KB placement with T3 confirmation, and async Gemini launch.

package/dist/tools/search.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * tacit_search — hybrid BM25+ANN+RRF search
  * Route: GET /api/v1/search?q=<term>

package/dist/tools/sharing.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * MV-1518b: Guest sharing MCP tools
  * tacit_shared_list  — list artifacts shared with the guest

package/dist/tools/skills.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * tacit_list_skills / tacit_run_skill — MCP skill orchestration (MV-1533 W6)
  *

package/dist/tools/synthesize.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * tacit_synthesize — canonical synthesis tool
  *

package/dist/tools/voice.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * Voice resonance tools — profile management, stats, sample upload,
  * and voice-applied composition via crew_compose + voice_mode.

package/dist/tools/web-url.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 import { z } from 'zod';
 import { getClient } from '../client.js';
 const ENTITY_TYPES = [

package/dist/tools/wiki.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * Wiki governance tools — validate articles against governance rules,
  * apply overrides, write to wiki repos, and author content via LLM.

package/dist/transport.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: MIT
 /**
  * HTTPS (Streamable HTTP) transport for external MCP clients.
  *

package/package.json

@@ -1,16 +1,14 @@
 {
   "name": "@tacitai/mcp-server",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "stdio MCP server wrapping Tacit /api/v1 REST/SSE API",
-  "license": "MIT",
+  "license": "UNLICENSED",
+  "private": false,
   "repository": {
     "type": "git",
     "url": "git+https://github.com/scottkmcmillan/tacit.git",
     "directory": "packages/tacit-mcp-server"
   },
-  "publishConfig": {
-    "access": "public"
-  },
   "type": "module",
   "main": "dist/index.js",
   "bin": {

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Quarterback AI
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.