@tday-com/mcp 0.0.0-stage → 0.2.0

package/dist/download-safety.js

@@ -0,0 +1,76 @@
+import { lstat, mkdir, realpath } from "node:fs/promises";
+import { dirname, isAbsolute, resolve, relative, sep } from "node:path";
+// Download safety: URL allowlist + path sandboxing + size cap for
+// tday_download_image (see tools.ts).
+export const ALLOWED_IMAGE_HOSTS = new Set([
+    "cdn.tday.com",
+    "video-cdn.communities.one", // pre-2026 stored URLs
+    "communities.one",
+    "media.brand.dev",
+    "asset.brandfetch.io",
+    "cdn.brandfetch.io",
+    "tday.com",
+    "www.tday.com",
+    "app.tday.com",
+]);
+export const MAX_IMAGE_BYTES = 50 * 1024 * 1024; // 50 MB
+export function validateImageUrl(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new Error(`Invalid image URL: "${raw}"`);
+    }
+    if (url.protocol !== "https:") {
+        throw new Error(`Image URL must use HTTPS (got ${url.protocol})`);
+    }
+    if (!ALLOWED_IMAGE_HOSTS.has(url.hostname)) {
+        throw new Error(`Image host "${url.hostname}" is not allowed. Expected one of: ${[...ALLOWED_IMAGE_HOSTS].join(", ")}`);
+    }
+    return url;
+}
+export function sandboxFilePath(raw) {
+    const cwd = process.cwd();
+    const resolved = resolve(cwd, raw);
+    const rel = relative(cwd, resolved);
+    // Match ".." only as a full path segment — a file literally named "..foo" is inside cwd.
+    if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel) || resolve(cwd, rel) !== resolved) {
+        throw new Error(`File path must be inside the working directory. "${raw}" resolves outside of ${cwd}`);
+    }
+    return resolved;
+}
+export async function prepareOutputFilePath(raw, options = {}) {
+    const filePath = sandboxFilePath(raw);
+    const parentDir = dirname(filePath);
+    await mkdir(parentDir, { recursive: true });
+    const cwdReal = await realpath(process.cwd());
+    const parentReal = await realpath(parentDir);
+    if (!isInsideDirectory(cwdReal, parentReal)) {
+        throw new Error(`File path parent directory must stay inside the working directory and cannot traverse symlinks outside of ${process.cwd()}`);
+    }
+    try {
+        const existing = await lstat(filePath);
+        if (existing.isSymbolicLink()) {
+            throw new Error("Refusing to write to a symbolic link.");
+        }
+        if (!existing.isFile()) {
+            throw new Error("Refusing to write because the target path exists and is not a regular file.");
+        }
+        if (!options.overwrite) {
+            throw new Error("File already exists. Choose a new filePath or pass overwrite: true.");
+        }
+    }
+    catch (err) {
+        if (!isNodeError(err) || err.code !== "ENOENT")
+            throw err;
+    }
+    return filePath;
+}
+function isInsideDirectory(base, target) {
+    const rel = relative(base, target);
+    return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+}
+function isNodeError(err) {
+    return err instanceof Error && "code" in err;
+}

package/dist/installer-agents.d.ts

@@ -0,0 +1,17 @@
+export type AgentId = "claude-code" | "cursor" | "gemini-cli" | "codex";
+export interface AgentPatchResult {
+    id: AgentId;
+    name: string;
+    action: "patched" | "skipped" | "manual";
+    configPath?: string;
+    message: string;
+}
+interface McpServerEntry {
+    command: string;
+    args: string[];
+    env?: Record<string, string>;
+}
+export declare function mcpCommand(): McpServerEntry;
+export declare function patchAllAgents(): AgentPatchResult[];
+export declare function previewAllAgents(): AgentPatchResult[];
+export {};

package/dist/installer-agents.js

@@ -0,0 +1,283 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, dirname } from "node:path";
+import { pinnedPackageSpec } from "./package-info.js";
+const SERVER_NAME = "tday";
+// Command used inside each agent's MCP config. Uses npx -y so the user
+// doesn't need the package installed globally; -y skips the prompt. The
+// version is pinned to the installer's own (see pinnedPackageSpec).
+export function mcpCommand() {
+    return {
+        command: "npx",
+        args: ["-y", pinnedPackageSpec(), "serve"],
+    };
+}
+// --------------------------------------------------------------------------
+// Claude Code — JSON at ~/.claude.json
+// --------------------------------------------------------------------------
+function patchClaudeCode() {
+    const configPath = join(homedir(), ".claude.json");
+    if (!existsSync(configPath)) {
+        return {
+            id: "claude-code",
+            name: "Claude Code",
+            action: "skipped",
+            configPath,
+            message: `No Claude Code config found at ${configPath}. Install Claude Code first, then re-run \`tday install\`.`,
+        };
+    }
+    let raw;
+    try {
+        raw = readFileSync(configPath, "utf8");
+    }
+    catch (err) {
+        return {
+            id: "claude-code",
+            name: "Claude Code",
+            action: "skipped",
+            configPath,
+            message: `Could not read ${configPath}: ${err.message}`,
+        };
+    }
+    let config;
+    try {
+        config = raw.trim() ? JSON.parse(raw) : {};
+    }
+    catch (err) {
+        return {
+            id: "claude-code",
+            name: "Claude Code",
+            action: "skipped",
+            configPath,
+            message: `Existing ${configPath} is not valid JSON (${err.message}). Fix it or patch manually.`,
+        };
+    }
+    const mcpServers = getMcpServers(config);
+    mcpServers[SERVER_NAME] = mcpCommand();
+    config.mcpServers = mcpServers;
+    writeFileAtomic(configPath, JSON.stringify(config, null, 2) + "\n");
+    return {
+        id: "claude-code",
+        name: "Claude Code",
+        action: "patched",
+        configPath,
+        message: `Added "${SERVER_NAME}" MCP server to ${configPath}.`,
+    };
+}
+// --------------------------------------------------------------------------
+// Cursor — JSON at ~/.cursor/mcp.json
+// --------------------------------------------------------------------------
+function patchCursor() {
+    const cursorDir = join(homedir(), ".cursor");
+    const configPath = join(cursorDir, "mcp.json");
+    if (!existsSync(cursorDir)) {
+        return {
+            id: "cursor",
+            name: "Cursor",
+            action: "skipped",
+            configPath,
+            message: `No Cursor install detected (${cursorDir} missing).`,
+        };
+    }
+    let config = {};
+    if (existsSync(configPath)) {
+        try {
+            const raw = readFileSync(configPath, "utf8");
+            config = raw.trim() ? JSON.parse(raw) : {};
+        }
+        catch (err) {
+            return {
+                id: "cursor",
+                name: "Cursor",
+                action: "skipped",
+                configPath,
+                message: `Existing ${configPath} is not valid JSON (${err.message}).`,
+            };
+        }
+    }
+    const mcpServers = getMcpServers(config);
+    mcpServers[SERVER_NAME] = mcpCommand();
+    config.mcpServers = mcpServers;
+    writeFileAtomic(configPath, JSON.stringify(config, null, 2) + "\n");
+    return {
+        id: "cursor",
+        name: "Cursor",
+        action: "patched",
+        configPath,
+        message: `Added "${SERVER_NAME}" MCP server to ${configPath}.`,
+    };
+}
+// --------------------------------------------------------------------------
+// Gemini CLI — JSON at ~/.gemini/settings.json
+// Gemini CLI follows the common MCP config shape with a top-level mcpServers
+// object, matching Cursor/Claude-style entries.
+// --------------------------------------------------------------------------
+function patchGeminiCli() {
+    const geminiDir = join(homedir(), ".gemini");
+    const configPath = join(geminiDir, "settings.json");
+    if (!existsSync(geminiDir)) {
+        return {
+            id: "gemini-cli",
+            name: "Gemini CLI",
+            action: "skipped",
+            configPath,
+            message: `No Gemini CLI config directory detected (${geminiDir} missing).`,
+        };
+    }
+    let config = {};
+    if (existsSync(configPath)) {
+        try {
+            const raw = readFileSync(configPath, "utf8");
+            config = raw.trim() ? JSON.parse(raw) : {};
+        }
+        catch (err) {
+            return {
+                id: "gemini-cli",
+                name: "Gemini CLI",
+                action: "skipped",
+                configPath,
+                message: `Existing ${configPath} is not valid JSON (${err.message}).`,
+            };
+        }
+    }
+    const mcpServers = getMcpServers(config);
+    mcpServers[SERVER_NAME] = mcpCommand();
+    config.mcpServers = mcpServers;
+    writeFileAtomic(configPath, JSON.stringify(config, null, 2) + "\n");
+    return {
+        id: "gemini-cli",
+        name: "Gemini CLI",
+        action: "patched",
+        configPath,
+        message: `Added "${SERVER_NAME}" MCP server to ${configPath}.`,
+    };
+}
+// --------------------------------------------------------------------------
+// Codex — TOML at ~/.codex/config.toml
+// We avoid parsing TOML to keep zero runtime deps; instead, print the
+// block so the user can paste it in. Safer than corrupting a user's file.
+// --------------------------------------------------------------------------
+function patchCodex() {
+    const codexDir = join(homedir(), ".codex");
+    const configPath = join(codexDir, "config.toml");
+    const block = [
+        ``,
+        `[mcp_servers."${SERVER_NAME}"]`,
+        `command = "npx"`,
+        `args = ["-y", "${pinnedPackageSpec()}", "serve"]`,
+        ``,
+    ].join("\n");
+    if (!existsSync(codexDir)) {
+        return {
+            id: "codex",
+            name: "Codex",
+            action: "skipped",
+            configPath,
+            message: `No Codex install detected (${codexDir} missing).`,
+        };
+    }
+    return {
+        id: "codex",
+        name: "Codex",
+        action: "manual",
+        configPath,
+        message: `Append the following block to ${configPath}:\n${block}\n` +
+            `(Codex uses TOML; we don't auto-edit it to avoid corrupting your config.)`,
+    };
+}
+// --------------------------------------------------------------------------
+// Runner
+// --------------------------------------------------------------------------
+export function patchAllAgents() {
+    return [patchClaudeCode(), patchCursor(), patchGeminiCli(), patchCodex()];
+}
+// Preview what patchAllAgents would do without touching the filesystem.
+// Used by `tday install --dry-run`.
+export function previewAllAgents() {
+    const home = homedir();
+    const claudePath = join(home, ".claude.json");
+    const cursorPath = join(home, ".cursor", "mcp.json");
+    const geminiPath = join(home, ".gemini", "settings.json");
+    const codexPath = join(home, ".codex", "config.toml");
+    return [
+        existsSync(claudePath)
+            ? {
+                id: "claude-code",
+                name: "Claude Code",
+                action: "patched",
+                configPath: claudePath,
+                message: `Would add "${SERVER_NAME}" MCP server to ${claudePath}.`,
+            }
+            : {
+                id: "claude-code",
+                name: "Claude Code",
+                action: "skipped",
+                configPath: claudePath,
+                message: `No Claude Code config at ${claudePath}.`,
+            },
+        existsSync(join(home, ".cursor"))
+            ? {
+                id: "cursor",
+                name: "Cursor",
+                action: "patched",
+                configPath: cursorPath,
+                message: `Would add "${SERVER_NAME}" MCP server to ${cursorPath}.`,
+            }
+            : {
+                id: "cursor",
+                name: "Cursor",
+                action: "skipped",
+                configPath: cursorPath,
+                message: `No Cursor install detected.`,
+            },
+        existsSync(join(home, ".gemini"))
+            ? {
+                id: "gemini-cli",
+                name: "Gemini CLI",
+                action: "patched",
+                configPath: geminiPath,
+                message: `Would add "${SERVER_NAME}" MCP server to ${geminiPath}.`,
+            }
+            : {
+                id: "gemini-cli",
+                name: "Gemini CLI",
+                action: "skipped",
+                configPath: geminiPath,
+                message: `No Gemini CLI config directory detected.`,
+            },
+        existsSync(join(home, ".codex"))
+            ? {
+                id: "codex",
+                name: "Codex",
+                action: "manual",
+                configPath: codexPath,
+                message: `Would print TOML block for ${codexPath} (manual append).`,
+            }
+            : {
+                id: "codex",
+                name: "Codex",
+                action: "skipped",
+                configPath: codexPath,
+                message: `No Codex install detected.`,
+            },
+    ];
+}
+function getMcpServers(config) {
+    const existing = config.mcpServers;
+    if (isPlainRecord(existing)) {
+        return existing;
+    }
+    return {};
+}
+function isPlainRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function writeFileAtomic(path, contents) {
+    const dir = dirname(path);
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true });
+    }
+    const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
+    writeFileSync(tmp, contents, { encoding: "utf8", mode: 0o600 });
+    renameSync(tmp, path);
+}

package/dist/installer-callback.d.ts

@@ -0,0 +1,13 @@
+interface CallbackResult {
+    token: string;
+    state: string;
+}
+interface WaitOptions {
+    expectedState: string;
+    timeoutMs: number;
+}
+export declare function startCallbackServer(options: WaitOptions): Promise<{
+    port: number;
+    done: Promise<CallbackResult>;
+}>;
+export {};

package/dist/installer-callback.js

@@ -0,0 +1,91 @@
+import http from "node:http";
+// Boots a loopback HTTP server on a random free port, resolves once the
+// /cli/auth browser page returns its authorization payload, and rejects on
+// timeout or malformed payloads. Binds 127.0.0.1 only so no remote host can
+// reach it.
+export async function startCallbackServer(options) {
+    let resolve;
+    let reject;
+    const done = new Promise((res, rej) => {
+        resolve = res;
+        reject = rej;
+    });
+    const server = http.createServer((req, res) => {
+        res.setHeader("access-control-allow-origin", "*");
+        res.setHeader("access-control-allow-methods", "POST, OPTIONS");
+        res.setHeader("access-control-allow-headers", "content-type");
+        if (req.method === "OPTIONS") {
+            res.statusCode = 204;
+            res.end();
+            return;
+        }
+        if (req.url && new URL(req.url, "http://127.0.0.1").pathname !== "/cb") {
+            res.statusCode = 404;
+            res.end("not found");
+            return;
+        }
+        if (req.method !== "POST") {
+            res.statusCode = 405;
+            res.end("method not allowed");
+            return;
+        }
+        let body = "";
+        req.on("data", (chunk) => {
+            body += chunk.toString();
+            if (body.length > 8_192) {
+                res.statusCode = 413;
+                res.end("payload too large");
+                req.destroy();
+            }
+        });
+        req.on("end", () => {
+            let parsed;
+            try {
+                parsed = JSON.parse(body);
+            }
+            catch {
+                res.statusCode = 400;
+                res.end("invalid json");
+                return;
+            }
+            if (!parsed ||
+                typeof parsed !== "object" ||
+                typeof parsed.token !== "string" ||
+                typeof parsed.state !== "string") {
+                res.statusCode = 400;
+                res.end("missing authorization payload or state");
+                return;
+            }
+            const payload = parsed;
+            if (payload.state !== options.expectedState) {
+                // Do not reject the whole installer on a bad local POST. A different
+                // local process can hit the loopback listener, so keep waiting for the
+                // browser page carrying the expected nonce until timeout.
+                res.statusCode = 400;
+                res.end("state mismatch");
+                return;
+            }
+            res.statusCode = 200;
+            res.setHeader("content-type", "application/json");
+            res.end(JSON.stringify({ ok: true }));
+            resolve(payload);
+        });
+    });
+    await new Promise((res, rej) => {
+        server.once("error", rej);
+        server.listen(0, "127.0.0.1", () => res());
+    });
+    const address = server.address();
+    if (!address || typeof address === "string") {
+        server.close();
+        throw new Error("failed to bind callback server");
+    }
+    const timer = setTimeout(() => {
+        reject(new Error(`Authorization timed out after ${options.timeoutMs / 1000}s`));
+    }, options.timeoutMs);
+    done.finally(() => {
+        clearTimeout(timer);
+        server.close();
+    });
+    return { port: address.port, done };
+}

package/dist/installer-slash-command.d.ts

@@ -0,0 +1,12 @@
+export interface SlashCommandResult {
+    path: string;
+    installed: boolean;
+}
+/** A command's text by filename, without installing anything (tests read it without touching ~/.claude). */
+export declare function slashCommandBody(filename: string): string | undefined;
+export declare function installSlashCommands(): SlashCommandResult[];
+export declare function cleanupLegacySlashCommands(commandsDir: string): string[];
+export declare function installSlashCommand(): {
+    path: string;
+    installed: boolean;
+};