@tday-com/mcp 0.4.0 → 0.4.3

package/README.md

@@ -4,7 +4,7 @@ Record narrated product demos with your coding agent. This is [tday](https://tda
 
 Ask your agent for a demo of a feature. It starts a separate demo copy of the app in your repo, on your machine, with throwaway data, and records one beat for each narrated line as it uses the app. It works with web apps, Electron apps and terminal tools. Before anything is uploaded it shows you a review page. Once you say yes, tday adds the voice, cursor, camera and style, and the demo arrives in tday ready to edit.
 
-**Only rendered UI and metadata leave your machine.** Source code, scripts, `.env` files and their values, cookies, local storage and network traffic never do. Every upload is scanned for secrets and for the values in your `.env` files first, and anything it finds blocks the upload until it is removed. Details: [What leaves your machine](https://tday.com/docs/capture-privacy).
+**Only rendered UI and metadata leave your machine.** Source code, scripts, `.env` files and their values, cookies, local storage and network traffic never do. Every upload is scanned for secrets and for the values in your `.env` files first, and anything it finds blocks the upload until it is removed. Details: [What leaves your machine](https://docs.tday.com/capture-privacy).
 
 ## Install
 
@@ -21,7 +21,7 @@ The installer opens your browser, lets you sign in or sign up on tday.com, and a
 With a capture prompt from a teammate (no tday account needed), run the line it gives you:
 
 ```bash
-TDAY_CAPTURE_TOKEN=<token from the prompt> npx -y @tday-com/mcp@latest install
+TDAY_CAPTURE_TOKEN=<token from the prompt> npx --prefix ~ -y @tday-com/mcp@latest install
 ```
 
 This adds `tday` to Claude Code at user scope (nothing is written into your repo) and installs the agent's skill. For other clients it prints the config to paste.
@@ -103,15 +103,15 @@ Run any of them with `npx -y @tday-com/mcp@latest <command>`.
   "mcpServers": {
     "tday": {
       "command": "npx",
-      "args": ["-y", "@tday-com/mcp@<version>", "serve"]
+      "args": ["--prefix", "<your home directory>", "-y", "@tday-com/mcp@<version>", "serve"]
     }
   }
 }
 ```
 
-`install` writes this entry pinned to its own version, so your agent never picks up a new release on its own. Run `install` again to update. Pin the version in an entry you write by hand too. If you add the entry yourself, run `npx -y @tday-com/mcp@latest install` once afterwards, so the browser sign-in can link the server to your tday account.
+`--prefix` keeps npx from reading the repo's `package.json`: the agent starts the server in your repo, and a repo whose `overrides` pin one of this package's dependencies would otherwise fail the start (`EOVERRIDE`). `install` writes this entry pinned to its own version, so your agent never picks up a new release on its own. Run `install` again to update. Pin the version in an entry you write by hand too. If you add the entry yourself, run `npx -y @tday-com/mcp@latest install` once afterwards, so the browser sign-in can link the server to your tday account.
 
-For Gemini CLI, put the same `mcpServers.tday` object in `~/.gemini/settings.json`. VS Code's user `mcp.json` keys entries by `servers` and names the transport: `{ "servers": { "tday": { "type": "stdio", "command": "npx", "args": ["-y", "@tday-com/mcp@<version>", "serve"] } } }`.
+For Gemini CLI, put the same `mcpServers.tday` object in `~/.gemini/settings.json`. VS Code's user `mcp.json` keys entries by `servers` and names the transport: `{ "servers": { "tday": { "type": "stdio", "command": "npx", "args": ["--prefix", "<your home directory>", "-y", "@tday-com/mcp@<version>", "serve"] } } }`.
 
 ## Claude and ChatGPT connectors
 
@@ -125,10 +125,10 @@ The hosted connector uses OAuth with PKCE and rotating refresh tokens. You sign
 
 ## Security and privacy
 
-- **Nothing uploads without your yes.** Your agent shows a review of every file and string, and can upload only with the confirmation code that review shows you.
+- **You see what uploads.** Every upload is reviewed first: every file and string, with a secret scan that blocks it. A demo uploads once its review is clean, and the review page stays on your machine. A capture of your screens also waits for your yes: tday opens its review in your browser, and your agent's app asks you or you read it the confirmation code shown there.
 - **Your repo stays as it was.** Demos run in a separate demo instance, and anything the agent creates is deleted when it finishes.
 - **What a connection can do.** The token only reaches the routes these tools use. It cannot delete or transfer a brand, manage members, or see payment details.
-- **Links expire.** A link made by `install` lasts 90 days; run `install` again to renew it. A capture prompt's token lasts 7 days. You can disconnect any connection from tday Settings - Integrations.
+- **Links expire.** A link made by `install` lasts 90 days; run `install` again to renew it. A capture prompt's token lasts 7 days, a demo prompt's one day. You can disconnect any connection from tday Settings - Integrations.
 - **Local only.** The server runs on your machine over stdio. The installer's sign-in uses a loopback callback on `127.0.0.1` with a random `state` value. Your login is written to `~/.tday/config.json` with `0600` permissions.
 - **No telemetry.** The server talks only to tday, and to tday's file storage for uploads and the downloads you ask for. Downloads are limited to HTTPS image URLs on an allowlist, re-check redirects, are capped at 50MB, and are written only inside the current working directory.