@tempo-ai/mcp 0.0.100 → 0.0.101

package/dist/bin.js

@@ -2,8 +2,8 @@
 import { createRequire as __tempoCreateRequire } from 'node:module'; const require = __tempoCreateRequire(import.meta.url);
 import {
   run
-} from "./chunk-EYHFTWP5.js";
-import "./chunk-JDPG7F4Z.js";
+} from "./chunk-6HT4KAGI.js";
+import "./chunk-J43EDR63.js";
 
 // src/bin.ts
 run(process.argv).then(

package/dist/call-6CDIHKDB.js

@@ -0,0 +1,130 @@
+import { createRequire as __tempoCreateRequire } from 'node:module'; const require = __tempoCreateRequire(import.meta.url);
+import {
+  ensureCliAuth,
+  parseServeArgs
+} from "./chunk-J43EDR63.js";
+
+// src/call.ts
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+async function connectAggregate(options) {
+  const { createTempoAggregate } = await import("./serve-JG5U3XF4.js");
+  const handle = await createTempoAggregate(options);
+  const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+  const client = new Client({ name: "tempo-mcp-cli", version: "0" });
+  await handle.aggregate.connect(serverTransport);
+  await client.connect(clientTransport);
+  return {
+    client,
+    dispose: async () => {
+      await client.close();
+      await handle.dispose();
+    }
+  };
+}
+function extractFlag(args, flag) {
+  const rest = args.filter((a) => a !== flag);
+  return { present: rest.length !== args.length, rest };
+}
+async function runTools(args) {
+  const { present: withSchemas, rest } = extractFlag(args, "--schemas");
+  const options = parseServeArgs(rest);
+  if ("error" in options) {
+    console.error(options.error);
+    return 1;
+  }
+  await ensureCliAuth();
+  const { client, dispose } = await connectAggregate(options);
+  try {
+    const { tools } = await client.listTools();
+    const rows = tools.map(
+      (tool) => withSchemas ? {
+        name: tool.name,
+        description: tool.description,
+        inputSchema: tool.inputSchema
+      } : { name: tool.name, description: tool.description }
+    );
+    console.log(JSON.stringify({ tools: rows }, null, 2));
+    return 0;
+  } finally {
+    await dispose();
+  }
+}
+async function runCall(args) {
+  const [toolName, ...rest] = args;
+  if (!toolName || toolName.startsWith("--")) {
+    console.error(
+      `Usage: tempo-mcp call <tool> --json '{"orgId": "...", ...}'
+Discover tools and their schemas with \`tempo-mcp tools --schemas\`.`
+    );
+    return 1;
+  }
+  let jsonArg = null;
+  const serveFlags = [];
+  for (let i = 0; i < rest.length; i++) {
+    if (rest[i] === "--json") {
+      jsonArg = rest[++i] ?? null;
+    } else {
+      serveFlags.push(rest[i]);
+    }
+  }
+  let toolArgs = {};
+  if (jsonArg != null) {
+    if (jsonArg === "-") {
+      jsonArg = await readStdin();
+    }
+    try {
+      const parsed = JSON.parse(jsonArg);
+      if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        console.error("--json must be a JSON object of tool arguments");
+        return 1;
+      }
+      toolArgs = parsed;
+    } catch (err) {
+      console.error(
+        `--json is not valid JSON: ${err instanceof Error ? err.message : String(err)}`
+      );
+      return 1;
+    }
+  }
+  const options = parseServeArgs(serveFlags);
+  if ("error" in options) {
+    console.error(options.error);
+    return 1;
+  }
+  await ensureCliAuth();
+  const { client, dispose } = await connectAggregate(options);
+  try {
+    const result = await client.callTool({
+      name: toolName,
+      arguments: toolArgs
+    });
+    const content = Array.isArray(result.content) ? result.content : [];
+    for (const block of content) {
+      if (block.type === "text") {
+        console.log(block.text);
+      } else {
+        console.log(JSON.stringify(block));
+      }
+    }
+    return result.isError ? 1 : 0;
+  } finally {
+    await dispose();
+  }
+}
+function readStdin() {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    process.stdin.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
+    process.stdin.on(
+      "end",
+      () => resolve(Buffer.concat(chunks).toString("utf8"))
+    );
+    process.stdin.on("error", reject);
+  });
+}
+export {
+  runCall,
+  runTools
+};
+//# sourceMappingURL=call-6CDIHKDB.js.map

package/dist/call-6CDIHKDB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/call.ts"],"sourcesContent":["/**\n * `tempo-mcp tools` and `tempo-mcp call` — the universal CLI surface\n * (TEM-2121) for hosts that cannot attach an MCP server at all (Codex\n * cloud has no MCP support; Grok Bot attaches remote-URL servers only).\n * Any agent with a terminal drives the EXACT same pipeline the MCP server\n * exposes — same aggregator, explicit orgId/projectId scoping, manifest\n * gating, canvas hooks — through two generic commands:\n *\n *   tempo-mcp tools [--schemas] [--toolsets a,b] [--readonly]\n *   tempo-mcp call <tool> --json '{\"orgId\": \"...\", ...}'\n *\n * An in-memory MCP client is connected to the same aggregate `runServe`\n * would put on stdio, so there is no per-tool code and no second code\n * path to drift.\n */\nimport { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { InMemoryTransport } from \"@modelcontextprotocol/sdk/inMemory.js\";\nimport { parseServeArgs, type ServeOptions } from \"./config.ts\";\nimport { ensureCliAuth } from \"./cli-auth.ts\";\n\ninterface ConnectedAggregate {\n  client: Client;\n  dispose: () => Promise<void>;\n}\n\nasync function connectAggregate(\n  options: ServeOptions,\n): Promise<ConnectedAggregate> {\n  const { createTempoAggregate } = await import(\"./serve.ts\");\n  const handle = await createTempoAggregate(options);\n  const [clientTransport, serverTransport] =\n    InMemoryTransport.createLinkedPair();\n  const client = new Client({ name: \"tempo-mcp-cli\", version: \"0\" });\n  await handle.aggregate.connect(serverTransport);\n  await client.connect(clientTransport);\n  return {\n    client,\n    dispose: async () => {\n      await client.close();\n      await handle.dispose();\n    },\n  };\n}\n\n/** Split our own flags from the serve-shaping flags shared with `serve`. */\nfunction extractFlag(args: string[], flag: string): { present: boolean; rest: string[] } {\n  const rest = args.filter((a) => a !== flag);\n  return { present: rest.length !== args.length, rest };\n}\n\nexport async function runTools(args: string[]): Promise<number> {\n  const { present: withSchemas, rest } = extractFlag(args, \"--schemas\");\n  const options = parseServeArgs(rest);\n  if (\"error\" in options) {\n    console.error(options.error);\n    return 1;\n  }\n\n  await ensureCliAuth();\n  const { client, dispose } = await connectAggregate(options);\n  try {\n    const { tools } = await client.listTools();\n    const rows = tools.map((tool) =>\n      withSchemas\n        ? {\n            name: tool.name,\n            description: tool.description,\n            inputSchema: tool.inputSchema,\n          }\n        : { name: tool.name, description: tool.description },\n    );\n    console.log(JSON.stringify({ tools: rows }, null, 2));\n    return 0;\n  } finally {\n    await dispose();\n  }\n}\n\nexport async function runCall(args: string[]): Promise<number> {\n  const [toolName, ...rest] = args;\n  if (!toolName || toolName.startsWith(\"--\")) {\n    console.error(\n      `Usage: tempo-mcp call <tool> --json '{\"orgId\": \"...\", ...}'\\nDiscover tools and their schemas with \\`tempo-mcp tools --schemas\\`.`,\n    );\n    return 1;\n  }\n\n  let jsonArg: string | null = null;\n  const serveFlags: string[] = [];\n  for (let i = 0; i < rest.length; i++) {\n    if (rest[i] === \"--json\") {\n      jsonArg = rest[++i] ?? null;\n    } else {\n      serveFlags.push(rest[i]);\n    }\n  }\n  let toolArgs: Record<string, unknown> = {};\n  if (jsonArg != null) {\n    if (jsonArg === \"-\") {\n      jsonArg = await readStdin();\n    }\n    try {\n      const parsed = JSON.parse(jsonArg) as unknown;\n      if (parsed === null || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n        console.error(\"--json must be a JSON object of tool arguments\");\n        return 1;\n      }\n      toolArgs = parsed as Record<string, unknown>;\n    } catch (err) {\n      console.error(\n        `--json is not valid JSON: ${err instanceof Error ? err.message : String(err)}`,\n      );\n      return 1;\n    }\n  }\n\n  const options = parseServeArgs(serveFlags);\n  if (\"error\" in options) {\n    console.error(options.error);\n    return 1;\n  }\n\n  await ensureCliAuth();\n  const { client, dispose } = await connectAggregate(options);\n  try {\n    const result = await client.callTool({\n      name: toolName,\n      arguments: toolArgs,\n    });\n    const content = Array.isArray(result.content) ? result.content : [];\n    for (const block of content) {\n      if (block.type === \"text\") {\n        console.log(block.text);\n      } else {\n        console.log(JSON.stringify(block));\n      }\n    }\n    return result.isError ? 1 : 0;\n  } finally {\n    await dispose();\n  }\n}\n\nfunction readStdin(): Promise<string> {\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    process.stdin.on(\"data\", (chunk) => chunks.push(Buffer.from(chunk)));\n    process.stdin.on(\"end\", () =>\n      resolve(Buffer.concat(chunks).toString(\"utf8\")),\n    );\n    process.stdin.on(\"error\", reject);\n  });\n}\n"],"mappings":";;;;;;;AAeA,SAAS,cAAc;AACvB,SAAS,yBAAyB;AASlC,eAAe,iBACb,SAC6B;AAC7B,QAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,qBAAY;AAC1D,QAAM,SAAS,MAAM,qBAAqB,OAAO;AACjD,QAAM,CAAC,iBAAiB,eAAe,IACrC,kBAAkB,iBAAiB;AACrC,QAAM,SAAS,IAAI,OAAO,EAAE,MAAM,iBAAiB,SAAS,IAAI,CAAC;AACjE,QAAM,OAAO,UAAU,QAAQ,eAAe;AAC9C,QAAM,OAAO,QAAQ,eAAe;AACpC,SAAO;AAAA,IACL;AAAA,IACA,SAAS,YAAY;AACnB,YAAM,OAAO,MAAM;AACnB,YAAM,OAAO,QAAQ;AAAA,IACvB;AAAA,EACF;AACF;AAGA,SAAS,YAAY,MAAgB,MAAoD;AACvF,QAAM,OAAO,KAAK,OAAO,CAAC,MAAM,MAAM,IAAI;AAC1C,SAAO,EAAE,SAAS,KAAK,WAAW,KAAK,QAAQ,KAAK;AACtD;AAEA,eAAsB,SAAS,MAAiC;AAC9D,QAAM,EAAE,SAAS,aAAa,KAAK,IAAI,YAAY,MAAM,WAAW;AACpE,QAAM,UAAU,eAAe,IAAI;AACnC,MAAI,WAAW,SAAS;AACtB,YAAQ,MAAM,QAAQ,KAAK;AAC3B,WAAO;AAAA,EACT;AAEA,QAAM,cAAc;AACpB,QAAM,EAAE,QAAQ,QAAQ,IAAI,MAAM,iBAAiB,OAAO;AAC1D,MAAI;AACF,UAAM,EAAE,MAAM,IAAI,MAAM,OAAO,UAAU;AACzC,UAAM,OAAO,MAAM;AAAA,MAAI,CAAC,SACtB,cACI;AAAA,QACE,MAAM,KAAK;AAAA,QACX,aAAa,KAAK;AAAA,QAClB,aAAa,KAAK;AAAA,MACpB,IACA,EAAE,MAAM,KAAK,MAAM,aAAa,KAAK,YAAY;AAAA,IACvD;AACA,YAAQ,IAAI,KAAK,UAAU,EAAE,OAAO,KAAK,GAAG,MAAM,CAAC,CAAC;AACpD,WAAO;AAAA,EACT,UAAE;AACA,UAAM,QAAQ;AAAA,EAChB;AACF;AAEA,eAAsB,QAAQ,MAAiC;AAC7D,QAAM,CAAC,UAAU,GAAG,IAAI,IAAI;AAC5B,MAAI,CAAC,YAAY,SAAS,WAAW,IAAI,GAAG;AAC1C,YAAQ;AAAA,MACN;AAAA;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,MAAI,UAAyB;AAC7B,QAAM,aAAuB,CAAC;AAC9B,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,QAAI,KAAK,CAAC,MAAM,UAAU;AACxB,gBAAU,KAAK,EAAE,CAAC,KAAK;AAAA,IACzB,OAAO;AACL,iBAAW,KAAK,KAAK,CAAC,CAAC;AAAA,IACzB;AAAA,EACF;AACA,MAAI,WAAoC,CAAC;AACzC,MAAI,WAAW,MAAM;AACnB,QAAI,YAAY,KAAK;AACnB,gBAAU,MAAM,UAAU;AAAA,IAC5B;AACA,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,OAAO;AACjC,UAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAC1E,gBAAQ,MAAM,gDAAgD;AAC9D,eAAO;AAAA,MACT;AACA,iBAAW;AAAA,IACb,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,6BAA6B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MAC/E;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,UAAU,eAAe,UAAU;AACzC,MAAI,WAAW,SAAS;AACtB,YAAQ,MAAM,QAAQ,KAAK;AAC3B,WAAO;AAAA,EACT;AAEA,QAAM,cAAc;AACpB,QAAM,EAAE,QAAQ,QAAQ,IAAI,MAAM,iBAAiB,OAAO;AAC1D,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,SAAS;AAAA,MACnC,MAAM;AAAA,MACN,WAAW;AAAA,IACb,CAAC;AACD,UAAM,UAAU,MAAM,QAAQ,OAAO,OAAO,IAAI,OAAO,UAAU,CAAC;AAClE,eAAW,SAAS,SAAS;AAC3B,UAAI,MAAM,SAAS,QAAQ;AACzB,gBAAQ,IAAI,MAAM,IAAI;AAAA,MACxB,OAAO;AACL,gBAAQ,IAAI,KAAK,UAAU,KAAK,CAAC;AAAA,MACnC;AAAA,IACF;AACA,WAAO,OAAO,UAAU,IAAI;AAAA,EAC9B,UAAE;AACA,UAAM,QAAQ;AAAA,EAChB;AACF;AAEA,SAAS,YAA6B;AACpC,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,SAAmB,CAAC;AAC1B,YAAQ,MAAM,GAAG,QAAQ,CAAC,UAAU,OAAO,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;AACnE,YAAQ,MAAM;AAAA,MAAG;AAAA,MAAO,MACtB,QAAQ,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,CAAC;AAAA,IAChD;AACA,YAAQ,MAAM,GAAG,SAAS,MAAM;AAAA,EAClC,CAAC;AACH;","names":[]}

package/dist/{chunk-EYHFTWP5.js → chunk-6HT4KAGI.js}

@@ -1,10 +1,12 @@
 import { createRequire as __tempoCreateRequire } from 'node:module'; const require = __tempoCreateRequire(import.meta.url);
 import {
   clearAuth,
+  ensureCliAuth,
+  envAccessToken,
   parseServeArgs,
   readAuth,
   startBrowserAuthFlow
-} from "./chunk-JDPG7F4Z.js";
+} from "./chunk-J43EDR63.js";
 
 // src/help.ts
 var USAGE = `tempo-mcp <subcommand>
@@ -27,14 +29,30 @@ Server:
                          scripts,slack,linear,canvas). Default: all.
     --readonly           Register no write tools at all
 
+Direct tool access (for hosts without MCP support \u2014 Codex cloud, bots):
+  tools [--schemas]      List every tool (add --schemas for arg schemas)
+  call <tool> --json '{"orgId": "..."}'
+                         Invoke any tool; same pipeline as the MCP server.
+                         --json - reads the argument object from stdin.
+                         Both accept --toolsets / --readonly.
+
 Auth (identity only):
   login                  Sign in via the browser (stores ~/.tempo/auth.json)
   logout                 Clear stored credentials
-  whoami                 Show the signed-in user
+  whoami                 Show the signed-in user (exchanges TEMPO_AUTH_TOKEN
+                         if set \u2014 the smoke test for headless environments)
+  token create [--name <label>]
+                         Mint a personal access token (printed once) for
+                         headless environments \u2014 cloud sandboxes with no
+                         browser. Set it there as TEMPO_AUTH_TOKEN.
+  token list             List your tokens
+  token revoke <id-or-prefix>
+                         Revoke a token
 
 Environment:
   TEMPO_CONVEX_URL       Override the Convex deployment (default: production)
   TEMPO_MCP_READONLY=1   Same as --readonly
+  TEMPO_AUTH_TOKEN       Personal access token \u2014 signs in without a browser
 `;
 
 // src/login.ts
@@ -88,7 +106,19 @@ async function runLogin() {
 
 // src/whoami.ts
 async function runWhoami() {
-  const auth = await readAuth();
+  let auth = await readAuth();
+  if (envAccessToken()) {
+    try {
+      await ensureCliAuth();
+      auth = await readAuth();
+    } catch (err) {
+      console.error(
+        "TEMPO_AUTH_TOKEN sign-in failed:",
+        err instanceof Error ? err.message : String(err)
+      );
+      return 1;
+    }
+  }
   if (!auth) {
     console.log("Not signed in. Run `tempo-mcp login`.");
     return 1;
@@ -127,7 +157,7 @@ async function run(argv) {
         process.stderr.write(USAGE);
         return 1;
       }
-      const { runServe } = await import("./serve-ODDE266E.js");
+      const { runServe } = await import("./serve-JG5U3XF4.js");
       return await runServe(options);
     }
     switch (subcommand) {
@@ -137,6 +167,18 @@ async function run(argv) {
         return await runLogout();
       case "whoami":
         return await runWhoami();
+      case "token": {
+        const { runToken } = await import("./token-VESH5QAF.js");
+        return await runToken(rest);
+      }
+      case "tools": {
+        const { runTools } = await import("./call-6CDIHKDB.js");
+        return await runTools(rest);
+      }
+      case "call": {
+        const { runCall } = await import("./call-6CDIHKDB.js");
+        return await runCall(rest);
+      }
       default:
         console.error(`Unknown subcommand: ${subcommand}`);
         process.stderr.write(USAGE);
@@ -153,4 +195,4 @@ async function run(argv) {
 export {
   run
 };
-//# sourceMappingURL=chunk-EYHFTWP5.js.map
+//# sourceMappingURL=chunk-6HT4KAGI.js.map

package/dist/chunk-6HT4KAGI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/help.ts","../src/login.ts","../src/whoami.ts","../src/index.ts"],"sourcesContent":["export const USAGE = `tempo-mcp <subcommand>\n\nTempo's MCP server — issues, docs, comments, agents, scripts, Slack,\nLinear, and (inside a Tempo repo) canvas tools, served as ONE stdio MCP\nserver.\n\nMCP host config (Claude Code / Codex / Cursor):\n  { \"tempo\": { \"command\": \"npx\", \"args\": [\"-y\", \"@tempo-ai/mcp\"] } }\n\nScoping: the AI passes an explicit orgId (and projectId where\nproject-scoped) on every tool call, discovered via the built-in\ntempo_list_orgs / tempo_list_projects tools. Nothing org-related is\nconfigured on the connection.\n\nServer:\n  (default) | serve      Serve the aggregate MCP server over stdio\n    --toolsets a,b       Only these toolsets (issues,docs,comments,agents,\n                         scripts,slack,linear,canvas). Default: all.\n    --readonly           Register no write tools at all\n\nDirect tool access (for hosts without MCP support — Codex cloud, bots):\n  tools [--schemas]      List every tool (add --schemas for arg schemas)\n  call <tool> --json '{\"orgId\": \"...\"}'\n                         Invoke any tool; same pipeline as the MCP server.\n                         --json - reads the argument object from stdin.\n                         Both accept --toolsets / --readonly.\n\nAuth (identity only):\n  login                  Sign in via the browser (stores ~/.tempo/auth.json)\n  logout                 Clear stored credentials\n  whoami                 Show the signed-in user (exchanges TEMPO_AUTH_TOKEN\n                         if set — the smoke test for headless environments)\n  token create [--name <label>]\n                         Mint a personal access token (printed once) for\n                         headless environments — cloud sandboxes with no\n                         browser. Set it there as TEMPO_AUTH_TOKEN.\n  token list             List your tokens\n  token revoke <id-or-prefix>\n                         Revoke a token\n\nEnvironment:\n  TEMPO_CONVEX_URL       Override the Convex deployment (default: production)\n  TEMPO_MCP_READONLY=1   Same as --readonly\n  TEMPO_AUTH_TOKEN       Personal access token — signs in without a browser\n`;\n","/**\n * `tempo-mcp login` — open the browser, wait for the user to sign in, store\n * credentials in ~/.tempo/auth.json. Reuses the same localhost-callback\n * primitive that the Electron app uses (web-auth Callback.tsx POSTs to\n * `127.0.0.1:{port}/tempo/auth`).\n *\n * Returns an exit code — see `whoami.ts` for the rationale.\n */\n\nimport { exec } from \"node:child_process\";\nimport { promisify } from \"node:util\";\nimport { startBrowserAuthFlow, readAuth } from \"@tempo-modules/mcp-runtime\";\n\nconst execAsync = promisify(exec);\n\n/**\n * Cross-platform \"open this URL in the user's default browser\". macOS uses\n * `open`, Linux `xdg-open`, Windows `start`. Falls back to printing the\n * URL if none of those exist (e.g. a headless server).\n */\nasync function openInBrowser(url: string): Promise<boolean> {\n  const cmd =\n    process.platform === \"darwin\"\n      ? `open \"${url}\"`\n      : process.platform === \"win32\"\n        ? `start \"\" \"${url}\"`\n        : `xdg-open \"${url}\"`;\n  try {\n    await execAsync(cmd, { windowsHide: true });\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport async function runLogin(): Promise<number> {\n  const existing = await readAuth();\n  if (existing && existing.expiresAt - Date.now() > 60_000) {\n    console.log(\n      `Already signed in as ${existing.email ?? existing.userId}. Run \\`tempo-mcp logout\\` first to re-authenticate.`,\n    );\n    return 0;\n  }\n\n  // TEMPO_AUTH_URL redirects the sign-in page (previews, e2e);\n  // TEMPO_MCP_NO_BROWSER=1 suppresses the browser launch (headless/e2e).\n  const handle = await startBrowserAuthFlow({\n    authUrl: process.env.TEMPO_AUTH_URL,\n  });\n  const opened =\n    process.env.TEMPO_MCP_NO_BROWSER === \"1\"\n      ? false\n      : await openInBrowser(handle.signInUrl);\n\n  if (opened) {\n    console.log(\"Opened your browser to sign in to Tempo.\");\n    console.log(\"If a browser didn't open, visit this URL:\");\n  } else {\n    console.log(\"Sign in to Tempo by visiting:\");\n  }\n  console.log(`  ${handle.signInUrl}`);\n  console.log(\"\");\n  console.log(\"Waiting for sign-in to complete...\");\n\n  try {\n    await handle.done;\n    const stored = await readAuth();\n    console.log(\"\");\n    console.log(\n      `Signed in as ${stored?.email ?? stored?.userId ?? \"unknown user\"}.`,\n    );\n    console.log(`Credentials stored in ~/.tempo/auth.json (0600).`);\n    return 0;\n  } catch (err) {\n    console.error(\"Sign-in failed:\", err instanceof Error ? err.message : err);\n    return 1;\n  }\n}\n","import { readAuth, clearAuth, envAccessToken } from \"@tempo-modules/mcp-runtime\";\nimport { ensureCliAuth } from \"./cli-auth.ts\";\n\n/**\n * Subcommand handlers return an exit code (0 = success, 1 = error). The\n * dispatcher in `index.ts` is responsible for actually calling process.exit\n * — keeping it out of the handlers makes them unit-testable without\n * stubbing process.exit.\n */\n\nexport async function runWhoami(): Promise<number> {\n  let auth = await readAuth();\n  if (envAccessToken()) {\n    // Headless environment: the env token is AUTHORITATIVE — exchange it\n    // unless the cached credentials provably came from this exact token\n    // (`whoami` is the standard smoke test after pasting TEMPO_AUTH_TOKEN,\n    // so it must never report a stale cached identity).\n    try {\n      await ensureCliAuth();\n      auth = await readAuth();\n    } catch (err) {\n      console.error(\n        \"TEMPO_AUTH_TOKEN sign-in failed:\",\n        err instanceof Error ? err.message : String(err),\n      );\n      return 1;\n    }\n  }\n  if (!auth) {\n    console.log(\"Not signed in. Run `tempo-mcp login`.\");\n    return 1;\n  }\n  const display = auth.email\n    ? `${auth.email} (${auth.userId})`\n    : auth.userId;\n  console.log(`Signed in as: ${display}`);\n  const ttlMs = auth.expiresAt - Date.now();\n  if (ttlMs <= 0) {\n    console.log(\n      `Token state:  expired ${Math.round(-ttlMs / 1000)}s ago (refresh on next call)`,\n    );\n  } else {\n    console.log(`Token state:  fresh, expires in ${Math.round(ttlMs / 1000)}s`);\n  }\n  return 0;\n}\n\nexport async function runLogout(): Promise<number> {\n  await clearAuth();\n  console.log(\"Signed out. Run `tempo-mcp login` to sign in again.\");\n  return 0;\n}\n","/**\n * Tempo MCP CLI entrypoint.\n *\n * The DEFAULT command (no subcommand) serves Tempo's full MCP tool surface\n * over stdio — that's what an MCP host config invokes:\n *   { \"tempo\": { \"command\": \"npx\", \"args\": [\"-y\", \"@tempo-ai/mcp\"] } }\n *\n * Subcommand routing:\n *   (none) | serve [--toolsets a,b] [--readonly] [--org id] [--project id]\n *       → run the aggregate MCP server over stdio (long-running)\n *   login | logout | whoami | orgs → auth utilities (short-lived)\n *   --help | -h → print usage\n */\n\nimport { USAGE } from \"./help.ts\";\nimport { runLogin } from \"./login.ts\";\nimport { runLogout, runWhoami } from \"./whoami.ts\";\nimport { parseServeArgs } from \"./config.ts\";\n\nexport async function run(argv: string[]): Promise<number> {\n  const [, , subcommand, ...rest] = argv;\n\n  if (subcommand === \"--help\" || subcommand === \"-h\" || subcommand === \"help\") {\n    process.stdout.write(USAGE);\n    return 0;\n  }\n\n  try {\n    // Bare invocation and flag-only invocations serve; `serve` is the\n    // explicit spelling.\n    if (\n      !subcommand ||\n      subcommand === \"serve\" ||\n      subcommand.startsWith(\"--\")\n    ) {\n      const serveArgs =\n        !subcommand || subcommand === \"serve\"\n          ? rest\n          : [subcommand, ...rest];\n      const options = parseServeArgs(serveArgs);\n      if (\"error\" in options) {\n        console.error(options.error);\n        process.stderr.write(USAGE);\n        return 1;\n      }\n      const { runServe } = await import(\"./serve.ts\");\n      return await runServe(options);\n    }\n\n    switch (subcommand) {\n      case \"login\":\n        return await runLogin();\n      case \"logout\":\n        return await runLogout();\n      case \"whoami\":\n        return await runWhoami();\n      case \"token\": {\n        const { runToken } = await import(\"./token.ts\");\n        return await runToken(rest);\n      }\n      case \"tools\": {\n        const { runTools } = await import(\"./call.ts\");\n        return await runTools(rest);\n      }\n      case \"call\": {\n        const { runCall } = await import(\"./call.ts\");\n        return await runCall(rest);\n      }\n      default:\n        console.error(`Unknown subcommand: ${subcommand}`);\n        process.stderr.write(USAGE);\n        return 1;\n    }\n  } catch (err) {\n    console.error(\n      err instanceof Error ? err.stack || err.message : String(err),\n    );\n    return 1;\n  }\n}\n"],"mappings":";;;;;;;;;;;AAAO,IAAM,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACSrB,SAAS,YAAY;AACrB,SAAS,iBAAiB;AAG1B,IAAM,YAAY,UAAU,IAAI;AAOhC,eAAe,cAAc,KAA+B;AAC1D,QAAM,MACJ,QAAQ,aAAa,WACjB,SAAS,GAAG,MACZ,QAAQ,aAAa,UACnB,aAAa,GAAG,MAChB,aAAa,GAAG;AACxB,MAAI;AACF,UAAM,UAAU,KAAK,EAAE,aAAa,KAAK,CAAC;AAC1C,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,WAA4B;AAChD,QAAM,WAAW,MAAM,SAAS;AAChC,MAAI,YAAY,SAAS,YAAY,KAAK,IAAI,IAAI,KAAQ;AACxD,YAAQ;AAAA,MACN,wBAAwB,SAAS,SAAS,SAAS,MAAM;AAAA,IAC3D;AACA,WAAO;AAAA,EACT;AAIA,QAAM,SAAS,MAAM,qBAAqB;AAAA,IACxC,SAAS,QAAQ,IAAI;AAAA,EACvB,CAAC;AACD,QAAM,SACJ,QAAQ,IAAI,yBAAyB,MACjC,QACA,MAAM,cAAc,OAAO,SAAS;AAE1C,MAAI,QAAQ;AACV,YAAQ,IAAI,0CAA0C;AACtD,YAAQ,IAAI,2CAA2C;AAAA,EACzD,OAAO;AACL,YAAQ,IAAI,+BAA+B;AAAA,EAC7C;AACA,UAAQ,IAAI,KAAK,OAAO,SAAS,EAAE;AACnC,UAAQ,IAAI,EAAE;AACd,UAAQ,IAAI,oCAAoC;AAEhD,MAAI;AACF,UAAM,OAAO;AACb,UAAM,SAAS,MAAM,SAAS;AAC9B,YAAQ,IAAI,EAAE;AACd,YAAQ;AAAA,MACN,gBAAgB,QAAQ,SAAS,QAAQ,UAAU,cAAc;AAAA,IACnE;AACA,YAAQ,IAAI,kDAAkD;AAC9D,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,YAAQ,MAAM,mBAAmB,eAAe,QAAQ,IAAI,UAAU,GAAG;AACzE,WAAO;AAAA,EACT;AACF;;;ACnEA,eAAsB,YAA6B;AACjD,MAAI,OAAO,MAAM,SAAS;AAC1B,MAAI,eAAe,GAAG;AAKpB,QAAI;AACF,YAAM,cAAc;AACpB,aAAO,MAAM,SAAS;AAAA,IACxB,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN;AAAA,QACA,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MACjD;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,CAAC,MAAM;AACT,YAAQ,IAAI,uCAAuC;AACnD,WAAO;AAAA,EACT;AACA,QAAM,UAAU,KAAK,QACjB,GAAG,KAAK,KAAK,KAAK,KAAK,MAAM,MAC7B,KAAK;AACT,UAAQ,IAAI,iBAAiB,OAAO,EAAE;AACtC,QAAM,QAAQ,KAAK,YAAY,KAAK,IAAI;AACxC,MAAI,SAAS,GAAG;AACd,YAAQ;AAAA,MACN,yBAAyB,KAAK,MAAM,CAAC,QAAQ,GAAI,CAAC;AAAA,IACpD;AAAA,EACF,OAAO;AACL,YAAQ,IAAI,mCAAmC,KAAK,MAAM,QAAQ,GAAI,CAAC,GAAG;AAAA,EAC5E;AACA,SAAO;AACT;AAEA,eAAsB,YAA6B;AACjD,QAAM,UAAU;AAChB,UAAQ,IAAI,qDAAqD;AACjE,SAAO;AACT;;;AChCA,eAAsB,IAAI,MAAiC;AACzD,QAAM,CAAC,EAAE,EAAE,YAAY,GAAG,IAAI,IAAI;AAElC,MAAI,eAAe,YAAY,eAAe,QAAQ,eAAe,QAAQ;AAC3E,YAAQ,OAAO,MAAM,KAAK;AAC1B,WAAO;AAAA,EACT;AAEA,MAAI;AAGF,QACE,CAAC,cACD,eAAe,WACf,WAAW,WAAW,IAAI,GAC1B;AACA,YAAM,YACJ,CAAC,cAAc,eAAe,UAC1B,OACA,CAAC,YAAY,GAAG,IAAI;AAC1B,YAAM,UAAU,eAAe,SAAS;AACxC,UAAI,WAAW,SAAS;AACtB,gBAAQ,MAAM,QAAQ,KAAK;AAC3B,gBAAQ,OAAO,MAAM,KAAK;AAC1B,eAAO;AAAA,MACT;AACA,YAAM,EAAE,SAAS,IAAI,MAAM,OAAO,qBAAY;AAC9C,aAAO,MAAM,SAAS,OAAO;AAAA,IAC/B;AAEA,YAAQ,YAAY;AAAA,MAClB,KAAK;AACH,eAAO,MAAM,SAAS;AAAA,MACxB,KAAK;AACH,eAAO,MAAM,UAAU;AAAA,MACzB,KAAK;AACH,eAAO,MAAM,UAAU;AAAA,MACzB,KAAK,SAAS;AACZ,cAAM,EAAE,SAAS,IAAI,MAAM,OAAO,qBAAY;AAC9C,eAAO,MAAM,SAAS,IAAI;AAAA,MAC5B;AAAA,MACA,KAAK,SAAS;AACZ,cAAM,EAAE,SAAS,IAAI,MAAM,OAAO,oBAAW;AAC7C,eAAO,MAAM,SAAS,IAAI;AAAA,MAC5B;AAAA,MACA,KAAK,QAAQ;AACX,cAAM,EAAE,QAAQ,IAAI,MAAM,OAAO,oBAAW;AAC5C,eAAO,MAAM,QAAQ,IAAI;AAAA,MAC3B;AAAA,MACA;AACE,gBAAQ,MAAM,uBAAuB,UAAU,EAAE;AACjD,gBAAQ,OAAO,MAAM,KAAK;AAC1B,eAAO;AAAA,IACX;AAAA,EACF,SAAS,KAAK;AACZ,YAAQ;AAAA,MACN,eAAe,QAAQ,IAAI,SAAS,IAAI,UAAU,OAAO,GAAG;AAAA,IAC9D;AACA,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/{chunk-JDPG7F4Z.js → chunk-J43EDR63.js}

@@ -107,11 +107,23 @@ function createRefreshLoop(opts) {
   const maxRetries = opts.maxRetries ?? 3;
   let timer = null;
   let stopped = false;
+  async function reauthOrGiveUp() {
+    if (opts.attemptReauth) {
+      try {
+        if (await opts.attemptReauth()) {
+          const fresh = await readAuth();
+          if (fresh) return fresh.token;
+        }
+      } catch {
+      }
+    }
+    opts.onReauthRequired();
+    return null;
+  }
   async function refreshNow() {
     const current = await readAuth();
     if (!current) {
-      opts.onReauthRequired();
-      return null;
+      return reauthOrGiveUp();
     }
     for (let attempt = 0; attempt <= maxRetries; attempt++) {
       try {
@@ -122,21 +134,18 @@ function createRefreshLoop(opts) {
         });
         if (res.status === 401) {
           await clearAuth();
-          opts.onReauthRequired();
-          return null;
+          return reauthOrGiveUp();
         }
         if (!res.ok) {
           if (attempt < maxRetries) {
             await sleep(retryDelay * Math.pow(1.5, attempt));
             continue;
           }
-          opts.onReauthRequired();
-          return null;
+          return reauthOrGiveUp();
         }
         const body = await res.json();
         if (!body.token) {
-          opts.onReauthRequired();
-          return null;
+          return reauthOrGiveUp();
         }
         const next = {
           ...current,
@@ -150,8 +159,7 @@ function createRefreshLoop(opts) {
           await sleep(retryDelay * Math.pow(1.5, attempt));
           continue;
         }
-        opts.onReauthRequired();
-        return null;
+        return reauthOrGiveUp();
       }
     }
     return null;
@@ -225,6 +233,98 @@ function createAuthProvider(refreshLoop) {
   };
 }
 
+// ../mcp-runtime/auth/token-exchange.ts
+import { createHash } from "crypto";
+var ENV_TOKEN_VAR = "TEMPO_AUTH_TOKEN";
+function envAccessToken() {
+  const raw = process.env[ENV_TOKEN_VAR]?.trim();
+  return raw ? raw : null;
+}
+function accessTokenFingerprint(accessToken) {
+  return createHash("sha256").update(accessToken).digest("hex").slice(0, 16);
+}
+function storedAuthMatchesAccessToken(stored, accessToken) {
+  return stored.accessTokenFingerprint === accessTokenFingerprint(accessToken);
+}
+var TokenExchangeError = class extends Error {
+  constructor(message, kind) {
+    super(message);
+    this.kind = kind;
+    this.name = "TokenExchangeError";
+  }
+};
+async function exchangeAccessToken(opts) {
+  const maxRetries = opts.maxRetries ?? 2;
+  const retryDelay = opts.retryDelayMs ?? 2e3;
+  let lastTransient = "exchange failed";
+  for (let attempt = 0; attempt <= maxRetries; attempt++) {
+    let res;
+    try {
+      res = await fetch(`${opts.convexSiteUrl}/auth/token-exchange`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ token: opts.accessToken })
+      });
+    } catch (err) {
+      lastTransient = err instanceof Error ? err.message : String(err);
+      if (attempt < maxRetries) {
+        await sleep2(retryDelay * Math.pow(1.5, attempt));
+        continue;
+      }
+      break;
+    }
+    if (res.status === 401) {
+      throw new TokenExchangeError(
+        `${ENV_TOKEN_VAR} was rejected (revoked or invalid). Mint a new token with \`tempo-mcp token create\` on a signed-in machine.`,
+        "invalid_token"
+      );
+    }
+    if (!res.ok) {
+      lastTransient = `token exchange returned ${res.status}`;
+      if (attempt < maxRetries) {
+        await sleep2(retryDelay * Math.pow(1.5, attempt));
+        continue;
+      }
+      break;
+    }
+    const body = await res.json();
+    if (!body.token || !body.sessionId || !body.userId) {
+      throw new TokenExchangeError(
+        "token exchange returned an incomplete payload",
+        "transient"
+      );
+    }
+    const stored = {
+      token: body.token,
+      sessionId: body.sessionId,
+      userId: body.userId,
+      email: decodeJwtEmail(body.token),
+      expiresAt: decodeJwtExp(body.token),
+      accessTokenFingerprint: accessTokenFingerprint(opts.accessToken)
+    };
+    await writeAuth(stored);
+    return stored;
+  }
+  throw new TokenExchangeError(
+    `Tempo token exchange failed: ${lastTransient}`,
+    "transient"
+  );
+}
+function decodeJwtEmail(jwt) {
+  try {
+    const [, payload] = jwt.split(".");
+    const decoded = JSON.parse(
+      Buffer.from(payload, "base64").toString("utf8")
+    );
+    return typeof decoded.email === "string" ? decoded.email : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function sleep2(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
 // ../mcp-runtime/auth/browser-flow.ts
 import http from "http";
 async function startBrowserAuthFlow(opts = {}) {
@@ -293,7 +393,7 @@ async function startBrowserAuthFlow(opts = {}) {
     throw new Error("Failed to bind callback listener");
   }
   const callbackPort = address.port;
-  const signInUrl = `${authUrl}/sign-in?callbackPort=${callbackPort}`;
+  const signInUrl = `${authUrl}/sign-in?callbackPort=${callbackPort}&flow=mcp`;
   const timeoutTimer = setTimeout(() => {
     server.close();
     rejectDone(new Error(`Sign-in timeout after ${timeoutMs}ms`));
@@ -572,6 +672,9 @@ function installProcessSafety(opts = {}) {
   };
 }
 
+// ../mcp-runtime/transport/pin-interceptor.ts
+import { randomUUID as randomUUID2 } from "crypto";
+
 // ../mcp-runtime/elicitation/auth-elicitation.ts
 async function requestAuthElicitation(opts = {}) {
   const handle = await startBrowserAuthFlow({
@@ -594,9 +697,6 @@ async function ensureAuth(opts = {}) {
   return { hadExistingAuth: false, signInUrl: eli.signInUrl };
 }
 
-// ../mcp-runtime/transport/pin-interceptor.ts
-import { randomUUID as randomUUID2 } from "crypto";
-
 // src/config.ts
 import fs3 from "fs";
 import path4 from "path";
@@ -667,6 +767,136 @@ function discoverWorkspace(startDir = process.cwd()) {
   }
 }
 
+// ../convex-http-client-auth/client.ts
+import { ConvexHttpClient } from "convex/browser";
+
+// ../convex-http-client-auth/errors.ts
+var McpToolError = class extends Error {
+  constructor(error) {
+    super(error.message);
+    this.name = "McpToolError";
+    this.error = error;
+  }
+};
+function mapConvexError(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  if (message.includes("Not authenticated") || message.includes("Unauthenticated")) {
+    return { code: "auth_required", message: "Authentication required. Please sign in." };
+  }
+  if (message.includes("not a member") || message.includes("Unauthorized") || message.includes("forbidden")) {
+    return { code: "forbidden", message: "You are not a member of this organization." };
+  }
+  if (message.includes("not found") || message.includes("Could not find")) {
+    return { code: "not_found", message };
+  }
+  if (message.includes("rate limit") || message.includes("Too many requests")) {
+    return { code: "rate_limited", message: "Rate limited. Please retry after a moment." };
+  }
+  if (message.includes("Invalid argument") || message.includes("Validator error")) {
+    return { code: "invalid_args", message };
+  }
+  return { code: "internal", message };
+}
+
+// ../convex-http-client-auth/client.ts
+var MAX_RETRIES = 3;
+var BASE_DELAY_MS = 200;
+var AuthedConvexClient = class {
+  constructor(opts) {
+    this.cachedToken = null;
+    this.client = new ConvexHttpClient(opts.url);
+    this.authProvider = opts.authProvider;
+  }
+  async query(fn, args) {
+    return this.callWithAuth(() => this.client.query(fn, args));
+  }
+  async mutation(fn, args) {
+    return this.callWithAuth(() => this.client.mutation(fn, args));
+  }
+  async action(fn, args) {
+    return this.callWithAuth(() => this.client.action(fn, args));
+  }
+  async ensureAuth() {
+    const now = Date.now();
+    if (this.cachedToken && this.cachedToken.expiresAt - now > 3e4) {
+      this.client.setAuth(this.cachedToken.jwt);
+      return;
+    }
+    const token = await this.authProvider.getToken();
+    this.cachedToken = token;
+    this.client.setAuth(token.jwt);
+  }
+  async callWithAuth(fn) {
+    await this.ensureAuth();
+    for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
+      try {
+        return await fn();
+      } catch (err) {
+        const mapped = mapConvexError(err);
+        if (mapped.code === "auth_required" && attempt === 0) {
+          this.cachedToken = null;
+          await this.ensureAuth();
+          continue;
+        }
+        if (mapped.code === "internal" && attempt < MAX_RETRIES - 1) {
+          await sleep3(BASE_DELAY_MS * 2 ** attempt);
+          continue;
+        }
+        throw new McpToolError(mapped);
+      }
+    }
+    throw new McpToolError({
+      code: "internal",
+      message: "Max retries exceeded"
+    });
+  }
+};
+function sleep3(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/cli-auth.ts
+async function ensureCliAuth() {
+  const accessToken = envAccessToken();
+  if (!accessToken) {
+    await ensureAuth();
+    return;
+  }
+  const existing = await readAuth();
+  if (existing && storedAuthMatchesAccessToken(existing, accessToken) && existing.expiresAt - Date.now() > 6e4) {
+    return;
+  }
+  await exchangeAccessToken({
+    convexSiteUrl: resolveConvexSiteUrl(resolveConvexUrl()),
+    accessToken
+  });
+}
+function envTokenReauth(convexSiteUrl) {
+  return async () => {
+    const accessToken = envAccessToken();
+    if (!accessToken) return false;
+    await exchangeAccessToken({ convexSiteUrl, accessToken });
+    return true;
+  };
+}
+function createCliConvex() {
+  const convexUrl = resolveConvexUrl();
+  const convexSiteUrl = resolveConvexSiteUrl(convexUrl);
+  const refreshLoop = createRefreshLoop({
+    convexSiteUrl,
+    attemptReauth: envTokenReauth(convexSiteUrl),
+    onReauthRequired: () => {
+      console.error(
+        "[tempo-mcp] Tempo session expired. Run `tempo-mcp login` to sign in again."
+      );
+    }
+  });
+  refreshLoop.start();
+  const authProvider = createAuthProvider(refreshLoop);
+  const convex = new AuthedConvexClient({ url: convexUrl, authProvider });
+  return { convex, authProvider, dispose: () => refreshLoop.stop() };
+}
+
 export {
   __require,
   __commonJS,
@@ -676,13 +906,18 @@ export {
   clearAuth,
   createRefreshLoop,
   createAuthProvider,
+  envAccessToken,
   startBrowserAuthFlow,
   createAggregateServer,
   installProcessSafety,
-  ensureAuth,
+  McpToolError,
+  AuthedConvexClient,
   resolveConvexUrl,
   resolveConvexSiteUrl,
   parseServeArgs,
-  discoverWorkspace
+  discoverWorkspace,
+  ensureCliAuth,
+  envTokenReauth,
+  createCliConvex
 };
-//# sourceMappingURL=chunk-JDPG7F4Z.js.map
+//# sourceMappingURL=chunk-J43EDR63.js.map