@thalovant/mcp-server 0.6.0 → 0.6.2

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.6.2 — 2026-10-02
+
+- Takes `@thalovant/sdk` ^0.9.3, which the lock resolves. Its `reply.claimed` now recognizes a skill's own confident fallback-tier answer; the earlier range silently swallowed a genuinely successful Home Assistant reply (a `claimed` answer from the home skill's fallback tier read as "nothing answered"). No code change in this package: the logic is the SDK's `replyClaimMetadata`, which `src/reply-output.ts` delegates to.
+- The parity contract acknowledges the reference's final round-two digest, and the vendored `reply-claim-vectors.json` carries the round's cases with each event's name and meta, so the assertion-on-a-non-speak-event-is-ignored case is actually exercised rather than built as a bare `speak`.
+- `package.json`, `server.json`, the OCI label and this file move to 0.6.2 together, so the release inventory's `compatible_node_sdk` can follow `package.json` to `@thalovant/sdk ^0.9.3`: the platform contracts gate compares the two byte for byte, and the dependency moved on 2026-09-30 without a release to record it.
+
+## 0.6.1 — 2026-09-28
+
+- **Sign in as a registered app.** `thalovant_begin_device_login` takes an optional `clientId`, passed to the API as `client_id` only when given: `thalovant-home-assistant` makes the approval page show the platform's name for Home Assistant as verified, and approving it again replaces the token it already holds. An id the API does not know is refused with 400 `unknown_client`, and the tool error carries the code and sentence like any other refusal.
+- **An echoed validation input never reaches a tool error.** The `fields:` line of a tool error printed a validation error's `input` whenever it was a bare string or sat under an ordinary key: the secret redaction matches key names only. Each entry of a `detail` or Problem+JSON `errors` list now has its `input` replaced with `"[omitted]"` before redaction, whatever its key or shape.
+- **Where the Noise key lives.** `@thalovant/sdk` 0.9.1 keeps an identity file's Noise key and hub pins in that file's folder, so every program reading the file presents one key, and copies them there once from the shared folder when that key already met the hub. Runtime tools given an `identityFile` follow it.
+- Takes `@thalovant/sdk` ^0.9.1, which carries `clientId`, `describeDeviceLogin()`, the refused-client-key error and the key folder. The lock resolves the published 0.9.1.
+- `fast-uri`, which `ajv` brings in, is overridden to 3.1.8: 3.1.6 now carries two high advisories (GHSA-qw65-cvwx-89v3, GHSA-58mr-gqgx-xq4g), and 3.1.8 still satisfies `ajv`'s `^3.0.1`.
+- The parity contract acknowledges the reference's `3b0acf7c8b2f` and declares its new `link-carriers` capability not applicable: this server's carriers are the Node SDK's, which runs those vectors. The re-vendored `api-error-vectors.json` and `device-login-vectors.json` run through the SDK that resolves here and through the tools over stdio; the `describe` cases through the SDK only, since a model has no approval screen to read. All 78 recorded cases, and each file's digest, equal the reference's.
+
 ## 0.6.0 — 2026-09-28
 
 Link Home Assistant, or any home controller, to a hub from an agent: sign in on the device, create a connection of the `home_assistant` kind, and wait for the hub to admit it. Existing tool schemas are unchanged; every addition is optional.

package/README.md

@@ -49,7 +49,7 @@ With none of these configured, a person can sign the server in through the brows
 
 A tool call cannot wait for a person, so the device flow (RFC 8628) is two tools:
 
-1. `thalovant_begin_device_login` with optional `scopes` (an empty list, like none, asks for the API's default) and `clientName` answers `loginId`, `userCode`, `verificationUri`, `verificationUriComplete`, `interval` and `expiresIn`. Show the person the URL and the code.
+1. `thalovant_begin_device_login` with optional `scopes` (an empty list, like none, asks for the API's default), `clientName` and `clientId` answers `loginId`, `userCode`, `verificationUri`, `verificationUriComplete`, `interval` and `expiresIn`. Show the person the URL and the code. `clientId` signs in as a registered app, `thalovant-home-assistant` for Home Assistant: the approval page shows the platform's name for it as verified, and approving it again replaces the token it already holds. An id the API does not know is refused (400 `unknown_client`).
 2. `thalovant_poll_device_login` with that `loginId` asks once. `outcome` is `pending` (poll again after `interval` seconds, already five seconds longer for good if the API asked to slow down), `approved` (with `tokenId`, `scopes` and `expiresAt`), `expired` or `denied`.
 
 The device code and the token never reach the model: the server keeps both, bound to the principal that began the sign-in, for the life of the process. Once approved, every control-plane tool for that principal uses the token when no credential is configured. `thalovant_revoke_device_login` signs out: it revokes that token (a token may always revoke itself, and one already revoked counts as revoked) and forgets it; signing out again answers `alreadyRevoked` without a request, and configured tokens are never touched. A sign-in reaches only the configured API origin (`THALOVANT_API_URL`, or the default), since the verification URL it answers with is shown to a person. A Home Assistant link asks for `hubs:read`, `clients:read` and `clients:write`, which is also all a Free plan can approve.
@@ -453,8 +453,9 @@ fields: {"allowed_images":{"bus":[...],"core":[...]},"allowed_repositories":{"co
 - `fields` is every other member of the error body as compact JSON (the
   Problem+JSON `type`, `title`, `status` and `instance` are left out), with the
   same secret redaction as every other tool output. A value a validation error
-  echoes back from the request is redacted there and never reaches the first
-  line. A plan refusal carries `resource`, `limit`, `used` and `plan` here.
+  echoes back from the request -- each entry's `input` in a `detail` or
+  `errors` list, whatever its key or shape -- is replaced with `"[omitted]"`
+  there and never reaches the first line. A plan refusal carries `resource`, `limit`, `used` and `plan` here.
 
 A hint may follow for statuses that need one. A `platform_image_required` or
 `plan_limit` 403 gets its own hint rather than the general scope hint.
@@ -530,7 +531,7 @@ Runtime calls sharing the same hub client identity run sequentially within one
 MCP process. Use a distinct client identity for each independently running MCP
 server so the hub can keep their sessions separate.
 
-Version 0.6.0 requires `@thalovant/sdk` `^0.9.0` (0.9.0 through versions below 0.10.0). Since 0.5.1 the server enforces
+Version 0.6.2 requires `@thalovant/sdk` `^0.9.3` (0.9.3 through versions below 0.10.0). Since 0.5.1 the server enforces
 secure effective MQTT URLs and carries a single connection deadline through
 MQTT setup and HTTP failure cleanup. Runtime tools support
 HiveMind v3 Noise over WSS, HTTPS and MQTT over TLS. `thalovant_healthcheck`

package/dist/api-error-output.d.ts

@@ -7,8 +7,10 @@
  * image each refused key may be instead, and that list was the part cut off.
  * So the code, the whole sentence (when the message line had to shorten it)
  * and every other field of the body follow, as one compact JSON object.
- * `redact` is the server's own secret redaction, applied to the fields: a
- * validation error echoes back what it was sent.
+ * `redact` is the server's own secret redaction, applied to the fields. A
+ * validation error echoes back what it was sent as each entry's `input`, which
+ * is replaced with "[omitted]" first: redaction by key name cannot see a bare
+ * string, or a secret under an ordinary key.
  *
  * Returns undefined for anything that is not a `ThalovantApiError`.
  */

package/dist/api-error-output.js

@@ -5,6 +5,22 @@ import { ThalovantApiError } from "@thalovant/sdk";
  * are the handler's own bookkeeping.
  */
 const ENVELOPE = new Set(["type", "title", "status", "instance"]);
+/**
+ * The lists a validation error arrives in: FastAPI's `detail` and a
+ * Problem+JSON `errors`. Each entry's `input` is what the request sent,
+ * echoed back -- a generated secret, a name, a whole spec -- under whatever key
+ * and in whatever shape the field had, so key-name redaction cannot catch it.
+ */
+const VALIDATION_LISTS = new Set(["detail", "errors"]);
+const OMITTED = "[omitted]";
+/** The entries of a validation list, each with its echoed `input` replaced. */
+function withoutEchoedInput(value) {
+    if (!Array.isArray(value))
+        return value;
+    return value.map((entry) => (entry && typeof entry === "object" && !Array.isArray(entry) && "input" in entry
+        ? { ...entry, input: OMITTED }
+        : entry));
+}
 /** A detail or a field list longer than this is cut, and says so. */
 const MAX_SECTION_CHARS = 4_000;
 function bounded(text) {
@@ -21,8 +37,10 @@ function bounded(text) {
  * image each refused key may be instead, and that list was the part cut off.
  * So the code, the whole sentence (when the message line had to shorten it)
  * and every other field of the body follow, as one compact JSON object.
- * `redact` is the server's own secret redaction, applied to the fields: a
- * validation error echoes back what it was sent.
+ * `redact` is the server's own secret redaction, applied to the fields. A
+ * validation error echoes back what it was sent as each entry's `input`, which
+ * is replaced with "[omitted]" first: redaction by key name cannot see a bare
+ * string, or a secret under an ordinary key.
  *
  * Returns undefined for anything that is not a `ThalovantApiError`.
  */
@@ -45,7 +63,7 @@ export function apiErrorText(error, redact) {
             // Already on a line above when they were read as strings.
             if ((key === "code" || key === "detail") && typeof value === "string")
                 continue;
-            fields[key] = value;
+            fields[key] = VALIDATION_LISTS.has(key) ? withoutEchoedInput(value) : value;
         }
         if (Object.keys(fields).length)
             lines.push(`fields: ${bounded(JSON.stringify(redact(fields)))}`);

package/dist/index.js

@@ -8,7 +8,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
-import { CONNECTION_TYPE_HOME_ASSISTANT, DEFAULT_CONTROL_API_URL, HOME_ASSISTANT_SCOPES, ThalovantAdmissionFailedError, ThalovantAdmissionTimeoutError, ThalovantAlreadyLinkedError, ThalovantApiError, ThalovantApiUnreachableError, ThalovantAuthError, ThalovantClient, ThalovantControlPlane, ThalovantDeviceLoginDeniedError, ThalovantDeviceLoginExpiredError, ThalovantDeviceLoginPendingError, ThalovantIdentity, ThalovantPlanError, ThalovantUnsupportedConnectionTypeError, buildClientContext, buildLocation, } from "@thalovant/sdk";
+import { CONNECTION_TYPE_HOME_ASSISTANT, DEFAULT_CONTROL_API_URL, HOME_ASSISTANT_CLIENT_ID, HOME_ASSISTANT_SCOPES, ThalovantAdmissionFailedError, ThalovantAdmissionTimeoutError, ThalovantAlreadyLinkedError, ThalovantApiError, ThalovantApiUnreachableError, ThalovantAuthError, ThalovantClient, ThalovantControlPlane, ThalovantDeviceLoginDeniedError, ThalovantDeviceLoginExpiredError, ThalovantDeviceLoginPendingError, ThalovantIdentity, ThalovantPlanError, ThalovantUnsupportedConnectionTypeError, buildClientContext, buildLocation, } from "@thalovant/sdk";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import { createServer as createHttpServer } from "node:http";
@@ -1464,7 +1464,7 @@ export function createServer() {
     });
     registerThalovantTool(server, "thalovant_begin_device_login", {
         title: "Begin Device Sign-In",
-        description: "Start a device sign-in (RFC 8628) when no API token is configured: a person approves it in a browser. Show the person verificationUri and userCode (or verificationUriComplete, which carries the code), then call thalovant_poll_device_login with loginId every `interval` seconds. The device code stays on this server. Once approved, control-plane tools for this principal use the token it minted. A Home Assistant link asks for hubs:read, clients:read and clients:write, which is also all a Free plan can approve.",
+        description: "Start a device sign-in (RFC 8628) when no API token is configured: a person approves it in a browser. Show the person verificationUri and userCode (or verificationUriComplete, which carries the code), then call thalovant_poll_device_login with loginId every `interval` seconds. The device code stays on this server. Once approved, control-plane tools for this principal use the token it minted. A Home Assistant link asks for hubs:read, clients:read and clients:write, which is also all a Free plan can approve, and signs in as the registered app thalovant-home-assistant (clientId).",
         inputSchema: {
             apiUrl: controlPlaneSchema.apiUrl,
             scopes: z
@@ -1472,7 +1472,13 @@ export function createServer() {
                 .max(32)
                 .optional()
                 .describe(`Scopes the token will carry. The API applies its default when omitted or empty (an empty list is left out of the request). A Home Assistant link asks for ${HOME_ASSISTANT_SCOPES.join(", ")}.`),
-            clientName: z.string().min(1).max(128).optional().describe("The name the approval page and the dashboard's token list show."),
+            clientName: z.string().min(1).max(128).optional().describe("The name the approval page and the dashboard's token list show. With clientId, the device's own label beside the app's verified name."),
+            clientId: z
+                .string()
+                .min(1)
+                .max(128)
+                .optional()
+                .describe(`Sign in as a registered app: ${HOME_ASSISTANT_CLIENT_ID} for Home Assistant. The approval page then shows the platform's name for the app as verified, and approving it again replaces the token it already holds. The app may ask only for its own scopes, and an id the API does not know is refused (400 unknown_client). Left out when omitted.`),
         },
         annotations: {
             readOnlyHint: false,
@@ -1480,9 +1486,9 @@ export function createServer() {
             idempotentHint: false,
             openWorldHint: true,
         },
-    }, async ({ apiUrl, scopes, clientName }) => {
+    }, async ({ apiUrl, scopes, clientName, clientId }) => {
         const api = await deviceLoginControlPlane(apiUrl);
-        const grant = await api.beginDeviceLogin({ scopes, clientName });
+        const grant = await api.beginDeviceLogin({ scopes, clientName, clientId });
         const loginId = deviceLogins.start(currentPrincipal().id, api, grant);
         return jsonContent({
             loginId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thalovant/mcp-server",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "Stdio and Streamable HTTP MCP server for Thalovant control-plane and hub runtime APIs.",
   "license": "MIT",
   "type": "module",
@@ -64,12 +64,12 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "@thalovant/sdk": "^0.9.0",
+    "@thalovant/sdk": "^0.9.3",
     "jose": "^6.2.8",
     "zod": "^3.25.76"
   },
   "overrides": {
-    "fast-uri": "3.1.6"
+    "fast-uri": "3.1.8"
   },
   "devDependencies": {
     "@types/node": "^22.18.12",

package/server.json

@@ -7,19 +7,19 @@
     "url": "https://github.com/thalovant/thalovant-mcp",
     "source": "github"
   },
-  "version": "0.6.0",
+  "version": "0.6.2",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@thalovant/mcp-server",
-      "version": "0.6.0",
+      "version": "0.6.2",
       "transport": {
         "type": "stdio"
       }
     },
     {
       "registryType": "oci",
-      "identifier": "ghcr.io/thalovant/thalovant-mcp:0.6.0",
+      "identifier": "ghcr.io/thalovant/thalovant-mcp:0.6.2",
       "transport": {
         "type": "streamable-http",
         "url": "http://127.0.0.1:3000/mcp"