@thinger-io/cli-core 0.5.0 → 0.5.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [0.5.1] - 2026-10-31
+
+### Fixed
+
+- `host` action `update_settings` says what the server does: it merges the
+  body into the host's custom settings (keys left out stay, `null` removes
+  one). Its confirmation plan no longer claims it removes the keys left
+  out of the body.
+- The browser login on a server that does not know the CLI's OAuth client
+  (older than Thinger 7.5.0, or the client was removed) says so and offers
+  username and password or a token instead of failing.
+
 ## [0.5.0] - 2026-10-21
 
 One grammar for every command, noun first:

package/lib/auth.js

@@ -110,7 +110,22 @@ export async function authenticate(opts = {}) {
         if (method === 'userpass') {
             await authenticateWithUserPass(opts);
         } else if (method === 'oauth') {
-            await authenticateWithOAuth(opts, existing);
+            await authenticateWithOAuth(opts, existing).catch(async (error) => {
+                // A server older than the CLI's built-in OAuth client, or
+                // one whose admin removed it: sign in another way.
+                if (error.code !== 'oauth_client_unknown' || !process.stdin.isTTY) throw error;
+                console.log(warning(error.message));
+                const fallback = await ask(select, {
+                    message: 'Sign in another way:',
+                    choices: [
+                        { name: 'Username and password', value: 'userpass' },
+                        { name: 'Token', value: 'token' },
+                    ],
+                });
+                return fallback === 'userpass'
+                    ? authenticateWithUserPass(opts)
+                    : authenticateWithToken(opts);
+            });
         } else {
             await authenticateWithToken(opts);
         }
@@ -391,6 +406,15 @@ async function authenticateWithOAuth(opts, existing) {
         spinner.succeed('OAuth User Code received');
     } catch (error) {
         spinner.fail('OAuth device-code request failed');
+        const status = error.response?.status;
+        if (status === 401 || status === 404) {
+            throw Object.assign(
+                new Error(
+                    `The server does not know the OAuth client ${client_id} (Thinger 7.5.0 and later have it built in). Sign in with a token or username and password instead.`,
+                ),
+                { code: 'oauth_client_unknown' },
+            );
+        }
         throw error;
     }
 

package/lib/mcp/catalog.js

@@ -665,7 +665,7 @@ export const CATALOG = {
                 method: 'put',
                 path: 'settings',
                 description:
-                    'Replace the host settings with `body`; read them first. Confirm with the user first.',
+                    'Patch the host settings with `body` (JSON merge: keys left out stay, null removes one); read them first. Confirm with the user first.',
             },
         },
     },

package/lib/mcp/tools-resource.js

@@ -1493,11 +1493,13 @@ export function resourceTools({
                 .then((r) => r.data)
                 .catch(() => undefined);
             if (isRecord(now) && isRecord(body)) {
+                // The server merges the body (JSON merge-patch): keys left
+                // out stay, a null removes one.
+                const removed = Object.keys(body).filter((k) => body[k] === null && k in now);
                 const changed = Object.keys(body).filter(
-                    (k) => JSON.stringify(now[k]) !== JSON.stringify(body[k]),
+                    (k) => body[k] !== null && JSON.stringify(now[k]) !== JSON.stringify(body[k]),
                 );
-                const dropped = Object.keys(now).filter((k) => !(k in body));
-                return `It would replace the settings of ${target}: changes ${some(changed)}; removes ${some(dropped)} (left out of the body).`;
+                return `It would patch the settings of ${target}: changes ${some(changed)}; removes ${some(removed)}; the rest stays.`;
             }
         }
         if (action === 'test_notification') {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@thinger-io/cli-core",
-    "version": "0.5.0",
+    "version": "0.5.1",
     "description": "Shared core of the Thinger.io CLIs and their MCP servers: API client, auth, profiles, generic commands and MCP tools",
     "type": "module",
     "exports": {