@topolo/mcp 0.13.1 → 0.13.3

package/dist/index.js

@@ -3,7 +3,7 @@
 // src/index.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
-// node_modules/.pnpm/@topolo+sdk@0.21.1/node_modules/@topolo/sdk/dist/index.js
+// node_modules/.pnpm/@topolo+sdk@0.21.2/node_modules/@topolo/sdk/dist/index.js
 function applyAuthHeaders(headers, credential) {
   if (credential.kind === "api_key") {
     headers.set("X-Api-Key", credential.apiKey);
@@ -3254,7 +3254,7 @@ function createTopolo(options) {
   };
 }
 
-// node_modules/.pnpm/@topolo+sdk@0.21.1/node_modules/@topolo/sdk/dist/node/credential-store.js
+// node_modules/.pnpm/@topolo+sdk@0.21.2/node_modules/@topolo/sdk/dist/node/credential-store.js
 import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2, chmod as chmod2, rm as rm2, stat } from "fs/promises";
 import { existsSync as existsSync2 } from "fs";
 import { homedir as homedir2, platform } from "os";
@@ -3671,6 +3671,8 @@ function topoloServiceOrigins2(serviceUrls, environment) {
   );
 }
 var KEYCHAIN_SERVICE = "topolo-external-agent-installation";
+var MACOS_KEYCHAIN_CHUNK_SIZE = 96;
+var MACOS_KEYCHAIN_CHUNK_PREFIX = "topolo-keychain-chunks:v1:";
 var MACOS_KEYCHAIN_WRITE_SCRIPT = [
   "log_user 0",
   "set timeout 10",
@@ -3711,40 +3713,73 @@ function createPlatformInstallationSecretBackend(options = {}) {
   const spawn = options.spawn ?? ((command, args, spawnOptions) => spawnSync(command, args, spawnOptions));
   const root = options.root ?? installationStorePath();
   if (platform2 === "darwin") {
+    const write = (account, value) => runOrThrow(spawn("/usr/bin/expect", ["-c", MACOS_KEYCHAIN_WRITE_SCRIPT], {
+      input: `${value}
+`,
+      encoding: "utf8",
+      env: {
+        ...process.env,
+        TOPOLO_KEYCHAIN_ACCOUNT: account,
+        TOPOLO_KEYCHAIN_SERVICE: KEYCHAIN_SERVICE
+      }
+    }), "macOS Keychain write");
+    const read = (account) => {
+      const result = spawn("security", [
+        "find-generic-password",
+        "-a",
+        account,
+        "-s",
+        KEYCHAIN_SERVICE,
+        "-w"
+      ], { encoding: "utf8" });
+      if (result.status === 44) return null;
+      return runOrThrow(result, "macOS Keychain read");
+    };
+    const remove = (account) => {
+      const result = spawn("security", [
+        "delete-generic-password",
+        "-a",
+        account,
+        "-s",
+        KEYCHAIN_SERVICE
+      ], { encoding: "utf8" });
+      if (result.status !== 44) runOrThrow(result, "macOS Keychain delete");
+    };
+    const chunkAccount = (account, index) => `${account}:chunk:${index}`;
+    const chunkCount = (value) => {
+      if (!value?.startsWith(MACOS_KEYCHAIN_CHUNK_PREFIX)) return 0;
+      const count = Number(value.slice(MACOS_KEYCHAIN_CHUNK_PREFIX.length));
+      if (!Number.isSafeInteger(count) || count < 1) throw new Error("macOS Keychain chunk manifest is invalid.");
+      return count;
+    };
     return {
       async set(account, value) {
-        runOrThrow(spawn("/usr/bin/expect", ["-c", MACOS_KEYCHAIN_WRITE_SCRIPT], {
-          input: `${value}
-`,
-          encoding: "utf8",
-          env: {
-            ...process.env,
-            TOPOLO_KEYCHAIN_ACCOUNT: account,
-            TOPOLO_KEYCHAIN_SERVICE: KEYCHAIN_SERVICE
-          }
-        }), "macOS Keychain write");
+        const previousCount = chunkCount(read(account));
+        const chunks = Array.from(
+          { length: Math.max(1, Math.ceil(value.length / MACOS_KEYCHAIN_CHUNK_SIZE)) },
+          (_, index) => value.slice(index * MACOS_KEYCHAIN_CHUNK_SIZE, (index + 1) * MACOS_KEYCHAIN_CHUNK_SIZE)
+        );
+        try {
+          chunks.forEach((chunk, index) => write(chunkAccount(account, index), chunk));
+          write(account, `${MACOS_KEYCHAIN_CHUNK_PREFIX}${chunks.length}`);
+          for (let index = chunks.length; index < previousCount; index += 1) remove(chunkAccount(account, index));
+        } catch (error) {
+          chunks.forEach((_, index) => remove(chunkAccount(account, index)));
+          throw error;
+        }
       },
       async get(account) {
-        const result = spawn("security", [
-          "find-generic-password",
-          "-a",
-          account,
-          "-s",
-          KEYCHAIN_SERVICE,
-          "-w"
-        ], { encoding: "utf8" });
-        if (result.status === 44) return null;
-        return runOrThrow(result, "macOS Keychain read");
+        const manifest = read(account);
+        const count = chunkCount(manifest);
+        if (!count) return manifest;
+        const chunks = Array.from({ length: count }, (_, index) => read(chunkAccount(account, index)));
+        if (chunks.some((chunk) => chunk === null)) throw new Error("macOS Keychain installation secret is incomplete.");
+        return chunks.join("");
       },
       async delete(account) {
-        const result = spawn("security", [
-          "delete-generic-password",
-          "-a",
-          account,
-          "-s",
-          KEYCHAIN_SERVICE
-        ], { encoding: "utf8" });
-        if (result.status !== 44) runOrThrow(result, "macOS Keychain delete");
+        const count = chunkCount(read(account));
+        for (let index = 0; index < count; index += 1) remove(chunkAccount(account, index));
+        remove(account);
       }
     };
   }
@@ -4933,6 +4968,10 @@ function audienceFor(context) {
   }
   return `app_topolo_${service.replace(/-/g, "_")}`;
 }
+function scopeFor(context, audience) {
+  if (context.service === "auth" && context.path === "/api/auth/me") return "app_topolo_auth:identity";
+  return `${audience}:actions:execute`;
+}
 function responseData(value) {
   if (!value || typeof value !== "object") return {};
   const record2 = value;
@@ -4950,22 +4989,24 @@ async function resolveExternalAgentInstallationCredential(environment, installat
   const fetchImpl = options.fetch ?? fetch;
   const now = options.now ?? Date.now;
   const authBaseUrl = resolveServiceUrl("auth", options.serviceUrls);
-  const tokenUrl = new URL("/api/developer-oauth/token", authBaseUrl).toString();
+  const tokenUrl = new URL("/oauth/token", authBaseUrl).toString();
   const cache = /* @__PURE__ */ new Map();
   const credentialProvider = async (context) => {
     const audience = audienceFor(context);
+    const scope = scopeFor(context, audience);
     const resource = context.resource ?? {
       resourceType: "organization",
       resourceId: stored.installation.organizationId
     };
     const boundTaskId = context.taskId?.trim() || taskId;
-    const key = JSON.stringify({ audience, taskId: boundTaskId, resource });
+    const key = JSON.stringify({ audience, scope, taskId: boundTaskId, resource });
     const cached = cache.get(key);
     if (cached && cached.expiresAt - 15e3 > now()) return cached.credential;
     const body = new URLSearchParams({
       grant_type: "client_credentials",
       client_id: stored.installation.clientId,
       client_secret: stored.secret.clientSecret,
+      scope,
       audience,
       task_id: boundTaskId,
       resource_type: resource.resourceType,

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@topolo/mcp",
   "packageManager": "pnpm@10.17.1",
-  "version": "0.13.1",
-  "topoloPublishedVersion": "0.13.1",
+  "version": "0.13.3",
+  "topoloPublishedVersion": "0.13.3",
   "description": "Model Context Protocol server for the Topolo platform. Exposes scope-gated tools that third-party agents (Claude, Codex, etc.) can call natively.",
   "license": "UNLICENSED",
   "author": "Topolo",
@@ -36,7 +36,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "@topolo/sdk": "0.21.1"
+    "@topolo/sdk": "0.21.2"
   },
   "devDependencies": {
     "@types/node": "^20.12.0",