@walkeros/mcp 4.7.2-next-1791147139360 → 4.7.2

package/dist/stdio.js

@@ -826,7 +826,7 @@ var NPM_SEARCH_URL = "https://registry.npmjs.org/-/v1/search";
 var JSDELIVR_BASE = "https://cdn.jsdelivr.net/npm";
 var WALKEROS_JSON_PATH = "dist/walkerOS.json";
 var CACHE_TTL = 5 * 60 * 1e3;
-var CLIENT_HEADER = "walkeros-mcp/4.7.2-next-1791147139360";
+var CLIENT_HEADER = "walkeros-mcp/4.7.2";
 function getPackageBaseUrl() {
   return process.env.WALKEROS_APP_URL || void 0;
 }
@@ -1432,6 +1432,21 @@ function wrapUserData(s) {
   const neutralised = s.replace(/<\/user_data>/g, "</user_data_>");
   return `<user_data>${neutralised}</user_data>`;
 }
+var DISPLAY_TEXT_KEYS = /* @__PURE__ */ new Set([
+  "name",
+  "flowName",
+  "summary"
+]);
+function wrapListedRecord(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return value;
+  const fields = Object.entries(value);
+  const out = {};
+  for (const [key, field] of fields) {
+    out[key] = DISPLAY_TEXT_KEYS.has(key) && typeof field === "string" ? wrapUserData(field) : field;
+  }
+  return out;
+}
 var STRUCTURAL_KEYS = /* @__PURE__ */ new Set([
   "id",
   "flowId",
@@ -1450,7 +1465,6 @@ var keepStructural = (key) => STRUCTURAL_KEYS.has(key);
 function redactNestedStrings(value, opts) {
   return walk(value, opts);
 }
-var DISPLAY_NAME_KEYS = /* @__PURE__ */ new Set(["name", "flowName"]);
 function redactDisplayNames(value) {
   return walkDisplay(value);
 }
@@ -1459,7 +1473,7 @@ function walkDisplay(value) {
   if (value && typeof value === "object") {
     const out = {};
     for (const [k, v] of Object.entries(value)) {
-      if (DISPLAY_NAME_KEYS.has(k) && typeof v === "string") {
+      if (DISPLAY_TEXT_KEYS.has(k) && typeof v === "string") {
         out[k] = wrapUserData(v);
       } else {
         out[k] = walkDisplay(v);
@@ -1666,7 +1680,7 @@ async function feedbackHandlerBody(client, input) {
     const isAnonymous = explicitAnonymous ?? anonymous ?? true;
     await client.submitFeedback(text, {
       anonymous: isAnonymous,
-      version: "4.7.2-next-1791147139360"
+      version: "4.7.2"
     });
     return mcpResult8({ ok: true });
   } catch (error) {
@@ -1816,6 +1830,13 @@ import { z as z9 } from "zod";
 import { mcpResult as mcpResult10, mcpError as mcpError11 } from "@walkeros/core";
 var TITLE9 = "Authentication";
 var DESCRIPTION8 = "Manage walkerOS authentication. Check login status, log in via the device authorization grant, or log out. No terminal or browser required, the MCP client handles the authorization URL.";
+var HOST_LOGIN_MESSAGE = "This connection is already authenticated by the host; no login needed.";
+var HOST_LOGOUT_MESSAGE = "This connection is authorized by the host, so there is no session here to log out of. To end it, disconnect walkerOS in your MCP client, or revoke it in the walkerOS app under Account, Connected apps.";
+var STILL_AUTHENTICATED = {
+  config: "A newer session was stored while logging out and was kept. Call auth logout again to remove it.",
+  env: "WALKEROS_TOKEN is still set for this server process, so calls stay authenticated. Remove it from the MCP server configuration.",
+  host: HOST_LOGOUT_MESSAGE
+};
 var inputSchema9 = {
   action: z9.enum(["status", "login", "logout"]).describe("Authentication action to perform"),
   deviceCode: z9.string().optional().describe(
@@ -1854,10 +1875,20 @@ async function authHandlerBody(client, input) {
         const user = await client.whoami();
         return mcpResult10({
           authenticated: true,
-          ...fieldsOf(user)
+          ...redactDisplayNames(fieldsOf(user))
         });
       }
       case "login": {
+        if (client.credentialSource() === "host") {
+          return mcpResult10(
+            { authenticated: true, message: HOST_LOGIN_MESSAGE },
+            {
+              next: [
+                'Use auth with action "status" to see which account you are on'
+              ]
+            }
+          );
+        }
         if (deviceCode) {
           const poll = await client.pollForToken(deviceCode, {
             timeoutMs: 6e4
@@ -1902,15 +1933,23 @@ async function authHandlerBody(client, input) {
         });
       }
       case "logout": {
-        const { deleted } = await client.logout();
-        const hadEnvToken = typeof process.env.WALKEROS_TOKEN === "string" && process.env.WALKEROS_TOKEN.length > 0;
-        delete process.env.WALKEROS_TOKEN;
+        if (client.credentialSource() === "host") {
+          return mcpError11(new Error(HOST_LOGOUT_MESSAGE));
+        }
+        const { deleted, envCleared } = await client.logout();
+        const remaining = client.credentialSource();
+        if (remaining !== null) {
+          return mcpResult10({
+            loggedOut: false,
+            message: STILL_AUTHENTICATED[remaining]
+          });
+        }
         let message;
-        if (deleted && hadEnvToken) {
+        if (deleted && envCleared) {
           message = "Logged out. Config removed and WALKEROS_TOKEN cleared from process environment.";
         } else if (deleted) {
           message = "Logged out and config removed.";
-        } else if (hadEnvToken) {
+        } else if (envCleared) {
           message = "No config found. WALKEROS_TOKEN cleared from process environment.";
         } else {
           message = "No config found, already logged out.";
@@ -2066,10 +2105,6 @@ var FRAME_MANAGE_REQUIREMENTS = {
 };
 
 // src/tools/project-manage.ts
-function wrapProjectName(project) {
-  const name = stringField(project, "name");
-  return isRecord(project) && name !== void 0 ? { ...project, name: wrapUserData(name) } : project;
-}
 var TITLE10 = "Project Management";
 var DESCRIPTION9 = "Manage walkerOS projects. List, create, update, delete projects, or set a default project for CLI operations.";
 var inputSchema10 = {
@@ -2127,17 +2162,19 @@ async function projectManageHandlerBody(client, input) {
             }
           );
         }
-        const safe = Array.isArray(projects) ? items.map(wrapProjectName) : { ...fieldsOf(projects), projects: items.map(wrapProjectName) };
-        return mcpResult11(safe);
+        return mcpResult11({
+          ...fieldsOf(projects),
+          projects: items.map(wrapListedRecord)
+        });
       }
       case "get": {
         const project = await client.getProject({ projectId });
-        return mcpResult11(wrapProjectName(project));
+        return mcpResult11(wrapListedRecord(project));
       }
       case "create": {
         assertParam(name, "name", "create");
         const created = await client.createProject({ name });
-        return mcpResult11(wrapProjectName(created), {
+        return mcpResult11(wrapListedRecord(created), {
           next: [
             'Use project_manage with action "set_default" to make this your active project'
           ]
@@ -2146,7 +2183,7 @@ async function projectManageHandlerBody(client, input) {
       case "update": {
         assertParam(name, "name", "update");
         const updated = await client.updateProject({ projectId, name });
-        return mcpResult11(wrapProjectName(updated));
+        return mcpResult11(wrapListedRecord(updated));
       }
       case "delete": {
         const deleted = await client.deleteProject({ projectId });
@@ -2308,9 +2345,20 @@ function flowPageUrl(client, projectId, flowId) {
   if (flowId === void 0) return void 0;
   return links.flow({ baseUrl: client.appBaseUrl(), projectId, flowId });
 }
-function safeSummary(flow) {
-  const name = stringField(flow, "name");
-  return isRecord(flow) && name !== void 0 ? { ...flow, name: wrapUserData(name) } : flow;
+function safeFlowPage(data) {
+  if (Array.isArray(data)) return { flows: data.map(wrapListedRecord) };
+  const flows = isRecord(data) ? data.flows : void 0;
+  return isRecord(data) && Array.isArray(flows) ? { ...data, flows: flows.map(wrapListedRecord) } : redactDisplayNames(data);
+}
+function safeFlowGroup(group) {
+  const safe = wrapListedRecord(group);
+  if (!isRecord(safe)) return safe;
+  const { project, flows } = safe;
+  return {
+    ...safe,
+    ...project !== void 0 && { project: wrapListedRecord(project) },
+    ...Array.isArray(flows) && { flows: flows.map(wrapListedRecord) }
+  };
 }
 function safeDetail(flow) {
   const fields = { ...fieldsOf(flow) };
@@ -2495,9 +2543,7 @@ async function flowManageHandlerBody(client, input) {
             cursor,
             limit
           });
-          const flows = isRecord(data2) ? data2.flows : void 0;
-          const safe2 = isRecord(data2) && Array.isArray(flows) ? { ...data2, flows: flows.map(safeSummary) } : data2;
-          return mcpResult12(safe2);
+          return mcpResult12(safeFlowPage(data2));
         }
         const data = await client.listAllFlows({
           sort,
@@ -2506,7 +2552,7 @@ async function flowManageHandlerBody(client, input) {
           cursor,
           limit
         });
-        const safe = Array.isArray(data) ? data.map(safeSummary) : data;
+        const safe = Array.isArray(data) ? data.map(safeFlowGroup) : redactDisplayNames(data);
         return mcpResult12(
           { projects: safe },
           {
@@ -3466,10 +3512,6 @@ async function resolveSessionId(client, options) {
     );
   }
 }
-function resolveProjectId(client, projectId) {
-  return projectId ?? client.getDefaultProject();
-}
-var NO_DEFAULT_PROJECT_ERROR2 = "No project ID given and no default project set. Pass projectId or set one with project_manage set_default.";
 function createObserveSessionToolSpec(client) {
   return {
     name: "observe_session",
@@ -3496,9 +3538,9 @@ async function observeSessionHandlerBody(client, input) {
   if (!flowId) {
     return mcpError17(new Error("flowId is required for observe_session."));
   }
-  const resolvedProjectId = resolveProjectId(client, projectId);
+  const resolvedProjectId = resolveDefaultProject(client, projectId);
   if (!resolvedProjectId) {
-    return mcpError17(new Error(NO_DEFAULT_PROJECT_ERROR2));
+    return mcpError17(new Error(NO_DEFAULT_PROJECT_ERROR));
   }
   try {
     switch (action) {
@@ -4922,7 +4964,7 @@ Every component in a flow is a **step**: sources capture events, transformers pr
 - **Consent** gates destinations (\`config.consent\`) and individual fields (a value's \`consent\`). A mapping rule's \`consent\` is not enforced yet. Privacy-first by design.
 - **Routing** uses one grammar in every chain field (\`source.before\`, \`source.next\`, \`transformer.before\`, \`transformer.next\`, \`collector.next\`, \`destination.before\`, \`destination.next\`). A route is a string ID, a sequence (\`["a", "b"]\`), or a RouteConfig: \`{ match?, next }\`, \`{ match?, one: [...] }\` (first match wins), \`{ match?, many: [...] }\` (every match becomes its own copy of the event with its own id and finishes the rest of the path on its own, never merged), or \`{ match?, stop: true }\` (ends that copy). In a sequence, a member's own \`next\` runs right after it, then the sequence continues. \`match\` reads \`{ ingest, event }\` and each route is evaluated when the event reaches it. A \`stop\` in \`collector.next\` drops the event for every destination; per-destination filtering belongs in \`destination.before\`. An array of only route configs is an implicit \`one\`. The optional \`match\` field is omitted to mean always-match (no wildcard literal).
 - **Pass-through steps** are transformer entries with no \`code\` and no \`package\`. The runtime synthesizes the push for them automatically. Three flavors share this shape: a \`before\` / \`next\`-only step (named hop reusable across destinations), a \`cache\`-only step (dedup, rate-limit), and a \`mapping\`-only step (declarative event-to-event transform). A pass-through must declare at least one of \`before\`, \`next\`, \`cache\`, or \`mapping\`.
-- **Mapping at the transformer position** uses the same \`Mapping.Config\` shape as destinations, but the semantic is event-to-event: \`policy\` and per-rule \`policy\`, \`mapping[].name\` (rename), \`mapping[].ignore\` (drop from chain), and \`include\` apply. \`consent\` is not enforced at this position. Vendor-payload fields (\`data\`, \`silent\`, \`mapping[].data\`) are no-ops at this position.
+- **Mapping at the transformer position** uses the same \`Mapping.Config\` shape as destinations, but the semantic is event-to-event: only config-level \`policy\` and a rule's \`condition\`, \`policy\`, \`name\` (rename) and \`ignore\` (drop from chain) apply. Everything that shapes a vendor payload or gates a destination is a no-op there: config-level \`consent\`, \`include\`, \`data\`, and a rule's \`consent\`, \`include\`, \`remove\`, \`batch\`, \`settings\`, \`extend\`, \`data\`, \`silent\`; validation warns about them (\`TRANSFORMER_MAPPING_NO_OP\`). A \`config.mapping\` wins over a step-level \`mapping\`.
 - **Closed-schema rule on transformer entries:** known keys only. Operative keys are \`code\`, \`package\`, \`before\`, \`next\`, \`cache\`, \`mapping\`. Combined with structural keys (\`config\`, \`env\`, \`validate\`, \`disabled\`, \`id\`, etc.). Unknown top-level keys on a transformer step are errors (catches typos like \`dedup: {}\` instead of nested under \`cache\`). \`code\` + \`package\` together is a conflict.
 - **Cache** memoizes step output on a configured store. Set \`cache.stop: true\` to short-circuit the chain on HIT (sources default to stop-on-HIT); in a source chain or \`collector.next\` that halts the event for all destinations. Set \`cache.namespace\` to prefix keys; omit it to write keys directly. \`CacheRule.match\` is optional, omit for always-match.
 
@@ -5131,7 +5173,7 @@ import {
   updateProject,
   deleteProject,
   setDefaultProject,
-  getDefaultProject,
+  resolveProjectId,
   listAllFlows,
   listFlows,
   getFlow,
@@ -5196,11 +5238,18 @@ var HttpToolClient = class {
   async deleteProject(options) {
     return deleteProject(options);
   }
+  /** Refuses while `WALKEROS_PROJECT_ID` names another project (see the CLI). */
   setDefaultProject(projectId) {
     setDefaultProject(projectId);
   }
+  /**
+   * `WALKEROS_PROJECT_ID`, then the CLI config's default, through the same
+   * resolution the CLI's own commands use. Read here, at the door that owns
+   * this process's environment, never in the shared tool layer: a hosted door
+   * runs in a server process whose variables are no person's selection.
+   */
   getDefaultProject() {
-    return getDefaultProject();
+    return resolveProjectId();
   }
   async listAllFlows(options) {
     return listAllFlows(options);
@@ -5325,8 +5374,16 @@ var HttpToolClient = class {
   credentialSource() {
     return credentialSource();
   }
+  /**
+   * Revoke and drop the stored session, then clear a `WALKEROS_TOKEN` from
+   * this process: the local door owns its environment, so a later call in the
+   * same session no longer authenticates with it.
+   */
   async logout() {
-    return logout();
+    const result = await logout();
+    const envCleared = Boolean(process.env.WALKEROS_TOKEN);
+    delete process.env.WALKEROS_TOKEN;
+    return { ...result, envCleared };
   }
   /**
    * The app this local door talks to: `WALKEROS_APP_URL`, then the CLI config
@@ -5360,7 +5417,7 @@ var HttpToolClient = class {
   async checkContract() {
     return compareContract({
       baseUrl: this.appBaseUrl(),
-      client: { type: "mcp", version: "4.7.2-next-1791147139360" }
+      client: { type: "mcp", version: "4.7.2" }
     });
   }
   /** The live public OpenAPI document of `appBaseUrl()`, without a credential. */
@@ -5571,7 +5628,7 @@ function parseJson(content) {
 }
 
 // src/stdio.ts
-setClientContext({ type: "mcp", version: "4.7.2-next-1791147139360" });
+setClientContext({ type: "mcp", version: "4.7.2" });
 process.on("uncaughtException", (err) => {
   const emitter = getMcpEmitterSingleton();
   if (emitter) {
@@ -5591,7 +5648,7 @@ process.on("unhandledRejection", (reason) => {
 async function main() {
   const server = createWalkerOSMcpServer({
     client: new HttpToolClient(),
-    version: "4.7.2-next-1791147139360",
+    version: "4.7.2",
     runtime: createLocalRuntime()
   });
   const transport = new StdioServerTransport();
@@ -5602,7 +5659,7 @@ main().catch(async (error) => {
   try {
     const emitter = await createMcpEmitter({
       clientInfo: void 0,
-      packageVersion: "4.7.2-next-1791147139360"
+      packageVersion: "4.7.2"
     });
     await emitter.emitError("startup");
   } catch {