@yawlabs/mcp 0.64.1 → 0.64.2

package/dist/index.js

@@ -1148,9 +1148,15 @@ async function runBundlesCommand(opts = {}) {
     env: opts.env
   });
   if (!config.token) {
-    printErr(
-      "yaw-mcp bundles match: no token resolved. Run `yaw-mcp install <client> --token mcp_pat_\u2026` or set YAW_MCP_TOKEN."
-    );
+    const msg = "no token resolved. Run `yaw-mcp install <client> --token mcp_pat_\u2026` or set YAW_MCP_TOKEN.";
+    if (opts.json) {
+      const jsonErr = JSON.stringify({ ok: false, error: msg });
+      lines.push(jsonErr);
+      writeErr(`${jsonErr}
+`);
+    } else {
+      printErr(`yaw-mcp bundles match: ${msg}`);
+    }
     return { exitCode: 1, lines };
   }
   const fetcher = opts.fetcher ?? fetchConfig;
@@ -1159,11 +1165,26 @@ async function runBundlesCommand(opts = {}) {
     backend = await fetcher(config.apiBase, config.token);
   } catch (err) {
     const msg = err instanceof ConfigError || err instanceof Error ? err.message : String(err);
-    printErr(`yaw-mcp bundles match: ${msg}`);
+    if (opts.json) {
+      const jsonErr = JSON.stringify({ ok: false, error: msg });
+      lines.push(jsonErr);
+      writeErr(`${jsonErr}
+`);
+    } else {
+      printErr(`yaw-mcp bundles match: ${msg}`);
+    }
     return { exitCode: 2, lines };
   }
   if (!backend) {
-    printErr("yaw-mcp bundles match: backend returned 304 without a conditional request.");
+    const msg = "backend returned 304 without a conditional request.";
+    if (opts.json) {
+      const jsonErr = JSON.stringify({ ok: false, error: msg });
+      lines.push(jsonErr);
+      writeErr(`${jsonErr}
+`);
+    } else {
+      printErr(`yaw-mcp bundles match: ${msg}`);
+    }
     return { exitCode: 2, lines };
   }
   const installed = backend.servers.filter((s) => s.isActive).map((s) => s.namespace);
@@ -1380,18 +1401,27 @@ function renderScript(shell) {
       return renderPowershell();
   }
 }
+function isPlaceholder(s) {
+  return s.startsWith("<") && s.endsWith(">");
+}
 function renderBash() {
   const subcommandList = SUBCOMMAND_SPEC.map((s) => s.name).join(" ");
   const topLevelFlags = "--help -h --version -V";
   const cases = SUBCOMMAND_SPEC.map((spec) => {
-    const posClause = spec.positional ? `    if [[ $cword -eq 2 ]]; then
-      COMPREPLY=( $(compgen -W "${spec.positional.join(" ")} ${spec.flags.join(" ")}" -- "$cur") )
+    const indexedPositionals = (spec.positional ?? []).map((p, i) => ({ value: p, index: i })).filter(({ value }) => !isPlaceholder(value));
+    const posClauses = indexedPositionals.map(
+      ({ value, index }) => `    if [[ $cword -eq $((${index} + 2)) ]]; then
+      COMPREPLY=( $(compgen -W "${value}" -- "$cur") )
       return 0
-    fi` : "";
+    fi`
+    );
+    const parts = [
+      ...posClauses,
+      `    COMPREPLY=( $(compgen -W "${spec.flags.join(" ")}" -- "$cur") )`,
+      "    return 0"
+    ].filter((p) => p !== "");
     return `  ${spec.name})
-${posClause}
-    COMPREPLY=( $(compgen -W "${spec.flags.join(" ")}" -- "$cur") )
-    return 0
+${parts.join("\n")}
     ;;`;
   }).join("\n");
   return `# bash completion for yaw-mcp \u2014 generated by \`yaw-mcp completion bash\`
@@ -1418,8 +1448,10 @@ function renderZsh() {
   const subcommandList = SUBCOMMAND_SPEC.map((s) => `    '${s.name}:${s.description}'`).join("\n");
   const argsCases = SUBCOMMAND_SPEC.map((spec) => {
     const lines = [`      ${spec.name})`];
-    if (spec.positional) {
-      lines.push(`        _arguments '1: :(${spec.positional.join(" ")})' '*: :(${spec.flags.join(" ")})'`);
+    const indexedPositionals = (spec.positional ?? []).map((p, i) => ({ value: p, index: i })).filter(({ value }) => !isPlaceholder(value));
+    if (indexedPositionals.length > 0) {
+      const posArgs = indexedPositionals.map(({ value, index }) => `'${index + 1}: :(${value})'`).join(" ");
+      lines.push(`        _arguments ${posArgs} '*: :(${spec.flags.join(" ")})'`);
     } else {
       lines.push(`        _arguments '*: :(${spec.flags.join(" ")})'`);
     }
@@ -1463,9 +1495,13 @@ complete -c yaw-mcp -f`;
   const flagLines = [];
   for (const spec of SUBCOMMAND_SPEC) {
     if (spec.positional) {
-      for (const p of spec.positional) {
-        positionalLines.push(`complete -c yaw-mcp -n "__fish_seen_subcommand_from ${spec.name}" -a ${p}`);
-      }
+      spec.positional.forEach((p, i) => {
+        if (isPlaceholder(p)) return;
+        const expectedCount = i + 2;
+        positionalLines.push(
+          `complete -c yaw-mcp -n "__fish_seen_subcommand_from ${spec.name}; and test (count (commandline -opc)) -eq ${expectedCount}" -a ${p}`
+        );
+      });
     }
     for (const f of spec.flags) {
       if (!f.startsWith("--")) continue;
@@ -1478,12 +1514,13 @@ complete -c yaw-mcp -f`;
 function renderPowershell() {
   const subcommandNames = SUBCOMMAND_SPEC.map((s) => `'${s.name}'`).join(", ");
   const caseBranches = SUBCOMMAND_SPEC.map((spec) => {
-    const positional = spec.positional ? spec.positional.map((p) => `'${p}'`).join(", ") : "";
+    const indexedPositionals = (spec.positional ?? []).map((p, i) => ({ value: p, index: i })).filter(({ value }) => !isPlaceholder(value));
     const flags = spec.flags.map((f) => `'${f}'`).join(", ");
-    const positionalLine = positional ? `      $completions += @(${positional})
+    const positionalLines = indexedPositionals.map(({ value, index }) => `      if ($tokens.Count -eq ${index + 2}) { $completions += @('${value}') }`).join("\n");
+    const positionalBlock = positionalLines ? `${positionalLines}
 ` : "";
     return `    '${spec.name}' {
-${positionalLine}      $completions += @(${flags})
+${positionalBlock}      $completions += @(${flags})
     }`;
   }).join("\n");
   return `# PowerShell completion for yaw-mcp \u2014 generated by \`yaw-mcp completion powershell\`
@@ -1694,6 +1731,19 @@ var token = "";
 var lastFailure = null;
 var lastLoggedConnectStatus = null;
 var lastLoggedDispatchStatus = null;
+var warnedInsecureBearerSkipConnect = false;
+var warnedInsecureBearerSkipDispatch = false;
+function shouldSendBearer(targetUrl) {
+  let parsed;
+  try {
+    parsed = new URL(targetUrl);
+  } catch {
+    return false;
+  }
+  if (parsed.protocol === "https:") return true;
+  if (parsed.protocol === "http:" && isLoopbackHost(parsed.hostname)) return true;
+  return false;
+}
 function getLastAnalyticsFailure() {
   return lastFailure;
 }
@@ -1746,12 +1796,20 @@ async function flush() {
   const events = buffer.splice(0, FLUSH_SIZE);
   const url = `${apiUrl.replace(/\/$/, "")}/api/connect/analytics`;
   try {
+    const headers = { "Content-Type": "application/json" };
+    if (shouldSendBearer(url)) {
+      headers.Authorization = `Bearer ${token}`;
+    } else if (!warnedInsecureBearerSkipConnect) {
+      log(
+        "warn",
+        "Analytics URL is not https and not loopback; sending without Authorization header to avoid leaking the bearer token",
+        { url }
+      );
+      warnedInsecureBearerSkipConnect = true;
+    }
     const res = await request3(url, {
       method: "POST",
-      headers: {
-        Authorization: `Bearer ${token}`,
-        "Content-Type": "application/json"
-      },
+      headers,
       body: JSON.stringify({ events }),
       headersTimeout: 1e4,
       bodyTimeout: 1e4
@@ -1788,17 +1846,25 @@ async function flushDispatch() {
   const events = dispatchBuffer.splice(0, FLUSH_SIZE);
   const url = `${apiUrl.replace(/\/$/, "")}/api/connect/dispatch-events`;
   try {
+    const headers = { "Content-Type": "application/json" };
+    if (shouldSendBearer(url)) {
+      headers.Authorization = `Bearer ${token}`;
+    } else if (!warnedInsecureBearerSkipDispatch) {
+      log(
+        "warn",
+        "Analytics URL is not https and not loopback; sending without Authorization header to avoid leaking the bearer token",
+        { url }
+      );
+      warnedInsecureBearerSkipDispatch = true;
+    }
     const res = await request3(url, {
       method: "POST",
-      headers: {
-        Authorization: `Bearer ${token}`,
-        "Content-Type": "application/json"
-      },
+      headers,
       body: JSON.stringify({ events }),
       headersTimeout: 1e4,
       bodyTimeout: 1e4
     });
-    if (res.statusCode >= 400 && res.statusCode !== 204) {
+    if (res.statusCode >= 400) {
       const retryable = res.statusCode >= 500 || res.statusCode === 408 || res.statusCode === 429;
       if (retryable) {
         const room = MAX_BUFFER - dispatchBuffer.length;
@@ -1812,7 +1878,7 @@ async function flushDispatch() {
         lastLoggedDispatchStatus = res.statusCode;
       }
       lastFailure = { statusCode: res.statusCode, url, at: Date.now() };
-    } else if (res.statusCode < 400) {
+    } else {
       lastFailure = null;
       lastLoggedDispatchStatus = null;
     }
@@ -1830,6 +1896,8 @@ function initAnalytics(url, tok) {
   token = tok;
   lastLoggedConnectStatus = null;
   lastLoggedDispatchStatus = null;
+  warnedInsecureBearerSkipConnect = false;
+  warnedInsecureBearerSkipDispatch = false;
   teamAnalyticsDisabled = false;
   flushTimer = setInterval(() => {
     flush().catch(() => {
@@ -2296,9 +2364,12 @@ function errorMessage(err) {
 import { request as request4 } from "undici";
 var apiUrl2 = "";
 var token2 = "";
-var lastFailure2 = null;
-function getLastReportFailure() {
-  return lastFailure2;
+var lastFailureByServer = /* @__PURE__ */ new Map();
+function getLastReportFailure(serverId) {
+  if (serverId !== void 0) return lastFailureByServer.get(serverId) ?? null;
+  const entries = [...lastFailureByServer.values()];
+  if (entries.length === 0) return null;
+  return entries.reduce((a, b) => a.at >= b.at ? a : b);
 }
 function initToolReport(url, tok) {
   apiUrl2 = url;
@@ -2306,7 +2377,7 @@ function initToolReport(url, tok) {
 }
 async function reportTools(serverId, tools) {
   if (!apiUrl2 || !token2 || !serverId) return;
-  const url = `${apiUrl2.replace(/\/$/, "")}/api/connect/servers/${serverId}/tools`;
+  const url = `${apiUrl2.replace(/\/$/, "")}/api/connect/servers/${encodeURIComponent(serverId)}/tools`;
   try {
     const res = await request4(url, {
       method: "POST",
@@ -2322,12 +2393,13 @@ async function reportTools(serverId, tools) {
     });
     if (res.statusCode >= 400 && res.statusCode !== 404) {
       log("warn", "Tool report failed", { serverId, status: res.statusCode });
-      lastFailure2 = { statusCode: res.statusCode, url, at: Date.now() };
-    } else if (res.statusCode < 400) {
-      lastFailure2 = null;
+      lastFailureByServer.set(serverId, { statusCode: res.statusCode, url, at: Date.now() });
+    } else {
+      lastFailureByServer.delete(serverId);
     }
   } catch (err) {
     log("warn", "Tool report error", { serverId, error: err?.message });
+    lastFailureByServer.set(serverId, { statusCode: 0, url, at: Date.now() });
   }
 }
 
@@ -2367,6 +2439,9 @@ function tokenizeCommand(cmd) {
       has = true;
     }
   }
+  if (quote !== null) {
+    throw new Error(`Unbalanced quote in command: ${cmd}`);
+  }
   if (has) out.push(cur);
   return out;
 }
@@ -3912,7 +3987,7 @@ async function runUpgrade(opts = {}) {
   return { exitCode: 3, lines };
 }
 function readCurrentVersion() {
-  return true ? "0.64.1" : "dev";
+  return true ? "0.64.2" : "dev";
 }
 
 // src/usage-hints.ts
@@ -3974,7 +4049,7 @@ function selectFlakyNamespaces(entries, limit) {
 }
 
 // src/doctor-cmd.ts
-var VERSION = true ? "0.64.1" : "dev";
+var VERSION = true ? "0.64.2" : "dev";
 function isPersistenceDisabled(env) {
   const raw = env.YAW_MCP_DISABLE_PERSISTENCE;
   return raw !== void 0 && raw !== "" && (raw === "1" || raw.toLowerCase() === "true");
@@ -6447,7 +6522,7 @@ function defaultSpawn2(cmd, args) {
 async function maybeAutoUpgrade(deps = {}) {
   const optOut = process.env.YAW_MCP_AUTO_UPGRADE;
   if (optOut === "0" || optOut?.toLowerCase() === "false") return;
-  const current = deps.currentVersion ?? (true ? "0.64.1" : "dev");
+  const current = deps.currentVersion ?? (true ? "0.64.2" : "dev");
   if (current === "dev") return;
   const method = (deps.isSeaImpl ? await deps.isSeaImpl() : await detectSea()) ? "binary" : detectInstallMethod(deps.argvPath ?? process.argv[1]);
   const latest = await (deps.fetchLatestImpl ?? fetchLatestVersion2)();
@@ -6957,18 +7032,18 @@ import { readFile as readFile10 } from "fs/promises";
 var GUIDE_READ_TIMEOUT_MS = 1e3;
 async function readGuide(path5, scope) {
   let raw;
+  const ac = new AbortController();
+  const timer = setTimeout(() => ac.abort(new Error("guide read timeout")), GUIDE_READ_TIMEOUT_MS);
   try {
-    raw = await Promise.race([
-      readFile10(path5, "utf8"),
-      new Promise(
-        (_, reject) => setTimeout(() => reject(new Error("guide read timeout")), GUIDE_READ_TIMEOUT_MS)
-      )
-    ]);
+    raw = await readFile10(path5, { encoding: "utf8", signal: ac.signal });
   } catch (err) {
-    if (err instanceof Error && err.message === "guide read timeout") {
+    const isTimeout = err instanceof Error && err.code === "ABORT_ERR";
+    if (isTimeout) {
       log("warn", "Guide read timed out", { path: path5 });
     }
     return null;
+  } finally {
+    clearTimeout(timer);
   }
   const content = raw.trim();
   if (content.length === 0) {
@@ -7080,7 +7155,7 @@ function initHeartbeat(url, tok) {
   lastLoggedErrorMessage = null;
   warnedInsecureBearerSkip = false;
 }
-function shouldSendBearer(targetUrl) {
+function shouldSendBearer2(targetUrl) {
   let parsed;
   try {
     parsed = new URL(targetUrl);
@@ -7106,7 +7181,7 @@ async function reportHeartbeat(clientName, clientVersion, isRefresh = false) {
     const headers = {
       "Content-Type": "application/json"
     };
-    if (shouldSendBearer(fullUrl)) {
+    if (shouldSendBearer2(fullUrl)) {
       headers.Authorization = `Bearer ${token3}`;
     }
     const res = await request6(fullUrl, {
@@ -8139,7 +8214,8 @@ function pruneJson(value) {
 }
 
 // src/read-tool.ts
-function normalizeToolName(namespace, raw) {
+function normalizeToolName(namespace, raw, tools) {
+  if (tools?.some((t) => t.name === raw)) return raw;
   const prefix = `${namespace}_`;
   if (raw.startsWith(prefix) && raw.length > prefix.length) return raw.slice(prefix.length);
   return raw;
@@ -9208,7 +9284,7 @@ function categorizeSpawnError(err) {
 }
 async function connectToUpstream(config, onDisconnect, onListChanged) {
   const client = new Client(
-    { name: "yaw-mcp", version: true ? "0.64.1" : "dev" },
+    { name: "yaw-mcp", version: true ? "0.64.2" : "dev" },
     { capabilities: {} }
   );
   let transport;
@@ -9279,7 +9355,7 @@ async function connectToUpstream(config, onDisconnect, onListChanged) {
       message = `Server "${config.namespace}" started but didn't complete the MCP handshake within ${connectTimeoutMs / 1e3}s.${trimmedStderr ? ` stderr tail: ${redactSecretsInOutput(trimmedStderr, resolvedServerEnv).slice(-500)}` : ""}`;
     } else if (trimmedStderr.length > 0) {
       category = "install_failure";
-      const safe = redactSecretsInOutput(trimmedStderr, config.env ?? {});
+      const safe = redactSecretsInOutput(trimmedStderr, resolvedServerEnv);
       message = `Server "${config.namespace}" failed to start. stderr: ${safe.slice(-500)}`;
     } else {
       category = categorizeSpawnError(err);
@@ -9292,7 +9368,7 @@ async function connectToUpstream(config, onDisconnect, onListChanged) {
     if (config.id) {
       message = `${message} \u2192 Edit at https://yaw.sh/mcp/dashboard/connect#server-${config.id}`;
     }
-    const redactedTail = trimmedStderr ? redactSecretsInOutput(trimmedStderr, config.env ?? {}) : void 0;
+    const redactedTail = trimmedStderr ? redactSecretsInOutput(trimmedStderr, resolvedServerEnv) : void 0;
     throw new ActivationError(message, category, redactedTail, err);
   }
   log("info", "Connected to upstream", { name: config.name, namespace: config.namespace, type: config.type });
@@ -9540,7 +9616,7 @@ var ConnectServer = class _ConnectServer {
     this.apiUrl = apiUrl5;
     this.token = token5;
     this.server = new Server(
-      { name: "yaw-mcp", version: true ? "0.64.1" : "dev" },
+      { name: "yaw-mcp", version: true ? "0.64.2" : "dev" },
       {
         capabilities: {
           tools: { listChanged: true },
@@ -11471,9 +11547,9 @@ Use mcp_connect_discover to see imported servers.`
         isError: true
       };
     }
-    const toolName = normalizeToolName(serverArg, toolArg);
     const existing = this.connections.get(serverArg);
     if (existing && existing.status === "connected") {
+      const toolName = normalizeToolName(serverArg, toolArg, existing.tools);
       const tool = findTool(existing.tools, toolName);
       if (!tool) {
         return {
@@ -11509,6 +11585,7 @@ Use mcp_connect_discover to see imported servers.`
       };
     }
     try {
+      const toolName = normalizeToolName(serverArg, toolArg, transient.tools);
       const tool = findTool(transient.tools, toolName);
       if (!tool) {
         return {
@@ -11974,9 +12051,10 @@ async function runServersCommand(opts = {}) {
     printErr("yaw-mcp servers: backend returned no data (unexpected 304).");
     return { exitCode: 2, lines };
   }
-  const filtered = opts.filter ? {
+  const filterStr = opts.filter;
+  const filtered = filterStr !== void 0 ? {
     ...backend,
-    servers: backend.servers.filter((s) => s.namespace.toLowerCase().includes(opts.filter.toLowerCase()))
+    servers: backend.servers.filter((s) => s.namespace.toLowerCase().includes(filterStr.toLowerCase()))
   } : backend;
   const gradesReader = opts.gradesReader ?? readGradesCache;
   const grades = await gradesReader(opts.home).catch(() => ({}));
@@ -11991,12 +12069,12 @@ async function runServersCommand(opts = {}) {
     const payload = {
       ...merged,
       filter: opts.filter ?? null,
-      filterMatched: opts.filter ? merged.servers.length > 0 : null
+      filterMatched: opts.filter !== void 0 ? merged.servers.length > 0 : null
     };
     print(JSON.stringify(payload, null, 2));
     return { exitCode: 0, lines };
   }
-  if (opts.filter && filtered.servers.length === 0) {
+  if (opts.filter !== void 0 && filtered.servers.length === 0) {
     print(`No servers match "${opts.filter}". Run \`yaw-mcp servers\` to see the full list.`);
     return { exitCode: 0, lines };
   }
@@ -12166,6 +12244,11 @@ async function runSetActive(opts, io = { out: (s) => process.stdout.write(s), er
             mcp_bundles: { lastPulledVersion: putRes.version }
           }).catch(() => {
           });
+        } else {
+          io.err(
+            `yaw-mcp set-active: putRes.version was not a number (got ${JSON.stringify(putRes.version)}); local sync-state not updated
+`
+          );
         }
         return done(io, opts.json, namespace, active, true);
       } catch (e) {
@@ -12416,7 +12499,15 @@ function suggestSubcommand(input, limit = 3) {
 }
 function suggestFlag(input, limit = 2) {
   if (input.length <= 2) return [];
-  return closestNames(input, FLAG_ALIASES, limit);
+  const q = input.toLowerCase();
+  const hits = [];
+  for (const alias of FLAG_ALIASES) {
+    if (alias.toLowerCase() === q) continue;
+    const d = levenshtein(q, alias.toLowerCase());
+    if (d <= 2) hits.push({ name: alias, d });
+  }
+  hits.sort((a, b) => a.d - b.d || a.name.localeCompare(b.name));
+  return hits.slice(0, limit).map((h) => h.name);
 }
 
 // src/sync-cmd.ts
@@ -12685,10 +12776,11 @@ function handleSyncError(err, opts, io) {
     return { exitCode: 1 };
   }
   if (err instanceof TeamSyncAuthError) {
-    if (opts.json)
-      io.err(`${JSON.stringify({ ok: false, error: "Session expired or revoked. Run `yaw-mcp login` again." })}
+    const authMsg = "Session expired or revoked. Run `yaw-mcp login --key <license-key>` again.";
+    if (opts.json) io.err(`${JSON.stringify({ ok: false, error: authMsg })}
+`);
+    else io.err(`yaw-mcp sync: ${authMsg}
 `);
-    else io.err("yaw-mcp sync: session expired or revoked. Run `yaw-mcp login --key <license-key>` again.\n");
     return { exitCode: 1 };
   }
   if (err instanceof TeamSyncForbiddenError) {
@@ -13100,7 +13192,7 @@ if (subcommand === "compliance") {
 `);
   process.exit(0);
 } else if (subcommand === "--version" || subcommand === "-V") {
-  process.stdout.write(`yaw-mcp ${true ? "0.64.1" : "dev"}
+  process.stdout.write(`yaw-mcp ${true ? "0.64.2" : "dev"}
 `);
   process.exit(0);
 } else if (subcommand && !subcommand.startsWith("-")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/mcp",
-  "version": "0.64.1",
+  "version": "0.64.2",
   "mcpName": "io.github.YawLabs/mcp",
   "description": "Yaw MCP -- MCP servers, managed. Free to run locally; Yaw Team adds cross-machine sync.",
   "license": "UNLICENSED",