autorouter-mcp 0.2.5 → 0.2.7

package/README.md

@@ -364,12 +364,41 @@ autorouter adopt --target claude --servers-only     # skip skills and plugins
 autorouter adopt --target claude --keep project-tools --keep-plugin ui-toolkit
 autorouter restore --target claude                  # undo the most recent adopt
 
+autorouter update                                   # upgrade in place
+autorouter update --check                           # is there a newer version?
+
 autorouter login                                    # which servers need a grant
 autorouter login remote-server                      # authorize one (opens a browser)
 autorouter login remote-server --device             # headless: enter a code elsewhere
+autorouter login remote-server --no-reindex         # authorize, index later
 autorouter logout remote-server                     # forget a stored grant
 ```
 
+## Updating
+
+`autorouter update` upgrades in place, using the package manager that installed
+the copy you are running:
+
+```sh
+autorouter update            # detect, then upgrade
+autorouter update --check    # report the available version, install nothing
+autorouter update --dry-run  # print the command, do not run it
+```
+
+Which manager to use is decided by where the running file sits on disk, not by
+what happens to be on `PATH` — running `npm i -g` against a pnpm-managed global
+installs a second copy that shadows the first, and you would then be upgrading
+one install while running the other.
+
+Three cases do not run a package manager, and say so instead: a copy unpacked by
+`npx`/`bunx`/`pnpm dlx` (nothing to upgrade — those refetch every run), a git
+checkout (`git pull && bun install && bun run build`), and a layout it cannot
+identify. All three still report whether a newer version exists.
+
+The router is a long-lived stdio server, so a harness that already has it
+running keeps the old build until it respawns it — restart the harness, or
+reconnect the MCP server, after updating.
+
 ## OAuth servers
 
 Some remote MCP servers carry no credentials in their visible configuration.
@@ -382,9 +411,17 @@ has a token to borrow:
 
 ```sh
 autorouter login remote-server
-autorouter reindex
 ```
 
+A new grant is followed by a reindex automatically, because the capabilities
+behind it are not searchable until the catalog has seen them — a grant on its
+own changes nothing the router can reach. `--no-reindex` skips it when you are
+authorizing several servers in a row and would rather index once at the end.
+
+Only a login that actually stores a new grant triggers it. `--list-scopes` and a
+server that already had a grant both change nothing, so neither pays for an
+index rebuild.
+
 Registration is RFC 7591 dynamic client registration, so there is no app to
 create first. Tokens live in `~/.autorouter/oauth/<server>.json` at `0600` and
 are refreshed automatically; `logout` deletes them. The loopback redirect uses a

package/dist/cli.js

@@ -19474,6 +19474,18 @@ function run(command, args, opts = {}) {
     child.stdin.end();
   });
 }
+function runStreaming(command, args, opts = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn2(command, args, {
+      stdio: "inherit",
+      cwd: opts.cwd,
+      env: opts.env,
+      shell: process.platform === "win32"
+    });
+    child.on("error", reject);
+    child.on("close", (code) => resolve(code));
+  });
+}
 function which(command) {
   const isWindows = process.platform === "win32";
   const exts = isWindows ? (process.env.PATHEXT ?? ".EXE;.CMD;.BAT;.COM").split(";").filter(Boolean) : [""];
@@ -22311,6 +22323,7 @@ async function runLogin(opts) {
       return result;
     return {
       ok: true,
+      authorized: true,
       message: `${entry.name}: authorized.` + (result.grantedScope ? `
   ${summarizeScopes(result.grantedScope)}` : "")
     };
@@ -22454,7 +22467,11 @@ Opening your browser to authorize ${entry.name}:
   try {
     const first = await auth(provider, { serverUrl: entry.url, scope });
     if (first === "AUTHORIZED") {
-      return { ok: true, message: `${entry.name}: already authorized (existing grant is still valid).` };
+      return {
+        ok: true,
+        authorized: true,
+        message: `${entry.name}: already authorized (existing grant is still valid).`
+      };
     }
     pendingState = (await readAuth(entry.name)).state;
     const code = mode === "manual" ? await readPastedCode(pendingState) : await withTimeout2(codePromise, 5 * 60000, "waiting for the browser callback");
@@ -22466,8 +22483,12 @@ Opening your browser to authorize ${entry.name}:
       await writeAuth(entry.name, { requestedScope: scope });
     const stored = await readAuth(entry.name);
     const granted = stored.tokens?.scope ?? scope;
-    return { ok: true, message: `${entry.name}: authorized.${granted ? `
-  ${summarizeScopes(granted)}` : ""}` };
+    return {
+      ok: true,
+      authorized: true,
+      message: `${entry.name}: authorized.${granted ? `
+  ${summarizeScopes(granted)}` : ""}`
+    };
   } catch (err) {
     return { ok: false, message: `${entry.name}: ${err instanceof Error ? err.message : String(err)}` };
   } finally {
@@ -22585,8 +22606,224 @@ function summarizeScopes(scope, limit = 6) {
   return `scope: ${all.length} granted, ${writes.length} of them write (${writes.slice(0, 3).join(", ") || "none"}${writes.length > 3 ? ", …" : ""})`;
 }
 
+// src/cli/update.ts
+import { existsSync, realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname as dirname3, join as join18, resolve as resolve2, sep } from "node:path";
+var PACKAGE_NAME = "autorouter-mcp";
+function entryPath() {
+  let raw;
+  try {
+    raw = fileURLToPath(import.meta.url);
+  } catch {
+    raw = process.argv[1] ?? "";
+  }
+  try {
+    return realpathSync(raw);
+  } catch {
+    return raw;
+  }
+}
+function packageRoot(from, exists) {
+  let dir = dirname3(from);
+  for (let i = 0;i < 12; i++) {
+    if (exists(join18(dir, "package.json")))
+      return dir;
+    const parent = dirname3(dir);
+    if (parent === dir)
+      break;
+    dir = parent;
+  }
+  return;
+}
+function managerFromLockfile(dir, exists) {
+  if (exists(join18(dir, "bun.lock")) || exists(join18(dir, "bun.lockb")))
+    return "bun";
+  if (exists(join18(dir, "pnpm-lock.yaml")))
+    return "pnpm";
+  if (exists(join18(dir, "yarn.lock")))
+    return "yarn";
+  return "npm";
+}
+function detectInstall(entry, exists = existsSync) {
+  const root = packageRoot(entry, exists);
+  if (!root)
+    return { kind: "unknown", dir: dirname3(entry) };
+  const path = root.split(sep).join("/");
+  if (exists(join18(root, ".git")))
+    return { kind: "source", dir: root };
+  const transient = path.includes("/_npx/") && "npx" || /\/dlx(-|\/)/.test(path) && "pnpm dlx" || path.includes("/.bun/install/cache/") && "bunx" || null;
+  if (transient)
+    return { kind: "transient", runner: transient, dir: root };
+  const nodeModules = dirname3(root);
+  const parent = dirname3(nodeModules);
+  const globalManager = path.includes("/.bun/install/global/") ? "bun" : /\/pnpm\/global\/|\/pnpm\/[0-9]+\/node_modules\//.test(path) ? "pnpm" : /\/\.config\/yarn\/global\/|\/\.yarn\/global\//.test(path) ? "yarn" : null;
+  if (globalManager)
+    return { kind: "global", manager: globalManager, dir: root };
+  if (nodeModules.split(sep).pop() === "node_modules") {
+    if (exists(join18(parent, "package.json"))) {
+      return {
+        kind: "project",
+        manager: managerFromLockfile(parent, exists),
+        dir: root,
+        projectDir: parent
+      };
+    }
+    return { kind: "global", manager: "npm", dir: root };
+  }
+  return { kind: "unknown", dir: root };
+}
+function updateCommand(install, pkg, version = "latest") {
+  const spec = `${pkg}@${version}`;
+  if (install.kind === "global") {
+    switch (install.manager) {
+      case "bun":
+        return ["bun", "add", "-g", spec];
+      case "pnpm":
+        return ["pnpm", "add", "-g", spec];
+      case "yarn":
+        return ["yarn", "global", "add", spec];
+      default:
+        return ["npm", "install", "-g", spec];
+    }
+  }
+  if (install.kind === "project") {
+    switch (install.manager) {
+      case "bun":
+        return ["bun", "add", spec];
+      case "pnpm":
+        return ["pnpm", "add", spec];
+      case "yarn":
+        return ["yarn", "add", spec];
+      default:
+        return ["npm", "install", spec];
+    }
+  }
+  return null;
+}
+function compareVersions2(a, b) {
+  const split = (v) => {
+    const [core = "", pre] = v.replace(/^v/, "").split("-", 2);
+    const parts = core.split(".").map((n) => Number.parseInt(n, 10) || 0);
+    return { parts, pre };
+  };
+  const x = split(a);
+  const y = split(b);
+  for (let i = 0;i < 3; i++) {
+    const d = (x.parts[i] ?? 0) - (y.parts[i] ?? 0);
+    if (d !== 0)
+      return d < 0 ? -1 : 1;
+  }
+  if (x.pre && !y.pre)
+    return -1;
+  if (!x.pre && y.pre)
+    return 1;
+  if (x.pre && y.pre && x.pre !== y.pre)
+    return x.pre < y.pre ? -1 : 1;
+  return 0;
+}
+async function latestVersion(pkg, fetchFn = fetch) {
+  const base = (process.env.npm_config_registry ?? process.env.NPM_CONFIG_REGISTRY ?? "https://registry.npmjs.org").replace(/\/+$/, "");
+  try {
+    const res = await fetchFn(`${base}/${encodeURIComponent(pkg)}/latest`, {
+      headers: { accept: "application/json" },
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!res.ok)
+      return { error: `registry returned ${res.status}` };
+    const body = await res.json();
+    return body.version ? { version: body.version } : { error: "registry returned no version" };
+  } catch (err) {
+    return { error: err instanceof Error ? err.message : String(err) };
+  }
+}
+function cannotUpdate(install, pkg) {
+  if (install.kind === "transient") {
+    return `This copy was unpacked by ${install.runner}, which fetches the package fresh on every run —
+` + `  there is no install here to upgrade. You are already getting the latest each time.
+` + `  To keep a copy that does not re-download: npm install -g ${pkg}`;
+  }
+  if (install.kind === "source") {
+    return `This is a checkout running from source (${install.dir}), not a package install.
+` + `  Update it with: git -C ${install.dir} pull && bun install && bun run build`;
+  }
+  return `Could not tell which package manager installed this copy (${install.dir}).
+` + `  Upgrade it the way you installed it, e.g. npm install -g ${pkg}@latest`;
+}
+function describe2(install) {
+  switch (install.kind) {
+    case "global":
+      return `${install.manager} global install at ${install.dir}`;
+    case "project":
+      return `${install.manager} dependency of ${install.projectDir}`;
+    case "transient":
+      return `${install.runner} temporary copy at ${install.dir}`;
+    case "source":
+      return `source checkout at ${install.dir}`;
+    default:
+      return `unrecognized install at ${install.dir}`;
+  }
+}
+async function runUpdate(opts) {
+  const entry = opts.entry ?? entryPath();
+  const install = detectInstall(entry, opts.exists);
+  const manifest = install.kind === "unknown" ? null : await readJson(join18(install.dir, "package.json"));
+  const pkg = manifest?.name ?? PACKAGE_NAME;
+  const latest = await latestVersion(pkg, opts.fetchFn);
+  if ("error" in latest) {
+    return { ok: false, message: `Could not reach the registry to check for updates: ${latest.error}` };
+  }
+  const behind = compareVersions2(opts.current, latest.version) < 0;
+  const status = behind ? `autorouter ${opts.current} → ${latest.version} available` : `autorouter ${opts.current} is up to date (latest is ${latest.version})`;
+  const command = updateCommand(install, pkg, latest.version);
+  if (!command) {
+    return { ok: !behind, message: `${status}
+
+${cannotUpdate(install, pkg)}` };
+  }
+  const printable = command.join(" ");
+  if (opts.check) {
+    return { ok: true, message: `${status}
+  ${describe2(install)}
+  Update with: ${printable}` };
+  }
+  if (!behind && !opts.force) {
+    return { ok: true, message: `${status}
+  ${describe2(install)}
+  Re-install anyway with: --force` };
+  }
+  if (opts.dryRun) {
+    return { ok: true, message: `${status}
+  ${describe2(install)}
+  Would run: ${printable}` };
+  }
+  console.log(`${status}
+  ${describe2(install)}
+  Running: ${printable}
+`);
+  const code = await runStreaming(command[0], command.slice(1), {
+    cwd: install.kind === "project" ? install.projectDir : undefined
+  }).catch((err) => err);
+  if (code instanceof Error) {
+    return {
+      ok: false,
+      message: `Could not run ${command[0]}: ${code.message}
+` + `  Run it yourself: ${printable}`
+    };
+  }
+  if (code !== 0) {
+    return { ok: false, message: `${command[0]} exited with code ${code}. Nothing was changed by autorouter.` };
+  }
+  return {
+    ok: true,
+    message: `
+Updated to ${latest.version}. Restart any harness with the router running to pick it up` + `
+(it is a long-lived stdio server, so an open session keeps the old build).`
+  };
+}
+
 // src/cli.ts
-var VERSION2 = "0.2.5";
+var VERSION2 = "0.2.7";
 var USAGE = `autorouter — one search tool instead of every tool
 
   autorouter serve                     Run as an MCP server over stdio (default)
@@ -22596,6 +22833,9 @@ var USAGE = `autorouter — one search tool instead of every tool
   autorouter list [--kind K]           List everything in the catalog
   autorouter reindex                   Rebuild the catalog now
   autorouter doctor                    Show what is reachable and what it saves
+  autorouter update                    Upgrade via the package manager that
+                                       installed this copy. --check to look
+                                       without installing.
   autorouter login [server]            Authorize an OAuth server (opens a browser,
                                        or prints a code on a headless box);
                                        with no argument, lists what needs one
@@ -22623,6 +22863,8 @@ Options
   --json         machine-readable output
   --yes          init/adopt: do not prompt
   --dry-run      adopt: show what would move, change nothing
+                 update: print the upgrade command without running it
+  --check        update: report the available version, install nothing
   --force        adopt: proceed even if a server is unreachable
   --keep S       adopt: leave server S registered in the harness (comma-separated)
   --keep-skill S adopt: leave skill S loaded (comma-separated)
@@ -22637,6 +22879,7 @@ Options
                  any narrowing the previous grant carried
   --scopes S     login: request exactly these scopes (comma or space separated)
   --list-scopes  login: show what the server offers, authorize nothing
+  --no-reindex   login: skip the reindex that otherwise follows a new grant
   --device       login: RFC 8628 — print a code to enter on another device and
                  poll for the result. No browser or open port needed here.
   --manual       login: print the authorization URL, then read the redirect you
@@ -22666,18 +22909,23 @@ async function main(argv) {
       return await cmdCall(positionals[0], flags);
     case "list":
       return await cmdList(flags);
-    case "reindex": {
-      const router = await Router.create({ force: true });
-      console.log(`Reindexed: ${router.summary()}`);
-      const failures = Object.entries(router.catalog.errors);
-      for (const [name, err] of failures)
-        console.error(`  unreachable: ${name}: ${oneLine(err, 100)}`);
-      await router.close();
+    case "reindex":
+      await cmdReindex();
       return 0;
-    }
     case "doctor":
       console.log(await runDoctor(process.cwd()));
       return 0;
+    case "update":
+    case "upgrade": {
+      const result = await runUpdate({
+        current: VERSION2,
+        check: Boolean(flags.check),
+        dryRun: Boolean(flags["dry-run"]),
+        force: Boolean(flags.force)
+      });
+      console.log(result.message);
+      return result.ok ? 0 : 1;
+    }
     case "init":
       return await cmdInit(flags);
     case "login":
@@ -22745,6 +22993,14 @@ async function cmdRemove(name) {
   console.log(await runRemove(name));
   return 0;
 }
+async function cmdReindex() {
+  const router = await Router.create({ force: true });
+  console.log(`Reindexed: ${router.summary()}`);
+  for (const [name, err] of Object.entries(router.catalog.errors)) {
+    console.error(`  unreachable: ${name}: ${oneLine(err, 100)}`);
+  }
+  await router.close();
+}
 async function cmdLogin(server, flags) {
   if (!server) {
     const resolved = await resolveConfig(process.cwd());
@@ -22794,10 +23050,20 @@ ${pending.length} need a grant; each is a separate authorization:`);
     manual: Boolean(flags.manual)
   });
   console.log(result.message);
-  if (result.ok && !flags["list-scopes"]) {
-    console.log("Re-run `autorouter reindex` to pick up its capabilities.");
+  if (!result.authorized)
+    return result.ok ? 0 : 1;
+  if (flags["no-reindex"]) {
+    console.log("Skipped the reindex; run `autorouter reindex` to pick up its capabilities.");
+    return 0;
   }
-  return result.ok ? 0 : 1;
+  try {
+    await cmdReindex();
+  } catch (err) {
+    console.error(`
+The grant was saved, but the reindex failed: ${oneLine(err instanceof Error ? err.message : String(err), 200)}
+` + `  Run \`autorouter reindex\` once that is resolved.`);
+  }
+  return 0;
 }
 async function cmdLogout(server) {
   if (!server) {
@@ -23082,7 +23348,7 @@ function parseArgs(argv) {
         command = `--${name}`;
         continue;
       }
-      const boolean = ["raw", "json", "yes", "dry-run", "force", "servers-only", "read-only", "all-scopes", "list-scopes", "device", "manual"].includes(name) && !(name === "json" && command === "add");
+      const boolean = ["raw", "json", "yes", "dry-run", "force", "servers-only", "read-only", "all-scopes", "list-scopes", "device", "manual", "check", "no-reindex"].includes(name) && !(name === "json" && command === "add");
       if (boolean) {
         flags[name] = true;
       } else if (inline !== undefined) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "autorouter-mcp",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "One search tool instead of every tool: an MCP capability router for Claude Code, Codex, Cursor and anything else that speaks MCP.",
   "mcpName": "io.github.Webb-Ventures/autorouter",
   "license": "MIT",

package/server.json

@@ -3,7 +3,7 @@
   "name": "io.github.Webb-Ventures/autorouter",
   "title": "autorouter",
   "description": "An MCP capability router: one search tool instead of every server's tool schema.",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "websiteUrl": "https://github.com/Webb-Ventures/autorouter",
   "repository": {
     "url": "https://github.com/Webb-Ventures/autorouter",
@@ -14,7 +14,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "autorouter-mcp",
-      "version": "0.2.5",
+      "version": "0.2.7",
       "transport": { "type": "stdio" },
       "packageArguments": [{ "type": "positional", "value": "serve" }],
       "environmentVariables": [