cleargate 0.7.0 → 0.8.0

package/dist/MANIFEST.json

@@ -1,6 +1,6 @@
 {
-  "cleargate_version": "0.7.0",
-  "generated_at": "2026-04-27T08:35:05.824Z",
+  "cleargate_version": "0.8.0",
+  "generated_at": "2026-04-27T08:53:26.701Z",
   "files": [
     {
       "path": ".claude/agents/architect.md",

package/dist/cli.cjs

@@ -627,7 +627,7 @@ var import_commander = require("commander");
 // package.json
 var package_default = {
   name: "cleargate",
-  version: "0.7.0",
+  version: "0.8.0",
   private: false,
   type: "module",
   description: "Planning framework for Claude Code agents \u2014 sprint/epic/story protocol, four-agent loop (architect/developer/qa/reporter), Karpathy-style awareness wiki.",
@@ -2052,9 +2052,13 @@ function mergeMcpJson(existing, entry) {
   next.mcpServers = servers;
   return JSON.stringify(next, null, 2) + "\n";
 }
-function injectMcpJson(cwd, url) {
+var STDIO_ENTRY = {
+  command: "cleargate",
+  args: ["mcp", "serve"]
+};
+function injectMcpJson(cwd, _unusedUrl) {
   const dst = path8.join(cwd, ".mcp.json");
-  const entry = { type: "http", url };
+  const entry = STDIO_ENTRY;
   let existing = null;
   let existingRaw = null;
   if (fs8.existsSync(dst)) {
@@ -3162,7 +3166,7 @@ async function initHandler(opts = {}) {
 `);
   }
   try {
-    const action = injectMcpJson(cwd, "https://cleargate-mcp.soula.ge/mcp");
+    const action = injectMcpJson(cwd);
     if (action === "created") {
       stdout(
         `[cleargate init] Created .mcp.json (cleargate MCP server registered) \u2014 restart Claude Code to load it.
@@ -8016,7 +8020,7 @@ function extractFrontmatterBlock(raw) {
 // src/lib/intake.ts
 async function runIntakeBranch(opts) {
   const {
-    mcp,
+    mcp: mcp2,
     identity,
     sprintRoot,
     projectRoot,
@@ -8027,7 +8031,7 @@ async function runIntakeBranch(opts) {
   const pendingSyncDir = path39.join(projectRoot, ".cleargate", "delivery", "pending-sync");
   let remoteItems = [];
   try {
-    remoteItems = await mcp.call(
+    remoteItems = await mcp2.call(
       "cleargate_detect_new_items",
       { label: labelFilter }
     );
@@ -8389,9 +8393,9 @@ async function syncCheckHandler(opts = {}) {
     }
   } catch {
   }
-  let mcp;
+  let mcp2;
   if (opts.mcp) {
-    mcp = opts.mcp;
+    mcp2 = opts.mcp;
   } else {
     let baseUrl = env["CLEARGATE_MCP_URL"];
     if (!baseUrl || !baseUrl.trim()) {
@@ -8420,10 +8424,10 @@ async function syncCheckHandler(opts = {}) {
       await emitError("adapter-not-configured", nowIso);
       return;
     }
-    mcp = createMcpClient({ baseUrl: baseUrl.trim(), token: accessToken });
+    mcp2 = createMcpClient({ baseUrl: baseUrl.trim(), token: accessToken });
   }
   try {
-    const adapterInfo = await mcp.adapterInfo();
+    const adapterInfo = await mcp2.adapterInfo();
     if (!adapterInfo.configured || adapterInfo.name === "no-adapter-configured") {
       await emitError("adapter-not-configured", nowIso);
       return;
@@ -8432,7 +8436,7 @@ async function syncCheckHandler(opts = {}) {
   }
   let refs;
   try {
-    refs = await mcp.call("cleargate_list_remote_updates", { since });
+    refs = await mcp2.call("cleargate_list_remote_updates", { since });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     await emitError(msg, nowIso);
@@ -8452,9 +8456,9 @@ async function syncHandler(opts = {}) {
   const identity = resolveIdentity(projectRoot);
   const sprintRoot = resolveActiveSprintDir(projectRoot);
   const sprintId = path43.basename(sprintRoot);
-  let mcp;
+  let mcp2;
   if (opts.mcp) {
-    mcp = opts.mcp;
+    mcp2 = opts.mcp;
   } else {
     let baseUrl = env["CLEARGATE_MCP_URL"];
     if (!baseUrl || !baseUrl.trim()) {
@@ -8497,11 +8501,11 @@ async function syncHandler(opts = {}) {
       exit(2);
       return;
     }
-    mcp = createMcpClient({ baseUrl: baseUrl.trim(), token: accessToken });
+    mcp2 = createMcpClient({ baseUrl: baseUrl.trim(), token: accessToken });
   }
   let adapterInfo;
   try {
-    adapterInfo = await mcp.adapterInfo();
+    adapterInfo = await mcp2.adapterInfo();
   } catch {
     adapterInfo = { configured: true, name: "unknown" };
   }
@@ -8522,13 +8526,13 @@ async function syncHandler(opts = {}) {
     }
   } catch {
   }
-  const remoteRefs = await mcp.call(
+  const remoteRefs = await mcp2.call(
     "cleargate_list_remote_updates",
     { since: lastRemoteSync }
   );
   const pulled = [];
   for (const ref of remoteRefs) {
-    const item = await mcp.call(
+    const item = await mcp2.call(
       "cleargate_pull_item",
       { remote_id: ref.remote_id }
     );
@@ -8540,7 +8544,7 @@ async function syncHandler(opts = {}) {
   let intakeResult = { created: 0, items: [] };
   try {
     intakeResult = await runIntakeBranch({
-      mcp,
+      mcp: mcp2,
       identity,
       sprintRoot,
       projectRoot,
@@ -8566,7 +8570,7 @@ async function syncHandler(opts = {}) {
     const activeSet = await resolveActiveItems(projectRoot, localRefs, nowFn);
     for (const remoteId of activeSet) {
       try {
-        const comments = await mcp.call(
+        const comments = await mcp2.call(
           "cleargate_pull_comments",
           { remote_id: remoteId }
         );
@@ -8720,7 +8724,7 @@ async function syncHandler(opts = {}) {
     await appendSyncLog(sprintRoot, entry);
   }
   for (const { localPath, fm, body, itemId } of pushQueue) {
-    await mcp.call("push_item", {
+    await mcp2.call("push_item", {
       cleargate_id: itemId,
       type: typeof fm["story_id"] === "string" ? "story" : typeof fm["epic_id"] === "string" ? "epic" : typeof fm["proposal_id"] === "string" ? "proposal" : "story",
       payload: fm
@@ -8853,9 +8857,9 @@ async function pullHandler(idOrRemoteId, opts = {}) {
   const nowFn = opts.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
   const identity = resolveIdentity(projectRoot);
   const sprintRoot = resolveActiveSprintDir(projectRoot);
-  let mcp;
+  let mcp2;
   if (opts.mcp) {
-    mcp = opts.mcp;
+    mcp2 = opts.mcp;
   } else {
     let baseUrl = env["CLEARGATE_MCP_URL"];
     if (!baseUrl || !baseUrl.trim()) {
@@ -8890,7 +8894,7 @@ async function pullHandler(idOrRemoteId, opts = {}) {
       exit(2);
       return;
     }
-    mcp = createMcpClient({ baseUrl: baseUrl.trim(), token: accessToken });
+    mcp2 = createMcpClient({ baseUrl: baseUrl.trim(), token: accessToken });
   }
   const remoteId = await resolveRemoteId(idOrRemoteId, projectRoot);
   if (!remoteId) {
@@ -8899,7 +8903,7 @@ async function pullHandler(idOrRemoteId, opts = {}) {
     exit(1);
     return;
   }
-  const remoteItem = await mcp.call("cleargate_pull_item", { remote_id: remoteId });
+  const remoteItem = await mcp2.call("cleargate_pull_item", { remote_id: remoteId });
   if (!remoteItem) {
     stderr(`Error: item ${remoteId} not found on MCP server.
 `);
@@ -8959,7 +8963,7 @@ async function pullHandler(idOrRemoteId, opts = {}) {
   stdout(`pull: ${remoteId} applied to ${path44.relative(projectRoot, localPath)}
 `);
   if (opts.comments) {
-    const comments = await mcp.call(
+    const comments = await mcp2.call(
       "cleargate_pull_comments",
       { remote_id: remoteId }
     );
@@ -9157,10 +9161,10 @@ async function handlePush(filePath, ctx) {
     if (h1) payloadForPush["title"] = h1;
   }
   payloadForPush["body"] = body;
-  const mcp = await resolveMcp();
+  const mcp2 = await resolveMcp();
   let result;
   try {
-    result = await mcp.call("push_item", {
+    result = await mcp2.call("push_item", {
       cleargate_id: itemId,
       type,
       payload: payloadForPush,
@@ -9212,9 +9216,9 @@ async function handleRevert(idOrRemoteId, ctx) {
     exit(1);
     return;
   }
-  const mcp = await resolveMcp();
+  const mcp2 = await resolveMcp();
   try {
-    await mcp.call("sync_status", {
+    await mcp2.call("sync_status", {
       cleargate_id: itemId,
       new_status: "archived-without-shipping"
     });
@@ -9653,6 +9657,218 @@ function hotfixNewHandler(opts, cli) {
   return exitFn(0);
 }
 
+// src/commands/mcp-serve.ts
+init_cjs_shims();
+var readline5 = __toESM(require("readline"), 1);
+init_config();
+init_factory();
+
+// src/auth/refresh.ts
+init_cjs_shims();
+async function refreshAccessToken(baseUrl, refreshToken, deps = {}) {
+  const fetchFn = deps.fetch ?? globalThis.fetch;
+  const res = await fetchFn(`${baseUrl}/auth/refresh`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json" },
+    body: JSON.stringify({ refresh_token: refreshToken })
+  });
+  if (!res.ok) {
+    const body = await res.json().catch(() => ({}));
+    throw new RefreshError(res.status, body.error ?? "unknown_error");
+  }
+  const json = await res.json();
+  if (typeof json.access_token !== "string" || typeof json.refresh_token !== "string" || typeof json.expires_in !== "number") {
+    throw new RefreshError(500, "malformed_response");
+  }
+  return json;
+}
+var RefreshError = class extends Error {
+  constructor(status, code) {
+    super(`refresh failed: ${status} ${code}`);
+    this.status = status;
+    this.code = code;
+    this.name = "RefreshError";
+  }
+  status;
+  code;
+};
+var AuthFetcher = class {
+  constructor(opts) {
+    this.opts = opts;
+  }
+  opts;
+  accessToken = null;
+  accessExpiresAt = 0;
+  inflight = null;
+  /** Returns a fresh access token, refreshing if needed. */
+  async getAccessToken() {
+    const now = (this.opts.now ?? (() => Date.now()))();
+    const skewMs = (this.opts.skewSeconds ?? 60) * 1e3;
+    if (this.accessToken && now < this.accessExpiresAt - skewMs) {
+      return this.accessToken;
+    }
+    if (this.inflight) return this.inflight;
+    this.inflight = this.refreshNow().finally(() => {
+      this.inflight = null;
+    });
+    return this.inflight;
+  }
+  /** Force the next call to refresh. Used after a 401. */
+  invalidate() {
+    this.accessToken = null;
+    this.accessExpiresAt = 0;
+  }
+  async refreshNow() {
+    const stored = await this.opts.loadRefresh();
+    if (!stored) {
+      throw new RefreshError(401, "no_refresh_token");
+    }
+    const exchanged = await refreshAccessToken(this.opts.baseUrl, stored, {
+      ...this.opts.fetch ? { fetch: this.opts.fetch } : {},
+      ...this.opts.now ? { now: this.opts.now } : {}
+    });
+    await this.opts.saveRefresh(exchanged.refresh_token);
+    const now = (this.opts.now ?? (() => Date.now()))();
+    this.accessToken = exchanged.access_token;
+    this.accessExpiresAt = now + exchanged.expires_in * 1e3;
+    return exchanged.access_token;
+  }
+};
+
+// src/commands/mcp-serve.ts
+var DEFAULT_BASE_URL = "https://cleargate-mcp.soula.ge";
+async function mcpServeHandler(opts) {
+  const fetchFn = opts.fetch ?? globalThis.fetch;
+  const stdout = opts.stdout ?? ((s) => process.stdout.write(s));
+  const stderr = opts.stderr ?? ((s) => process.stderr.write(s));
+  const exit = opts.exit ?? ((c) => process.exit(c));
+  const cfg = loadConfig({
+    flags: { profile: opts.profile, mcpUrl: opts.mcpUrlFlag }
+  });
+  const baseUrl = cfg.mcpUrl ?? DEFAULT_BASE_URL;
+  const store = await (opts.createStore ?? createTokenStore)({
+    ...opts.keychainService !== void 0 ? { keychainService: opts.keychainService } : {},
+    ...opts.forceBackend !== void 0 ? { forceBackend: opts.forceBackend } : {}
+  });
+  const fetcher = new AuthFetcher({
+    baseUrl,
+    loadRefresh: () => store.load(opts.profile),
+    saveRefresh: (t) => store.save(opts.profile, t),
+    ...opts.fetch !== void 0 ? { fetch: opts.fetch } : {},
+    ...opts.now !== void 0 ? { now: opts.now } : {}
+  });
+  try {
+    await fetcher.getAccessToken();
+  } catch (err) {
+    if (err instanceof RefreshError) {
+      stderr(
+        `cleargate mcp serve: refresh failed (${err.status} ${err.code}). Run \`cleargate join <invite-url>\` to re-authenticate.
+`
+      );
+    } else {
+      stderr(
+        `cleargate mcp serve: ${err instanceof Error ? err.message : String(err)}
+`
+      );
+    }
+    return exit(1);
+  }
+  const inputStream = opts.stdin ?? process.stdin;
+  const rl = readline5.createInterface({
+    input: inputStream,
+    output: void 0,
+    terminal: false
+  });
+  for await (const line of rl) {
+    if (!line.trim()) continue;
+    try {
+      await proxyOne(line, baseUrl, fetcher, fetchFn, stdout, stderr);
+    } catch (err) {
+      const errMsg = err instanceof Error ? err.message : String(err);
+      stderr(`cleargate mcp serve: proxy error: ${errMsg}
+`);
+      const id = extractId(line);
+      if (id !== void 0) {
+        stdout(
+          JSON.stringify({
+            jsonrpc: "2.0",
+            id,
+            error: { code: -32603, message: `proxy error: ${errMsg}` }
+          }) + "\n"
+        );
+      }
+    }
+  }
+}
+async function proxyOne(line, baseUrl, fetcher, fetchFn, stdout, stderr) {
+  let parsed;
+  try {
+    parsed = JSON.parse(line);
+  } catch {
+    stderr(`cleargate mcp serve: ignoring non-JSON line: ${line.slice(0, 80)}
+`);
+    return;
+  }
+  const isNotification = !("id" in parsed) || parsed.id === void 0 || parsed.id === null;
+  let access = await fetcher.getAccessToken();
+  let res = await postFrame(baseUrl, line, access, fetchFn);
+  if (res.status === 401) {
+    fetcher.invalidate();
+    access = await fetcher.getAccessToken();
+    res = await postFrame(baseUrl, line, access, fetchFn);
+  }
+  if (isNotification) {
+    await res.arrayBuffer().catch(() => void 0);
+    return;
+  }
+  const ct = res.headers.get("content-type") ?? "";
+  if (ct.includes("text/event-stream")) {
+    await streamSse(res, stdout);
+  } else {
+    const text = await res.text();
+    if (text.length > 0) stdout(text + "\n");
+  }
+}
+async function postFrame(baseUrl, body, accessToken, fetchFn) {
+  return fetchFn(`${baseUrl}/mcp`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Accept: "application/json, text/event-stream",
+      Authorization: `Bearer ${accessToken}`
+    },
+    body
+  });
+}
+async function streamSse(res, stdout) {
+  if (!res.body) return;
+  const reader = res.body.getReader();
+  const decoder = new TextDecoder("utf-8");
+  let buf = "";
+  for (; ; ) {
+    const { value, done } = await reader.read();
+    if (done) break;
+    buf += decoder.decode(value, { stream: true });
+    let nl;
+    while ((nl = buf.indexOf("\n")) !== -1) {
+      const ln = buf.slice(0, nl);
+      buf = buf.slice(nl + 1);
+      if (ln.startsWith("data:")) {
+        const payload = ln.slice(5).trim();
+        if (payload) stdout(payload + "\n");
+      }
+    }
+  }
+}
+function extractId(line) {
+  try {
+    const obj = JSON.parse(line);
+    return "id" in obj ? obj.id : void 0;
+  } catch {
+    return void 0;
+  }
+}
+
 // src/cli.ts
 var program = new import_commander.Command();
 program.name("cleargate").description("ClearGate CLI \u2014 connects AI agent teams to the ClearGate MCP server").version(package_default.version, "-V, --version").option("--profile <name>", "configuration profile to use", "default").option("--mcp-url <url>", "MCP server URL (overrides config file and env)").showHelpAfterError("(use `cleargate --help`)");
@@ -9895,5 +10111,13 @@ var hotfix = program.command("hotfix").description("hotfix lane commands (off-sp
 hotfix.command("new <slug>").description("scaffold a new HOTFIX-NNN_<slug>.md in pending-sync/").action((slug) => {
   hotfixNewHandler({ slug });
 });
+var mcp = program.command("mcp").description("MCP-server bridge commands (stdio shim, registration helpers)");
+mcp.command("serve").description("run a stdio MCP server that proxies to the cleargate HTTP /mcp endpoint with auto-refresh Bearer auth").action(async (_opts, command) => {
+  const globals = command.parent.parent.opts();
+  await mcpServeHandler({
+    profile: globals.profile,
+    ...globals.mcpUrl !== void 0 ? { mcpUrlFlag: globals.mcpUrl } : {}
+  });
+});
 void program.parseAsync(process.argv);
 //# sourceMappingURL=cli.cjs.map