cleargate 0.7.0 → 0.8.0

package/dist/cli.js

@@ -14,7 +14,7 @@ import { Command } from "commander";
 // package.json
 var package_default = {
   name: "cleargate",
-  version: "0.7.0",
+  version: "0.8.0",
   private: false,
   type: "module",
   description: "Planning framework for Claude Code agents \u2014 sprint/epic/story protocol, four-agent loop (architect/developer/qa/reporter), Karpathy-style awareness wiki.",
@@ -1423,9 +1423,13 @@ function mergeMcpJson(existing, entry) {
   next.mcpServers = servers;
   return JSON.stringify(next, null, 2) + "\n";
 }
-function injectMcpJson(cwd, url) {
+var STDIO_ENTRY = {
+  command: "cleargate",
+  args: ["mcp", "serve"]
+};
+function injectMcpJson(cwd, _unusedUrl) {
   const dst = path5.join(cwd, ".mcp.json");
-  const entry = { type: "http", url };
+  const entry = STDIO_ENTRY;
   let existing = null;
   let existingRaw = null;
   if (fs6.existsSync(dst)) {
@@ -2518,7 +2522,7 @@ async function initHandler(opts = {}) {
 `);
   }
   try {
-    const action = injectMcpJson(cwd, "https://cleargate-mcp.soula.ge/mcp");
+    const action = injectMcpJson(cwd);
     if (action === "created") {
       stdout(
         `[cleargate init] Created .mcp.json (cleargate MCP server registered) \u2014 restart Claude Code to load it.
@@ -7335,7 +7339,7 @@ function extractFrontmatterBlock(raw) {
 // src/lib/intake.ts
 async function runIntakeBranch(opts) {
   const {
-    mcp,
+    mcp: mcp2,
     identity,
     sprintRoot,
     projectRoot,
@@ -7346,7 +7350,7 @@ async function runIntakeBranch(opts) {
   const pendingSyncDir = path36.join(projectRoot, ".cleargate", "delivery", "pending-sync");
   let remoteItems = [];
   try {
-    remoteItems = await mcp.call(
+    remoteItems = await mcp2.call(
       "cleargate_detect_new_items",
       { label: labelFilter }
     );
@@ -7705,9 +7709,9 @@ async function syncCheckHandler(opts = {}) {
     }
   } catch {
   }
-  let mcp;
+  let mcp2;
   if (opts.mcp) {
-    mcp = opts.mcp;
+    mcp2 = opts.mcp;
   } else {
     let baseUrl = env["CLEARGATE_MCP_URL"];
     if (!baseUrl || !baseUrl.trim()) {
@@ -7736,10 +7740,10 @@ async function syncCheckHandler(opts = {}) {
       await emitError("adapter-not-configured", nowIso);
       return;
     }
-    mcp = createMcpClient({ baseUrl: baseUrl.trim(), token: accessToken });
+    mcp2 = createMcpClient({ baseUrl: baseUrl.trim(), token: accessToken });
   }
   try {
-    const adapterInfo = await mcp.adapterInfo();
+    const adapterInfo = await mcp2.adapterInfo();
     if (!adapterInfo.configured || adapterInfo.name === "no-adapter-configured") {
       await emitError("adapter-not-configured", nowIso);
       return;
@@ -7748,7 +7752,7 @@ async function syncCheckHandler(opts = {}) {
   }
   let refs;
   try {
-    refs = await mcp.call("cleargate_list_remote_updates", { since });
+    refs = await mcp2.call("cleargate_list_remote_updates", { since });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     await emitError(msg, nowIso);
@@ -7768,9 +7772,9 @@ async function syncHandler(opts = {}) {
   const identity = resolveIdentity(projectRoot);
   const sprintRoot = resolveActiveSprintDir(projectRoot);
   const sprintId = path40.basename(sprintRoot);
-  let mcp;
+  let mcp2;
   if (opts.mcp) {
-    mcp = opts.mcp;
+    mcp2 = opts.mcp;
   } else {
     let baseUrl = env["CLEARGATE_MCP_URL"];
     if (!baseUrl || !baseUrl.trim()) {
@@ -7813,11 +7817,11 @@ async function syncHandler(opts = {}) {
       exit(2);
       return;
     }
-    mcp = createMcpClient({ baseUrl: baseUrl.trim(), token: accessToken });
+    mcp2 = createMcpClient({ baseUrl: baseUrl.trim(), token: accessToken });
   }
   let adapterInfo;
   try {
-    adapterInfo = await mcp.adapterInfo();
+    adapterInfo = await mcp2.adapterInfo();
   } catch {
     adapterInfo = { configured: true, name: "unknown" };
   }
@@ -7838,13 +7842,13 @@ async function syncHandler(opts = {}) {
     }
   } catch {
   }
-  const remoteRefs = await mcp.call(
+  const remoteRefs = await mcp2.call(
     "cleargate_list_remote_updates",
     { since: lastRemoteSync }
   );
   const pulled = [];
   for (const ref of remoteRefs) {
-    const item = await mcp.call(
+    const item = await mcp2.call(
       "cleargate_pull_item",
       { remote_id: ref.remote_id }
     );
@@ -7856,7 +7860,7 @@ async function syncHandler(opts = {}) {
   let intakeResult = { created: 0, items: [] };
   try {
     intakeResult = await runIntakeBranch({
-      mcp,
+      mcp: mcp2,
       identity,
       sprintRoot,
       projectRoot,
@@ -7882,7 +7886,7 @@ async function syncHandler(opts = {}) {
     const activeSet = await resolveActiveItems(projectRoot, localRefs, nowFn);
     for (const remoteId of activeSet) {
       try {
-        const comments = await mcp.call(
+        const comments = await mcp2.call(
           "cleargate_pull_comments",
           { remote_id: remoteId }
         );
@@ -8036,7 +8040,7 @@ async function syncHandler(opts = {}) {
     await appendSyncLog(sprintRoot, entry);
   }
   for (const { localPath, fm, body, itemId } of pushQueue) {
-    await mcp.call("push_item", {
+    await mcp2.call("push_item", {
       cleargate_id: itemId,
       type: typeof fm["story_id"] === "string" ? "story" : typeof fm["epic_id"] === "string" ? "epic" : typeof fm["proposal_id"] === "string" ? "proposal" : "story",
       payload: fm
@@ -8166,9 +8170,9 @@ async function pullHandler(idOrRemoteId, opts = {}) {
   const nowFn = opts.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
   const identity = resolveIdentity(projectRoot);
   const sprintRoot = resolveActiveSprintDir(projectRoot);
-  let mcp;
+  let mcp2;
   if (opts.mcp) {
-    mcp = opts.mcp;
+    mcp2 = opts.mcp;
   } else {
     let baseUrl = env["CLEARGATE_MCP_URL"];
     if (!baseUrl || !baseUrl.trim()) {
@@ -8203,7 +8207,7 @@ async function pullHandler(idOrRemoteId, opts = {}) {
       exit(2);
       return;
     }
-    mcp = createMcpClient({ baseUrl: baseUrl.trim(), token: accessToken });
+    mcp2 = createMcpClient({ baseUrl: baseUrl.trim(), token: accessToken });
   }
   const remoteId = await resolveRemoteId(idOrRemoteId, projectRoot);
   if (!remoteId) {
@@ -8212,7 +8216,7 @@ async function pullHandler(idOrRemoteId, opts = {}) {
     exit(1);
     return;
   }
-  const remoteItem = await mcp.call("cleargate_pull_item", { remote_id: remoteId });
+  const remoteItem = await mcp2.call("cleargate_pull_item", { remote_id: remoteId });
   if (!remoteItem) {
     stderr(`Error: item ${remoteId} not found on MCP server.
 `);
@@ -8272,7 +8276,7 @@ async function pullHandler(idOrRemoteId, opts = {}) {
   stdout(`pull: ${remoteId} applied to ${path41.relative(projectRoot, localPath)}
 `);
   if (opts.comments) {
-    const comments = await mcp.call(
+    const comments = await mcp2.call(
       "cleargate_pull_comments",
       { remote_id: remoteId }
     );
@@ -8467,10 +8471,10 @@ async function handlePush(filePath, ctx) {
     if (h1) payloadForPush["title"] = h1;
   }
   payloadForPush["body"] = body;
-  const mcp = await resolveMcp();
+  const mcp2 = await resolveMcp();
   let result;
   try {
-    result = await mcp.call("push_item", {
+    result = await mcp2.call("push_item", {
       cleargate_id: itemId,
       type,
       payload: payloadForPush,
@@ -8522,9 +8526,9 @@ async function handleRevert(idOrRemoteId, ctx) {
     exit(1);
     return;
   }
-  const mcp = await resolveMcp();
+  const mcp2 = await resolveMcp();
   try {
-    await mcp.call("sync_status", {
+    await mcp2.call("sync_status", {
       cleargate_id: itemId,
       new_status: "archived-without-shipping"
     });
@@ -8957,6 +8961,214 @@ function hotfixNewHandler(opts, cli) {
   return exitFn(0);
 }
 
+// src/commands/mcp-serve.ts
+import * as readline5 from "readline";
+
+// src/auth/refresh.ts
+async function refreshAccessToken(baseUrl, refreshToken, deps = {}) {
+  const fetchFn = deps.fetch ?? globalThis.fetch;
+  const res = await fetchFn(`${baseUrl}/auth/refresh`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json" },
+    body: JSON.stringify({ refresh_token: refreshToken })
+  });
+  if (!res.ok) {
+    const body = await res.json().catch(() => ({}));
+    throw new RefreshError(res.status, body.error ?? "unknown_error");
+  }
+  const json = await res.json();
+  if (typeof json.access_token !== "string" || typeof json.refresh_token !== "string" || typeof json.expires_in !== "number") {
+    throw new RefreshError(500, "malformed_response");
+  }
+  return json;
+}
+var RefreshError = class extends Error {
+  constructor(status, code) {
+    super(`refresh failed: ${status} ${code}`);
+    this.status = status;
+    this.code = code;
+    this.name = "RefreshError";
+  }
+  status;
+  code;
+};
+var AuthFetcher = class {
+  constructor(opts) {
+    this.opts = opts;
+  }
+  opts;
+  accessToken = null;
+  accessExpiresAt = 0;
+  inflight = null;
+  /** Returns a fresh access token, refreshing if needed. */
+  async getAccessToken() {
+    const now = (this.opts.now ?? (() => Date.now()))();
+    const skewMs = (this.opts.skewSeconds ?? 60) * 1e3;
+    if (this.accessToken && now < this.accessExpiresAt - skewMs) {
+      return this.accessToken;
+    }
+    if (this.inflight) return this.inflight;
+    this.inflight = this.refreshNow().finally(() => {
+      this.inflight = null;
+    });
+    return this.inflight;
+  }
+  /** Force the next call to refresh. Used after a 401. */
+  invalidate() {
+    this.accessToken = null;
+    this.accessExpiresAt = 0;
+  }
+  async refreshNow() {
+    const stored = await this.opts.loadRefresh();
+    if (!stored) {
+      throw new RefreshError(401, "no_refresh_token");
+    }
+    const exchanged = await refreshAccessToken(this.opts.baseUrl, stored, {
+      ...this.opts.fetch ? { fetch: this.opts.fetch } : {},
+      ...this.opts.now ? { now: this.opts.now } : {}
+    });
+    await this.opts.saveRefresh(exchanged.refresh_token);
+    const now = (this.opts.now ?? (() => Date.now()))();
+    this.accessToken = exchanged.access_token;
+    this.accessExpiresAt = now + exchanged.expires_in * 1e3;
+    return exchanged.access_token;
+  }
+};
+
+// src/commands/mcp-serve.ts
+var DEFAULT_BASE_URL = "https://cleargate-mcp.soula.ge";
+async function mcpServeHandler(opts) {
+  const fetchFn = opts.fetch ?? globalThis.fetch;
+  const stdout = opts.stdout ?? ((s) => process.stdout.write(s));
+  const stderr = opts.stderr ?? ((s) => process.stderr.write(s));
+  const exit = opts.exit ?? ((c) => process.exit(c));
+  const cfg = loadConfig({
+    flags: { profile: opts.profile, mcpUrl: opts.mcpUrlFlag }
+  });
+  const baseUrl = cfg.mcpUrl ?? DEFAULT_BASE_URL;
+  const store = await (opts.createStore ?? createTokenStore)({
+    ...opts.keychainService !== void 0 ? { keychainService: opts.keychainService } : {},
+    ...opts.forceBackend !== void 0 ? { forceBackend: opts.forceBackend } : {}
+  });
+  const fetcher = new AuthFetcher({
+    baseUrl,
+    loadRefresh: () => store.load(opts.profile),
+    saveRefresh: (t) => store.save(opts.profile, t),
+    ...opts.fetch !== void 0 ? { fetch: opts.fetch } : {},
+    ...opts.now !== void 0 ? { now: opts.now } : {}
+  });
+  try {
+    await fetcher.getAccessToken();
+  } catch (err) {
+    if (err instanceof RefreshError) {
+      stderr(
+        `cleargate mcp serve: refresh failed (${err.status} ${err.code}). Run \`cleargate join <invite-url>\` to re-authenticate.
+`
+      );
+    } else {
+      stderr(
+        `cleargate mcp serve: ${err instanceof Error ? err.message : String(err)}
+`
+      );
+    }
+    return exit(1);
+  }
+  const inputStream = opts.stdin ?? process.stdin;
+  const rl = readline5.createInterface({
+    input: inputStream,
+    output: void 0,
+    terminal: false
+  });
+  for await (const line of rl) {
+    if (!line.trim()) continue;
+    try {
+      await proxyOne(line, baseUrl, fetcher, fetchFn, stdout, stderr);
+    } catch (err) {
+      const errMsg = err instanceof Error ? err.message : String(err);
+      stderr(`cleargate mcp serve: proxy error: ${errMsg}
+`);
+      const id = extractId(line);
+      if (id !== void 0) {
+        stdout(
+          JSON.stringify({
+            jsonrpc: "2.0",
+            id,
+            error: { code: -32603, message: `proxy error: ${errMsg}` }
+          }) + "\n"
+        );
+      }
+    }
+  }
+}
+async function proxyOne(line, baseUrl, fetcher, fetchFn, stdout, stderr) {
+  let parsed;
+  try {
+    parsed = JSON.parse(line);
+  } catch {
+    stderr(`cleargate mcp serve: ignoring non-JSON line: ${line.slice(0, 80)}
+`);
+    return;
+  }
+  const isNotification = !("id" in parsed) || parsed.id === void 0 || parsed.id === null;
+  let access = await fetcher.getAccessToken();
+  let res = await postFrame(baseUrl, line, access, fetchFn);
+  if (res.status === 401) {
+    fetcher.invalidate();
+    access = await fetcher.getAccessToken();
+    res = await postFrame(baseUrl, line, access, fetchFn);
+  }
+  if (isNotification) {
+    await res.arrayBuffer().catch(() => void 0);
+    return;
+  }
+  const ct = res.headers.get("content-type") ?? "";
+  if (ct.includes("text/event-stream")) {
+    await streamSse(res, stdout);
+  } else {
+    const text = await res.text();
+    if (text.length > 0) stdout(text + "\n");
+  }
+}
+async function postFrame(baseUrl, body, accessToken, fetchFn) {
+  return fetchFn(`${baseUrl}/mcp`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Accept: "application/json, text/event-stream",
+      Authorization: `Bearer ${accessToken}`
+    },
+    body
+  });
+}
+async function streamSse(res, stdout) {
+  if (!res.body) return;
+  const reader = res.body.getReader();
+  const decoder = new TextDecoder("utf-8");
+  let buf = "";
+  for (; ; ) {
+    const { value, done } = await reader.read();
+    if (done) break;
+    buf += decoder.decode(value, { stream: true });
+    let nl;
+    while ((nl = buf.indexOf("\n")) !== -1) {
+      const ln = buf.slice(0, nl);
+      buf = buf.slice(nl + 1);
+      if (ln.startsWith("data:")) {
+        const payload = ln.slice(5).trim();
+        if (payload) stdout(payload + "\n");
+      }
+    }
+  }
+}
+function extractId(line) {
+  try {
+    const obj = JSON.parse(line);
+    return "id" in obj ? obj.id : void 0;
+  } catch {
+    return void 0;
+  }
+}
+
 // src/cli.ts
 var program = new Command();
 program.name("cleargate").description("ClearGate CLI \u2014 connects AI agent teams to the ClearGate MCP server").version(package_default.version, "-V, --version").option("--profile <name>", "configuration profile to use", "default").option("--mcp-url <url>", "MCP server URL (overrides config file and env)").showHelpAfterError("(use `cleargate --help`)");
@@ -9199,5 +9411,13 @@ var hotfix = program.command("hotfix").description("hotfix lane commands (off-sp
 hotfix.command("new <slug>").description("scaffold a new HOTFIX-NNN_<slug>.md in pending-sync/").action((slug) => {
   hotfixNewHandler({ slug });
 });
+var mcp = program.command("mcp").description("MCP-server bridge commands (stdio shim, registration helpers)");
+mcp.command("serve").description("run a stdio MCP server that proxies to the cleargate HTTP /mcp endpoint with auto-refresh Bearer auth").action(async (_opts, command) => {
+  const globals = command.parent.parent.opts();
+  await mcpServeHandler({
+    profile: globals.profile,
+    ...globals.mcpUrl !== void 0 ? { mcpUrlFlag: globals.mcpUrl } : {}
+  });
+});
 void program.parseAsync(process.argv);
 //# sourceMappingURL=cli.js.map