constructor-research-mcp 0.3.1 → 0.4.0-beta.1

package/dist/runtime.js

@@ -3,7 +3,7 @@ import { terminal } from "./deployment.js";
 import { ToolError } from "./api.js";
 import { waitCommand } from "./config.js";
 import { buildInput, deployInput, updateInput, lifecycleInput, getInput, } from "./schemas.js";
-export const paused = new Set(["needs_auth", "needs_upload"]);
+export const paused = new Set(["needs_key", "needs_upload"]);
 /** Tells the agent which unfinished deployments a new one ended, and what they changed that it does not. */
 function replacedNote(replaced) {
     if (!replaced?.length)
@@ -73,7 +73,7 @@ export class DeploymentRuntime {
             await this.engine.api.withBudget(15000, () => this.engine.get({ ...i, resume: true }));
         }
         let op = await this.engine.store.load(i.deployment_id);
-        if (op?.status === "needs_auth" &&
+        if (op?.status === "needs_key" &&
             i.resume &&
             i.files_uploaded === undefined) {
             await this.pause(i.deployment_id);
@@ -210,8 +210,8 @@ export class DeploymentRuntime {
                     : "background",
             next_action: op.status === "failed"
                 ? "Tell the user which stage/service failed and pass on the message. failure.log_tail has the last log lines when the MCP captured them; get_logs shows more. Do not investigate using browser or other tools."
-                : op.status === "needs_auth"
-                    ? `${this.engine.api.authHelp("The token expired or is invalid.")} Then check this deployment again.`
+                : op.status === "needs_key"
+                    ? `${this.engine.api.keyHelp("Constructor rejected the access key, or none is set.")} Then check this deployment again.`
                     : op.status === "needs_upload"
                         ? "Upload the listed files with sync_files, then call get_deployment with files_uploaded=true."
                         : op.status === "confirm_required"
@@ -220,7 +220,7 @@ export class DeploymentRuntime {
                                 ? "Inspect the uncertain mutation in Constructor before submitting a new operation."
                                 : terminal.has(op.status)
                                     ? undefined
-                                    : `The MCP is executing this deployment. Keep working on other things and check later with get_deployment. If nothing else is left, wait with the shell command \`${waitCommand(this.engine.api.config, [op.id])}\` (run it in the background if your client wakes you when a background command ends); it prints the outcome when the deployment finishes. Without a shell, call get_deployment with wait_seconds=20.`,
+                                    : `Not finished yet; builds often take several minutes. Do not end your turn or answer the user until execution is finished: they asked for the result (the public_url, or what failed). Finish any other work of this request, then wait with the shell command \`${waitCommand(this.engine.api.config, [op.id])}\`; it prints the outcome when the deployment finishes. Run it in the foreground, or in the background only if your client wakes you when a background command ends. Without a shell, keep calling get_deployment with wait_seconds=20 until execution is finished.`,
         };
     }
     async wait(id, milliseconds) {

package/dist/schemas.d.ts

@@ -225,8 +225,3 @@ export declare const syncFilesInput: z.ZodObject<{
     dry_run: z.ZodDefault<z.ZodBoolean>;
     confirm: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strict>;
-export declare const signInInput: z.ZodObject<{
-    url: z.ZodOptional<z.ZodString>;
-    wait_seconds: z.ZodDefault<z.ZodNumber>;
-    force: z.ZodDefault<z.ZodBoolean>;
-}, z.core.$strict>;

package/dist/schemas.js

@@ -257,21 +257,3 @@ export const syncFilesInput = z.strictObject({
         .default(false)
         .describe("Needed only when existing files would be replaced: the first call returns the list for the user to approve once; repeat with confirm=true."),
 });
-export const signInInput = z.strictObject({
-    url: z
-        .string()
-        .max(2000)
-        .optional()
-        .describe("Any link to the user's Constructor: a desk link, or just its address, e.g. https://acme.constructor.app. The user signs in there and the MCP works there afterwards, replacing any earlier sign-in. Pass it when the user names their Constructor or gives a link; omit it to sign in where the MCP works now (https://constructor.app unless the user signed in elsewhere)."),
-    wait_seconds: z
-        .number()
-        .int()
-        .min(0)
-        .max(25)
-        .default(20)
-        .describe("How long to wait for the user to finish signing in."),
-    force: z
-        .boolean()
-        .default(false)
-        .describe("Open the window even though a renewable session is saved (to switch account)."),
-});

package/dist/server.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { configFromEnv, originOf, VERSION } from "./config.js";
+import { configFromEnv, VERSION } from "./config.js";
 import { PlatformApi, ToolError } from "./api.js";
 import { StateStore } from "./store.js";
-import { DeploymentEngine, terminal } from "./deployment.js";
+import { DeploymentEngine } from "./deployment.js";
 import { DeploymentRuntime } from "./runtime.js";
 import { FileManager, dockerignore } from "./files.js";
 import { basename } from "node:path";
@@ -12,10 +12,7 @@ import { LogFollower } from "./logs.js";
 const RULES = "Dockerfile rules: one Dockerfile per service named Dockerfile or <name>.dockerfile; docker-compose is not supported. The Dockerfile must build everything itself; no separate setup script the user runs before the build. The app listens on 0.0.0.0 on a fixed port; only one port per service can be public. Services reach each other through internal references (bare host:port by default, http:// only when scheme is set), never localhost; do not bake compose-style fallback hosts (http://db:5432) into ENV. Files uploaded to a desk lose the executable bit: RUN chmod 0755 any entrypoint script you COPY. In nginx configs use only the IPv4 listen line. A volume belongs to one service; services cannot share a volume. Volume data survives restarts and image changes but is wiped if the service is deleted or the volume is removed or changed. The build context is the folder containing the Dockerfile, exactly like a local docker build in that folder. Test the image locally (docker build/run) before uploading.";
 import { located, resolveDeskUrl } from "./location.js";
 import { ZodError } from "zod";
-import { buildInput, listInput, deployInput, updateInput, lifecycleInput, getInput, logsInput, listFilesInput, createFolderInput, syncFilesInput, movePathInput, deletePathInput, signInInput, } from "./schemas.js";
-import { harnessOf, sessionFile } from "./config.js";
-import { sessionHost } from "./session.js";
-import { signIn } from "./signin.js";
+import { buildInput, listInput, deployInput, updateInput, lifecycleInput, getInput, logsInput, listFilesInput, createFolderInput, syncFilesInput, movePathInput, deletePathInput, } from "./schemas.js";
 async function main() {
     const config = configFromEnv();
     const api = new PlatformApi(config);
@@ -118,7 +115,7 @@ async function main() {
             : result;
     };
     const server = new McpServer({ name: "constructor-research", version: VERSION }, {
-        instructions: `Sign-in: the MCP works with one Constructor, https://constructor.app unless the user signed in to another. When the user asks to sign in, or names their Constructor or gives a link from it (e.g. https://acme.constructor.app), call sign_in with url set to that link. Where to act: ask the user for the Constructor desk link (they open the desk in the browser and copy the address; it contains /projects/<project>/desks/<desk>) and pass it as desk_url. Do not pick a project or desk yourself; if the user has not said where to deploy or where files live, ask. Ask the user only before replacing, renaming or deleting files on a disk, once per request for the whole list (the tools return confirm_required); creating folders and uploading new files need no question. ${RULES} For a local app, pass build.local_path (the folder with the Dockerfile) and deploy_app uploads it first. Hardware: leave it out; the default is used. Set hardware minimums only when the app cannot run without a GPU or a lot of RAM. Use deploy_app/update_app once for the WHOLE application. The MCP builds, resolves service URLs, configures and starts services in the background. IDs are automatic. To wait, call get_deployment(wait_seconds=20) again as often as needed (a loop of such calls is fine); never perform the deployment steps yourself. On failure, tell the user the failed stage/service; failure.log_tail and get_logs show the last build or service log lines. Do not use browser or debugging tools. For source files: sync_files to the desk before building (the MCP checks each Dockerfile on the disk and reports warnings); after a needs_upload pause, sync and call get_deployment with files_uploaded=true. Started is not readiness.`,
+        instructions: `Access: the MCP works with one Constructor and the user's personal access key for it, set up outside the chat. When a tool returns needs_key, pass its instructions on to the user; never ask for the key in the chat. Where to act: ask the user for the Constructor desk link (they open the desk in the browser and copy the address; it contains /projects/<project>/desks/<desk>) and pass it as desk_url. Do not pick a project or desk yourself; if the user has not said where to deploy or where files live, ask. Ask the user only before replacing, renaming or deleting files on a disk, once per request for the whole list (the tools return confirm_required); creating folders and uploading new files need no question. ${RULES} For a local app, pass build.local_path (the folder with the Dockerfile) and deploy_app uploads it first. Hardware: leave it out; the default is used. Set hardware minimums only when the app cannot run without a GPU or a lot of RAM. Use deploy_app/update_app once for the WHOLE application. The MCP builds, resolves service URLs, configures and starts services in the background. IDs are automatic. To wait, call get_deployment(wait_seconds=20) again as often as needed (a loop of such calls is fine); never perform the deployment steps yourself. When the user asks to deploy or build, wait until the deployment is finished before answering, then give the public URL or what failed. On failure, tell the user the failed stage/service; failure.log_tail and get_logs show the last build or service log lines. Do not use browser or debugging tools. For source files: sync_files to the desk before building (the MCP checks each Dockerfile on the disk and reports warnings); after a needs_upload pause, sync and call get_deployment with files_uploaded=true. Started is not readiness.`,
     });
     const register = (name, description, schema, fn, readOnly = false, budget = 20000, scope) => {
         if (scope && scope !== "deploy")
@@ -134,41 +131,10 @@ async function main() {
             },
         }, async (args) => {
             try {
-                await api.followSession();
-                // Nobody signed in yet: a desk link names the Constructor to sign in to.
-                if (args?.desk_url &&
-                    !config.baseUrlFixed &&
-                    !(await sessionHost(config.cookieFile)))
-                    try {
-                        api.aimed = config.baseUrl = originOf(args.desk_url);
-                    }
-                    catch { }
-                // Do not start a change on a token about to expire; checking on a deployment is still fine.
-                const before = await api.authLeft().catch(() => undefined);
-                const what = (renewable) => renewable ? "The login session ends" : "The token expires";
-                if (!readOnly &&
-                    name !== "get_deployment" &&
-                    name !== "sign_in" &&
-                    before !== undefined &&
-                    before.minutes < 3)
-                    throw new ToolError("needs_auth", api.authHelp(`${what(before.renewable)} in ${Math.max(0, Math.floor(before.minutes))} min, too soon to start this operation.`));
-                let result = await api.withBudget(budget, () => fn(scope
+                await api.refresh();
+                const result = await api.withBudget(budget, () => fn(scope
                     ? resolveDeskUrl(args, config.baseUrl, scope, config.baseUrlFixed)
                     : args));
-                const left = await api.authLeft().catch(() => undefined);
-                // A build can take half an hour; warn while there is still time to sign in again.
-                // A renewable session warns a day ahead.
-                const builds = ["deploy_app", "update_app", "build_image"].includes(name);
-                const limit = left?.renewable ? 24 * 60 : builds ? 40 : 10;
-                if (left !== undefined && left.minutes > 0 && left.minutes < limit)
-                    result = {
-                        ...result,
-                        auth_warning: `${what(left.renewable)} in ${left.minutes >= 120
-                            ? `${Math.floor(left.minutes / 60)} h`
-                            : `${Math.floor(left.minutes)} min`}${builds && !terminal.has(result.status)
-                            ? "; builds often take 10–30 min, and when it ends the deployment pauses as needs_auth until the user signs in again"
-                            : ""}. Ask the user to sign in again now: ${api.authHelp("")}`,
-                    };
                 return {
                     content: [
                         {
@@ -176,10 +142,7 @@ async function main() {
                             text: result.text ??
                                 (result.status
                                     ? `${result.status}${result.deployment_id ? ` (${result.deployment_id})` : ""}${result.message ? `: ${result.message}` : ""}`
-                                    : `Discovery result: ${result.total !== undefined ? result.total + " images" : Object.keys(result).join(", ")}. See structuredContent for details.`) +
-                                    (result.auth_warning
-                                        ? ` Warning: ${result.auth_warning}`
-                                        : ""),
+                                    : `Discovery result: ${result.total !== undefined ? result.total + " images" : Object.keys(result).join(", ")}. See structuredContent for details.`),
                         },
                     ],
                     // A preformatted text (build logs) is not repeated in structuredContent.
@@ -226,62 +189,7 @@ async function main() {
     register("update_app", "Update/add selected services in one request; preserve omitted settings. MCP handles builds, links and restarts in the background. Environment variables merge; supplied port/volume lists replace their lists. Resume a failed update using deployment_id and service overrides. The Dockerfile rules in deploy_app apply.", updateInput, checked((a) => runtime.update(a)), false, 60000, "deploy");
     register("start_app", "Start all or selected services as one operation. MCP handles all requests. Waits up to wait_seconds (default 20); remaining execution continues in the background. Started does not mean ready.", lifecycleInput, (a) => runtime.lifecycle("start", a), false, 20000, "project");
     register("stop_app", "Stop all or selected services as one operation. MCP handles all requests. Waits up to wait_seconds (default 20). Stopped means stop requests accepted, not verified teardown.", lifecycleInput, (a) => runtime.lifecycle("stop", a), false, 20000, "project");
-    register("get_deployment", "With deployment_id, observe/wait for background execution; the MCP owns execution. Each call waits up to wait_seconds (max 20); to wait longer, call again, as often as needed (a loop of get_deployment calls is fine). Services carry status_changes and restarts_seen when the MCP saw the status change or a new container start. After sync_files (or manual upload) set files_uploaded=true; after cookie replacement checking the job resumes it. With no arguments, returns the map of all deployments: every deployment-enabled project with its applications and services (names, native statuses, public URLs, ports). With desk_url or project_id, returns that project's desks, images, hardware and applications; add application_id for one application. resume=false observes only. Never returns environment-variable values.", getInput, (a) => runtime.get(a), false, 20000, "deploy");
-    let signing;
-    register("sign_in", "Signs the user in to their Constructor: https://constructor.app unless url names another one (any link from it, e.g. https://acme.constructor.app). Call it when the user asks to sign in, or when a tool returns needs_auth, after telling the user a sign-in window is about to open. It opens a separate Chrome window at the sign-in page; the user signs in there and the window closes by itself. There is one sign-in at a time: signing in to another Constructor replaces it, and the MCP works there afterwards. The session is kept for this harness only, and the MCP renews it automatically for up to 14 days. Waits up to wait_seconds; while the user is still signing in it returns sign_in_pending: call it again (no second window opens), then repeat the call that needed auth.", signInInput, async (a) => {
-        const i = signInInput.parse(a);
-        if (!signing) {
-            let host = config.baseUrl;
-            if (i.url) {
-                try {
-                    host = originOf(i.url);
-                }
-                catch (e) {
-                    throw new ToolError("invalid_input", `url: ${e.message}`);
-                }
-                if (config.baseUrlFixed && host !== config.baseUrl)
-                    throw new ToolError("wrong_environment", `This MCP is fixed to ${config.baseUrl} by CONSTRUCTOR_BASE_URL; it cannot sign in to ${host}.`);
-            }
-            const signedIn = (await sessionHost(config.cookieFile)) === host;
-            const left = signedIn
-                ? await api.authLeft().catch(() => undefined)
-                : undefined;
-            if (!i.force && left?.renewable && left.minutes > 60)
-                return {
-                    status: "signed_in",
-                    message: `Already signed in to ${host}; the session renews automatically for another ${Math.floor(left.minutes / 1440)} days. Pass force=true to sign in again.`,
-                    session_file: config.cookieFile,
-                    host,
-                };
-            const state = {
-                done: false,
-                host,
-                promise: Promise.resolve(),
-            };
-            state.promise = signIn({ ...config, baseUrl: host }, config.cookieFile).then((r) => {
-                state.result = r;
-                state.done = true;
-                if (r.status === "signed_in")
-                    api.aimed = undefined;
-            });
-            signing = state;
-            api.signingIn = true;
-            void state.promise.finally(() => (api.signingIn = false));
-        }
-        const current = signing;
-        await Promise.race([
-            current.promise,
-            new Promise((r) => setTimeout(r, i.wait_seconds * 1000)),
-        ]);
-        if (!current.done)
-            return {
-                status: "sign_in_pending",
-                message: `A Chrome window is open at ${current.host}. Ask the user to sign in there; it closes by itself afterwards. Then call sign_in again to confirm, or repeat the call that needed auth.`,
-            };
-        signing = undefined;
-        await api.followSession();
-        return current.result;
-    }, true, 30000);
+    register("get_deployment", "With deployment_id, observe/wait for background execution; the MCP owns execution. Each call waits up to wait_seconds (max 20); to wait longer, call again, as often as needed (a loop of get_deployment calls is fine), until execution is finished; do not answer the user while it is still in the background. Services carry status_changes and restarts_seen when the MCP saw the status change or a new container start. After sync_files (or manual upload) set files_uploaded=true; after a new key is saved, checking the job resumes it. With no arguments, returns the map of all deployments: every deployment-enabled project with its applications and services (names, native statuses, public URLs, ports). With desk_url or project_id, returns that project's desks, images, hardware and applications; add application_id for one application. resume=false observes only. Never returns environment-variable values.", getInput, (a) => runtime.get(a), false, 20000, "deploy");
     register("get_logs", "Last lines (default 20, up to 50) of a build or service log: why a build or start failed, how far a long build got, what a starting service prints. Constructor serves logs only live: a build log while the build runs, a service log for its current container while it runs (both replayed from the start, then streamed). The MCP follows the builds and services it starts or shows and keeps their last 50 lines, so they stay readable after the build ends or the container restarts; anything else can be read only while it runs. When a new container starts, the lines of the one before stay, above a '--- new container' marker, and restarts_seen counts them: that answers whether a service keeps restarting and why. An empty service log on a running service usually means a crash loop.", logsInput, async (a) => {
         const i = logsInput.parse(a);
         let targets = [];
@@ -333,14 +241,11 @@ async function main() {
         process.once(signal, () => {
             void Promise.all([runtime.close(), logs.close()]).then(() => server.close());
         });
-    // Each harness keeps its own session, named after the client in the handshake.
     let recovered = false;
     server.server.oninitialized = () => {
-        if (!config.cookieFileFixed)
-            config.cookieFile = sessionFile(harnessOf(server.server.getClientVersion()?.name));
         if (!recovered) {
             recovered = true;
-            void api.followSession().finally(() => runtime.recover());
+            void api.refresh().finally(() => runtime.recover());
         }
     };
     await server.connect(new StdioServerTransport());

package/dist/set-key.js

@@ -0,0 +1,107 @@
+#!/usr/bin/env node
+// Save a personal access key for the MCP without it appearing in the chat, a command line or the
+// shell history: the key is read from the terminal (hidden) or from stdin.
+// Usage: npx -y -p constructor-research-mcp constructor-research-set-key <Constructor link>
+import { configFromEnv, originOf } from "./config.js";
+import { cleanKey } from "./api.js";
+import { saveKeyFile } from "./key.js";
+const USAGE = "Usage: npx -y -p constructor-research-mcp constructor-research-set-key <Constructor link, e.g. https://acme.constructor.app>\nThen paste the access key (rk-…) when asked, or pipe it in on stdin.";
+/** One line from the terminal without echoing it, or all of stdin when piped. */
+async function readSecret(prompt) {
+    const input = process.stdin;
+    if (!input.isTTY) {
+        let text = "";
+        for await (const chunk of input)
+            text += chunk;
+        return text;
+    }
+    process.stderr.write(prompt);
+    input.setRawMode(true);
+    input.setEncoding("utf8");
+    return new Promise((resolve, reject) => {
+        let text = "";
+        const done = (value) => {
+            input.setRawMode(false);
+            input.pause();
+            input.off("data", onData);
+            process.stderr.write("\n");
+            value === undefined ? reject(new Error("cancelled")) : resolve(value);
+        };
+        const onData = (chunk) => {
+            for (const ch of chunk) {
+                if (ch === "\r" || ch === "\n")
+                    return done(text);
+                if (ch === "\u0003" || ch === "\u0004")
+                    return done();
+                if (ch === "\u007f" || ch === "\b")
+                    text = text.slice(0, -1);
+                else if (ch >= " ")
+                    text += ch;
+            }
+        };
+        input.on("data", onData);
+        input.resume();
+    });
+}
+async function main() {
+    const args = process.argv.slice(2);
+    if (args.length !== 1 || args[0].startsWith("-")) {
+        console.error(USAGE);
+        return 2;
+    }
+    let url;
+    try {
+        url = originOf(args[0]);
+    }
+    catch (e) {
+        console.error(e.message);
+        return 2;
+    }
+    const config = configFromEnv({ ...process.env, CONSTRUCTOR_BASE_URL: url });
+    let raw;
+    try {
+        raw = await readSecret(`Access key for ${url} (hidden): `);
+    }
+    catch {
+        console.error("Cancelled; nothing saved.");
+        return 1;
+    }
+    const key = cleanKey(raw);
+    if (!key) {
+        console.error("That is not an access key; nothing saved.");
+        return 1;
+    }
+    // Check the key with Constructor before saving it.
+    let status;
+    try {
+        const response = await fetch(`${url}${config.apiPath}/auth/session`, {
+            headers: {
+                "X-Research-AccessKey": `Bearer ${key}`,
+                Accept: "application/json",
+            },
+            redirect: "manual",
+            signal: AbortSignal.timeout(15000),
+        });
+        status = response.status;
+        await response.body?.cancel();
+    }
+    catch {
+        console.error(`Could not reach ${url} (VPN?); nothing saved.`);
+        return 1;
+    }
+    if (status === 401) {
+        console.error(`${url} rejected this key; nothing saved.`);
+        return 1;
+    }
+    if (status !== 200) {
+        console.error(`${url} answered HTTP ${status}: it may not have the public API yet; nothing saved.`);
+        return 1;
+    }
+    await saveKeyFile(config.keyFile, url, key);
+    console.log(`Key for ${url} saved to ${config.keyFile}. The MCP uses it from the next call; no restart needed.`);
+    return 0;
+}
+main().then((code) => (process.exitCode = code), () => {
+    console.error("Saving the key failed.");
+    process.exitCode = 1;
+});

package/dist/store.d.ts

@@ -70,7 +70,7 @@ export declare class StateStore {
      * harnesses' calls "busy" about half the time while anything was deploying.
      */
     lockWaitMs: number;
-    /** The Constructor API saved operations belong to; follows a sign-in to another host. */
+    /** The Constructor API saved operations belong to; follows a key saved for another host. */
     get endpoint(): string;
     private init;
     load(id: string): Promise<Operation | undefined>;

package/dist/store.js

@@ -13,7 +13,7 @@ export class StateStore {
      * harnesses' calls "busy" about half the time while anything was deploying.
      */
     lockWaitMs = 15000;
-    /** The Constructor API saved operations belong to; follows a sign-in to another host. */
+    /** The Constructor API saved operations belong to; follows a key saved for another host. */
     get endpoint() {
         return this.config.baseUrl + this.config.apiPath;
     }

package/dist/wait.js

@@ -10,7 +10,7 @@ import { readFile, unlink, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
-import { configFromEnv, sessionFile } from "./config.js";
+import { configFromEnv } from "./config.js";
 import { PlatformApi } from "./api.js";
 import { StateStore } from "./store.js";
 import { DeploymentEngine, terminal } from "./deployment.js";
@@ -132,7 +132,7 @@ async function claim(dir, id) {
 const USAGE = `Usage: constructor-research-wait [deployment_id ...] [--max-minutes N] [--hook claude-code|codex|opencode]
 
 Waits until the deployments finish (all in-progress ones when no ID is given) and prints one line each.
-Exit codes: 0 finished, 2 needs the user (failed, token, upload, confirmation), 3 still running at the
+Exit codes: 0 finished, 2 needs the user (failed, key, upload, confirmation), 3 still running at the
 time limit, 4 nothing to wait for, 1 usage error.
 
 --hook claude-code  PostToolUse hook with asyncRewake: waits for the deployment in the tool result and
@@ -165,11 +165,8 @@ async function main(argv) {
         return EXIT.error;
     }
     const config = configFromEnv();
-    // A hook runs for one harness: use that harness's session.
-    if (hook && !config.cookieFileFixed)
-        config.cookieFile = sessionFile(hook);
     const api = new PlatformApi(config);
-    await api.followSession();
+    await api.refresh();
     const store = new StateStore(config);
     const engine = new DeploymentEngine(api, store);
     engine.files = new FileManager(api, engine);

package/examples/claude-hooks.json

@@ -6,7 +6,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "npx -y -p constructor-research-mcp constructor-research-wait --hook claude-code",
+            "command": "npx -y -p constructor-research-mcp@beta constructor-research-wait --hook claude-code",
             "asyncRewake": true
           }
         ]

package/examples/claude.mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "constructor-research": {
       "command": "npx",
-      "args": ["-y", "constructor-research-mcp@latest"]
+      "args": ["-y", "constructor-research-mcp@beta"]
     }
   }
 }

package/examples/codex-hooks.json

@@ -5,7 +5,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "npx -y -p constructor-research-mcp constructor-research-wait --hook codex",
+            "command": "npx -y -p constructor-research-mcp@beta constructor-research-wait --hook codex",
             "timeout": 600,
             "statusMessage": "Waiting for Constructor deployments"
           }

package/examples/codex.toml

@@ -1,6 +1,6 @@
 [mcp_servers.constructor-research]
 command = "npx"
-args = ["-y", "constructor-research-mcp@latest"]
+args = ["-y", "constructor-research-mcp@beta"]
 # The first start downloads the package.
 startup_timeout_sec = 60
 tool_timeout_sec = 30

package/examples/opencode-plugin.js

@@ -5,7 +5,7 @@ import { spawn } from "node:child_process";
 const WAIT = [
   "-y",
   "-p",
-  "constructor-research-mcp",
+  "constructor-research-mcp@beta",
   "constructor-research-wait",
 ];
 // Any CONSTRUCTOR_* settings your MCP entry sets besides the defaults.

package/examples/opencode-v2.json

@@ -4,7 +4,7 @@
     "servers": {
       "constructor-research": {
         "type": "local",
-        "command": ["npx", "-y", "constructor-research-mcp@latest"]
+        "command": ["npx", "-y", "constructor-research-mcp@beta"]
       }
     }
   }

package/examples/opencode.json

@@ -3,7 +3,7 @@
   "mcp": {
     "constructor-research": {
       "type": "local",
-      "command": ["npx", "-y", "constructor-research-mcp@latest"]
+      "command": ["npx", "-y", "constructor-research-mcp@beta"]
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "constructor-research-mcp",
-  "version": "0.3.1",
+  "version": "0.4.0-beta.1",
   "type": "module",
   "description": "Local deployment MCP for Constructor Research",
   "license": "MIT",
@@ -24,8 +24,7 @@
   "bin": {
     "constructor-research-mcp": "dist/server.js",
     "constructor-research-wait": "dist/wait.js",
-    "constructor-research-login": "dist/login.js",
-    "constructor-research-set-token": "dist/set-token.js"
+    "constructor-research-set-key": "dist/set-key.js"
   },
   "files": [
     "dist",
@@ -44,10 +43,9 @@
     "pretest": "npm run build",
     "format": "prettier --write src test examples README.md INSTALL.md",
     "format:check": "prettier --check src test examples README.md INSTALL.md",
-    "set-token": "node dist/set-token.js",
     "wait": "node dist/wait.js",
-    "login": "node dist/login.js",
-    "prepublishOnly": "npm run check && npm run format:check && npm test"
+    "prepublishOnly": "npm run check && npm run format:check && npm test",
+    "set-key": "node dist/set-key.js"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.32.2",
@@ -58,5 +56,8 @@
     "prettier": "3.9.10",
     "tsx": "4.23.15",
     "typescript": "7.0.2"
+  },
+  "publishConfig": {
+    "tag": "beta"
   }
 }

package/dist/login.js

@@ -1,25 +0,0 @@
-#!/usr/bin/env node
-// Sign in from a terminal; the MCP's sign_in tool does the same from an agent session.
-// Usage: npx -y -p constructor-research-mcp constructor-research-login [--url <any link to your Constructor>] --for claude-code|codex|opencode   (or --to <session file>)
-import { configFromEnv, HARNESSES, originOf, sessionArgs } from "./config.js";
-import { signIn } from "./signin.js";
-const config = configFromEnv();
-const args = process.argv.slice(2);
-const at = args.indexOf("--url");
-const url = at >= 0 ? args.splice(at, 2)[1] : undefined;
-const { file } = sessionArgs(args, config);
-if (!file || (at >= 0 && !url)) {
-    console.error(`Usage: npx -y -p constructor-research-mcp constructor-research-login [--url <any link to your Constructor>] --for ${HARNESSES.join("|")}   (or --to <session file>)`);
-    process.exit(2);
-}
-if (url) {
-    const host = originOf(url);
-    if (config.baseUrlFixed && host !== config.baseUrl) {
-        console.error(`CONSTRUCTOR_BASE_URL fixes the MCP to ${config.baseUrl}.`);
-        process.exit(2);
-    }
-    config.baseUrl = host;
-}
-const result = await signIn(config, file, () => console.log(`A Chrome window opened at ${config.baseUrl}. Sign in there; it closes by itself afterwards.`));
-(result.status === "signed_in" ? console.log : console.error)(result.message);
-process.exit(result.status === "signed_in" ? 0 : 1);

package/dist/session.d.ts

@@ -1,21 +0,0 @@
-/** The cookies the MCP keeps: the access token for requests, the refresh token to renew it. */
-export declare const SESSION_COOKIES: readonly ["ap_access_token", "ap_id_token", "ap_refresh_token"];
-/** Claims of a JWT, or undefined when it is not one. */
-export declare function claims(jwt?: string): Record<string, any> | undefined;
-/** Session cookies found in a Cookie header, a cURL, a Set-Cookie list or a bare JWT. */
-export declare function sessionCookies(text: string): Map<string, string>;
-/** The session saved in a cookie file; only its cookie line is read. */
-export declare function readSession(file: string): Promise<Map<string, string>>;
-/**
- * The Constructor (an origin) a saved session belongs to: its host line, written at sign-in,
- * or else the issuer of its access token. Undefined when nothing is saved.
- */
-export declare function sessionHost(file: string): Promise<string | undefined>;
-/**
- * Replaces the cookie line of a file with these cookies, keeping its other lines, and with
- * `host` its host line. Written to a temporary file and renamed, mode 600, so a reader never
- * sees half a token and a crash never loses the session.
- */
-export declare function saveSession(file: string, cookies: Map<string, string>, host?: string): Promise<void>;
-/** New session cookies from a response's Set-Cookie headers. */
-export declare function setCookies(response: Response): Map<string, string>;