driggsby 0.6.2 → 0.6.3

package/README.md

@@ -22,11 +22,9 @@ npx driggsby@latest mcp setup other
 After setup, authenticate Driggsby through your client — run `/mcp` in
 Claude Code, or sign in through the browser window Codex opens.
 
-So your Driggsby MCP page can tell your connections apart, `login` sends
+So your Driggsby MCP page can tell your CLI sign-ins apart, `login` sends
 Driggsby this computer's name and operating system version (for example
-`mbp-studio` and `macOS 15.6`) with its sign-in, and
-`mcp setup claude-code` saves them as headers on the Driggsby entry it
-adds to Claude Code, which sends them with each request.
+`mbp-studio` and `macOS 15.6`) with its sign-in.
 
 For another MCP client, choose Other. Driggsby currently supports only
 OAuth-based remote MCP at:

package/dist/device.js

@@ -1,10 +1,8 @@
 import { readFileSync, statSync } from "node:fs";
 import { isIP } from "node:net";
 import { hostname, platform, release, version } from "node:os";
-// Load-bearing: these allowlists are what make the values safe as command
-// arguments (spawn-plan.ts quotes them for cmd.exe) and as "Name: value"
-// headers. They must never admit % ! ^ & | < > " \ : or a control
-// character; device.test.ts checks each.
+// These allowlists keep what leaves the CLI plain text: they never admit
+// % ! ^ & | < > " \ : or a control character (device.test.ts checks each).
 const NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,62}$/;
 const SYSTEM_PATTERN = /^[A-Za-z0-9][A-Za-z0-9 ._/-]{0,63}$/;
 const MAC_VERSION_FILE = "/System/Library/CoreServices/SystemVersion.plist";
@@ -38,17 +36,6 @@ export function knownDevice(device) {
     };
     return Object.keys(known).length === 0 ? null : known;
 }
-// The Driggsby headers `mcp setup` gives Claude Code, one per known value.
-export function deviceHeaders(device) {
-    const headers = [];
-    if (device.name !== null) {
-        headers.push(`X-Driggsby-Device-Name: ${device.name}`);
-    }
-    if (device.system !== null) {
-        headers.push(`X-Driggsby-Device-System: ${device.system}`);
-    }
-    return headers;
-}
 // "mbp-studio.local" and "devbox-02.corp.example.test" are mbp-studio and
 // devbox-02: the first label is the name people give their computer. An
 // address or localhost names no computer.

package/dist/mcp-setup/classify.js

@@ -19,9 +19,12 @@ function reportsMissingConfig(text) {
 function matchesExpectedConfig(client, scope, text) {
     switch (client) {
         case "claude-code":
+            // An entry an earlier version gave device headers doesn't match:
+            // Claude Code doesn't send its sign-in on requests to it.
             return (hasLine(text, "Type: http") &&
                 hasLine(text, `URL: ${DRIGGSBY_MCP_URL}`) &&
-                hasClaudeScope(text, scope ?? "user"));
+                hasClaudeScope(text, scope ?? "user") &&
+                !text.includes("X-Driggsby-Device-"));
         case "codex":
             return (text.includes('"enabled": true') &&
                 text.includes('"type": "streamable_http"') &&

package/dist/mcp-setup/commands.js

@@ -1,11 +1,8 @@
 import {} from "./known-client.js";
 export const DRIGGSBY_MCP_URL = "https://app.driggsby.com/mcp";
-// headers: this computer's name and system for Driggsby's MCP page
-// (device.ts builds them from allowlisted values only). Claude Code takes
-// them after the URL (--header is variadic, so before the name it would
-// swallow it); Codex has no header option, so it never gets any. The
-// commands printed for a person to run carry none.
-export function buildInstallerCommand(client, scope, headers = []) {
+// The plain entry, with no custom headers: Claude Code doesn't send its
+// sign-in on requests to an entry that carries them.
+export function buildInstallerCommand(client, scope) {
     switch (client) {
         case "claude-code":
             return {
@@ -19,7 +16,6 @@ export function buildInstallerCommand(client, scope, headers = []) {
                     scope ?? "user",
                     "driggsby",
                     DRIGGSBY_MCP_URL,
-                    ...headers.flatMap((header) => ["--header", header]),
                 ],
             };
         case "codex":

package/dist/mcp-setup/setup.js

@@ -1,6 +1,5 @@
 import { createInterface } from "node:readline/promises";
 import { CliError } from "../cli-error.js";
-import { describeDevice, deviceHeaders } from "../device.js";
 import { trimLikeRust } from "../terminal-text.js";
 import { runClientCommand } from "./client-command.js";
 import { classifyExistingMcpConfig } from "./classify.js";
@@ -25,11 +24,7 @@ export async function runMcpSetup(options) {
         return;
     }
     write(`Adding Driggsby to ${displayName(client)} MCP config...\n`);
-    // The command it runs also names this computer (Claude Code only); the
-    // commands it prints for a person stay the plain, portable ones.
-    const headers = installClient === "claude-code" ? deviceHeaders(describeDevice()) : [];
-    const runInstaller = buildInstallerCommand(installClient, options.scope, headers);
-    const result = await runClientCommand(runInstaller, streamConfigOutput(client));
+    const result = await runClientCommand(installer, streamConfigOutput(client));
     switch (result.kind) {
         case "output":
             if (result.output.succeeded) {

package/dist/mcp-setup/spawn-plan.js

@@ -5,9 +5,8 @@
 // PATH + PATHEXT (never the current directory, which Windows shells would
 // search first) and run shims through an explicit, absolute cmd.exe
 // invocation with our own quoting. Real commands only ever carry fixed
-// constant arguments (see commands.ts) or this computer's name and system,
-// allowlisted by device.ts to characters cmd.exe treats as plain; nothing
-// user-controlled may ever flow into a spawn plan.
+// constant arguments (see commands.ts); nothing user-controlled may ever
+// flow into a spawn plan.
 import { existsSync } from "node:fs";
 import { isAbsolute, join } from "node:path";
 import {} from "./commands.js";
@@ -81,9 +80,8 @@ export function resolveWindowsProgram(program, lookup = defaultLookup()) {
 // (the cmd convention) and trailing backslashes doubled (so a path ending
 // in \ cannot escape the closing quote for the child's own parser). The
 // safe set covers every constant argument the CLI actually runs, including
-// the MCP URL; only fixed constants, PATH-resolved program paths, and the
-// device values device.ts allowlists (no % ! ^ & | < > " \ or control
-// characters) may reach this function.
+// the MCP URL; only fixed constants and PATH-resolved program paths may
+// reach this function.
 export function quoteForCmd(value) {
     if (/^[A-Za-z0-9_\-.:\\/=]+$/.test(value)) {
         return value;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "driggsby",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "description": "Set up and build on Driggsby, the MCP server for personal finance.",
   "license": "Apache-2.0",
   "repository": {
@@ -28,7 +28,7 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@driggsby/deploy": "0.6.2",
-    "@driggsby/sdk": "0.6.2"
+    "@driggsby/deploy": "0.6.3",
+    "@driggsby/sdk": "0.6.3"
   }
 }