evrex-mcp 0.9.0 → 0.10.0

package/dist/pretool.js

@@ -3,21 +3,42 @@
 // src/pretool.ts
 import { pathToFileURL } from "node:url";
 
+// src/request-context.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+var storage = new AsyncLocalStorage();
+function currentRequest() {
+  return storage.getStore();
+}
+
 // src/client.ts
 var DEFAULT_API_BASE_URL = "https://api.evrex.ai";
 var API_BASE_URL = (process.env.EVREX_API_BASE_URL ?? process.env.EVREX_API_URL ?? DEFAULT_API_BASE_URL).replace(/\/+$/, "");
 var EVREX_TOKEN = process.env.EVREX_TOKEN ?? process.env.EVREX_API_TOKEN ?? null;
+function token() {
+  return currentRequest()?.token ?? EVREX_TOKEN;
+}
 function headers() {
   const base = { "Content-Type": "application/json" };
-  if (EVREX_TOKEN) base.Authorization = `Bearer ${EVREX_TOKEN}`;
+  const credential = token();
+  if (credential) base.Authorization = `Bearer ${credential}`;
   return base;
 }
 function describeFailure(method, path, status, statusText) {
   if (status === 401 || status === 403) {
+    if (currentRequest()) {
+      return `${method} ${path} -> ${status}: the Evrex token this connection carries was rejected, or lacks the scope this needs. Mint a read token at https://app.evrex.ai/agents.`;
+    }
     return EVREX_TOKEN ? `${method} ${path} -> ${status}: the EVREX_TOKEN this server was started with was rejected. It may be revoked or expired.` : `${method} ${path} -> ${status}: this evrex backend requires a credential, but no EVREX_TOKEN is set for this MCP server.`;
   }
   return `${method} ${path} -> ${status} ${statusText}`;
 }
+var EvrexApiError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "EvrexApiError";
+  }
+};
 async function request(method, path, { body, absentIsAnswer } = {}) {
   const res = await fetch(`${API_BASE_URL}${path}`, {
     method,
@@ -25,7 +46,7 @@ async function request(method, path, { body, absentIsAnswer } = {}) {
     ...body === void 0 ? {} : { body: JSON.stringify(body) }
   });
   if (res.status === 404 && absentIsAnswer) return null;
-  if (!res.ok) throw new Error(describeFailure(method, path, res.status, res.statusText));
+  if (!res.ok) throw new EvrexApiError(describeFailure(method, path, res.status, res.statusText), res.status);
   return await res.json();
 }
 var get = (path) => request("GET", path);
@@ -34,6 +55,7 @@ var post = (path, body) => request("POST", path, { body });
 var evrexApi = {
   baseUrl: API_BASE_URL,
   repos: () => get("/repos"),
+  me: () => get("/auth/me"),
   commits: (repoPath) => get(`/commits?repoPath=${encodeURIComponent(repoPath)}`),
   // Abbreviated shas resolve server-side, so a value pasted from `git log`
   // works here (apps/backend/src/reads/reads.service.ts#resolveSha).

package/dist/tickets.js

@@ -9,18 +9,39 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/request-context.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+function currentRequest() {
+  return storage.getStore();
+}
+var storage;
+var init_request_context = __esm({
+  "src/request-context.ts"() {
+    "use strict";
+    storage = new AsyncLocalStorage();
+  }
+});
+
 // src/client.ts
 var client_exports = {};
 __export(client_exports, {
+  EvrexApiError: () => EvrexApiError,
   evrexApi: () => evrexApi
 });
+function token() {
+  return currentRequest()?.token ?? EVREX_TOKEN;
+}
 function headers() {
   const base = { "Content-Type": "application/json" };
-  if (EVREX_TOKEN) base.Authorization = `Bearer ${EVREX_TOKEN}`;
+  const credential = token();
+  if (credential) base.Authorization = `Bearer ${credential}`;
   return base;
 }
 function describeFailure(method, path, status, statusText) {
   if (status === 401 || status === 403) {
+    if (currentRequest()) {
+      return `${method} ${path} -> ${status}: the Evrex token this connection carries was rejected, or lacks the scope this needs. Mint a read token at https://app.evrex.ai/agents.`;
+    }
     return EVREX_TOKEN ? `${method} ${path} -> ${status}: the EVREX_TOKEN this server was started with was rejected. It may be revoked or expired.` : `${method} ${path} -> ${status}: this evrex backend requires a credential, but no EVREX_TOKEN is set for this MCP server.`;
   }
   return `${method} ${path} -> ${status} ${statusText}`;
@@ -32,22 +53,31 @@ async function request(method, path, { body, absentIsAnswer } = {}) {
     ...body === void 0 ? {} : { body: JSON.stringify(body) }
   });
   if (res.status === 404 && absentIsAnswer) return null;
-  if (!res.ok) throw new Error(describeFailure(method, path, res.status, res.statusText));
+  if (!res.ok) throw new EvrexApiError(describeFailure(method, path, res.status, res.statusText), res.status);
   return await res.json();
 }
-var DEFAULT_API_BASE_URL, API_BASE_URL, EVREX_TOKEN, get, getOrNull, post, evrexApi;
+var DEFAULT_API_BASE_URL, API_BASE_URL, EVREX_TOKEN, EvrexApiError, get, getOrNull, post, evrexApi;
 var init_client = __esm({
   "src/client.ts"() {
     "use strict";
+    init_request_context();
     DEFAULT_API_BASE_URL = "https://api.evrex.ai";
     API_BASE_URL = (process.env.EVREX_API_BASE_URL ?? process.env.EVREX_API_URL ?? DEFAULT_API_BASE_URL).replace(/\/+$/, "");
     EVREX_TOKEN = process.env.EVREX_TOKEN ?? process.env.EVREX_API_TOKEN ?? null;
+    EvrexApiError = class extends Error {
+      constructor(message, status) {
+        super(message);
+        this.status = status;
+        this.name = "EvrexApiError";
+      }
+    };
     get = (path) => request("GET", path);
     getOrNull = (path) => request("GET", path, { absentIsAnswer: true });
     post = (path, body) => request("POST", path, { body });
     evrexApi = {
       baseUrl: API_BASE_URL,
       repos: () => get("/repos"),
+      me: () => get("/auth/me"),
       commits: (repoPath) => get(`/commits?repoPath=${encodeURIComponent(repoPath)}`),
       // Abbreviated shas resolve server-side, so a value pasted from `git log`
       // works here (apps/backend/src/reads/reads.service.ts#resolveSha).
@@ -141,11 +171,13 @@ evrex will not fall back to writing the credential in a plain file.`
         if (!await this.available()) throw new NoKeychainError(this.runner.platform);
         switch (this.runner.platform) {
           case "darwin": {
+            if (/["\\\r\n]/.test(secret)) {
+              throw new Error("Keychain write refused: the credential has a character `security -i` cannot carry.");
+            }
             const result = await this.runner.run(
               "security",
-              ["add-generic-password", "-a", ACCOUNT, "-s", SERVICE, "-U", "-w"],
-              `${secret}
-${secret}
+              ["-i"],
+              `add-generic-password -a "${ACCOUNT}" -s "${SERVICE}" -U -w "${secret}"
 `
             );
             if (result.code !== 0) throw new Error(`Keychain write failed: ${result.stderr.trim()}`);
@@ -609,8 +641,8 @@ async function syncTickets(deps) {
 async function main() {
   const { evrexApi: evrexApi2 } = await Promise.resolve().then(() => (init_client(), client_exports));
   const { CredentialStore: CredentialStore2 } = await Promise.resolve().then(() => (init_credential_store(), credential_store_exports));
-  const token = process.env.EVREX_TOKEN ?? await new CredentialStore2().retrieve().catch(() => null);
-  if (!token) {
+  const token2 = process.env.EVREX_TOKEN ?? await new CredentialStore2().retrieve().catch(() => null);
+  if (!token2) {
     console.error(
       "evrex: this machine is not enrolled.\n  Run `npx -y evrex-mcp enrol` first, or set EVREX_TOKEN."
     );
@@ -625,7 +657,7 @@ async function main() {
           method: "POST",
           headers: {
             "content-type": "application/json",
-            authorization: `Bearer ${token}`
+            authorization: `Bearer ${token2}`
           },
           body: JSON.stringify(body)
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "evrex-mcp",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "MCP server that gives coding agents the recorded reasoning behind a repo: prior decisions, hard constraints, and approaches already rejected.",
   "keywords": [
     "mcp",
@@ -36,27 +36,28 @@
   "engines": {
     "node": ">=20"
   },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "bundle": "node scripts/bundle.mjs",
+    "dev": "tsc -p tsconfig.json --watch",
+    "lint": "eslint .",
+    "check-types": "tsc --noEmit",
+    "test": "tsc -p tsconfig.json && node --test dist/*.test.js",
+    "prepack": "pnpm run bundle"
+  },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.72.0",
     "@modelcontextprotocol/sdk": "^1.20.1",
     "zod": "^3.24.1"
   },
   "devDependencies": {
+    "@repo/eslint-config": "workspace:*",
+    "@repo/ingest-core": "workspace:*",
+    "@repo/llm-core": "workspace:*",
+    "@repo/typescript-config": "workspace:*",
     "@types/node": "^24.0.0",
     "esbuild": "^0.25.12",
     "eslint": "^9.39.1",
-    "typescript": "^5.9.2",
-    "@repo/eslint-config": "0.0.0",
-    "@repo/ingest-core": "0.0.0",
-    "@repo/typescript-config": "0.0.0",
-    "@repo/llm-core": "0.0.0"
-  },
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "bundle": "node scripts/bundle.mjs",
-    "dev": "tsc -p tsconfig.json --watch",
-    "lint": "eslint .",
-    "check-types": "tsc --noEmit",
-    "test": "tsc -p tsconfig.json && node --test dist/*.test.js"
+    "typescript": "^5.9.2"
   }
-}
+}