impreza-mcp 0.6.0 → 0.7.0

package/README.md

@@ -39,7 +39,7 @@ ticket away from being linked to a legal name.
 
 ## Status
 
-**Full surface live.** All 97 tools shipped — app deployment plus account +
+**Full surface live.** All 102 tools shipped — app deployment plus account +
 crypto balance, catalog + ordering, domains/DNS + registration, invoices, VPS
 lifecycle with snapshots and backups, dedicated / bare-metal servers, plan
 upgrades, and Titan / Google Workspace mailboxes — with a setup wizard that
@@ -48,6 +48,30 @@ generates ready-to-paste config snippets for 5 AI tools.
 The local (`npx`) server and the hosted OAuth connector expose the **same 97
 tools**, so nothing is lost by picking either path.
 
+### New in 0.6.1
+
+**`tools/list` now reflects what your account actually owns.** About a third of
+the tools only make sense if you have the machine behind them — VPS power
+controls with no VPS can only ever answer "not found" — so those are left out
+of the listing until you own one. Typical accounts see around 70 tools instead
+of 97, which is roughly six thousand fewer tokens of context spent before you
+ask anything.
+
+Three things worth knowing about how it behaves:
+
+- **The purchase path is never filtered.** An account that owns nothing is the
+  one that needs to buy something, so ordering, top-up, invoices and the
+  catalogue are always listed.
+- **Buying something grows the list mid-session.** The server sends
+  `notifications/tools/list_changed` on the same response as the order, so a
+  client that honours it picks up the new tools without reconnecting.
+- **It fails open.** If this server cannot reach the API to ask, it lists
+  everything rather than guess.
+
+Hiding a tool is not an authorization boundary — the API still refuses anything
+your account does not own. This only stops the listing from carrying tools that
+could never work for you.
+
 ### New in 0.6.0
 
 Four things that only make sense on a host built for anonymity:

package/dist/server.js

@@ -214,6 +214,68 @@ const TOOLS = [
             additionalProperties: false,
         },
     },
+    {
+        name: 'impreza_backup_app',
+        description: "Back up a running deployment's data into the customer's OWN Impreza S3 bucket. Packs the app's data directory and uploads it in chunks with a per-chunk SHA-256 manifest written alongside it, so the backup stays verifiable with the customer's own S3 credentials and without us. Returns immediately with a backup_id — a large app takes minutes, so poll impreza_list_backups for the outcome. Needs an active S3 service on the account; without one it answers NO_STORAGE. One job at a time per app.",
+        inputSchema: {
+            type: 'object',
+            properties: {
+                deployment_id: { type: 'string', description: 'The dpl_... id to back up.' },
+            },
+            required: ['deployment_id'],
+            additionalProperties: false,
+        },
+    },
+    {
+        name: 'impreza_list_backups',
+        description: "List this account's app backups and restores, newest first — id, kind, status, chunk count, size, and any error. This is how you find out whether a job started with impreza_backup_app or impreza_restore_app has finished. A `replaced_path` on a restore means the data it displaced is STILL on the server using disk until impreza_discard_replaced removes it. Pass deployment_id to narrow to one app. Not the same as impreza_vps_list_backups, which is Proxmox snapshots of a whole VPS.",
+        inputSchema: {
+            type: 'object',
+            properties: {
+                deployment_id: { type: 'string', description: 'Optional — only this app\'s jobs.' },
+            },
+            additionalProperties: false,
+        },
+    },
+    {
+        name: 'impreza_restore_app',
+        description: "Restore a completed backup over its app's current data, then restart the app. Every chunk's SHA-256 is checked BEFORE anything is touched, and the data being replaced is moved aside rather than deleted — so restoring the wrong backup is recoverable. That saved copy keeps using disk until impreza_discard_replaced removes it. Returns a job id; poll impreza_list_backups. This overwrites the app's current state: confirm which backup the customer means before calling.",
+        inputSchema: {
+            type: 'object',
+            properties: {
+                backup_id: { type: 'string', description: 'The completed backup to restore, from impreza_list_backups.' },
+            },
+            required: ['backup_id'],
+            additionalProperties: false,
+        },
+    },
+    {
+        name: 'impreza_discard_replaced',
+        description: "Permanently delete the copy of the old data that a restore set aside, freeing that disk on the server. Pass the RESTORE job's id — the one whose replaced_path is set. Irreversible, and that copy is the customer's way back from a restore they may not have wanted, so only call it once they confirm the restored app is the one they want.",
+        inputSchema: {
+            type: 'object',
+            properties: {
+                backup_id: { type: 'string', description: 'The restore job that set data aside.' },
+            },
+            required: ['backup_id'],
+            additionalProperties: false,
+        },
+    },
+    {
+        name: 'impreza_backup_schedule',
+        description: "Change how often an app is backed up automatically and how many copies are kept. Every running app is already on a schedule by DEFAULT — daily, keeping 3 — even with nothing configured, so this changes an existing policy rather than creating one; to read the current setting, call impreza_list_backups with that deployment_id. Set enabled=false to stop automatic backups for the app (manual ones still work). Old copies are removed only after a NEWER one has completed and been verified, and only automatic copies are ever pruned — a backup taken by hand stays until someone deletes it.",
+        inputSchema: {
+            type: 'object',
+            properties: {
+                deployment_id: { type: 'string', description: 'The dpl_... id whose schedule changes.' },
+                enabled: { type: 'boolean', description: 'Whether automatic backups run at all. Default true.' },
+                frequency: { type: 'string', enum: ['daily', 'weekly'], description: 'How often. Default daily.' },
+                keep: { type: 'integer', description: 'How many automatic copies to keep, 1-30. Default 3.' },
+            },
+            required: ['deployment_id'],
+            additionalProperties: false,
+        },
+    },
     {
         name: 'impreza_restart_deployment',
         description: 'Restart a deployment\'s docker-compose stack (non-destructive). The container is stopped + started; data volumes preserved. Status flips to `installing` briefly then back to `running`. Works for both catalog and custom deployments.',
@@ -1616,6 +1678,11 @@ const TOOL_ANNOTATIONS = {
     // since HEAD moves under it.
     impreza_redeploy_deployment: A_WRITE_EXT,
     impreza_restart_deployment: A_WRITE_IDEM,
+    impreza_backup_app: A_WRITE_EXT,
+    impreza_list_backups: A_READ,
+    impreza_restore_app: A_DESTRUCTIVE,
+    impreza_discard_replaced: A_DESTRUCTIVE,
+    impreza_backup_schedule: A_WRITE_IDEM,
     impreza_change_domain: A_WRITE_EXT_IDEM,
     impreza_add_onion: A_WRITE_EXT_IDEM,
     // Both touch the hook on GitHub; disconnect documents itself as idempotent
@@ -1871,9 +1938,45 @@ const ANNOTATED_TOOLS = TOOLS.map((tool) => {
         throw new Error(`Tool ${tool.name} has no entry in TOOL_ANNOTATIONS`);
     return { ...tool, annotations };
 });
+/**
+ * Which tools this account should not be shown.
+ *
+ * The hosted server filters `tools/list` by what the account owns — about 42
+ * of the tools only make sense if you have the product behind them, and an
+ * account with one VPS was carrying twenty-five that could only ever answer
+ * "not found".
+ *
+ * This process has no database, so it asks for the ANSWER rather than the
+ * rules. A copy of the prefix-to-family map here would drift the first time a
+ * family is added server-side, and would need an npm release to catch up.
+ *
+ * Fails open in every direction — a request that errors, times out, or comes
+ * back malformed hides nothing. Too many tools is the behaviour we shipped
+ * yesterday; too few silently removes capability the customer pays for, and
+ * they would have no way to tell why.
+ */
+async function hiddenTools() {
+    try {
+        const res = await impreza.get('/v1/entitlements');
+        if (res?.known !== true || !Array.isArray(res.hidden)) {
+            return new Set();
+        }
+        return new Set(res.hidden.filter((n) => typeof n === 'string'));
+    }
+    catch {
+        return new Set();
+    }
+}
 server.setRequestHandler(ListToolsRequestSchema, async () => {
     const offer = wantsUi();
-    const tools = ANNOTATED_TOOLS.map((tool) => {
+    // Fetched per call rather than cached for the process: a stdio session
+    // outlives a purchase, and a customer who buys a VPS mid-session should see
+    // its tools on the next listing rather than after a restart. tools/list is
+    // called rarely enough that the extra round trip does not matter.
+    const hidden = await hiddenTools();
+    const tools = ANNOTATED_TOOLS
+        .filter((tool) => !hidden.has(tool.name))
+        .map((tool) => {
         const uri = offer ? panelFor(tool.name) : undefined;
         // The nested `ui.resourceUri`, not the flat `_meta["ui/resourceUri"]`:
         // the spec deprecated the flat key and removes it before GA.
@@ -1940,6 +2043,39 @@ server.setRequestHandler(CallToolRequestSchema, async (req) => {
                     body.since_seconds = args.since_seconds;
                 return toResult(await impreza.post(`/v1/platform/deployments/${encodeURIComponent(dep)}/logs`, body));
             }
+            case 'impreza_backup_app': {
+                const dep = String(args.deployment_id ?? '');
+                if (!dep)
+                    return toError('deployment_id is required');
+                return toResult(await impreza.post('/v1/backups', { deployment_id: dep }));
+            }
+            case 'impreza_backup_schedule': {
+                const dep = String(args.deployment_id ?? '');
+                if (!dep)
+                    return toError('deployment_id is required');
+                const body = {};
+                for (const k of ['enabled', 'frequency', 'keep']) {
+                    if (k in args)
+                        body[k] = args[k];
+                }
+                return toResult(await impreza.post(`/v1/backups/schedule/${encodeURIComponent(dep)}`, body));
+            }
+            case 'impreza_list_backups': {
+                const dep = String(args.deployment_id ?? '');
+                return toResult(await impreza.get(`/v1/backups${dep ? `?deployment_id=${encodeURIComponent(dep)}` : ''}`));
+            }
+            case 'impreza_restore_app': {
+                const bid = String(args.backup_id ?? '');
+                if (!bid)
+                    return toError('backup_id is required');
+                return toResult(await impreza.post(`/v1/backups/${encodeURIComponent(bid)}/restore`, {}));
+            }
+            case 'impreza_discard_replaced': {
+                const bid = String(args.backup_id ?? '');
+                if (!bid)
+                    return toError('backup_id is required');
+                return toResult(await impreza.post(`/v1/backups/${encodeURIComponent(bid)}/discard-previous`, {}));
+            }
             case 'impreza_restart_deployment': {
                 const dep = String(args.deployment_id ?? '');
                 if (!dep)