metheus-governance-mcp-cli 0.2.7 → 0.2.9

package/cli.mjs

@@ -168,9 +168,33 @@ function extractWorkspaceCandidateFromRequest(requestObj, toolArgs) {
   return resolveWorkspaceDir(candidate);
 }
 
+function extractWorkspaceCandidateFromEnv() {
+  const rawCandidate = firstNonEmptyString([
+    process.env.METHEUS_WORKSPACE_DIR,
+    process.env.CLAUDE_WORKSPACE_DIR,
+    process.env.CLAUDE_PROJECT_DIR,
+    process.env.CODEX_WORKSPACE_DIR,
+    process.env.WORKSPACE_DIR,
+    process.env.WORKSPACE_FOLDER,
+    process.env.VSCODE_CWD,
+    process.env.PWD,
+    process.env.INIT_CWD,
+  ]);
+  const fileCandidate = fileURIToLocalPath(rawCandidate);
+  const candidate = firstNonEmptyString([fileCandidate, rawCandidate]);
+  if (!candidate) return "";
+  return resolveWorkspaceDir(candidate);
+}
+
 function resolveWorkspaceDirForRequest(defaultWorkspaceDir, requestObj, toolArgs) {
   const requestCandidate = extractWorkspaceCandidateFromRequest(requestObj, toolArgs);
-  const candidate = firstNonEmptyString([requestCandidate, defaultWorkspaceDir, process.cwd()]);
+  const envCandidate = extractWorkspaceCandidateFromEnv();
+  const candidate = firstNonEmptyString([
+    requestCandidate,
+    envCandidate,
+    defaultWorkspaceDir,
+    process.cwd(),
+  ]);
   return resolveWorkspaceDir(candidate);
 }
 
@@ -1387,6 +1411,19 @@ function addDoctorCheck(rows, status, label, detail) {
   });
 }
 
+function isUnauthorizedLike(rawText) {
+  const text = String(rawText || "").trim().toLowerCase();
+  if (!text) return false;
+  return (
+    text.includes("unauthorized") ||
+    text.includes("access denied") ||
+    text.includes("status 401") ||
+    text.includes("status 403") ||
+    text.includes("http 401") ||
+    text.includes("http 403")
+  );
+}
+
 function statusIcon(status) {
   if (status === "ok") return "OK";
   if (status === "fail") return "FAIL";
@@ -1671,12 +1708,25 @@ async function runDoctor(flags) {
         addDoctorCheck(rows, "ok", "server mode", "ctxpack writable");
       }
     } catch (err) {
-      addDoctorCheck(
-        rows,
-        "warn",
-        "server ctxpack policy",
-        `unable to read /ctxpack/stats (${String(err?.message || err)})`,
-      );
+      const statusCode = Number(err?.statusCode || 0);
+      const message = String(err?.message || err);
+      if (statusCode === 404) {
+        addDoctorCheck(
+          rows,
+          "ok",
+          "server ctxpack policy",
+          "ctxpack/stats endpoint is not exposed in this deployment (optional check skipped)",
+        );
+      } else if (statusCode === 401 || statusCode === 403 || isUnauthorizedLike(message)) {
+        addDoctorCheck(
+          rows,
+          "warn",
+          "server ctxpack policy",
+          "no permission to read ctxpack/stats in this environment",
+        );
+      } else {
+        addDoctorCheck(rows, "warn", "server ctxpack policy", `unable to read /ctxpack/stats (${message})`);
+      }
     }
   }
 
@@ -1712,7 +1762,17 @@ async function runDoctor(flags) {
       },
     });
     if (!rpc.ok) {
-      addDoctorCheck(rows, "fail", `smoke ${row.tool}`, rpc.error || "rpc error");
+      const errorText = String(rpc.error || "rpc error");
+      if (isUnauthorizedLike(errorText)) {
+        addDoctorCheck(
+          rows,
+          "warn",
+          `smoke ${row.tool}`,
+          "unauthorized for this tool with current token/project role",
+        );
+      } else {
+        addDoctorCheck(rows, "fail", `smoke ${row.tool}`, errorText);
+      }
       continue;
     }
     const envelope = parseToolEnvelopeFromRPCResult(safeObject(rpc.response).result);
@@ -1725,12 +1785,21 @@ async function runDoctor(flags) {
     if (ok && status >= 200 && status < 300) {
       addDoctorCheck(rows, "ok", `smoke ${row.tool}`, `status ${status}`);
     } else {
-      addDoctorCheck(
-        rows,
-        "fail",
-        `smoke ${row.tool}`,
-        `status ${status || "-"}, ok=${ok ? "true" : "false"}`,
-      );
+      if (status === 401 || status === 403) {
+        addDoctorCheck(
+          rows,
+          "warn",
+          `smoke ${row.tool}`,
+          `status ${status}: unauthorized for this tool with current token/project role`,
+        );
+      } else {
+        addDoctorCheck(
+          rows,
+          "fail",
+          `smoke ${row.tool}`,
+          `status ${status || "-"}, ok=${ok ? "true" : "false"}`,
+        );
+      }
     }
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "metheus-governance-mcp-cli",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "description": "Metheus Governance MCP CLI (setup + stdio proxy)",
   "type": "module",
   "files": [