pattern-mcp 0.15.0 → 0.16.0

package/README.md

@@ -15,22 +15,22 @@ design reference.
 
 [Website](https://usepattern.sh) · [npm](https://www.npmjs.com/package/pattern-mcp) · [Report an issue](https://github.com/donaldrichard19-LVD/pattern-mcp/issues/new/choose)
 
-**Current release: v0.15.0** — `npx pattern-mcp init` is now the first
-and only command shown for getting started, everywhere (this README
-and the website); bare `npx pattern-mcp` is documented as the server
-command your client uses, not something to run yourself. The connect
-wizard also no longer asks just once: if you run Pattern bare in your
-own terminal and skip or miss it, it keeps offering on every later run
-until it can actually confirm a client is connected, instead of going
-silent forever after the first try. Previously: v0.14.1 made the
-crash/exit telemetry added in v0.14.0 (`pattern_cli_exited`) register
-before any of this file's own module-level code runs, and tagged both
-it and `pattern_cli_started` with the running package version, so a
-crash right around a release can be tied to the old or new binary. Before
-that: v0.14.0 made a crash on startup diagnosable instead of silent,
-warned at startup if `ANTHROPIC_API_KEY` is missing or clearly
-malformed instead of only surfacing a raw 401 mid-call, and added one
-respectful retry on a 429 (honoring `Retry-After`). See
+**Current release: v0.16.0** — a component request that's on the
+skip-list (`button`, `input`, ...) now succeeds with no
+`ANTHROPIC_API_KEY` at all, instead of failing before it ever reached
+that free, local check. When a real call does fail for a missing key,
+the error now names two concrete fixes (re-run `init`, or export the
+key directly) instead of just naming the problem. Codex CLI's connect
+instructions also now carry whatever API key you entered in the
+wizard, as a ready-to-run shell export, instead of silently dropping
+it. Previously: v0.15.0 made `npx pattern-mcp init` the first and only
+command shown for getting started, everywhere (this README and the
+website), and the connect wizard stopped asking just once -- it now
+keeps offering on later bare runs until it can confirm a client is
+actually connected. Before that: v0.14.1 made the crash/exit telemetry
+added in v0.14.0 (`pattern_cli_exited`) register before any of this
+file's own module-level code runs, and tagged it and
+`pattern_cli_started` with the running package version. See
 [Connect Pattern to your MCP client](#connect-pattern-to-your-mcp-client)
 for more details.
 

package/dist/client-connect.js

@@ -192,10 +192,21 @@ async function setupCursor(root, apiKey, options) {
 // existing config is worse than just telling them what to add. Detected
 // the same way as the other targets (evidence it's actually used), but
 // only ever prints instructions.
-function offerCodexInstructions() {
+//
+// Deliberately does NOT print a per-server `env = {...}` TOML snippet for
+// the API key, unlike the command/args lines above -- checked directly
+// (openai/codex#7521, open as of 2026-09): Codex's own maintainers hadn't
+// settled which env-var syntax their TOML config actually supports at the
+// time this was written. Printing a guessed snippet risked giving
+// confidently wrong instructions, worse than the honest "it depends on
+// your version, here's what works regardless" below. A plain shell
+// export is the one method that works the same way across every Codex
+// version and every other client here, since it never depends on a
+// client-specific config format at all.
+function offerCodexInstructions(apiKey) {
     if (!existsSync(join(homedir(), ".codex")))
         return;
-    console.log([
+    const lines = [
         "\nCodex CLI detected (~/.codex exists). Pattern doesn't auto-write Codex's",
         "TOML config -- add this to ~/.codex/config.toml (or .codex/config.json for",
         "this project only):",
@@ -203,7 +214,15 @@ function offerCodexInstructions() {
         '  [mcp_servers.pattern]',
         '  command = "npx"',
         '  args = ["pattern-mcp"]',
-    ].join("\n"));
+        "",
+    ];
+    if (apiKey) {
+        lines.push("You entered an API key above. Codex's own per-server TOML env syntax isn't", "reliably documented across versions, so the safest way to get it to Codex", "is exporting it in the shell you launch Codex from:", "", `  export ANTHROPIC_API_KEY="${apiKey}"`);
+    }
+    else {
+        lines.push("Codex also needs ANTHROPIC_API_KEY available in its own environment.", "Export it in the shell you launch Codex from:", "", "  export ANTHROPIC_API_KEY=sk-ant-...");
+    }
+    console.log(lines.join("\n"));
 }
 async function promptApiKey(options) {
     if (options.yes)
@@ -233,7 +252,7 @@ export async function runConnect(root, options) {
         }
         if (existsSync(join(homedir(), ".codex"))) {
             anyDetected = true;
-            offerCodexInstructions();
+            offerCodexInstructions(apiKey);
         }
         if (!anyDetected) {
             console.log("\nNo supported MCP client was detected on this machine automatically.\n" + connectInstructionsText());

package/dist/index.js

@@ -111,6 +111,19 @@ function warnIfAnthropicKeyLooksWrong() {
             "\"sk-ant-\"). If a tool call fails with a 401, check this value first.");
     }
 }
+// Thrown by recommend_component/extract_requirements when they actually
+// need the API and no key is present -- this is what the calling agent
+// sees as the tool's error result, so unlike warnIfAnthropicKeyLooksWrong's
+// stderr line (invisible in most real clients -- see
+// project_pattern_activation_funnel memory), this is the message a real
+// user is actually likely to see. Gives two concrete fixes rather than
+// just naming the problem: re-running `init` (which already offers to
+// write the key into every client it detects), or exporting it directly --
+// the one method that works the same way across every client, since it
+// doesn't depend on any client-specific config format.
+const MISSING_API_KEY_MESSAGE = "Pattern: ANTHROPIC_API_KEY is not set, so this call can't reach the Anthropic API. Fix it one of two ways: " +
+    "re-run `npx pattern-mcp init` to add it to your MCP client's config, or export it directly -- " +
+    "`export ANTHROPIC_API_KEY=sk-ant-...` in the shell your client launches Pattern from, then restart the client.";
 // Configurable so Sonnet vs. Haiku can be A/B tested without a code change.
 // Defaults to Sonnet 5. Try MODEL=claude-haiku-4-5-20251001 to test the
 // cheaper tier -- re-run the 5 validated test cases from the product brief
@@ -1173,14 +1186,15 @@ export function estimateExtractionConfidence(componentNeed) {
     return "high";
 }
 async function runSinglePass(input) {
-    if (!ANTHROPIC_API_KEY) {
-        throw new Error("ANTHROPIC_API_KEY is not set. Export it in the environment running this MCP server.");
-    }
     const passStartMs = Date.now();
     const checklistSource = input.checklist && input.checklist.length > 0 ? "provided" : "extracted";
     // Fast path: skip-list check happens locally too, so trivial primitives
     // never spend a real API call. The system prompt also enforces this, but
-    // checking here avoids the round-trip entirely for the common case.
+    // checking here avoids the round-trip entirely for the common case. The
+    // ANTHROPIC_API_KEY check used to run before this, unconditionally --
+    // meaning a keyless install couldn't get even this free, local path.
+    // Moved below the skip-list return so a missing/invalid key only ever
+    // blocks the cases that actually need the API.
     if (isSkipListMatch(input.component_need)) {
         const skipListElapsedMs = Math.max(1, Date.now() - passStartMs);
         return {
@@ -1213,6 +1227,9 @@ async function runSinglePass(input) {
             },
         };
     }
+    if (!ANTHROPIC_API_KEY) {
+        throw new Error(MISSING_API_KEY_MESSAGE);
+    }
     // Coverage still computes fresh below regardless of what this finds --
     // memory (MEMORY_PATH/record_component_decision) only ever adds context
     // to the user message, it never short-circuits search/scoring or gets
@@ -1526,9 +1543,6 @@ existing_stack: ${input.existing_stack ?? "(not specified)"}${checklistBlock}${p
 // for the same reason (trivial primitives shouldn't cost an API call here
 // either).
 async function runExtraction(input) {
-    if (!ANTHROPIC_API_KEY) {
-        throw new Error("ANTHROPIC_API_KEY is not set. Export it in the environment running this MCP server.");
-    }
     const startMs = Date.now();
     if (isSkipListMatch(input.component_need)) {
         const elapsedMs = Math.max(1, Date.now() - startMs);
@@ -1546,6 +1560,9 @@ async function runExtraction(input) {
             },
         };
     }
+    if (!ANTHROPIC_API_KEY) {
+        throw new Error(MISSING_API_KEY_MESSAGE);
+    }
     const userMessage = `component_need: ${input.component_need}\ndomain: ${input.domain}`;
     const data = await streamAnthropicMessage({
         model: MODEL,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pattern-mcp",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "MCP server that turns your design guidance into a checkable process -- evaluates UI components from external libraries (shadcn/ui, 21st.dev, ReUI) or your own registered design system against a requirements checklist, then tells the agent whether to reuse an existing component or build one from a concrete design reference.",
   "type": "module",
   "main": "dist/index.js",