pipebrain-mcp 0.43.0 → 0.44.0

package/dist/main.js

@@ -15837,7 +15837,6 @@ var commentSchema = external_exports.object({
 var apiTokenKindSchema = external_exports.enum(["connector", "manual"]);
 var apiTokenSchema = external_exports.object({
   id: uuidSchema,
-  orgId: uuidSchema,
   userId: uuidSchema,
   label: external_exports.string().min(1),
   tokenPrefix: tokenPrefixSchema,
@@ -16623,6 +16622,30 @@ var ApiClient = class _ApiClient {
       timeoutMs: this.timeoutMs
     });
   }
+  /**
+   * The inverse of {@link forOrg}: a thin copy that stamps NO `X-Org-Id`, for the
+   * org-INDEPENDENT routes named above.
+   *
+   * IT EXISTS BECAUSE A BASE CLIENT IS NOT ALWAYS UNSCOPED. The rule above assumes the
+   * caller reaches those routes through the client it started with, which holds for the
+   * web application. It does not hold for `pipebrain-mcp`, which scopes its client ONCE at
+   * startup from `PIPEBRAIN_ORG` and hands that scoped client to the tool registry as its
+   * base — so an org-independent call made there carries a header anyway.
+   *
+   * That is harmless while the default is good and actively harmful when it is not. A
+   * default naming an organization its holder has since been removed from makes EVERY call
+   * of that session refuse, including the one call whose whole purpose is to tell the
+   * caller which organizations it may name instead. Asking that question has to work from
+   * inside the broken state, or it does not help in the only case it is needed.
+   */
+  unscoped() {
+    return new _ApiClient({
+      baseUrl: this.baseUrl,
+      auth: this.auth,
+      fetch: this.fetchImpl,
+      timeoutMs: this.timeoutMs
+    });
+  }
   // --- core ------------------------------------------------------------------
   /** Builds the auth + active-org headers for the configured mode. */
   authHeaders() {
@@ -17569,7 +17592,7 @@ async function resolveDeliverableTargetId(client2, projectKey, ref) {
   }
   return match.id;
 }
-var ORG_ARGUMENT_DESCRIPTION = "The organization this call acts in \u2014 its slug or its uuid. Omit it to act in this session\u2019s default.";
+var ORG_ARGUMENT_DESCRIPTION = "The organization this call acts in \u2014 its slug or its uuid. Omitting it is refused unless this session has a default.";
 var orgArgumentSchema = external_exports.string().min(1).describe(ORG_ARGUMENT_DESCRIPTION).optional();
 function createMcpServer(baseClient, apiBaseUrl, orgInstructions2 = /* @__PURE__ */ new Map(), opts = {}) {
   const surface = opts.surface ?? "local";
@@ -17629,6 +17652,29 @@ function createMcpServer(baseClient, apiBaseUrl, orgInstructions2 = /* @__PURE__
       })
     );
   }
+  registerStrict("list_orgs", {
+    description: "List the organizations this credential may act in \u2014 each with its name, slug, id, kind (personal or shared) and your role there. THIS IS THE ONE TOOL THAT NEEDS NO `org`: every other call names the organization it acts in and is refused if it names none, and this is how you find out which names you may use. The answer is your live memberships at this moment, which is exactly what that check tests against, so an organization you have just joined appears here and one you have been removed from does not (\xA77)."
+    // NO inputSchema, and the absence is the point rather than an omission. There is
+    // nothing to narrow: the answer is the caller's own memberships, and a filter over a
+    // list this short would be a second way to ask one question.
+  }, () => (
+    // A BARE ARRAY, unlike `list_waiting`'s `{ items }`, and for the reason that tool
+    // gives rather than against it: the envelope has already been unwrapped by
+    // `ApiClient.listOrgs`, so passing it through is what avoids deciding the shape a
+    // second time. The sibling list tools return bare arrays for the same reason.
+    //
+    // `.unscoped()` IS LOAD-BEARING, and this is the only tool that uses it. Every other
+    // tool wants whatever scope is in force; this one must have none, because it is the
+    // tool a caller reaches for when the scope in force is the problem. Two ways in:
+    // a call naming an organization the caller cannot use, and — worse, because the
+    // caller names nothing at all — a stdio server started with a `PIPEBRAIN_ORG` whose
+    // organization its holder has since left, which scopes the registry's base client
+    // once at startup. In either state every other call refuses, and without this the
+    // one call that could say which organizations ARE available refuses along with them.
+    // The answer does not depend on scope, so dropping it costs nothing and is what
+    // makes the tool's own description true.
+    run(() => client2().unscoped().listOrgs(), GUIDANCE_POINTER)
+  ));
   registerStrict("list_projects", {
     description: "List all projects with their key, environments, milestones (token, label, active), deliverable targets (slug, label, active), and open-issue counts \u2014 the project switcher and workflow entry point (\xA77).",
     // Optional pagination (§9) — bounds mirror list_issues/list_requirements; the
@@ -18247,7 +18293,7 @@ function loadMcpConfig() {
 }
 
 // src/version.ts
-var VERSION = "0.43.0";
+var VERSION = "0.44.0";
 
 // src/main.ts
 async function scopedClient(base, org) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pipebrain-mcp",
-  "version": "0.43.0",
+  "version": "0.44.0",
   "description": "Pipebrain MCP server for Claude Code and Claude Desktop — issues, requirements, decision records, conventions, prompts, content, assets, metadata-only secrets, and more of the platform's modules over the Pipebrain API.",
   "type": "module",
   "license": "MIT",