premanmcp 0.4.0 → 0.7.0

package/bin/shared.js

@@ -0,0 +1,351 @@
+/**
+ * Shared CLI helpers: prompts, credential storage, backend calls, terminal auth.
+ *
+ * Extracted from bin/cli.js so `connect` and `install` can use the same login
+ * and config-writing behavior instead of growing a second copy. Every function
+ * that reads flags takes an `args` accessor (see makeArgs) rather than closing
+ * over a module-level argv, so a command can pass its own slice.
+ */
+
+import { chmodSync, existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { createInterface } from "node:readline/promises";
+
+export const DEFAULT_BACKEND = "https://api.preman.live";
+export const DEFAULT_FRONTEND = "https://app.preman.live";
+export const CREDENTIALS_DIR = path.join(os.homedir(), ".preman");
+export const CREDENTIALS_FILE = path.join(CREDENTIALS_DIR, "credentials.json");
+
+/** Wrap a raw argv slice in the positional lookup the CLI has always used. */
+export function makeArgs(commandArgs = []) {
+  return {
+    raw: commandArgs,
+    value(name, fallback = "") {
+      const index = commandArgs.indexOf(name);
+      if (index === -1) return fallback;
+      return commandArgs[index + 1] || fallback;
+    },
+    has(name) {
+      return commandArgs.includes(name);
+    },
+  };
+}
+
+export function readJsonFile(filePath) {
+  if (!existsSync(filePath)) return {};
+  const raw = readFileSync(filePath, "utf8").trim();
+  if (!raw) return {};
+  try {
+    return JSON.parse(raw);
+  } catch (error) {
+    throw new Error(`Could not parse ${filePath}: ${error.message}`);
+  }
+}
+
+export function writeJsonFile(filePath, value) {
+  mkdirSync(path.dirname(filePath), { recursive: true });
+  writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+  // writeFileSync's mode only applies when it creates the file, and these
+  // configs can hold a pm_live_ key — tighten an existing file explicitly.
+  chmodSync(filePath, 0o600);
+}
+
+export function readStoredCredentials() {
+  try {
+    const raw = readFileSync(CREDENTIALS_FILE, "utf8").trim();
+    if (!raw) return null;
+    const creds = JSON.parse(raw);
+    if (creds && typeof creds.api_key === "string" && creds.api_key.startsWith("pm_live_")) {
+      return creds;
+    }
+  } catch {
+    // No stored credentials yet.
+  }
+  return null;
+}
+
+export function saveStoredCredentials(creds) {
+  mkdirSync(CREDENTIALS_DIR, { recursive: true, mode: 0o700 });
+  writeFileSync(CREDENTIALS_FILE, `${JSON.stringify(creds, null, 2)}\n`, { mode: 0o600 });
+}
+
+export function backendUrl(args) {
+  return args.value("--backend", process.env.PREMAN_BACKEND || DEFAULT_BACKEND).replace(/\/+$/, "");
+}
+
+export function frontendUrl(args) {
+  return args.value("--frontend", process.env.PREMAN_FRONTEND || DEFAULT_FRONTEND).replace(/\/+$/, "");
+}
+
+export async function promptText(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return (await rl.question(question)).trim();
+  } finally {
+    rl.close();
+  }
+}
+
+export async function promptSecret(question) {
+  if (!process.stdin.isTTY || !process.stdin.setRawMode) {
+    return promptText(question);
+  }
+
+  return new Promise((resolve) => {
+    const stdin = process.stdin;
+    const stdout = process.stdout;
+    const wasRaw = stdin.isRaw;
+    let value = "";
+
+    function cleanup() {
+      stdin.off("data", onData);
+      stdin.setRawMode(Boolean(wasRaw));
+      stdin.pause();
+    }
+
+    function onData(chunk) {
+      const text = String(chunk);
+      if (text === "\u0003") {
+        stdout.write("\n");
+        cleanup();
+        process.exit(130);
+      }
+      if (text === "\r" || text === "\n" || text === "\u0004") {
+        stdout.write("\n");
+        cleanup();
+        resolve(value);
+        return;
+      }
+      if (text === "\u007f" || text === "\b") {
+        if (value.length) {
+          value = value.slice(0, -1);
+          stdout.write("\b \b");
+        }
+        return;
+      }
+      value += text;
+      stdout.write("*");
+    }
+
+    stdout.write(question);
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.setEncoding("utf8");
+    stdin.on("data", onData);
+  });
+}
+
+export async function promptPasswordTwice() {
+  const password = await promptSecret("Create password: ");
+  if (!password || password.length < 6) {
+    throw new Error("Password must be at least 6 characters.");
+  }
+  const confirm = await promptSecret("Confirm password: ");
+  if (password !== confirm) {
+    throw new Error("Passwords do not match.");
+  }
+  return password;
+}
+
+export async function callBackendJson(args, method, routePath, { json, token, query } = {}) {
+  const url = new URL(routePath.replace(/^\/+/, ""), `${backendUrl(args)}/`);
+  if (query) {
+    for (const [key, value] of Object.entries(query)) {
+      if (value != null && value !== "") url.searchParams.set(key, String(value));
+    }
+  }
+
+  const headers = { Accept: "application/json" };
+  const hasBody = json !== undefined && json !== null;
+  if (hasBody) headers["Content-Type"] = "application/json";
+  if (token) headers.Authorization = `Bearer ${token}`;
+
+  const resp = await fetch(url, {
+    method,
+    headers,
+    body: hasBody ? JSON.stringify(json) : undefined,
+  });
+  const text = await resp.text();
+  let body = {};
+  try {
+    body = text ? JSON.parse(text) : {};
+  } catch {
+    body = { raw: text };
+  }
+  return {
+    status_code: resp.status,
+    ok: resp.ok,
+    ...body,
+  };
+}
+
+export function assertOk(result, action) {
+  if (result.ok) return;
+  const detail = result.detail || result.message || result.raw || `${action} failed`;
+  throw new Error(`${action} failed: ${result.status_code} ${detail}`);
+}
+
+async function verifyUnconfirmedAccount(args, email) {
+  process.stdout.write("This email exists but is not verified. Sending a new OTP.\n");
+  const resend = await callBackendJson(args, "POST", "/auth/resend-otp", { json: { email } });
+  assertOk(resend, "resend OTP");
+  const otp = await promptText("Verification code: ");
+  const verified = await callBackendJson(args, "POST", "/auth/verify-otp", { json: { email, otp } });
+  assertOk(verified, "verify OTP");
+  return verified.access_token;
+}
+
+async function createAccountFromTerminal(args, email) {
+  const signup = await callBackendJson(args, "POST", "/auth/start-signup", {
+    json: { email },
+  });
+
+  if (signup.ok) {
+    process.stdout.write("Verification code sent. Check your email.\n");
+    const otp = await promptText("Verification code: ");
+    const password = await promptPasswordTwice();
+    const setPassword = await callBackendJson(args, "POST", "/auth/set-password", {
+      json: { email, otp, new_password: password },
+    });
+    assertOk(setPassword, "set password");
+    return String(setPassword.access_token || "");
+  }
+
+  if (signup.status_code !== 404) {
+    assertOk(signup, "start signup");
+  }
+
+  process.stdout.write(
+    "This PreMan backend uses the password-first signup flow. Create your password now, then enter the email code.\n"
+  );
+  const password = await promptPasswordTwice();
+  const legacySignup = await callBackendJson(args, "POST", "/auth/signup", {
+    json: { email, password },
+  });
+  assertOk(legacySignup, "signup");
+  process.stdout.write("Verification code sent. Check your email.\n");
+  const otp = await promptText("Verification code: ");
+  const verified = await callBackendJson(args, "POST", "/auth/verify-otp", {
+    json: { email, otp },
+  });
+  assertOk(verified, "verify OTP");
+  return String(verified.access_token || "");
+}
+
+/**
+ * Get a usable pm_live_ key: an explicit one, or by logging in / signing up
+ * right here in the terminal. Always persists to ~/.preman/credentials.json.
+ */
+export async function authenticateTerminal(args) {
+  const explicitKey = args.value("--api-key", process.env.PREMAN_API_KEY || "");
+  if (explicitKey && explicitKey.startsWith("pm_live_")) {
+    const creds = {
+      api_key: explicitKey,
+      backend_url: backendUrl(args),
+      user_email: args.value("--email", ""),
+      device_name: os.hostname(),
+      created_at: new Date().toISOString(),
+    };
+    saveStoredCredentials(creds);
+    return creds;
+  }
+
+  const email = (args.value("--email", "") || await promptText("Email: ")).trim().toLowerCase();
+  if (!email) throw new Error("Email is required.");
+
+  process.stdout.write(`Checking PreMan account for ${email}...\n`);
+  const account = await callBackendJson(args, "GET", "/auth/needs-password", { query: { email } });
+  assertOk(account, "check account");
+
+  let accessToken = "";
+
+  if (!account.exists) {
+    process.stdout.write("No PreMan account found. Creating one now.\n");
+    accessToken = await createAccountFromTerminal(args, email);
+  } else if (account.needs_password) {
+    process.stdout.write("This account needs a password. Sending an OTP first.\n");
+    const resend = await callBackendJson(args, "POST", "/auth/resend-otp", { json: { email } });
+    assertOk(resend, "resend OTP");
+    const otp = await promptText("Verification code: ");
+    const password = await promptPasswordTwice();
+    const setPassword = await callBackendJson(args, "POST", "/auth/set-password", {
+      json: { email, otp, new_password: password },
+    });
+    assertOk(setPassword, "set password");
+    accessToken = String(setPassword.access_token || "");
+  } else {
+    const password = await promptSecret("Password: ");
+    const login = await callBackendJson(args, "POST", "/auth/login", {
+      json: { email, password },
+    });
+    if (!login.ok && login.status_code === 403 && String(login.detail || "").toLowerCase().includes("not verified")) {
+      accessToken = await verifyUnconfirmedAccount(args, email);
+    } else {
+      assertOk(login, "login");
+      accessToken = String(login.access_token || "");
+    }
+  }
+
+  if (!accessToken) throw new Error("PreMan did not return an access token.");
+
+  const keyName = `PreMan MCP CLI (${os.hostname()})`;
+  const key = await callBackendJson(args, "POST", "/api-keys", {
+    token: accessToken,
+    json: { name: keyName },
+  });
+  assertOk(key, "create API key");
+  if (!key.key || !String(key.key).startsWith("pm_live_")) {
+    throw new Error("PreMan did not return a valid API key.");
+  }
+
+  const creds = {
+    api_key: String(key.key),
+    backend_url: backendUrl(args),
+    user_email: email,
+    device_name: os.hostname(),
+    created_at: new Date().toISOString(),
+  };
+  saveStoredCredentials(creds);
+  return creds;
+}
+
+/** Does this invocation already have a key, without prompting for one? */
+export function hasKeyAvailable(args) {
+  return Boolean(
+    args.value("--api-key", "") || process.env.PREMAN_API_KEY || readStoredCredentials()
+  );
+}
+
+/** Resolve the key to embed in a written config, if any. */
+export function resolveApiKey(args) {
+  const explicit = args.value("--api-key", process.env.PREMAN_API_KEY || "");
+  if (explicit) return explicit;
+  const stored = readStoredCredentials();
+  return stored ? stored.api_key : "";
+}
+
+/**
+ * The MCP server block written into every agent's config.
+ *
+ * Matches the backend's install snippets (`build_install_snippets`) so the
+ * copy-paste path and this writer cannot drift.
+ */
+export function buildServerConfig(args, { pairCode = "" } = {}) {
+  const env = {
+    PREMAN_BACKEND: backendUrl(args),
+    PREMAN_FRONTEND: frontendUrl(args),
+  };
+  const apiKey = resolveApiKey(args);
+  if (apiKey) env.PREMAN_API_KEY = apiKey;
+  if (pairCode) env.PREMAN_PAIR_CODE = pairCode;
+
+  return {
+    // npm exec rather than npx: same resolution, but it is the command every
+    // install of npm ships, and it is what the rest of our instructions use.
+    // The trailing "--" stops npm from claiming flags meant for the server.
+    command: "npm",
+    args: ["exec", "-y", "premanmcp@latest", "--"],
+    env,
+  };
+}

package/dist/server.js

@@ -62,6 +62,7 @@ async function heartbeatWorkbenchLink() {
     try {
         const resp = await fetch(`${BACKEND_URL}/workbench/coding-agent/heartbeat`, {
             method: "POST",
+            signal: AbortSignal.timeout(5000),
             headers: {
                 Authorization: `Bearer ${API_KEY}`,
                 "Content-Type": "application/json",
@@ -360,7 +361,7 @@ export function createServer() {
             "",
             "## Tool taxonomy",
             "- **Read tools** (no side effects): get_endpoints, get_coverage, detect_drift, preman_status, list_collections, get_collection, list_runs",
-            "- **Action tools** (execute tests / mutate state): test_api, generate_tests, import_collection, test_endpoint_by_id, run_tests, delete_collection",
+            "- **Action tools** (execute tests / mutate state): test_api, generate_tests, generate_endpoint_tests, run_stress_test, import_collection, test_endpoint_by_id, register_discovered_endpoints, run_tests, delete_collection",
             "- **MCP conversion tools**: discover_endpoints_from_codebase, verify_endpoints_live, mcp_preview (returns inline two-pane panel), mcp_deploy, mcp_list_deployed, mcp_mint_consumer_token, mcp_revoke_consumer_token",
             "- **Auth (API key / PreMan)**: preman_create_api_key (JWT -> saved pm_live_ key), preman_login, preman_login_complete, preman_logout",
             "- **Auth (app JWT — email/OTP/password on your API)**: user_auth_start_signup, user_auth_signup, user_auth_verify_otp, user_auth_login, user_auth_needs_password, user_auth_resend_otp, user_auth_forgot_password, user_auth_set_password, user_auth_me, user_auth_change_password, user_auth_delete_account (HTTP to PREMAN_BACKEND /auth/*; no pm_live_ key required)",
@@ -372,6 +373,9 @@ export function createServer() {
             "- 'preview my MCP before deploying': mcp_preview (read-only). 'actually deploy': mcp_deploy.",
             "- 'test the login endpoint' / 'hit POST /auth/login with body': test_api with the full URL. Use test_endpoint_by_id ONLY when the user references a saved endpoint by id/uuid.",
             "- 'import my Postman/OpenAPI/Bruno/curl collection': import_collection.",
+            "- 'generate tests for endpoint X' / 'write unit tests for X and run them': generate_endpoint_tests (set include_code=true and write the returned code_artifacts to disk when the user wants test files).",
+            "- 'stress / load test X': run_stress_test. Read-only unless the user explicitly authorises writes — never set allow_writes yourself.",
+            "- After discover_endpoints_from_codebase, call register_discovered_endpoints with the JSON array it asked for, then verify_endpoints_live to confirm they respond.",
             "- App-auth flows (signup, OTP, login, change_password) live under the user_auth_* tools and do not need an pm_live_ key.",
             "- PREMAN_BACKEND / backend_url is the PreMan control plane. It is NOT the target API upstream for a generated MCP unless the user's own API is PreMan. Prefer base_url from verify_endpoints_live results.",
             "",
@@ -469,6 +473,70 @@ export function createServer() {
             });
         }
     });
+    // ── generate_endpoint_tests ───────────────────────────────────────
+    server.tool("generate_endpoint_tests", "Generate scenario tests for one endpoint (happy path, auth, validation, boundaries, plus user-described scenarios) and run them by default. Pass a workbench request_id, a registry endpoint_id, or target to let PreMan resolve either. Set include_code=true for ready-to-write pytest/jest files in code_artifacts.", {
+        request_id: z.string().optional().describe("Saved workbench request id"),
+        endpoint_id: z.string().optional().describe("Registry endpoint UUID from get_endpoints"),
+        target: z.string().optional().describe("Either kind of id; PreMan resolves it"),
+        scenarios: z.array(z.string()).optional().describe("The user's scenario descriptions, one per entry"),
+        run: z.boolean().optional().default(true).describe("Execute the generated cases now (read-only by default)"),
+        allow_writes: z.boolean().optional().default(false).describe("Permit mutating cases — only when the user authorised it"),
+        persist_suite: z.boolean().optional().default(false).describe("Also save as a recurring auto-test suite (paid feature)"),
+        max_cases: z.number().optional().default(10).describe("Max generated cases (1-25)"),
+        include_code: z.boolean().optional().default(false).describe("Return unit-test files in code_artifacts"),
+        test_framework: z.enum(["pytest", "jest"]).optional().default("pytest").describe("Framework for code_artifacts"),
+    }, async (args) => {
+        try {
+            const result = await callBackend("generate_endpoint_tests", args);
+            return withFrontendUrl(result, "/endpoints");
+        }
+        catch (e) {
+            return toolError(e.message, inferErrorCode(e.message), {
+                next_actions: ["Call get_endpoints (include_workbench=true) to find a valid request or endpoint id."],
+                related_tools: ["get_endpoints", "run_stress_test"],
+            });
+        }
+    });
+    // ── run_stress_test ───────────────────────────────────────────────
+    server.tool("run_stress_test", "Bounded load test against one endpoint: paced requests for a fixed duration, reporting p50/p95/p99 latency, error rate, throughput, and a failure-classification mix. Read-only endpoints unless the user explicitly authorised writes; destructive endpoints always refused. Paid feature; server-side caps apply.", {
+        request_id: z.string().optional().describe("Saved workbench request id"),
+        endpoint_id: z.string().optional().describe("Registry endpoint UUID from get_endpoints"),
+        target: z.string().optional().describe("Either kind of id; PreMan resolves it"),
+        duration_seconds: z.number().optional().default(15).describe("Run length (server caps apply)"),
+        rps: z.number().optional().default(5).describe("Target requests per second (server caps apply)"),
+        concurrency: z.number().optional().default(5).describe("Max in-flight requests (server caps apply)"),
+        allow_writes: z.boolean().optional().default(false).describe("Only when the user authorised stressing a write endpoint"),
+    }, async (args) => {
+        try {
+            const result = await callBackend("run_stress_test", args);
+            return withFrontendUrl(result, "/endpoints");
+        }
+        catch (e) {
+            return toolError(e.message, inferErrorCode(e.message), {
+                next_actions: ["Call get_endpoints (include_workbench=true) to find a valid request or endpoint id."],
+                related_tools: ["get_endpoints", "generate_endpoint_tests"],
+            });
+        }
+    });
+    // ── register_discovered_endpoints ─────────────────────────────────
+    server.tool("register_discovered_endpoints", "Save discovered endpoints into PreMan and set them up as runnable requests. Use after discover_endpoints_from_codebase with the JSON array its brief asked you to build; then call verify_endpoints_live to confirm they respond.", {
+        endpoints: z.array(z.record(z.any())).optional().describe("Discovery-shaped endpoint objects (method, path_template, schemas, confidence, …); max 100"),
+        endpoint_ids: z.array(z.string()).optional().describe("Alternatively, existing registry ids to set up as runnable requests"),
+        project_id: z.string().optional().describe("Scope registration to a project"),
+        base_url: z.string().optional().describe("Applied to endpoints that carry none"),
+        setup_workbench: z.boolean().optional().default(true).describe("Also create saved workbench requests (default true)"),
+    }, async (args) => {
+        try {
+            const result = await callBackend("register_discovered_endpoints", args);
+            return withFrontendUrl(result, "/endpoints");
+        }
+        catch (e) {
+            return toolError(e.message, inferErrorCode(e.message), {
+                next_actions: ["Run discover_endpoints_from_codebase first and pass its endpoints array here."],
+                related_tools: ["discover_endpoints_from_codebase", "verify_endpoints_live"],
+            });
+        }
+    });
     // ── get_endpoints ─────────────────────────────────────────────────
     server.tool("get_endpoints", "Return endpoint inventory (registry, optionally MCP sessions and collections). Default: structured JSON for agents. Pass format='text' for deprecated human-friendly output, or open_ui=true for the visual dashboard. Schemas stripped by default to save tokens; set include_schemas=true when needed.", {
         status: z.string().optional().describe("Filter: tested, needed, draft"),
@@ -476,6 +544,7 @@ export function createServer() {
         include_sessions: z.boolean().optional().default(false).describe("Include recent MCP session test results"),
         include_collections: z.boolean().optional().default(false).describe("Include imported collection endpoints"),
         include_schemas: z.boolean().optional().default(false).describe("Include request/response schemas per endpoint (default false to save tokens)"),
+        include_workbench: z.boolean().optional().default(false).describe("Also list the default workspace's saved runnable requests"),
         limit: z.number().optional().default(50).describe("Max endpoints per page (default 50)"),
         offset: z.number().optional().default(0).describe("Pagination offset"),
         project_id: z.string().optional().describe("Scope to a specific project"),
@@ -1068,6 +1137,42 @@ export function createServer() {
     // ── Hosted MCP platform tools ──────────────────────────────────────
     // Thin stdio proxies; all real logic lives in flowtest/mcp/hosted_mcp_tools.py
     // and is reached via the /mcp/call-tool HTTP bridge.
+    server.tool("connect_logs", "Front door for connecting a customer's production logs to PreMan. Call with NO arguments first: it returns the projects you can use, the supported sources, and the questions to ask. Then call again with action='connect' (CloudWatch/S3/PostHog), action='push' (logs that live anywhere else — Kubernetes, a PaaS drain, a self-hosted collector), and finally action='verify'. NEVER ask the user for AWS access keys: AWS access is a read-only role the customer creates from the CloudFormation template this tool returns, and your job is to run the deploy command it gives you. For action='push', reference $PREMAN_API_KEY by name in any config you write — never print the key itself.", {
+        action: z
+            .enum(["brief", "connect", "push", "verify"])
+            .optional()
+            .describe("Omit for the guided brief; then connect | push | verify"),
+        project_id: z.string().optional().describe("PreMan project the logs belong to"),
+        source: z
+            .enum(["cloudwatch", "s3", "posthog"])
+            .optional()
+            .describe("Where the logs already land; required for action='connect'"),
+        config: z
+            .record(z.any())
+            .optional()
+            .describe("Source config: cloudwatch {region, log_group}, s3 {region, bucket, prefix?}, posthog {project_id, host?, event_names?}"),
+        aws_account_id: z
+            .string()
+            .optional()
+            .describe("Customer's 12-digit AWS account id; used to predict the role ARN the template creates"),
+        posthog_api_key: z.string().optional().describe("PostHog personal API key, read scope (posthog only)"),
+        name: z.string().optional().describe("Display name for the connector"),
+        env_name: z.string().optional().describe("Environment the logs belong to, e.g. production"),
+        stream: z.enum(["frontend", "backend", "unknown"]).optional().describe("Which log rail these lines land on"),
+        interval_seconds: z.number().optional().describe("Poll interval; defaults per source type"),
+        connector_id: z.string().optional().describe("Connector to check; required for action='verify'"),
+    }, async (args) => {
+        try {
+            const result = await callBackend("connect_logs", args);
+            return { content: [{ type: "text", text: JSON.stringify(result) }] };
+        }
+        catch (e) {
+            return toolError(e.message, inferErrorCode(e.message), {
+                next_actions: ["Call connect_logs with no arguments to see the supported actions."],
+                related_tools: ["connect_logs"],
+            });
+        }
+    });
     server.tool("discover_endpoints_from_codebase", "Return a brief the coding agent follows to extract HTTP endpoints from the user's codebase. Call this first when the user asks to turn their API into an MCP — the returned instructions tell your agent how to walk the repo and what shape to produce. Then pass the findings to verify_endpoints_live.", {
         base_path: z.string().optional().describe("Directory to scan (defaults to CWD)"),
         framework_hint: z.string().optional().describe("fastapi | express | nestjs | rails | django | nextjs"),
@@ -1323,6 +1428,21 @@ async function main() {
     const server = createServer();
     const transport = new StdioServerTransport();
     await server.connect(transport);
+    // Starting the configured MCP server is itself proof that the coding agent
+    // is live.  Previously the workbench remained in `connecting` until someone
+    // explicitly asked the agent to call `preman_status`, even when this process
+    // already had valid stored credentials and the pairing code in its env.
+    // Keep startup non-blocking so a slow control plane cannot delay MCP setup.
+    if (API_KEY) {
+        void heartbeatWorkbenchLink().then((link) => {
+            if (link?.ok) {
+                console.error("[PreMan] Coding-agent connection heartbeat sent");
+            }
+            else if (link) {
+                console.error(`[PreMan] Coding-agent heartbeat not accepted: ${String(link.detail || link.status || "unknown error")}`);
+            }
+        });
+    }
 }
 main().catch(console.error);
 process.on("SIGINT", () => { process.exit(0); });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "premanmcp",
-  "version": "0.4.0",
+  "version": "0.7.0",
   "description": "Turn APIs into agent-callable MCP tools with auth, testing, and audit logs",
   "type": "module",
   "bin": {
@@ -12,7 +12,8 @@
     "build": "tsc -p tsconfig.server.json",
     "dev": "tsx src/server.ts",
     "open-mcp-preview": "node scripts/emit-mcp-preview.mjs",
-    "open-mcp-preview-in-cursor": "node scripts/open-cursor-preview.mjs"
+    "open-mcp-preview-in-cursor": "node scripts/open-cursor-preview.mjs",
+    "test": "node --test scripts/smoke-onboard.mjs"
   },
   "dependencies": {
     "@modelcontextprotocol/ext-apps": "^0.1.0",