premanmcp 0.9.0 → 0.10.0

package/bin/shared.js

@@ -8,7 +8,7 @@
  */
 
 import { spawn, spawnSync } from "node:child_process";
-import { chmodSync, existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { chmodSync, existsSync, readFileSync, rmSync, writeFileSync, mkdirSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { createInterface } from "node:readline/promises";
@@ -93,6 +93,18 @@ export function saveStoredCredentials(creds) {
   writeFileSync(CREDENTIALS_FILE, `${JSON.stringify(creds, null, 2)}\n`, { mode: 0o600 });
 }
 
+/** Forget the stored key. Returns whether there was one. */
+export function clearStoredCredentials() {
+  if (!existsSync(CREDENTIALS_FILE)) return false;
+  rmSync(CREDENTIALS_FILE, { force: true });
+  return true;
+}
+
+/** True when the key in play came from a flag or the environment, not our store. */
+export function apiKeyIsExplicit(args) {
+  return Boolean(args.value("--api-key", "") || process.env.PREMAN_API_KEY);
+}
+
 export function backendUrl(args) {
   return args.value("--backend", process.env.PREMAN_BACKEND || DEFAULT_BACKEND).replace(/\/+$/, "");
 }

package/dist/server.js

@@ -9,11 +9,7 @@ import path from "node:path";
 import os from "node:os";
 import { randomUUID } from "node:crypto";
 import { MCP_PREVIEW_RESOURCE_URI, RESOURCE_URI_META_KEY, buildConversionPanelHtml, writeMcpPreviewFile, } from "./mcp-preview-panel.js";
-/**
- * Load ``PREMAN_*`` from repo JSON so project URLs win over stale **global** Cursor MCP env
- * (which often sets the wrong ``PREMAN_BACKEND``, e.g. app port instead of API port).
- * First match wins: ``.cursor/preman-mcp.config.json``, then ``preman-mcp.config.json`` (cwd).
- */
+let REPO_CONFIG = null;
 function applyRepoPremanConfig() {
     const candidates = [
         path.join(process.cwd(), ".cursor", "preman-mcp.config.json"),
@@ -24,13 +20,19 @@ function applyRepoPremanConfig() {
             if (!existsSync(p))
                 continue;
             const j = JSON.parse(readFileSync(p, "utf8"));
+            const override = j.PREMAN_CONFIG_OVERRIDE === true || j.PREMAN_CONFIG_OVERRIDE === "true";
+            const applied = [];
             for (const [key, val] of Object.entries(j)) {
-                if (!key.startsWith("PREMAN_"))
+                if (!key.startsWith("PREMAN_") || key === "PREMAN_CONFIG_OVERRIDE")
                     continue;
-                if (typeof val === "string" && val.trim()) {
-                    process.env[key] = val.trim();
-                }
+                if (typeof val !== "string" || !val.trim())
+                    continue;
+                if (!override && process.env[key])
+                    continue;
+                process.env[key] = val.trim();
+                applied.push(key);
             }
+            REPO_CONFIG = { path: p, override, applied };
             return;
         }
         catch {
@@ -42,6 +44,22 @@ applyRepoPremanConfig();
 const BACKEND_URL = process.env.PREMAN_BACKEND || "https://api.preman.live";
 const FRONTEND_URL = process.env.PREMAN_FRONTEND || "https://app.preman.live";
 let API_KEY = process.env.PREMAN_API_KEY || "";
+/**
+ * Where the URLs this process is using came from.
+ *
+ * Reported by `preman_status` because the most confusing failure in setup is a
+ * server that works perfectly against the wrong backend: the key is fine, the
+ * config on disk is fine, and every call still 401s. Naming the file that
+ * redirected it turns that into a one-line diagnosis.
+ */
+function configSource() {
+    return {
+        backend_url: BACKEND_URL,
+        repo_config: REPO_CONFIG
+            ? { path: REPO_CONFIG.path, override: REPO_CONFIG.override, applied: REPO_CONFIG.applied }
+            : null,
+    };
+}
 function detectCodingAgent() {
     const forced = (process.env.PREMAN_CODING_AGENT || "").trim().toLowerCase();
     if (forced)
@@ -1040,6 +1058,7 @@ export function createServer() {
                             backend_url: BACKEND_URL,
                             frontend_base_url: FRONTEND_BASE,
                             endpoints_page_url: buildAgentDashboardUrl("/endpoints"),
+                            config: configSource(),
                             message: "Stored API key is no longer valid. Run `npm exec -y premanmcp@latest -- login`, or use user_auth_* then preman_create_api_key, or run preman_login.",
                         }),
                     }],
@@ -1056,6 +1075,7 @@ export function createServer() {
                         backend_url: BACKEND_URL,
                         frontend_base_url: FRONTEND_BASE,
                         endpoints_page_url: buildAgentDashboardUrl("/endpoints"),
+                        config: configSource(),
                         coding_agent: workbench,
                         _agent_hints: {
                             next_actions: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "premanmcp",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Turn APIs into agent-callable MCP tools with auth, testing, and audit logs",
   "type": "module",
   "bin": {