premanmcp 0.9.0 → 0.10.1

package/bin/shared.js

@@ -8,7 +8,15 @@
  */
 
 import { spawn, spawnSync } from "node:child_process";
-import { chmodSync, existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import {
+  chmodSync,
+  existsSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  writeFileSync,
+  mkdirSync,
+} from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { createInterface } from "node:readline/promises";
@@ -29,16 +37,55 @@ export const CREDENTIALS_FILE = path.join(CREDENTIALS_DIR, "credentials.json");
  */
 let _invocation = null;
 
-export function cliInvocation() {
-  if (_invocation) return _invocation;
+/**
+ * The package that owns the first `preman` on PATH, or "".
+ *
+ * `preman` is not ours by name alone: `preman-sdk` publishes a bin called
+ * exactly that, and whichever package lost the race still resolves. Assuming it
+ * is us writes hints and a git hook that call the other CLI — which answers
+ * "Unknown command: verify" and turns every push into a silent
+ * "[preman] checks skipped", the worst possible failure for a tool whose whole
+ * job is running checks on push.
+ */
+export function pathPremanOwner() {
   const probe = process.platform === "win32" ? "where" : "which";
+  let resolved = "";
   try {
     const found = spawnSync(probe, ["preman"], { stdio: "pipe", encoding: "utf8" });
-    _invocation = found.status === 0 && found.stdout.trim() ? "preman" : null;
+    if (found.status !== 0) return "";
+    resolved = String(found.stdout || "").split("\n")[0].trim();
+  } catch {
+    return "";
+  }
+  if (!resolved) return "";
+
+  // Walk up from the real file, not the symlink: a bin is a link into the
+  // package directory, and only that directory's manifest names the owner.
+  try {
+    let dir = path.dirname(realpathSync(resolved));
+    for (let depth = 0; depth < 5; depth += 1) {
+      const manifest = path.join(dir, "package.json");
+      if (existsSync(manifest)) {
+        return String(JSON.parse(readFileSync(manifest, "utf8")).name || "");
+      }
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
   } catch {
-    _invocation = null;
+    return "";
   }
-  return (_invocation ||= "npm exec -y premanmcp@latest --");
+  return "";
+}
+
+export function cliInvocation() {
+  return (_invocation ||=
+    pathPremanOwner() === "premanmcp" ? "preman" : "npm exec -y premanmcp@latest --");
+}
+
+/** Test seam: `cliInvocation` memoizes a PATH probe for the life of the process. */
+export function resetCliInvocation() {
+  _invocation = null;
 }
 
 export function makeArgs(commandArgs = []) {
@@ -93,6 +140,18 @@ export function saveStoredCredentials(creds) {
   writeFileSync(CREDENTIALS_FILE, `${JSON.stringify(creds, null, 2)}\n`, { mode: 0o600 });
 }
 
+/** Forget the stored key. Returns whether there was one. */
+export function clearStoredCredentials() {
+  if (!existsSync(CREDENTIALS_FILE)) return false;
+  rmSync(CREDENTIALS_FILE, { force: true });
+  return true;
+}
+
+/** True when the key in play came from a flag or the environment, not our store. */
+export function apiKeyIsExplicit(args) {
+  return Boolean(args.value("--api-key", "") || process.env.PREMAN_API_KEY);
+}
+
 export function backendUrl(args) {
   return args.value("--backend", process.env.PREMAN_BACKEND || DEFAULT_BACKEND).replace(/\/+$/, "");
 }

package/dist/server.js

@@ -9,11 +9,7 @@ import path from "node:path";
 import os from "node:os";
 import { randomUUID } from "node:crypto";
 import { MCP_PREVIEW_RESOURCE_URI, RESOURCE_URI_META_KEY, buildConversionPanelHtml, writeMcpPreviewFile, } from "./mcp-preview-panel.js";
-/**
- * Load ``PREMAN_*`` from repo JSON so project URLs win over stale **global** Cursor MCP env
- * (which often sets the wrong ``PREMAN_BACKEND``, e.g. app port instead of API port).
- * First match wins: ``.cursor/preman-mcp.config.json``, then ``preman-mcp.config.json`` (cwd).
- */
+let REPO_CONFIG = null;
 function applyRepoPremanConfig() {
     const candidates = [
         path.join(process.cwd(), ".cursor", "preman-mcp.config.json"),
@@ -24,13 +20,19 @@ function applyRepoPremanConfig() {
             if (!existsSync(p))
                 continue;
             const j = JSON.parse(readFileSync(p, "utf8"));
+            const override = j.PREMAN_CONFIG_OVERRIDE === true || j.PREMAN_CONFIG_OVERRIDE === "true";
+            const applied = [];
             for (const [key, val] of Object.entries(j)) {
-                if (!key.startsWith("PREMAN_"))
+                if (!key.startsWith("PREMAN_") || key === "PREMAN_CONFIG_OVERRIDE")
                     continue;
-                if (typeof val === "string" && val.trim()) {
-                    process.env[key] = val.trim();
-                }
+                if (typeof val !== "string" || !val.trim())
+                    continue;
+                if (!override && process.env[key])
+                    continue;
+                process.env[key] = val.trim();
+                applied.push(key);
             }
+            REPO_CONFIG = { path: p, override, applied };
             return;
         }
         catch {
@@ -42,6 +44,22 @@ applyRepoPremanConfig();
 const BACKEND_URL = process.env.PREMAN_BACKEND || "https://api.preman.live";
 const FRONTEND_URL = process.env.PREMAN_FRONTEND || "https://app.preman.live";
 let API_KEY = process.env.PREMAN_API_KEY || "";
+/**
+ * Where the URLs this process is using came from.
+ *
+ * Reported by `preman_status` because the most confusing failure in setup is a
+ * server that works perfectly against the wrong backend: the key is fine, the
+ * config on disk is fine, and every call still 401s. Naming the file that
+ * redirected it turns that into a one-line diagnosis.
+ */
+function configSource() {
+    return {
+        backend_url: BACKEND_URL,
+        repo_config: REPO_CONFIG
+            ? { path: REPO_CONFIG.path, override: REPO_CONFIG.override, applied: REPO_CONFIG.applied }
+            : null,
+    };
+}
 function detectCodingAgent() {
     const forced = (process.env.PREMAN_CODING_AGENT || "").trim().toLowerCase();
     if (forced)
@@ -1025,6 +1043,7 @@ export function createServer() {
                             backend_url: BACKEND_URL,
                             frontend_base_url: FRONTEND_BASE,
                             endpoints_page_url: buildAgentDashboardUrl("/endpoints"),
+                            config: configSource(),
                             message: "Not authenticated. Run `npm exec -y premanmcp@latest -- login`, or use user_auth_* then preman_create_api_key, or run preman_login.",
                         }),
                     }],
@@ -1040,6 +1059,7 @@ export function createServer() {
                             backend_url: BACKEND_URL,
                             frontend_base_url: FRONTEND_BASE,
                             endpoints_page_url: buildAgentDashboardUrl("/endpoints"),
+                            config: configSource(),
                             message: "Stored API key is no longer valid. Run `npm exec -y premanmcp@latest -- login`, or use user_auth_* then preman_create_api_key, or run preman_login.",
                         }),
                     }],
@@ -1056,6 +1076,7 @@ export function createServer() {
                         backend_url: BACKEND_URL,
                         frontend_base_url: FRONTEND_BASE,
                         endpoints_page_url: buildAgentDashboardUrl("/endpoints"),
+                        config: configSource(),
                         coding_agent: workbench,
                         _agent_hints: {
                             next_actions: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "premanmcp",
-  "version": "0.9.0",
+  "version": "0.10.1",
   "description": "Turn APIs into agent-callable MCP tools with auth, testing, and audit logs",
   "type": "module",
   "bin": {
@@ -13,9 +13,9 @@
     "dev": "tsx src/server.ts",
     "open-mcp-preview": "node scripts/emit-mcp-preview.mjs",
     "open-mcp-preview-in-cursor": "node scripts/open-cursor-preview.mjs",
-    "test": "npm run test:connect && npm run test:node",
+    "test": "npm run build && npm run test:connect && npm run test:node",
     "test:connect": "node scripts/smoke-connect.mjs",
-    "test:node": "node --test --test-timeout=30000 scripts/smoke-launcher-config.mjs scripts/smoke-onboard.mjs scripts/smoke-local-detect.mjs scripts/smoke-prepush-hook.mjs scripts/smoke-verify-prepush.mjs scripts/smoke-push-diff.mjs scripts/smoke-progress-reporter.mjs scripts/smoke-verify-plan.mjs scripts/smoke-install-desktop.mjs"
+    "test:node": "node --test --test-timeout=30000 scripts/smoke-launcher-config.mjs scripts/smoke-runner.mjs scripts/smoke-repo-config.mjs scripts/smoke-onboard.mjs scripts/smoke-local-detect.mjs scripts/smoke-prepush-hook.mjs scripts/smoke-cli-identity.mjs scripts/smoke-verify-prepush.mjs scripts/smoke-push-diff.mjs scripts/smoke-progress-reporter.mjs scripts/smoke-verify-plan.mjs scripts/smoke-install-desktop.mjs"
   },
   "dependencies": {
     "@modelcontextprotocol/ext-apps": "^0.1.0",