slyplan-mcp 1.2.2 → 1.4.0

package/dist/cli.js

@@ -1,82 +1,218 @@
 #!/usr/bin/env node
 import * as fs from 'fs';
 import * as path from 'path';
+import * as http from 'http';
 import * as readline from 'readline';
 import { createClient } from '@supabase/supabase-js';
+import { exec } from 'child_process';
 const SUPABASE_URL = 'https://omfzpkwtuzucwwxmyuqt.supabase.co';
 const SUPABASE_ANON_KEY = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Im9tZnpwa3d0dXp1Y3d3eG15dXF0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzA5MjMwNDIsImV4cCI6MjA4NjQ5OTA0Mn0.KXGoUez7M45RtFM9qR7mjzGX6UhlaRE-gggAJxSkIHY';
-const PRE_DIRECTIVE = "ACTION REQUIRED: If you haven't set a SlyPlan project this session, call list_projects + set_project NOW. Then call search to find the node for your current task and add_to_work_mode. If no node exists, create one with add_node first. Do this BEFORE continuing with other work.";
-const POST_DIRECTIVE = "ACTION REQUIRED: You just made changes. Call search to find the SlyPlan node for this task, then update_node with current progress. Skip only for trivial edits (typos, config tweaks). Never mark done without asking the user first.";
-const POST_HOOK_FILE_CONTENT = `#!/usr/bin/env node
-const output = JSON.stringify({
-  suppressOutput: true,
-  hookSpecificOutput: {
-    hookEventName: "PostToolUse",
-    additionalContext: POST_DIRECTIVE_PLACEHOLDER
+const SLYPLAN_URL = 'https://slyplan.com';
+// Smart transcript-aware hook: checks if set_project + add_to_work_mode have been called.
+// Silent when OK, reminds only when needed.
+const PRE_HOOK_FILE_CONTENT = `#!/usr/bin/env node
+const fs = require('fs');
+
+let input = '';
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', (chunk) => { input += chunk; });
+process.stdin.on('end', () => {
+  try {
+    const data = JSON.parse(input);
+
+    if (!data.transcript_path) {
+      const output = JSON.stringify({
+        suppressOutput: true,
+        hookSpecificOutput: {
+          hookEventName: "PreToolCall",
+          additionalContext: "BLOCKED: Call list_projects + set_project before doing any work. This is not optional."
+        }
+      });
+      process.stdout.write(output);
+      process.exit(0);
+    }
+
+    const transcriptPath = data.transcript_path.replace(/^~/, process.env.HOME || process.env.USERPROFILE || '');
+    if (!fs.existsSync(transcriptPath)) { process.exit(0); }
+
+    const content = fs.readFileSync(transcriptPath, 'utf8');
+    const lines = content.split('\\n').filter(Boolean);
+
+    let hasSetProject = false;
+    let hasWorkModeNode = false;
+
+    for (const line of lines) {
+      try {
+        const entry = JSON.parse(line);
+        if (entry.type === 'assistant' && entry.message && Array.isArray(entry.message.content)) {
+          for (const block of entry.message.content) {
+            if (block.type !== 'tool_use') continue;
+            const name = block.name || '';
+            if (name.includes('set_project')) hasSetProject = true;
+            if (name.includes('add_to_work_mode')) hasWorkModeNode = true;
+          }
+        }
+      } catch {}
+    }
+
+    if (!hasSetProject) {
+      const output = JSON.stringify({
+        suppressOutput: true,
+        hookSpecificOutput: {
+          hookEventName: "PreToolCall",
+          additionalContext: "BLOCKED: Call list_projects + set_project before doing any work. This is not optional."
+        }
+      });
+      process.stdout.write(output);
+      process.exit(0);
+    }
+
+    if (!hasWorkModeNode) {
+      const output = JSON.stringify({
+        suppressOutput: true,
+        hookSpecificOutput: {
+          hookEventName: "PreToolCall",
+          additionalContext: "SYNC NOW: You have a project set but no node in work mode. Call search + add_to_work_mode before continuing."
+        }
+      });
+      process.stdout.write(output);
+      process.exit(0);
+    }
+
+    process.exit(0);
+  } catch (e) {
+    process.exit(0);
   }
 });
-process.stdout.write(output);
-process.exit(0);
-`.replace('POST_DIRECTIVE_PLACEHOLDER', JSON.stringify(POST_DIRECTIVE));
-const PRE_HOOK_FILE_CONTENT = `#!/usr/bin/env node
-const output = JSON.stringify({
-  suppressOutput: true,
-  hookSpecificOutput: {
-    hookEventName: "PreToolCall",
-    additionalContext: PRE_DIRECTIVE_PLACEHOLDER
+`;
+// Smart transcript-aware hook: counts file changes since last SlyPlan sync.
+// Silent when synced, reminds with count when unsynced.
+const POST_HOOK_FILE_CONTENT = `#!/usr/bin/env node
+const fs = require('fs');
+
+let input = '';
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', (chunk) => { input += chunk; });
+process.stdin.on('end', () => {
+  try {
+    const data = JSON.parse(input);
+
+    if (!data.transcript_path) { process.exit(0); }
+
+    const transcriptPath = data.transcript_path.replace(/^~/, process.env.HOME || process.env.USERPROFILE || '');
+    if (!fs.existsSync(transcriptPath)) { process.exit(0); }
+
+    const content = fs.readFileSync(transcriptPath, 'utf8');
+    const lines = content.split('\\n').filter(Boolean);
+
+    const FILE_TOOLS = ['Write', 'Edit', 'NotebookEdit'];
+    const SLYPLAN_SYNC_TOOLS = ['update_node', 'add_node', 'add_to_work_mode'];
+
+    let lastFileChangeIdx = -1;
+    let lastSlyplanSyncIdx = -1;
+    let fileChangeCount = 0;
+
+    for (let i = 0; i < lines.length; i++) {
+      try {
+        const entry = JSON.parse(lines[i]);
+        if (entry.type === 'assistant' && entry.message && Array.isArray(entry.message.content)) {
+          for (const block of entry.message.content) {
+            if (block.type !== 'tool_use') continue;
+            const name = block.name || '';
+
+            if (FILE_TOOLS.includes(name)) {
+              lastFileChangeIdx = i;
+              fileChangeCount++;
+            }
+            if (name === 'Bash' && block.input && typeof block.input.command === 'string') {
+              const cmd = block.input.command;
+              if (cmd.includes('git commit') || cmd.includes('mkdir')) {
+                lastFileChangeIdx = i;
+                fileChangeCount++;
+              }
+            }
+            for (const st of SLYPLAN_SYNC_TOOLS) {
+              if (name.includes(st)) lastSlyplanSyncIdx = i;
+            }
+          }
+        }
+      } catch {}
+    }
+
+    if (fileChangeCount === 0) { process.exit(0); }
+    if (lastSlyplanSyncIdx > lastFileChangeIdx) { process.exit(0); }
+
+    const output = JSON.stringify({
+      suppressOutput: true,
+      hookSpecificOutput: {
+        hookEventName: "PostToolUse",
+        additionalContext: "SYNC NOW: " + fileChangeCount + " file change(s) since last SlyPlan sync. Call update_node with current progress before continuing."
+      }
+    });
+    process.stdout.write(output);
+    process.exit(0);
+  } catch (e) {
+    process.exit(0);
   }
 });
-process.stdout.write(output);
-process.exit(0);
-`.replace('PRE_DIRECTIVE_PLACEHOLDER', JSON.stringify(PRE_DIRECTIVE));
+`;
 const CLAUDEMD_SECTION = `
-## SlyPlan Sync — OBLIGATORISKE REGLER
+## Hook Compliance — HARD REQUIREMENTS
+
+Hook messages containing **"BLOCKED"** or **"SYNC NOW"** are HARD REQUIREMENTS, not suggestions.
 
-DU SKAL holde SlyPlan oppdatert. Dette er ikke valgfritt. Følg disse reglene:
+- **BLOCKED:** You MUST stop what you're doing and follow the instruction BEFORE doing anything else. No exceptions — regardless of whether you're mid-workflow, running a GSD command, or in a multi-step task.
+- **SYNC NOW:** You MUST call \`update_node\` with updated progress BEFORE continuing with the next tool call. Max one file change between each sync.
+- Hooks are transcript-aware — they only fire when sync is actually missing. If you see a message, it means you have NOT done the work.
+- Ignoring hooks because you're "following a recipe" or "in the middle of something" is NEVER a valid reason.
 
-### 1. Sett prosjekt FØRST
-- **Ved start av hver sesjon:** Kall \`list_projects\` + \`set_project\` FØR du gjør noe annet.
-- Match prosjekt basert på cwd-mappenavn eller brukerens kontekst.
-- Hvis tvetydig, spør brukeren. Cache prosjekt-ID resten av sesjonen.
+## SlyPlan Sync — MANDATORY RULES
 
-### 2. Finn eller opprett node FØR du begynner arbeid
-- Kall \`search\` for å finne noden som matcher oppgaven din.
-- Hvis ingen node finnes: opprett med \`add_node\` umiddelbart.
-- Kall \`add_to_work_mode\` på noden FØR du starter med Edit/Write/Bash.
-- **Du skal ALDRI starte arbeid uten en aktiv work mode node.**
+You MUST keep SlyPlan updated. This is not optional. Follow these rules:
 
-### 3. Oppdater progress UNDERVEIS
-- Etter hver meningsfull endring: kall \`update_node\` med oppdatert \`progress\` (0-100).
-- Oppdater \`description\` med hva som faktisk ble gjort.
-- Hopp over for trivielle endringer (typos, config-tweaks).
+### 1. Set project FIRST
+- **At the start of every session:** Call \`list_projects\` + \`set_project\` BEFORE doing anything else.
+- Match the project based on the cwd folder name or user context.
+- If ambiguous, ask the user. Cache the project ID for the rest of the session.
 
-### 4. ALDRI merk noe som done uten å spørre
-- Bruk \`AskUserQuestion\` med valg: "Yes, mark as done" / "Not yet" / "Skip".
-- **Ingen unntak.** Auto-marking done er forbudt.
+### 2. Find or create a node BEFORE starting work
+- Call \`search\` to find the node matching your task.
+- If no node exists: create one with \`add_node\` immediately.
+- Call \`add_to_work_mode\` on the node BEFORE starting with Edit/Write/Bash.
+- **You must NEVER start work without an active work mode node.**
 
-### 5. Rydd opp work mode når du er ferdig
-- Kall \`remove_from_work_mode\` når du er ferdig med en node eller bytter til annen oppgave.
+### 3. Update progress AS YOU GO
+- After each meaningful change: call \`update_node\` with updated \`progress\` (0-100).
+- Update \`description\` with what was actually done.
+- Skip for trivial changes (typos, config tweaks).
 
-### 6. Alt arbeid skal reflekteres
-- Gjelder ALL type arbeid. Hvis kode endret seg, SKAL SlyPlan reflektere det.
-- Små fix = \`plan\`-node under eksisterende phase. Stor feature = ny \`phase\` med \`plan\`-children.
+### 4. NEVER mark anything as done without asking
+- Use \`AskUserQuestion\` with choices: "Yes, mark as done" / "Not yet" / "Skip".
+- **No exceptions.** Auto-marking done is forbidden.
 
-### Node-hierarki
+### 5. Clean up work mode when done
+- Call \`remove_from_work_mode\` when you're done with a node or switching to another task.
+
+### 6. All work must be reflected
+- Applies to ALL types of work. If code changed, SlyPlan MUST reflect it.
+- Small fixes = \`plan\` node under existing phase. Large features = new \`phase\` with \`plan\` children.
+
+### Node hierarchy
 \`project\` > \`category\` > \`phase\` > \`plan\`
 
-### Ytelsesregler
-- ALDRI bruk \`get_tree\` (returnerer ~18k tokens). Bruk \`search\` i stedet.
-
-### MCP-verktøy
-| Verktøy | Bruk |
-|---------|------|
-| \`list_projects\` | Finn prosjekter (sesjonstart) |
-| \`set_project\` | Velg aktivt prosjekt |
-| \`search\` | Finn noder etter navn/innhold |
-| \`add_node\` | Opprett ny node (project/category/phase/plan) |
-| \`update_node\` | Oppdater status, progress, description |
-| \`add_to_work_mode\` | Marker node som aktivt arbeid |
-| \`remove_from_work_mode\` | Fjern fra aktivt arbeid |
+### Performance rules
+- NEVER use \`get_tree\` (returns ~18k tokens). Use \`search\` instead.
+
+### MCP tools
+| Tool | Usage |
+|------|-------|
+| \`list_projects\` | Find projects (session start) |
+| \`set_project\` | Select active project |
+| \`search\` | Find nodes by name/content |
+| \`add_node\` | Create new node (project/category/phase/plan) |
+| \`update_node\` | Update status, progress, description |
+| \`add_to_work_mode\` | Mark node as active work |
+| \`remove_from_work_mode\` | Remove from active work |
 `;
 // --- Helpers ---
 function log(msg) {
@@ -137,7 +273,7 @@ async function validateCredentials(email, password) {
     const { data, error } = await client.auth.signInWithPassword({ email, password });
     if (error)
         return { ok: false, error: error.message };
-    return { ok: true, userEmail: data.user?.email ?? email };
+    return { ok: true, userEmail: data.user?.email ?? email, refreshToken: data.session?.refresh_token };
 }
 function readJsonFile(filePath) {
     try {
@@ -152,8 +288,108 @@ function writeJsonFile(filePath, data) {
     fs.mkdirSync(path.dirname(filePath), { recursive: true });
     fs.writeFileSync(filePath, JSON.stringify(data, null, 2) + '\n', 'utf8');
 }
+// --- Browser Auth ---
+function openBrowser(url) {
+    const platform = process.platform;
+    const cmd = platform === 'win32' ? 'start ""'
+        : platform === 'darwin' ? 'open'
+            : 'xdg-open';
+    exec(`${cmd} "${url}"`);
+}
+const SUCCESS_HTML = `<!DOCTYPE html>
+<html lang="en">
+<head><meta charset="utf-8"><title>SlyPlan - Authorized</title>
+<style>
+  body { margin: 0; min-height: 100vh; display: flex; align-items: center; justify-content: center;
+         background: #09090b; color: #f4f4f5; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; }
+  .card { text-align: center; padding: 3rem; }
+  .check { width: 64px; height: 64px; margin: 0 auto 1.5rem; color: #22c55e; }
+  h1 { font-size: 1.5rem; margin: 0 0 0.5rem; }
+  p { color: #a1a1aa; font-size: 0.875rem; margin: 0; }
+</style>
+</head>
+<body>
+<div class="card">
+  <svg class="check" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+    <path stroke-linecap="round" stroke-linejoin="round" d="M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z"/>
+  </svg>
+  <h1>Authorized!</h1>
+  <p>You can close this tab and return to your terminal.</p>
+</div>
+</body>
+</html>`;
+const ERROR_HTML = (msg) => `<!DOCTYPE html>
+<html lang="en">
+<head><meta charset="utf-8"><title>SlyPlan - Error</title>
+<style>
+  body { margin: 0; min-height: 100vh; display: flex; align-items: center; justify-content: center;
+         background: #09090b; color: #f4f4f5; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; }
+  .card { text-align: center; padding: 3rem; }
+  .icon { width: 64px; height: 64px; margin: 0 auto 1.5rem; color: #ef4444; }
+  h1 { font-size: 1.5rem; margin: 0 0 0.5rem; }
+  p { color: #a1a1aa; font-size: 0.875rem; margin: 0; }
+</style>
+</head>
+<body>
+<div class="card">
+  <svg class="icon" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+    <path stroke-linecap="round" stroke-linejoin="round" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-2.5L13.732 4c-.77-.833-1.964-.833-2.732 0L4.082 16.5c-.77.833.192 2.5 1.732 2.5z"/>
+  </svg>
+  <h1>Authorization Failed</h1>
+  <p>${msg}</p>
+</div>
+</body>
+</html>`;
+function startLocalAuthServer() {
+    return new Promise((resolve, reject) => {
+        const server = http.createServer((req, res) => {
+            const url = new URL(req.url ?? '/', `http://localhost`);
+            if (url.pathname === '/callback') {
+                const refreshToken = url.searchParams.get('refresh_token');
+                const email = url.searchParams.get('email') ?? '';
+                if (refreshToken) {
+                    res.writeHead(200, { 'Content-Type': 'text/html' });
+                    res.end(SUCCESS_HTML);
+                    server.close();
+                    resolve({ refreshToken, email });
+                }
+                else {
+                    res.writeHead(400, { 'Content-Type': 'text/html' });
+                    res.end(ERROR_HTML('Missing refresh token in callback.'));
+                    server.close();
+                    reject(new Error('Missing refresh token in callback'));
+                }
+            }
+            else {
+                res.writeHead(404, { 'Content-Type': 'text/plain' });
+                res.end('Not found');
+            }
+        });
+        // Listen on random port
+        server.listen(0, '127.0.0.1', () => {
+            const addr = server.address();
+            if (!addr || typeof addr === 'string') {
+                reject(new Error('Failed to start local server'));
+                return;
+            }
+            const port = addr.port;
+            const callbackUrl = `http://localhost:${port}/callback`;
+            const authUrl = `${SLYPLAN_URL}/cli/auth?port=${port}&callback=${encodeURIComponent(callbackUrl)}`;
+            log(`  Opening browser...`);
+            log(`  If it doesn't open, visit:`);
+            log(`  ${authUrl}`);
+            log('');
+            openBrowser(authUrl);
+        });
+        // Timeout after 120 seconds
+        setTimeout(() => {
+            server.close();
+            reject(new Error('Authorization timed out after 120 seconds. Please try again.'));
+        }, 120000);
+    });
+}
 // --- Settings Merge ---
-function mergeSettings(existing, email, password) {
+function mergeSettings(existing, refreshToken) {
     const result = { ...existing };
     // MCP server config
     if (!result.mcpServers)
@@ -162,8 +398,7 @@ function mergeSettings(existing, email, password) {
         command: 'npx',
         args: ['-y', 'slyplan-mcp@latest'],
         env: {
-            SLYPLAN_EMAIL: email,
-            SLYPLAN_PASSWORD: password,
+            SLYPLAN_REFRESH_TOKEN: refreshToken,
         },
     };
     // Hook config
@@ -256,41 +491,39 @@ async function runSetup() {
         if (args[i] === '--password' && args[i + 1])
             flagPassword = args[i + 1];
     }
-    let email = flagEmail;
-    let password = flagPassword;
-    let authenticated = false;
-    // Interactive credential prompts with retry
-    for (let attempt = 0; attempt < 3; attempt++) {
-        if (!email)
-            email = await promptUser('  Email: ');
-        if (!password)
-            password = await promptUser('  Password: ', true);
-        if (!email || !password) {
-            log('  Email and password are required.');
-            email = '';
-            password = '';
-            continue;
-        }
-        process.stderr.write('  Validating... ');
-        const result = await validateCredentials(email, password);
-        if (result.ok) {
-            log(`OK (signed in as ${result.userEmail})`);
-            authenticated = true;
-            break;
-        }
-        else {
+    let refreshToken = '';
+    let userEmail = '';
+    if (flagEmail && flagPassword) {
+        // CI/scripted mode: validate credentials and extract refresh token
+        process.stderr.write('  Validating credentials... ');
+        const result = await validateCredentials(flagEmail, flagPassword);
+        if (!result.ok) {
             log(`FAILED (${result.error})`);
-            if (attempt < 2) {
-                log('  Try again:');
-                email = '';
-                password = '';
-            }
+            process.exit(1);
         }
+        if (!result.refreshToken) {
+            log('FAILED (no refresh token returned)');
+            process.exit(1);
+        }
+        log(`OK (signed in as ${result.userEmail})`);
+        refreshToken = result.refreshToken;
+        userEmail = result.userEmail ?? flagEmail;
     }
-    if (!authenticated) {
+    else {
+        // Interactive mode: browser-based auth
+        log('  Waiting for authorization in browser...');
         log('');
-        log('  Authentication failed after 3 attempts. Aborting.');
-        process.exit(1);
+        try {
+            const result = await startLocalAuthServer();
+            refreshToken = result.refreshToken;
+            userEmail = result.email;
+            log(`  Authorized as ${userEmail}`);
+        }
+        catch (err) {
+            log('');
+            log(`  ${err.message}`);
+            process.exit(1);
+        }
     }
     log('');
     // 1. Create hook files
@@ -313,7 +546,7 @@ async function runSetup() {
     else if (rawSettings) {
         existingSettings = rawSettings;
     }
-    const mergedSettings = mergeSettings(existingSettings, email, password);
+    const mergedSettings = mergeSettings(existingSettings, refreshToken);
     writeJsonFile(settingsPath, mergedSettings);
     log('  [+] Updated .claude/settings.json');
     // 3. Optional CLAUDE.md append
@@ -321,7 +554,7 @@ async function runSetup() {
     if (appendAnswer.toLowerCase() !== 'n') {
         if (fs.existsSync(claudeMdPath)) {
             const content = fs.readFileSync(claudeMdPath, 'utf8');
-            if (content.includes('## SlyPlan Sync')) {
+            if (content.includes('## SlyPlan Sync') || content.includes('## Hook Compliance')) {
                 log('  [=] CLAUDE.md already has SlyPlan Sync section — skipped');
             }
             else {

package/dist/db.d.ts

@@ -1,4 +1,4 @@
-import type { TreeNode, Link } from './types.js';
+import type { TreeNode, Link, NodeDependency } from './types.js';
 export declare function getTree(rootId?: string | null): Promise<TreeNode[]>;
 export declare function getNode(id: string): Promise<TreeNode | null>;
 export declare function insertNode(data: {
@@ -28,3 +28,21 @@ export declare function searchNodes(query: string, filters?: {
     type?: string[];
     status?: string[];
 }): Promise<TreeNode[]>;
+export declare function insertDependency(fromNodeId: string, toNodeId: string): Promise<NodeDependency>;
+export declare function deleteDependency(id: string): Promise<void>;
+export declare function listDependencies(nodeIds: string[]): Promise<NodeDependency[]>;
+export declare function getBlockedNodes(projectId: string): Promise<Array<{
+    nodeId: string;
+    blockedBy: string[];
+}>>;
+export declare function computeProjectProgress(projectId: string): Promise<{
+    overall: number;
+    breakdown: Array<{
+        id: string;
+        title: string;
+        type: string;
+        progress: number;
+        weight: number;
+    }>;
+}>;
+export declare function computeCriticalPath(projectId: string): Promise<string[]>;

package/dist/db.js

@@ -303,3 +303,199 @@ export async function searchNodes(query, filters) {
         throw new Error(error.message);
     return (rows || []).map(row => dbNodeToTree(row, [], []));
 }
+function dbDepToNodeDep(row) {
+    return {
+        id: row.id,
+        fromNodeId: row.from_node_id,
+        toNodeId: row.to_node_id,
+        dependencyType: row.dependency_type,
+        createdBy: row.created_by,
+        createdAt: row.created_at,
+    };
+}
+export async function insertDependency(fromNodeId, toNodeId) {
+    const { data, error } = await supabase
+        .from('node_dependencies')
+        .insert({
+        from_node_id: fromNodeId,
+        to_node_id: toNodeId,
+        created_by: getUserId(),
+    })
+        .select()
+        .single();
+    if (error) {
+        // Catch cycle detection error from DB trigger and re-throw with user-friendly message
+        if (error.message.includes('cycle') || error.message.includes('circular')) {
+            throw new Error(`Cannot create dependency: this would create a circular dependency chain. "${fromNodeId}" already depends (directly or indirectly) on "${toNodeId}".`);
+        }
+        throw new Error(error.message);
+    }
+    return dbDepToNodeDep(data);
+}
+export async function deleteDependency(id) {
+    const { error } = await supabase
+        .from('node_dependencies')
+        .delete()
+        .eq('id', id);
+    if (error)
+        throw new Error(error.message);
+}
+export async function listDependencies(nodeIds) {
+    const { data, error } = await supabase
+        .from('node_dependencies')
+        .select('*')
+        .or(`from_node_id.in.(${nodeIds.join(',')}),to_node_id.in.(${nodeIds.join(',')})`);
+    if (error)
+        throw new Error(error.message);
+    return (data || []).map(dbDepToNodeDep);
+}
+export async function getBlockedNodes(projectId) {
+    // Get all nodes for the project
+    const tree = await getTree(projectId);
+    if (tree.length === 0)
+        return [];
+    // Collect all node IDs and build a status map
+    const nodeMap = new Map();
+    function walkTree(nodes) {
+        for (const node of nodes) {
+            nodeMap.set(node.id, { id: node.id, status: node.status });
+            walkTree(node.children);
+        }
+    }
+    walkTree(tree);
+    const allNodeIds = Array.from(nodeMap.keys());
+    if (allNodeIds.length === 0)
+        return [];
+    // Get all dependencies for these nodes
+    const deps = await listDependencies(allNodeIds);
+    // Find nodes where from_node status !== 'done'
+    const blockedMap = new Map();
+    for (const dep of deps) {
+        const fromNode = nodeMap.get(dep.fromNodeId);
+        if (fromNode && fromNode.status !== 'done') {
+            const existing = blockedMap.get(dep.toNodeId) || [];
+            existing.push(dep.fromNodeId);
+            blockedMap.set(dep.toNodeId, existing);
+        }
+    }
+    return Array.from(blockedMap.entries()).map(([nodeId, blockedBy]) => ({
+        nodeId,
+        blockedBy,
+    }));
+}
+export async function computeProjectProgress(projectId) {
+    const tree = await getTree(projectId);
+    if (tree.length === 0)
+        return { overall: 0, breakdown: [] };
+    const root = tree[0];
+    // Count leaves for weighting
+    function countLeaves(node) {
+        if (node.children.length === 0)
+            return 1;
+        return node.children.reduce((sum, child) => sum + countLeaves(child), 0);
+    }
+    // Compute weighted progress recursively
+    function weightedProgress(node) {
+        if (node.children.length === 0)
+            return node.progress;
+        let totalWeight = 0;
+        let weightedSum = 0;
+        for (const child of node.children) {
+            const weight = countLeaves(child);
+            const childProgress = weightedProgress(child);
+            weightedSum += childProgress * weight;
+            totalWeight += weight;
+        }
+        return totalWeight === 0 ? 0 : Math.round(weightedSum / totalWeight);
+    }
+    const breakdown = root.children.map(child => ({
+        id: child.id,
+        title: child.title,
+        type: child.type,
+        progress: weightedProgress(child),
+        weight: countLeaves(child),
+    }));
+    const overall = weightedProgress(root);
+    return { overall, breakdown };
+}
+export async function computeCriticalPath(projectId) {
+    // Get all nodes for the project
+    const tree = await getTree(projectId);
+    if (tree.length === 0)
+        return [];
+    // Collect all node IDs
+    const allNodeIds = [];
+    function walkTree(nodes) {
+        for (const node of nodes) {
+            allNodeIds.push(node.id);
+            walkTree(node.children);
+        }
+    }
+    walkTree(tree);
+    if (allNodeIds.length === 0)
+        return [];
+    // Get all dependencies
+    const deps = await listDependencies(allNodeIds);
+    if (deps.length === 0)
+        return [];
+    // Kahn's topological sort + longest path relaxation
+    const allNodes = new Set();
+    const adjList = new Map();
+    const inDegree = new Map();
+    for (const dep of deps) {
+        allNodes.add(dep.fromNodeId);
+        allNodes.add(dep.toNodeId);
+    }
+    for (const nodeId of allNodes) {
+        adjList.set(nodeId, []);
+        inDegree.set(nodeId, 0);
+    }
+    for (const dep of deps) {
+        adjList.get(dep.fromNodeId).push(dep.toNodeId);
+        inDegree.set(dep.toNodeId, (inDegree.get(dep.toNodeId) || 0) + 1);
+    }
+    const dist = new Map();
+    const prev = new Map();
+    const queue = [];
+    for (const nodeId of allNodes) {
+        dist.set(nodeId, 0);
+        prev.set(nodeId, null);
+        if (inDegree.get(nodeId) === 0) {
+            queue.push(nodeId);
+        }
+    }
+    while (queue.length > 0) {
+        const current = queue.shift();
+        const currentDist = dist.get(current);
+        for (const neighbor of adjList.get(current)) {
+            const newDist = currentDist + 1;
+            if (newDist > dist.get(neighbor)) {
+                dist.set(neighbor, newDist);
+                prev.set(neighbor, current);
+            }
+            inDegree.set(neighbor, inDegree.get(neighbor) - 1);
+            if (inDegree.get(neighbor) === 0) {
+                queue.push(neighbor);
+            }
+        }
+    }
+    // Find the node with max distance (end of critical path)
+    let maxDist = -1;
+    let endNode = '';
+    for (const [nodeId, d] of dist) {
+        if (d > maxDist) {
+            maxDist = d;
+            endNode = nodeId;
+        }
+    }
+    if (maxDist <= 0)
+        return [];
+    // Trace back from endNode to start
+    const path = [];
+    let current = endNode;
+    while (current !== null) {
+        path.unshift(current);
+        current = prev.get(current) ?? null;
+    }
+    return path;
+}

package/dist/index.js

@@ -10,7 +10,7 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { z } from 'zod';
 import { authenticate, supabase } from './supabase.js';
-import { getTree, getNode, insertNode, updateNode, deleteNode, moveNode, searchNodes, getWorkMode, addToWorkMode, removeFromWorkMode } from './db.js';
+import { getTree, getNode, insertNode, updateNode, deleteNode, moveNode, searchNodes, getWorkMode, addToWorkMode, removeFromWorkMode, insertDependency, deleteDependency, listDependencies, getBlockedNodes, computeProjectProgress, computeCriticalPath, } from './db.js';
 const server = new McpServer({
     name: 'slyplan',
     version: '1.0.0',
@@ -213,6 +213,163 @@ server.tool('whoami', 'Show which user is authenticated for this MCP session.',
         content: [{ type: 'text', text: `Authenticated as: ${user.email} (${user.id})` }],
     };
 });
+// --- Dependency Tools ---
+server.tool('add_dependency', 'Create a dependency. from_node blocks to_node (from_node must complete before to_node can start). Only use for REAL hard dependencies where work genuinely cannot start without the prerequisite. Do NOT create soft/nice-to-have dependencies.', {
+    from_node_id: z.string().describe('Node ID that must complete first (the blocker)'),
+    to_node_id: z.string().describe('Node ID that depends on from_node (the blocked)'),
+}, async ({ from_node_id, to_node_id }) => {
+    try {
+        const dep = await insertDependency(from_node_id, to_node_id);
+        const fromNode = await getNode(from_node_id);
+        const toNode = await getNode(to_node_id);
+        const fromTitle = fromNode ? `"${fromNode.title}"` : from_node_id;
+        const toTitle = toNode ? `"${toNode.title}"` : to_node_id;
+        return {
+            content: [{ type: 'text', text: `Dependency created: ${fromTitle} blocks ${toTitle}\n\nID: ${dep.id}` }],
+        };
+    }
+    catch (e) {
+        return { content: [{ type: 'text', text: `Error: ${e.message}` }], isError: true };
+    }
+});
+server.tool('remove_dependency', 'Remove a dependency between two nodes', {
+    dependency_id: z.string().describe('Dependency ID to remove. Get from list_dependencies.'),
+}, async ({ dependency_id }) => {
+    try {
+        await deleteDependency(dependency_id);
+        return { content: [{ type: 'text', text: `Dependency ${dependency_id} removed.` }] };
+    }
+    catch (e) {
+        return { content: [{ type: 'text', text: `Error: ${e.message}` }], isError: true };
+    }
+});
+server.tool('list_dependencies', 'List all dependencies for the active project or specific nodes', {
+    node_ids: z.array(z.string()).optional().describe('Specific node IDs to list dependencies for. Omit for all nodes in active project.'),
+}, async ({ node_ids }) => {
+    try {
+        let ids = node_ids;
+        if (!ids || ids.length === 0) {
+            if (!activeProjectId) {
+                return { content: [{ type: 'text', text: 'No active project set. Use set_project first, or provide node_ids.' }], isError: true };
+            }
+            // Get all node IDs in the active project
+            const tree = await getTree(activeProjectId);
+            const allIds = [];
+            function walkTree(nodes) {
+                for (const node of nodes) {
+                    allIds.push(node.id);
+                    if (node.children)
+                        walkTree(node.children);
+                }
+            }
+            walkTree(tree);
+            ids = allIds;
+        }
+        if (ids.length === 0)
+            return { content: [{ type: 'text', text: 'No nodes found.' }] };
+        const deps = await listDependencies(ids);
+        if (deps.length === 0)
+            return { content: [{ type: 'text', text: 'No dependencies found.' }] };
+        // Fetch node titles for readable output
+        const nodeCache = new Map();
+        for (const dep of deps) {
+            for (const nid of [dep.fromNodeId, dep.toNodeId]) {
+                if (!nodeCache.has(nid)) {
+                    const node = await getNode(nid);
+                    nodeCache.set(nid, node ? node.title : nid);
+                }
+            }
+        }
+        const lines = deps.map(dep => {
+            const fromTitle = nodeCache.get(dep.fromNodeId) || dep.fromNodeId;
+            const toTitle = nodeCache.get(dep.toNodeId) || dep.toNodeId;
+            return `• "${fromTitle}" blocks "${toTitle}" [${dep.id}]`;
+        });
+        return {
+            content: [{ type: 'text', text: `Dependencies (${deps.length}):\n${lines.join('\n')}` }],
+        };
+    }
+    catch (e) {
+        return { content: [{ type: 'text', text: `Error: ${e.message}` }], isError: true };
+    }
+});
+server.tool('get_blocked', 'Get all currently blocked nodes in the active project (nodes with unmet dependencies)', {}, async () => {
+    try {
+        if (!activeProjectId) {
+            return { content: [{ type: 'text', text: 'No active project set. Use set_project first.' }], isError: true };
+        }
+        const blocked = await getBlockedNodes(activeProjectId);
+        if (blocked.length === 0) {
+            return { content: [{ type: 'text', text: 'No blocked nodes. All dependencies are met.' }] };
+        }
+        // Fetch node titles
+        const nodeCache = new Map();
+        for (const item of blocked) {
+            for (const nid of [item.nodeId, ...item.blockedBy]) {
+                if (!nodeCache.has(nid)) {
+                    const node = await getNode(nid);
+                    nodeCache.set(nid, node ? node.title : nid);
+                }
+            }
+        }
+        const lines = blocked.map(item => {
+            const nodeName = nodeCache.get(item.nodeId) || item.nodeId;
+            const blockerNames = item.blockedBy.map(b => `"${nodeCache.get(b) || b}"`).join(', ');
+            return `• "${nodeName}" is blocked by ${blockerNames}`;
+        });
+        return {
+            content: [{ type: 'text', text: `Blocked nodes (${blocked.length}):\n${lines.join('\n')}` }],
+        };
+    }
+    catch (e) {
+        return { content: [{ type: 'text', text: `Error: ${e.message}` }], isError: true };
+    }
+});
+server.tool('get_progress', 'Get weighted project completion percentage and breakdown by phase/category', {
+    project_id: z.string().optional().describe('Project ID. Omit for active project.'),
+}, async ({ project_id }) => {
+    try {
+        const pid = project_id || activeProjectId;
+        if (!pid) {
+            return { content: [{ type: 'text', text: 'No project specified and no active project set.' }], isError: true };
+        }
+        const result = await computeProjectProgress(pid);
+        const breakdownLines = result.breakdown.map(item => `• ${item.title} (${item.type}): ${item.progress}% (weight: ${item.weight})`);
+        return {
+            content: [{ type: 'text', text: `Overall: ${result.overall}%\n\nBreakdown:\n${breakdownLines.join('\n') || '(no children)'}` }],
+        };
+    }
+    catch (e) {
+        return { content: [{ type: 'text', text: `Error: ${e.message}` }], isError: true };
+    }
+});
+server.tool('critical_path', 'Get the critical dependency chain (longest path to project completion)', {
+    project_id: z.string().optional().describe('Project ID. Omit for active project.'),
+}, async ({ project_id }) => {
+    try {
+        const pid = project_id || activeProjectId;
+        if (!pid) {
+            return { content: [{ type: 'text', text: 'No project specified and no active project set.' }], isError: true };
+        }
+        const path = await computeCriticalPath(pid);
+        if (path.length === 0) {
+            return { content: [{ type: 'text', text: 'No critical path found. The project has no dependencies or all dependencies are isolated.' }] };
+        }
+        // Fetch node titles
+        const titles = [];
+        for (const nodeId of path) {
+            const node = await getNode(nodeId);
+            titles.push(node ? node.title : nodeId);
+        }
+        const steps = titles.map((title, i) => `${i + 1}. ${title}`).join(' → ');
+        return {
+            content: [{ type: 'text', text: `Critical path (${path.length} steps):\n${steps}` }],
+        };
+    }
+    catch (e) {
+        return { content: [{ type: 'text', text: `Error: ${e.message}` }], isError: true };
+    }
+});
 // --- Start ---
 async function main() {
     await authenticate();

package/dist/supabase.js

@@ -1,24 +1,75 @@
 import { createClient } from '@supabase/supabase-js';
+import * as fs from 'fs';
+import * as path from 'path';
 const SUPABASE_URL = 'https://omfzpkwtuzucwwxmyuqt.supabase.co';
 const SUPABASE_ANON_KEY = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Im9tZnpwa3d0dXp1Y3d3eG15dXF0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzA5MjMwNDIsImV4cCI6MjA4NjQ5OTA0Mn0.KXGoUez7M45RtFM9qR7mjzGX6UhlaRE-gggAJxSkIHY';
 export const supabase = createClient(SUPABASE_URL, SUPABASE_ANON_KEY, {
     auth: { autoRefreshToken: true, persistSession: false },
 });
 let userId = null;
+function findSettingsPath() {
+    // Walk up from cwd looking for .claude/settings.json
+    let dir = process.cwd();
+    while (true) {
+        const candidate = path.join(dir, '.claude', 'settings.json');
+        if (fs.existsSync(candidate))
+            return candidate;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return null;
+}
+function persistNewRefreshToken(newToken) {
+    try {
+        const settingsPath = findSettingsPath();
+        if (!settingsPath)
+            return;
+        const raw = fs.readFileSync(settingsPath, 'utf8');
+        const settings = JSON.parse(raw);
+        const env = settings?.mcpServers?.slyplan?.env;
+        if (!env)
+            return;
+        env.SLYPLAN_REFRESH_TOKEN = newToken;
+        fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf8');
+    }
+    catch {
+        // Silent — token rotation is best-effort
+    }
+}
 export async function authenticate() {
+    const refreshToken = process.env.SLYPLAN_REFRESH_TOKEN;
     const email = process.env.SLYPLAN_EMAIL;
     const password = process.env.SLYPLAN_PASSWORD;
-    if (!email || !password) {
-        console.error('Missing SLYPLAN_EMAIL or SLYPLAN_PASSWORD environment variables.');
-        console.error('Set them in your Claude MCP config under "env".');
-        process.exit(1);
+    // Prefer refresh token (browser auth flow)
+    if (refreshToken) {
+        const { data, error } = await supabase.auth.refreshSession({ refresh_token: refreshToken });
+        if (error) {
+            console.error(`Token refresh failed: ${error.message}`);
+            console.error('Re-run "npx slyplan-mcp setup" to re-authorize.');
+            process.exit(1);
+        }
+        userId = data.user.id;
+        // Persist rotated token for next startup
+        if (data.session?.refresh_token && data.session.refresh_token !== refreshToken) {
+            persistNewRefreshToken(data.session.refresh_token);
+        }
+        return;
     }
-    const { data, error } = await supabase.auth.signInWithPassword({ email, password });
-    if (error) {
-        console.error(`Authentication failed: ${error.message}`);
-        process.exit(1);
+    // Legacy fallback: email + password
+    if (email && password) {
+        const { data, error } = await supabase.auth.signInWithPassword({ email, password });
+        if (error) {
+            console.error(`Authentication failed: ${error.message}`);
+            process.exit(1);
+        }
+        userId = data.user.id;
+        return;
     }
-    userId = data.user.id;
+    console.error('Missing SLYPLAN_REFRESH_TOKEN (or legacy SLYPLAN_EMAIL + SLYPLAN_PASSWORD).');
+    console.error('Run "npx slyplan-mcp setup" to authorize.');
+    process.exit(1);
 }
 export function getUserId() {
     if (!userId)

package/dist/types.d.ts

@@ -24,3 +24,11 @@ export interface Link {
     linkType: string;
     createdAt: string;
 }
+export interface NodeDependency {
+    id: string;
+    fromNodeId: string;
+    toNodeId: string;
+    dependencyType: string;
+    createdBy: string | null;
+    createdAt: string;
+}

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "slyplan-mcp",
-  "version": "1.2.2",
+  "version": "1.4.0",
   "description": "MCP server for Slyplan — visual project management via Claude",
   "type": "module",
   "bin": {
-    "slyplan-mcp": "./dist/index.js"
+    "slyplan-mcp": "dist/index.js"
   },
   "files": [
     "dist"