slyplan-mcp 1.4.1 → 1.5.0

package/dist/cli.js

@@ -3,11 +3,11 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as http from 'http';
 import * as readline from 'readline';
-import { createClient } from '@supabase/supabase-js';
 import { exec } from 'child_process';
+import { createClient } from '@supabase/supabase-js';
 const SUPABASE_URL = 'https://omfzpkwtuzucwwxmyuqt.supabase.co';
 const SUPABASE_ANON_KEY = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Im9tZnpwa3d0dXp1Y3d3eG15dXF0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzA5MjMwNDIsImV4cCI6MjA4NjQ5OTA0Mn0.KXGoUez7M45RtFM9qR7mjzGX6UhlaRE-gggAJxSkIHY';
-const SLYPLAN_URL = 'https://slyplan.com';
+const SLYPLAN_ORIGIN = 'https://slyplan.com';
 // Smart transcript-aware hook: checks if set_project + add_to_work_mode have been called.
 // Silent when OK, reminds only when needed.
 const PRE_HOOK_FILE_CONTENT = `#!/usr/bin/env node
@@ -218,136 +218,66 @@ You MUST keep SlyPlan updated. This is not optional. Follow these rules:
 function log(msg) {
     process.stderr.write(msg + '\n');
 }
-function promptUser(question, hidden = false) {
+function promptUser(question) {
     return new Promise((resolve) => {
-        if (hidden && process.stdin.isTTY) {
-            // Password masking via raw mode
-            process.stderr.write(question);
-            const stdin = process.stdin;
-            stdin.setRawMode(true);
-            stdin.resume();
-            stdin.setEncoding('utf8');
-            let password = '';
-            const onData = (ch) => {
-                const c = ch.toString();
-                if (c === '\n' || c === '\r' || c === '\u0004') {
-                    stdin.setRawMode(false);
-                    stdin.pause();
-                    stdin.removeListener('data', onData);
-                    process.stderr.write('\n');
-                    resolve(password);
-                }
-                else if (c === '\u0003') {
-                    // Ctrl+C
-                    stdin.setRawMode(false);
-                    process.exit(1);
-                }
-                else if (c === '\u007f' || c === '\b') {
-                    // Backspace
-                    if (password.length > 0) {
-                        password = password.slice(0, -1);
-                        process.stderr.write('\b \b');
-                    }
-                }
-                else {
-                    password += c;
-                    process.stderr.write('*');
-                }
-            };
-            stdin.on('data', onData);
-        }
-        else {
-            // Non-TTY or visible input
-            const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
-            rl.question(question, (answer) => {
-                rl.close();
-                resolve(answer.trim());
-            });
-        }
-    });
-}
-async function validateCredentials(email, password) {
-    const client = createClient(SUPABASE_URL, SUPABASE_ANON_KEY, {
-        auth: { autoRefreshToken: false, persistSession: false },
+        const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+        rl.question(question, (answer) => {
+            rl.close();
+            resolve(answer.trim());
+        });
     });
-    const { data, error } = await client.auth.signInWithPassword({ email, password });
-    if (error)
-        return { ok: false, error: error.message };
-    return { ok: true, userEmail: data.user?.email ?? email, refreshToken: data.session?.refresh_token };
-}
-function readJsonFile(filePath) {
-    try {
-        const content = fs.readFileSync(filePath, 'utf8');
-        return JSON.parse(content);
-    }
-    catch {
-        return null;
-    }
-}
-function writeJsonFile(filePath, data) {
-    fs.mkdirSync(path.dirname(filePath), { recursive: true });
-    fs.writeFileSync(filePath, JSON.stringify(data, null, 2) + '\n', 'utf8');
 }
-// --- Browser Auth ---
 function openBrowser(url) {
     const platform = process.platform;
-    const cmd = platform === 'win32' ? 'start ""'
-        : platform === 'darwin' ? 'open'
-            : 'xdg-open';
-    exec(`${cmd} "${url}"`);
+    const cmd = platform === 'win32' ? `start "" "${url}"`
+        : platform === 'darwin' ? `open "${url}"`
+            : `xdg-open "${url}"`;
+    exec(cmd, () => {
+        // Ignore errors — user can always open manually
+    });
 }
 const SUCCESS_HTML = `<!DOCTYPE html>
-<html lang="en">
-<head><meta charset="utf-8"><title>SlyPlan - Authorized</title>
+<html>
+<head><title>SlyPlan — Authorized</title>
 <style>
-  body { margin: 0; min-height: 100vh; display: flex; align-items: center; justify-content: center;
-         background: #09090b; color: #f4f4f5; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; }
-  .card { text-align: center; padding: 3rem; }
-  .check { width: 64px; height: 64px; margin: 0 auto 1.5rem; color: #22c55e; }
-  h1 { font-size: 1.5rem; margin: 0 0 0.5rem; }
-  p { color: #a1a1aa; font-size: 0.875rem; margin: 0; }
-</style>
-</head>
-<body>
-<div class="card">
-  <svg class="check" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
-    <path stroke-linecap="round" stroke-linejoin="round" d="M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z"/>
-  </svg>
+  body { background: #09090b; color: #e4e4e7; font-family: system-ui, sans-serif;
+         display: flex; align-items: center; justify-content: center; min-height: 100vh; margin: 0; }
+  .card { text-align: center; padding: 3rem; border-radius: 12px;
+          background: #18181b; border: 1px solid #27272a; max-width: 360px; }
+  .check { color: #22c55e; font-size: 3rem; margin-bottom: 1rem; }
+  h1 { font-size: 1.25rem; margin: 0 0 0.5rem; }
+  p { color: #71717a; font-size: 0.875rem; margin: 0; }
+</style></head>
+<body><div class="card">
+  <div class="check">&#10003;</div>
   <h1>Authorized!</h1>
   <p>You can close this tab and return to your terminal.</p>
-</div>
-</body>
-</html>`;
+</div></body></html>`;
 const ERROR_HTML = (msg) => `<!DOCTYPE html>
-<html lang="en">
-<head><meta charset="utf-8"><title>SlyPlan - Error</title>
+<html>
+<head><title>SlyPlan — Error</title>
 <style>
-  body { margin: 0; min-height: 100vh; display: flex; align-items: center; justify-content: center;
-         background: #09090b; color: #f4f4f5; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; }
-  .card { text-align: center; padding: 3rem; }
-  .icon { width: 64px; height: 64px; margin: 0 auto 1.5rem; color: #ef4444; }
-  h1 { font-size: 1.5rem; margin: 0 0 0.5rem; }
-  p { color: #a1a1aa; font-size: 0.875rem; margin: 0; }
-</style>
-</head>
-<body>
-<div class="card">
-  <svg class="icon" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
-    <path stroke-linecap="round" stroke-linejoin="round" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-2.5L13.732 4c-.77-.833-1.964-.833-2.732 0L4.082 16.5c-.77.833.192 2.5 1.732 2.5z"/>
-  </svg>
+  body { background: #09090b; color: #e4e4e7; font-family: system-ui, sans-serif;
+         display: flex; align-items: center; justify-content: center; min-height: 100vh; margin: 0; }
+  .card { text-align: center; padding: 3rem; border-radius: 12px;
+          background: #18181b; border: 1px solid #27272a; max-width: 360px; }
+  .icon { color: #ef4444; font-size: 3rem; margin-bottom: 1rem; }
+  h1 { font-size: 1.25rem; margin: 0 0 0.5rem; }
+  p { color: #71717a; font-size: 0.875rem; margin: 0; }
+</style></head>
+<body><div class="card">
+  <div class="icon">&#10007;</div>
   <h1>Authorization Failed</h1>
   <p>${msg}</p>
-</div>
-</body>
-</html>`;
+</div></body></html>`;
 function startLocalAuthServer() {
     return new Promise((resolve, reject) => {
         const server = http.createServer((req, res) => {
             const url = new URL(req.url ?? '/', `http://localhost`);
             if (url.pathname === '/callback') {
                 const refreshToken = url.searchParams.get('refresh_token');
-                const email = url.searchParams.get('email') ?? '';
-                if (refreshToken) {
+                const email = url.searchParams.get('email');
+                if (refreshToken && email) {
                     res.writeHead(200, { 'Content-Type': 'text/html' });
                     res.end(SUCCESS_HTML);
                     server.close();
@@ -355,45 +285,67 @@ function startLocalAuthServer() {
                 }
                 else {
                     res.writeHead(400, { 'Content-Type': 'text/html' });
-                    res.end(ERROR_HTML('Missing refresh token in callback.'));
+                    res.end(ERROR_HTML('Missing token or email in callback.'));
                     server.close();
-                    reject(new Error('Missing refresh token in callback'));
+                    reject(new Error('Missing token or email in callback'));
                 }
             }
             else {
-                res.writeHead(404, { 'Content-Type': 'text/plain' });
-                res.end('Not found');
+                res.writeHead(404);
+                res.end();
             }
         });
-        // Listen on random port
         server.listen(0, '127.0.0.1', () => {
             const addr = server.address();
             if (!addr || typeof addr === 'string') {
-                reject(new Error('Failed to start local server'));
+                reject(new Error('Failed to get server address'));
                 return;
             }
             const port = addr.port;
             const callbackUrl = `http://localhost:${port}/callback`;
-            const authUrl = `${SLYPLAN_URL}/cli/auth?port=${port}&callback=${encodeURIComponent(callbackUrl)}`;
-            log(`  Opening browser...`);
-            log(`  If it doesn't open, visit:`);
-            log(`  ${authUrl}`);
+            const authUrl = `${SLYPLAN_ORIGIN}/cli/auth?port=${port}&callback=${encodeURIComponent(callbackUrl)}`;
+            log(`  Opening browser to authorize...`);
+            log(`  If it doesn't open, visit: ${authUrl}`);
             log('');
             openBrowser(authUrl);
         });
         // Timeout after 120 seconds
         setTimeout(() => {
             server.close();
-            reject(new Error('Authorization timed out after 120 seconds. Please try again.'));
+            reject(new Error('Authorization timed out (120s). Try again.'));
         }, 120000);
     });
 }
+async function validateCredentials(email, password) {
+    const client = createClient(SUPABASE_URL, SUPABASE_ANON_KEY, {
+        auth: { autoRefreshToken: false, persistSession: false },
+    });
+    const { data, error } = await client.auth.signInWithPassword({ email, password });
+    if (error)
+        return { ok: false, error: error.message };
+    return {
+        ok: true,
+        userEmail: data.user?.email ?? email,
+        refreshToken: data.session?.refresh_token,
+    };
+}
+function readJsonFile(filePath) {
+    try {
+        const content = fs.readFileSync(filePath, 'utf8');
+        return JSON.parse(content);
+    }
+    catch {
+        return null;
+    }
+}
+function writeJsonFile(filePath, data) {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, JSON.stringify(data, null, 2) + '\n', 'utf8');
+}
 // --- Settings Merge ---
-// MCP server + env go in settings.local.json (user-local, not committed)
-// Hooks go in settings.json (can be committed)
-function mergeLocalSettings(existing, refreshToken) {
+function mergeSettings(existing, refreshToken) {
     const result = { ...existing };
-    // MCP server config with credentials
+    // MCP server config
     if (!result.mcpServers)
         result.mcpServers = {};
     result.mcpServers.slyplan = {
@@ -403,10 +355,6 @@ function mergeLocalSettings(existing, refreshToken) {
             SLYPLAN_REFRESH_TOKEN: refreshToken,
         },
     };
-    return result;
-}
-function mergeSettings(existing) {
-    const result = { ...existing };
     // Hook config
     if (!result.hooks)
         result.hooks = {};
@@ -450,18 +398,9 @@ function mergeSettings(existing) {
     }
     return result;
 }
-function removeFromLocalSettings(existing) {
-    const result = { ...existing };
-    if (result.mcpServers) {
-        delete result.mcpServers.slyplan;
-        if (Object.keys(result.mcpServers).length === 0)
-            delete result.mcpServers;
-    }
-    return result;
-}
 function removeFromSettings(existing) {
     const result = { ...existing };
-    // Remove MCP server (legacy — was previously in settings.json)
+    // Remove MCP server
     if (result.mcpServers) {
         delete result.mcpServers.slyplan;
         if (Object.keys(result.mcpServers).length === 0)
@@ -488,7 +427,6 @@ async function runSetup() {
     const claudeDir = path.join(cwd, '.claude');
     const hooksDir = path.join(claudeDir, 'hooks');
     const settingsPath = path.join(claudeDir, 'settings.json');
-    const localSettingsPath = path.join(claudeDir, 'settings.local.json');
     const postHookFilePath = path.join(hooksDir, 'slyplan-post-tool-sync.cjs');
     const preHookFilePath = path.join(hooksDir, 'slyplan-pre-tool-sync.cjs');
     const claudeMdPath = path.join(cwd, 'CLAUDE.md');
@@ -497,7 +435,7 @@ async function runSetup() {
     log('  ==============================');
     log(`  Setting up in: ${cwd}`);
     log('');
-    // Parse flags
+    // Parse flags (--email + --password for CI/scripted use)
     const args = process.argv.slice(3);
     let flagEmail = '';
     let flagPassword = '';
@@ -510,7 +448,7 @@ async function runSetup() {
     let refreshToken = '';
     let userEmail = '';
     if (flagEmail && flagPassword) {
-        // CI/scripted mode: validate credentials and extract refresh token
+        // CI mode: validate credentials and extract refresh token
         process.stderr.write('  Validating credentials... ');
         const result = await validateCredentials(flagEmail, flagPassword);
         if (!result.ok) {
@@ -527,8 +465,6 @@ async function runSetup() {
     }
     else {
         // Interactive mode: browser-based auth
-        log('  Waiting for authorization in browser...');
-        log('');
         try {
             const result = await startLocalAuthServer();
             refreshToken = result.refreshToken;
@@ -536,7 +472,6 @@ async function runSetup() {
             log(`  Authorized as ${userEmail}`);
         }
         catch (err) {
-            log('');
             log(`  ${err.message}`);
             process.exit(1);
         }
@@ -548,18 +483,11 @@ async function runSetup() {
     log('  [+] Created .claude/hooks/slyplan-pre-tool-sync.cjs');
     fs.writeFileSync(postHookFilePath, POST_HOOK_FILE_CONTENT, 'utf8');
     log('  [+] Created .claude/hooks/slyplan-post-tool-sync.cjs');
-    // 2a. Merge settings.local.json (MCP server + credentials)
-    let existingLocal = {};
-    const rawLocal = readJsonFile(localSettingsPath);
-    if (rawLocal)
-        existingLocal = rawLocal;
-    const mergedLocal = mergeLocalSettings(existingLocal, refreshToken);
-    writeJsonFile(localSettingsPath, mergedLocal);
-    log('  [+] Updated .claude/settings.local.json (MCP server)');
-    // 2b. Merge settings.json (hooks — safe to commit)
+    // 2. Merge settings.json
     let existingSettings = {};
     const rawSettings = readJsonFile(settingsPath);
     if (rawSettings === null && fs.existsSync(settingsPath)) {
+        // File exists but is malformed
         const answer = await promptUser('  .claude/settings.json exists but is malformed. Overwrite? [y/N]: ');
         if (answer.toLowerCase() !== 'y') {
             log('  Aborting. Fix settings.json manually and re-run setup.');
@@ -569,9 +497,9 @@ async function runSetup() {
     else if (rawSettings) {
         existingSettings = rawSettings;
     }
-    const mergedSettings = mergeSettings(existingSettings);
+    const mergedSettings = mergeSettings(existingSettings, refreshToken);
     writeJsonFile(settingsPath, mergedSettings);
-    log('  [+] Updated .claude/settings.json (hooks)');
+    log('  [+] Updated .claude/settings.json');
     // 3. Optional CLAUDE.md append
     const appendAnswer = await promptUser('  Append SlyPlan sync instructions to CLAUDE.md? [Y/n]: ');
     if (appendAnswer.toLowerCase() !== 'n') {
@@ -608,7 +536,6 @@ async function runRemove() {
     const cwd = process.cwd();
     const claudeDir = path.join(cwd, '.claude');
     const settingsPath = path.join(claudeDir, 'settings.json');
-    const localSettingsPath = path.join(claudeDir, 'settings.local.json');
     const postHookFilePath = path.join(claudeDir, 'hooks', 'slyplan-post-tool-sync.cjs');
     const preHookFilePath = path.join(claudeDir, 'hooks', 'slyplan-pre-tool-sync.cjs');
     log('');
@@ -629,20 +556,7 @@ async function runRemove() {
             log(`  [=] .claude/hooks/${name} not found — skipped`);
         }
     }
-    // 2a. Clean settings.local.json (MCP server)
-    const existingLocal = readJsonFile(localSettingsPath);
-    if (existingLocal) {
-        const cleanedLocal = removeFromLocalSettings(existingLocal);
-        if (Object.keys(cleanedLocal).length === 0) {
-            fs.unlinkSync(localSettingsPath);
-            log('  [-] Deleted empty .claude/settings.local.json');
-        }
-        else {
-            writeJsonFile(localSettingsPath, cleanedLocal);
-            log('  [-] Removed SlyPlan from .claude/settings.local.json');
-        }
-    }
-    // 2b. Clean settings.json (hooks + legacy MCP server)
+    // 2. Clean settings.json
     const existing = readJsonFile(settingsPath);
     if (existing) {
         const cleaned = removeFromSettings(existing);

package/dist/supabase.js

@@ -7,54 +7,34 @@ export const supabase = createClient(SUPABASE_URL, SUPABASE_ANON_KEY, {
     auth: { autoRefreshToken: true, persistSession: false },
 });
 let userId = null;
-function findSettingsPath() {
-    // Walk up from cwd looking for .claude/settings.local.json (preferred) or settings.json
-    let dir = process.cwd();
-    while (true) {
-        const localCandidate = path.join(dir, '.claude', 'settings.local.json');
-        if (fs.existsSync(localCandidate))
-            return localCandidate;
-        const candidate = path.join(dir, '.claude', 'settings.json');
-        if (fs.existsSync(candidate))
-            return candidate;
-        const parent = path.dirname(dir);
-        if (parent === dir)
-            break;
-        dir = parent;
-    }
-    return null;
-}
 function persistNewRefreshToken(newToken) {
+    const settingsPath = path.join(process.cwd(), '.claude', 'settings.json');
     try {
-        const settingsPath = findSettingsPath();
-        if (!settingsPath)
-            return;
-        const raw = fs.readFileSync(settingsPath, 'utf8');
-        const settings = JSON.parse(raw);
-        const env = settings?.mcpServers?.slyplan?.env;
-        if (!env)
-            return;
-        env.SLYPLAN_REFRESH_TOKEN = newToken;
-        fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf8');
+        const content = fs.readFileSync(settingsPath, 'utf8');
+        const settings = JSON.parse(content);
+        if (settings?.mcpServers?.slyplan?.env) {
+            settings.mcpServers.slyplan.env.SLYPLAN_REFRESH_TOKEN = newToken;
+            fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf8');
+        }
     }
     catch {
-        // Silent — token rotation is best-effort
+        // Best-effort — don't crash if settings file is missing/malformed
     }
 }
 export async function authenticate() {
     const refreshToken = process.env.SLYPLAN_REFRESH_TOKEN;
     const email = process.env.SLYPLAN_EMAIL;
     const password = process.env.SLYPLAN_PASSWORD;
-    // Prefer refresh token (browser auth flow)
+    // Prefer refresh token (new browser-based flow)
     if (refreshToken) {
         const { data, error } = await supabase.auth.refreshSession({ refresh_token: refreshToken });
         if (error) {
             console.error(`Token refresh failed: ${error.message}`);
-            console.error('Re-run "npx slyplan-mcp setup" to re-authorize.');
+            console.error('Run "npx slyplan-mcp setup" to re-authenticate.');
             process.exit(1);
         }
         userId = data.user.id;
-        // Persist rotated token for next startup
+        // Self-healing: persist rotated token
         if (data.session?.refresh_token && data.session.refresh_token !== refreshToken) {
             persistNewRefreshToken(data.session.refresh_token);
         }
@@ -70,8 +50,8 @@ export async function authenticate() {
         userId = data.user.id;
         return;
     }
-    console.error('Missing SLYPLAN_REFRESH_TOKEN (or legacy SLYPLAN_EMAIL + SLYPLAN_PASSWORD).');
-    console.error('Run "npx slyplan-mcp setup" to authorize.');
+    console.error('Missing SLYPLAN_REFRESH_TOKEN (or SLYPLAN_EMAIL + SLYPLAN_PASSWORD).');
+    console.error('Run "npx slyplan-mcp setup" to configure authentication.');
     process.exit(1);
 }
 export function getUserId() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "slyplan-mcp",
-  "version": "1.4.1",
+  "version": "1.5.0",
   "description": "MCP server for Slyplan — visual project management via Claude",
   "type": "module",
   "bin": {