sp-rag 0.6.15 → 0.6.16

package/README.md

@@ -32,9 +32,10 @@ CLI để setup nhanh SP-RAG theo hướng dev-friendly:
 
 ## Trạng thái package
 
-- package npm public: `sp-rag`
-- version đang publish: `0.6.15`
-- binary public: `sp-rag`
+- package npm public: `sp-rag`
+- version trong repo: `0.6.16`
+- npm latest hiện tại: `0.6.15`
+- binary public: `sp-rag`
 
 ## Cài từ source trong monorepo
 
@@ -289,10 +290,11 @@ sp-rag uninstall --client codex
 
 - ping các endpoint `api`, `mcp`, `codegraph`
 - đọc đúng file MCP của client để kiểm:
-  - IDE đang nhìn vào file nào
-  - server entry nào được match theo alias hoặc theo endpoint
-  - `Authorization` đang là token literal, env var hợp lệ, hay đang thiếu
-  - khả năng IDE sẽ bật link đăng nhập OAuth
+  - IDE đang nhìn vào file nào
+  - server entry nào được match theo alias hoặc theo endpoint
+  - `Authorization` đang là token literal, env var hợp lệ, hay đang thiếu
+  - riêng Codex, xác nhận `bearer_token_env_var`/`http_headers` thay vì legacy `[mcp_servers.<alias>.headers]`
+  - khả năng IDE sẽ bật link đăng nhập OAuth
 
 Ví dụ:
 
@@ -361,6 +363,10 @@ Day JSON signal do `sp-audit` tao ra vao server memory import path:
 sp-rag audit signal --file ./sp-audit-signal.json
 ```
 
+`audit signal` posts through the existing knowledge-source import API with
+`normalizer_provider=heuristic` and `warm_cache=false`, so small audit feedback
+records do not block on AI normalization or semantic-cache materialization.
+
 Native paths cua audit workflow:
 
 - Codex: `~/.codex/skills/sp-audit/SKILL.md`

package/dist/cli.js

@@ -655,6 +655,8 @@ async function runAuditSignal(parsed) {
         content_type: 'application/json',
         title_hint: titleHint,
         provider: optionString(parsed, 'provider') ?? 'builtin',
+        normalizer_provider: 'heuristic',
+        warm_cache: 'false',
     });
     const result = await fetchJson(`${defaults.baseUrl.replace(/\/+$/, '')}/api/v1/import/knowledge-source/file?${params.toString()}`, {
         method: 'POST',

package/dist/lib/doctor.js

@@ -62,7 +62,16 @@ function parseTomlEntries(raw) {
         const headersMatch = line.match(/^\[mcp_servers\.(?:"([^"]+)"|([^\].]+))\.headers\]$/);
         if (headersMatch) {
             currentAlias = headersMatch[1] || headersMatch[2];
-            currentSection = 'headers';
+            currentSection = 'legacy_headers';
+            if (!entries.has(currentAlias)) {
+                entries.set(currentAlias, { alias: currentAlias });
+            }
+            continue;
+        }
+        const httpHeadersMatch = line.match(/^\[mcp_servers\.(?:"([^"]+)"|([^\].]+))\.http_headers\]$/);
+        if (httpHeadersMatch) {
+            currentAlias = httpHeadersMatch[1] || httpHeadersMatch[2];
+            currentSection = 'http_headers';
             if (!entries.has(currentAlias)) {
                 entries.set(currentAlias, { alias: currentAlias });
             }
@@ -89,12 +98,21 @@ function parseTomlEntries(raw) {
         if (currentSection === 'server' && key === 'url') {
             entry.endpoint = normalizeEndpoint(value);
         }
-        if (currentSection === 'headers') {
+        if (currentSection === 'server' && key === 'bearer_token_env_var') {
+            entry.bearerTokenEnvVar = value;
+        }
+        if (currentSection === 'http_headers') {
             entry.headers = {
                 ...(entry.headers ?? {}),
                 [key]: value,
             };
         }
+        if (currentSection === 'legacy_headers') {
+            entry.legacyHeaders = {
+                ...(entry.legacyHeaders ?? {}),
+                [key]: value,
+            };
+        }
         entries.set(currentAlias, entry);
     }
     return [...entries.values()];
@@ -186,6 +204,12 @@ function analyzeAuthorization(headerValue) {
         likelyOAuthLogin: true,
     };
 }
+function analyzeEntryAuthorization(entry) {
+    if (entry.bearerTokenEnvVar?.trim()) {
+        return analyzeAuthorization(`Bearer \${${entry.bearerTokenEnvVar.trim()}}`);
+    }
+    return analyzeAuthorization(entry.headers?.Authorization ?? entry.headers?.authorization);
+}
 function entriesForClient(raw, client) {
     if (client === 'codex') {
         return parseTomlEntries(raw);
@@ -233,8 +257,11 @@ export async function diagnoseMcpConfig(options) {
             ],
         };
     }
-    const authorization = analyzeAuthorization(entry.headers?.Authorization ?? entry.headers?.authorization);
+    const authorization = analyzeEntryAuthorization(entry);
     const issues = [...baseResult.issues];
+    if (options.client === 'codex' && entry.legacyHeaders) {
+        issues.push('Codex config đang dùng legacy [mcp_servers.<alias>.headers]. Streamable HTTP MCP cần http_headers, env_http_headers hoặc bearer_token_env_var; legacy headers có thể không expose tools.');
+    }
     if (authorization.authorizationState === 'missing') {
         issues.push('Thiếu Authorization header. IDE rất dễ rơi sang luồng đăng nhập OAuth.');
     }

package/dist/lib/mcp-config.js

@@ -134,28 +134,38 @@ export function upsertCodexConfig(existing, options) {
     const aliasPattern = escapeRegex(alias);
     const cleaned = existing
         .replace(new RegExp(`(?:^|\\n)\\[mcp_servers\\.(?:"${aliasPattern}"|${aliasPattern})\\.headers\\][\\s\\S]*?(?=(?:\\n\\[[^\\n]+\\])|$)`, 'g'), '')
+        .replace(new RegExp(`(?:^|\\n)\\[mcp_servers\\.(?:"${aliasPattern}"|${aliasPattern})\\.http_headers\\][\\s\\S]*?(?=(?:\\n\\[[^\\n]+\\])|$)`, 'g'), '')
         .replace(new RegExp(`(?:^|\\n)\\[mcp_servers\\.(?:"${aliasPattern}"|${aliasPattern})\\][\\s\\S]*?(?=(?:\\n\\[[^\\n]+\\])|$)`, 'g'), '')
         .trimEnd();
     const lines = [
         `[mcp_servers.${quotedTomlKey(alias)}]`,
         `url = "${options.url}"`,
     ];
-    const headers = bearerHeader(options.authToken, options.authEnvVar, 'shell');
-    if (headers?.Authorization) {
-        lines.push('', `[mcp_servers.${quotedTomlKey(alias)}.headers]`);
-        lines.push(`Authorization = "${headers.Authorization.replace(/"/g, '\\"')}"`);
+    const literalHeaders = bearerHeader(options.authToken, undefined, 'shell');
+    if (literalHeaders?.Authorization) {
+        lines.push('', `[mcp_servers.${quotedTomlKey(alias)}.http_headers]`);
+        lines.push(`Authorization = "${literalHeaders.Authorization.replace(/"/g, '\\"')}"`);
+    }
+    else if (options.authEnvVar?.trim()) {
+        lines.push(`bearer_token_env_var = "${options.authEnvVar.trim().replace(/"/g, '\\"')}"`);
     }
     return `${cleaned ? `${cleaned}\n\n` : ''}${lines.join('\n')}\n`;
 }
-export function removeCodexConfigContent(existing, serverAlias) {
-    const alias = serverAlias.trim();
-    const aliasPattern = escapeRegex(alias);
+function removeCodexSubtable(existing, aliasPattern, subtable) {
     let removed = false;
-    const withoutHeaders = existing.replace(new RegExp(`(?:^|\\n)\\[mcp_servers\\.(?:"${aliasPattern}"|${aliasPattern})\\.headers\\][\\s\\S]*?(?=(?:\\n\\[[^\\n]+\\])|$)`, 'g'), () => {
+    const content = existing.replace(new RegExp(`(?:^|\\n)\\[mcp_servers\\.(?:"${aliasPattern}"|${aliasPattern})\\.${subtable}\\][\\s\\S]*?(?=(?:\\n\\[[^\\n]+\\])|$)`, 'g'), () => {
         removed = true;
         return '';
     });
-    const cleaned = withoutHeaders.replace(new RegExp(`(?:^|\\n)\\[mcp_servers\\.(?:"${aliasPattern}"|${aliasPattern})\\][\\s\\S]*?(?=(?:\\n\\[[^\\n]+\\])|$)`, 'g'), () => {
+    return { content, removed };
+}
+export function removeCodexConfigContent(existing, serverAlias) {
+    const alias = serverAlias.trim();
+    const aliasPattern = escapeRegex(alias);
+    const withoutLegacyHeaders = removeCodexSubtable(existing, aliasPattern, 'headers');
+    const withoutHttpHeaders = removeCodexSubtable(withoutLegacyHeaders.content, aliasPattern, 'http_headers');
+    let removed = withoutLegacyHeaders.removed || withoutHttpHeaders.removed;
+    const cleaned = withoutHttpHeaders.content.replace(new RegExp(`(?:^|\\n)\\[mcp_servers\\.(?:"${aliasPattern}"|${aliasPattern})\\][\\s\\S]*?(?=(?:\\n\\[[^\\n]+\\])|$)`, 'g'), () => {
         removed = true;
         return '';
     });

package/dist/lib/skill.js

@@ -139,6 +139,7 @@ Docs URL: \`${context.docsUrl}\`
 
 ${seoBoosterProjectGuard}
 ${seoBoosterReportGuard}
+- Codex streamable HTTP MCP config must use \`http_headers\`, \`env_http_headers\`, or \`bearer_token_env_var\`; \`[mcp_servers.<alias>.headers]\` is legacy-invalid and will not expose tools.
 - Find root cause before fixing bugs.
 - Use evidence before conclusions; do not claim completion without verification.
 - For behavior changes, write or update tests before implementation when feasible.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sp-rag",
-  "version": "0.6.15",
+  "version": "0.6.16",
   "description": "CLI cho setup MCP, codegraph GitNexus và skill của SP-RAG",
   "type": "module",
   "files": [