studiograph 1.3.48-next.26 → 1.3.48-next.261

package/dist/mcp/oauth-registry.js

@@ -1,19 +1,45 @@
 /**
  * OAuth Broker Registry
  *
- * Maps MCP server hostnames to broker connector names.
- * When a connector URL matches, OAuth is handled by the hosted broker
- * at auth.studiograph.com — no client secrets needed on the instance.
+ * Catalog of MCP servers with pre-registered OAuth apps on the
+ * `auth.studiograph.com` broker. Two responsibilities, both driven by
+ * the same array below:
+ *
+ *   1. RUNTIME — when a user-imported connector's URL matches one of
+ *      these hostnames, OAuth gets routed through the broker (which
+ *      holds the client secret) instead of expecting per-instance
+ *      credentials. See `getBrokerConnectUrl`.
+ *   2. CATALOG — Settings → External Connectors lists these as
+ *      "available to one-click add" tiles so an owner doesn't have to
+ *      know the canonical URL or paste JSON. See
+ *      `listAvailableBrokerConnectors`.
+ *
+ * Adding a new entry is a deliberate decision, not a default workflow.
+ * See docs/agents/agent-system.md § "Broker strategy" for when to do it and the costs
+ * involved (provider relationship, rate-limit exposure, single point
+ * of compromise).
  */
 const BROKER_URL = 'https://auth.studiograph.com';
-/**
- * MCP server hostnames with pre-registered OAuth apps on the broker.
- * Value is the connector name used in broker routes.
- */
-export const BROKER_CONNECTORS = {
-    'mcp.asana.com': 'asana',
-    'mcp.figma.com': 'figma',
-};
+export const BROKER_CONNECTORS = [
+    {
+        hostname: 'mcp.asana.com',
+        name: 'asana',
+        displayName: 'Asana',
+        serverUrl: 'https://mcp.asana.com/sse',
+    },
+    {
+        hostname: 'mcp.figma.com',
+        name: 'figma',
+        displayName: 'Figma',
+        serverUrl: 'https://mcp.figma.com/v1/mcp',
+        // Figma's MCP server is pending GA; keep the OAuth app registered
+        // for early-access workspaces but don't surface the catalog tile
+        // until the endpoint is publicly available.
+        catalogHidden: true,
+    },
+];
+/** Internal lookup — hostname → slug. Rebuilt from BROKER_CONNECTORS. */
+const BROKER_HOSTS = new Map(BROKER_CONNECTORS.map(c => [c.hostname, c.name]));
 /**
  * Check if a connector URL has broker support.
  * Returns the broker connect URL, or undefined if not supported.
@@ -21,7 +47,7 @@ export const BROKER_CONNECTORS = {
 export function getBrokerConnectUrl(connectorUrl, state) {
     try {
         const hostname = new URL(connectorUrl).hostname;
-        const connectorName = BROKER_CONNECTORS[hostname];
+        const connectorName = BROKER_HOSTS.get(hostname);
         if (!connectorName)
             return undefined;
         return `${BROKER_URL}/connect/${connectorName}?state=${encodeURIComponent(state)}`;
@@ -35,12 +61,25 @@ export function getBrokerConnectUrl(connectorUrl, state) {
  */
 export function hasBrokerSupport(connectorUrl) {
     try {
-        return new URL(connectorUrl).hostname in BROKER_CONNECTORS;
+        return BROKER_HOSTS.has(new URL(connectorUrl).hostname);
     }
     catch {
         return false;
     }
 }
+/**
+ * Catalog entries owners can one-click add. Drops `catalogHidden`
+ * connectors and anything callers have already configured (the names
+ * passed in are case-normalized — connector names are url-safe slugs
+ * but the import form may capitalize the display label).
+ */
+export function listAvailableBrokerConnectors(configuredNames = new Set()) {
+    const normalized = new Set([...configuredNames].map(n => n.toLowerCase()));
+    return BROKER_CONNECTORS
+        .filter(c => !c.catalogHidden)
+        .filter(c => !normalized.has(c.name.toLowerCase()) && !normalized.has(c.displayName.toLowerCase()))
+        .map(({ name, displayName, serverUrl }) => ({ name, displayName, serverUrl }));
+}
 /** Broker base URL for claim retrieval. */
 export { BROKER_URL };
 //# sourceMappingURL=oauth-registry.js.map

package/dist/mcp/oauth-registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-registry.js","sourceRoot":"","sources":["../../src/mcp/oauth-registry.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,UAAU,GAAG,8BAA8B,CAAC;AAElD;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA2B;IACvD,eAAe,EAAE,OAAO;IACxB,eAAe,EAAE,OAAO;CACzB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,YAAoB,EAAE,KAAa;IACrE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC;QAChD,MAAM,aAAa,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,aAAa;YAAE,OAAO,SAAS,CAAC;QACrC,OAAO,GAAG,UAAU,YAAY,aAAa,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACnD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,2CAA2C;AAC3C,OAAO,EAAE,UAAU,EAAE,CAAC"}
+{"version":3,"file":"oauth-registry.js","sourceRoot":"","sources":["../../src/mcp/oauth-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,UAAU,GAAG,8BAA8B,CAAC;AAwBlD,MAAM,CAAC,MAAM,iBAAiB,GAA+B;IAC3D;QACE,QAAQ,EAAE,eAAe;QACzB,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,OAAO;QACpB,SAAS,EAAE,2BAA2B;KACvC;IACD;QACE,QAAQ,EAAE,eAAe;QACzB,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,OAAO;QACpB,SAAS,EAAE,8BAA8B;QACzC,kEAAkE;QAClE,iEAAiE;QACjE,4CAA4C;QAC5C,aAAa,EAAE,IAAI;KACpB;CACF,CAAC;AAEF,yEAAyE;AACzE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAE/E;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,YAAoB,EAAE,KAAa;IACrE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC;QAChD,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,aAAa;YAAE,OAAO,SAAS,CAAC;QACrC,OAAO,GAAG,UAAU,YAAY,aAAa,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACnD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,kBAAuC,IAAI,GAAG,EAAE;IAEhD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC3E,OAAO,iBAAiB;SACrB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;SAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC;SAClG,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,2CAA2C;AAC3C,OAAO,EAAE,UAAU,EAAE,CAAC"}

package/dist/mcp/server-discovery.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Local-server discovery for the stdio MCP proxy (Increment 1 of the unified
+ * multi-peer editing model — see ~/.claude/plans/indexed-stirring-turtle.md).
+ *
+ * When `studiograph serve` is running it writes `.studiograph/server.json`
+ * describing how to reach it ({ url, pid, workspacePath, serverId }). The stdio
+ * proxy (`stdio-proxy.ts`) reads that file and decides, per tool call, whether
+ * to forward to the live HTTP server (so writes go through BodyWriteCoordinator
+ * and merge into any open editor) or to fall back to an in-process server (safe:
+ * no server ⇒ no live editor to clobber).
+ *
+ * SECURITY (Codex-hardened):
+ *  - The Bearer token is only ever sent to a LOOPBACK url. A non-loopback url in
+ *    server.json is treated as "no server" — never trusted, never sent a token.
+ *  - A 401/403 from the probe means "server present, auth rejected" → FAIL LOUD.
+ *    We must NOT fall back to a local in-process write in that case, because a
+ *    live editor may be open; a silent local write is the exact data-loss path
+ *    this increment removes.
+ *  - Identity is the serverId echo + workspacePath match, NOT team_name.
+ */
+export interface ServerInfo {
+    /** Loopback HTTP base url, e.g. "http://127.0.0.1:3000" (no trailing slash). */
+    url: string;
+    /** PID of the serve process — primary staleness guard. */
+    pid: number;
+    /** Absolute workspace path the server is bound to. */
+    workspacePath: string;
+    /** Random per-boot id echoed by GET /api/server-info. */
+    serverId: string;
+}
+export type ProbeResult = {
+    mode: 'remote';
+    url: string;
+    serverId: string;
+} | {
+    mode: 'local';
+} | {
+    mode: 'fail';
+    reason: string;
+};
+/** Path to the discovery file for a workspace. */
+export declare function serverInfoPath(workspacePath: string): string;
+/**
+ * Atomically write the discovery file (tmp + rename, like SessionManager's
+ * pending-commits persistence) and make sure `server.json` is gitignored in
+ * `.studiograph/.gitignore` (covers workspaces created before this template
+ * change). Best-effort on the gitignore — a failure there never blocks serve.
+ */
+export declare function writeServerInfo(workspacePath: string, info: ServerInfo): void;
+/** Best-effort removal of the discovery file (called after server.close()). */
+export declare function deleteServerInfo(workspacePath: string): void;
+/** Read + parse the discovery file. Returns null on missing or malformed JSON. */
+export declare function readServerInfo(workspacePath: string): ServerInfo | null;
+/** Append `entry` to a `.gitignore` file if not already present (one per line). */
+export declare function ensureGitignoreEntry(gitignorePath: string, entry: string): void;
+/** True only for loopback hosts. The Bearer token is never sent elsewhere. */
+export declare function isLoopbackUrl(url: string): boolean;
+/** True if a process with `pid` exists (signal 0 probe). */
+export declare function isPidAlive(pid: number): boolean;
+export interface ProbeDeps {
+    fetchFn?: typeof fetch;
+    isPidAliveFn?: (pid: number) => boolean;
+    readInfoFn?: (workspacePath: string) => ServerInfo | null;
+}
+/**
+ * Decide whether the stdio proxy should forward to the live local server.
+ *
+ * Returns `remote` only when every identity check passes; `fail` only when the
+ * server is reachable but rejects our token (401/403); `local` for every other
+ * case (no file, dead pid, non-loopback, wrong workspace, connection refused,
+ * or a different server answering on the port).
+ */
+export declare function probeServer(workspacePath: string, token: string, deps?: ProbeDeps): Promise<ProbeResult>;

package/dist/mcp/server-discovery.js

@@ -0,0 +1,164 @@
+/**
+ * Local-server discovery for the stdio MCP proxy (Increment 1 of the unified
+ * multi-peer editing model — see ~/.claude/plans/indexed-stirring-turtle.md).
+ *
+ * When `studiograph serve` is running it writes `.studiograph/server.json`
+ * describing how to reach it ({ url, pid, workspacePath, serverId }). The stdio
+ * proxy (`stdio-proxy.ts`) reads that file and decides, per tool call, whether
+ * to forward to the live HTTP server (so writes go through BodyWriteCoordinator
+ * and merge into any open editor) or to fall back to an in-process server (safe:
+ * no server ⇒ no live editor to clobber).
+ *
+ * SECURITY (Codex-hardened):
+ *  - The Bearer token is only ever sent to a LOOPBACK url. A non-loopback url in
+ *    server.json is treated as "no server" — never trusted, never sent a token.
+ *  - A 401/403 from the probe means "server present, auth rejected" → FAIL LOUD.
+ *    We must NOT fall back to a local in-process write in that case, because a
+ *    live editor may be open; a silent local write is the exact data-loss path
+ *    this increment removes.
+ *  - Identity is the serverId echo + workspacePath match, NOT team_name.
+ */
+import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'fs';
+import { join } from 'path';
+/** Path to the discovery file for a workspace. */
+export function serverInfoPath(workspacePath) {
+    return join(workspacePath, '.studiograph', 'server.json');
+}
+/**
+ * Atomically write the discovery file (tmp + rename, like SessionManager's
+ * pending-commits persistence) and make sure `server.json` is gitignored in
+ * `.studiograph/.gitignore` (covers workspaces created before this template
+ * change). Best-effort on the gitignore — a failure there never blocks serve.
+ */
+export function writeServerInfo(workspacePath, info) {
+    const path = serverInfoPath(workspacePath);
+    const tmp = `${path}.tmp`;
+    writeFileSync(tmp, JSON.stringify(info, null, 2), 'utf-8');
+    renameSync(tmp, path);
+    try {
+        ensureGitignoreEntry(join(workspacePath, '.studiograph', '.gitignore'), 'server.json');
+    }
+    catch {
+        /* non-fatal — server.json is ephemeral; worst case it shows as untracked */
+    }
+}
+/** Best-effort removal of the discovery file (called after server.close()). */
+export function deleteServerInfo(workspacePath) {
+    try {
+        unlinkSync(serverInfoPath(workspacePath));
+    }
+    catch {
+        /* already gone / never written */
+    }
+}
+/** Read + parse the discovery file. Returns null on missing or malformed JSON. */
+export function readServerInfo(workspacePath) {
+    const path = serverInfoPath(workspacePath);
+    if (!existsSync(path))
+        return null;
+    try {
+        const raw = JSON.parse(readFileSync(path, 'utf-8'));
+        if (raw &&
+            typeof raw.url === 'string' &&
+            typeof raw.pid === 'number' &&
+            typeof raw.workspacePath === 'string' &&
+            typeof raw.serverId === 'string') {
+            return raw;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Append `entry` to a `.gitignore` file if not already present (one per line). */
+export function ensureGitignoreEntry(gitignorePath, entry) {
+    if (existsSync(gitignorePath)) {
+        const content = readFileSync(gitignorePath, 'utf-8');
+        if (content.split('\n').some(line => line.trim() === entry))
+            return;
+        const sep = content.endsWith('\n') ? '' : '\n';
+        writeFileSync(gitignorePath, `${content}${sep}${entry}\n`);
+    }
+    else {
+        writeFileSync(gitignorePath, `${entry}\n`);
+    }
+}
+/** True only for loopback hosts. The Bearer token is never sent elsewhere. */
+export function isLoopbackUrl(url) {
+    let host;
+    try {
+        host = new URL(url).hostname;
+    }
+    catch {
+        return false;
+    }
+    // Node keeps the brackets on IPv6 hostnames ("[::1]") — strip them.
+    if (host.startsWith('[') && host.endsWith(']'))
+        host = host.slice(1, -1);
+    return host === '127.0.0.1' || host === 'localhost' || host === '::1';
+}
+/** True if a process with `pid` exists (signal 0 probe). */
+export function isPidAlive(pid) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        // EPERM = process exists but we can't signal it → still alive.
+        return err?.code === 'EPERM';
+    }
+}
+/**
+ * Decide whether the stdio proxy should forward to the live local server.
+ *
+ * Returns `remote` only when every identity check passes; `fail` only when the
+ * server is reachable but rejects our token (401/403); `local` for every other
+ * case (no file, dead pid, non-loopback, wrong workspace, connection refused,
+ * or a different server answering on the port).
+ */
+export async function probeServer(workspacePath, token, deps = {}) {
+    const fetchFn = deps.fetchFn ?? fetch;
+    const pidAlive = deps.isPidAliveFn ?? isPidAlive;
+    const readInfo = deps.readInfoFn ?? readServerInfo;
+    const info = readInfo(workspacePath);
+    if (!info)
+        return { mode: 'local' };
+    if (!pidAlive(info.pid))
+        return { mode: 'local' };
+    if (!isLoopbackUrl(info.url))
+        return { mode: 'local' };
+    if (info.workspacePath !== workspacePath)
+        return { mode: 'local' };
+    let res;
+    try {
+        res = await fetchFn(`${info.url}/api/server-info`, {
+            headers: { Authorization: `Bearer ${token}` },
+        });
+    }
+    catch {
+        // ECONNREFUSED / DNS / abort → the pid is alive but isn't this server
+        // (pid reuse, or a server mid-shutdown). Treat as no server.
+        return { mode: 'local' };
+    }
+    if (res.status === 401 || res.status === 403) {
+        return { mode: 'fail', reason: `server rejected token (HTTP ${res.status})` };
+    }
+    if (!res.ok)
+        return { mode: 'local' };
+    let body;
+    try {
+        body = await res.json();
+    }
+    catch {
+        return { mode: 'local' };
+    }
+    if (body?.serverId !== info.serverId || body?.workspacePath !== workspacePath) {
+        // A different studiograph instance is answering on that port.
+        return { mode: 'local' };
+    }
+    return { mode: 'remote', url: info.url, serverId: info.serverId };
+}
+//# sourceMappingURL=server-discovery.js.map

package/dist/mcp/server-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-discovery.js","sourceRoot":"","sources":["../../src/mcp/server-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACrF,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAkB5B,kDAAkD;AAClD,MAAM,UAAU,cAAc,CAAC,aAAqB;IAClD,OAAO,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,aAAqB,EAAE,IAAgB;IACrE,MAAM,IAAI,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;IAC1B,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3D,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtB,IAAI,CAAC;QACH,oBAAoB,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,YAAY,CAAC,EAAE,aAAa,CAAC,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;IAC9E,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAAC,aAAqB;IACpD,IAAI,CAAC;QACH,UAAU,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,aAAqB;IAClD,MAAM,IAAI,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACpD,IACE,GAAG;YACH,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;YAC3B,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;YAC3B,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ;YACrC,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAChC,CAAC;YACD,OAAO,GAAiB,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,oBAAoB,CAAC,aAAqB,EAAE,KAAa;IACvE,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACrD,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC;YAAE,OAAO;QACpE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/C,aAAa,CAAC,aAAa,EAAE,GAAG,OAAO,GAAG,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,aAAa,CAAC,aAAa,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,oEAAoE;IACpE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,CAAC;AACxE,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,+DAA+D;QAC/D,OAAO,GAAG,EAAE,IAAI,KAAK,OAAO,CAAC;IAC/B,CAAC;AACH,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,aAAqB,EACrB,KAAa,EACb,OAAkB,EAAE;IAEpB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,IAAI,UAAU,CAAC;IACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,cAAc,CAAC;IAEnD,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAClD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACvD,IAAI,IAAI,CAAC,aAAa,KAAK,aAAa;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAEnE,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,kBAAkB,EAAE;YACjD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,6DAA6D;QAC7D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,+BAA+B,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChF,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAEtC,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE,aAAa,KAAK,aAAa,EAAE,CAAC;QAC9E,8DAA8D;QAC9D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;AACpE,CAAC"}

package/dist/mcp/server.d.ts

@@ -1,11 +1,32 @@
 /**
- * Studiograph MCP server
+ * Studiograph MCP server (stdio transport)
  *
  * Creates a McpServer instance, registers all tools, and connects via stdio
  * transport for integration with Claude Desktop and other MCP clients.
  *
- * NOTE: All logging uses console.error() — stdout is reserved for the
+ * Identity: requires STUDIOGRAPH_MCP_TOKEN to be set to a per-user API token
+ * (or a JWT). The token is resolved against the workspace's AuthService to
+ * produce the caller identity used by every tool's access control check.
+ * Fails closed — if the token is missing or invalid the process exits.
+ *
+ * NOTE: All logging uses log.error() — stdout is reserved for the
  * JSON-RPC protocol messages and must not be written to directly.
+ * log.error writes to stderr (via console.error under the hood), which
+ * preserves the stdio-transport invariant.
  */
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { WorkspaceManager } from '../core/workspace-manager.js';
-export declare function startMcpServer(workspaceManager: WorkspaceManager): Promise<void>;
+import { AuthService, type AuthUser } from '../services/auth-service.js';
+export declare function startMcpServer(workspaceManager: WorkspaceManager, authService: AuthService): Promise<void>;
+export declare function resolveStdioUser(authService: AuthService): AuthUser | null;
+/**
+ * Build an in-process MCP server (full tool surface, same as stdio/HTTP) and
+ * return a connected `Client` wired to it over an in-memory transport. Used by
+ * the stdio proxy as the LOCAL fallback when no live HTTP server is reachable —
+ * in that case there is no open editor, so a direct write is safe.
+ *
+ * Identity is the resolved per-user `STUDIOGRAPH_MCP_TOKEN`, threaded through
+ * `registerTools` exactly as the real stdio server does, so access control is
+ * identical on both upstreams.
+ */
+export declare function createInProcessMcpClient(workspaceManager: WorkspaceManager, authService: AuthService, user: AuthUser): Promise<Client>;

package/dist/mcp/server.js

@@ -1,28 +1,71 @@
 /**
- * Studiograph MCP server
+ * Studiograph MCP server (stdio transport)
  *
  * Creates a McpServer instance, registers all tools, and connects via stdio
  * transport for integration with Claude Desktop and other MCP clients.
  *
- * NOTE: All logging uses console.error() — stdout is reserved for the
+ * Identity: requires STUDIOGRAPH_MCP_TOKEN to be set to a per-user API token
+ * (or a JWT). The token is resolved against the workspace's AuthService to
+ * produce the caller identity used by every tool's access control check.
+ * Fails closed — if the token is missing or invalid the process exits.
+ *
+ * NOTE: All logging uses log.error() — stdout is reserved for the
  * JSON-RPC protocol messages and must not be written to directly.
+ * log.error writes to stderr (via console.error under the hood), which
+ * preserves the stdio-transport invariant.
  */
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { registerTools } from './tools.js';
-export async function startMcpServer(workspaceManager) {
-    const server = new McpServer({
-        name: 'studiograph',
-        version: '1.0.0',
-    });
-    registerTools(server, workspaceManager);
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js';
+import { registerTools, MCP_SERVER_INFO, MCP_INSTRUCTIONS } from './tools.js';
+import { log } from '../utils/log.js';
+export async function startMcpServer(workspaceManager, authService) {
+    const user = resolveStdioUser(authService);
+    if (!user) {
+        process.stderr.write('Studiograph MCP: STUDIOGRAPH_MCP_TOKEN is required.\n' +
+            'Generate a token with:\n' +
+            '  curl -X POST http://<host>/api/auth/tokens \\\n' +
+            '       -H "Content-Type: application/json" \\\n' +
+            '       -b __sg_token=<your-jwt> \\\n' +
+            '       -d \'{"name":"claude-desktop"}\'\n' +
+            'Then set STUDIOGRAPH_MCP_TOKEN=<token> in your Claude Desktop MCP config env.\n');
+        process.exit(1);
+    }
+    const server = new McpServer(MCP_SERVER_INFO, { instructions: MCP_INSTRUCTIONS });
+    registerTools(server, workspaceManager, authService, { user });
     const transport = new StdioServerTransport();
     await server.connect(transport);
-    console.error('Studiograph MCP server ready');
+    log.error(`Studiograph MCP server ready (user: ${user.email})`);
     // Keep the process alive — the transport closes when the client disconnects
     process.on('SIGINT', async () => {
         await server.close();
         process.exit(0);
     });
 }
+export function resolveStdioUser(authService) {
+    const token = process.env.STUDIOGRAPH_MCP_TOKEN?.trim();
+    if (!token)
+        return null;
+    return authService.verifyApiToken(token) ?? authService.verifyToken(token);
+}
+/**
+ * Build an in-process MCP server (full tool surface, same as stdio/HTTP) and
+ * return a connected `Client` wired to it over an in-memory transport. Used by
+ * the stdio proxy as the LOCAL fallback when no live HTTP server is reachable —
+ * in that case there is no open editor, so a direct write is safe.
+ *
+ * Identity is the resolved per-user `STUDIOGRAPH_MCP_TOKEN`, threaded through
+ * `registerTools` exactly as the real stdio server does, so access control is
+ * identical on both upstreams.
+ */
+export async function createInProcessMcpClient(workspaceManager, authService, user) {
+    const server = new McpServer(MCP_SERVER_INFO, { instructions: MCP_INSTRUCTIONS });
+    registerTools(server, workspaceManager, authService, { user });
+    const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+    await server.connect(serverTransport);
+    const client = new Client({ name: 'studiograph-stdio-proxy-local', version: '1.0.0' });
+    await client.connect(clientTransport);
+    return client;
+}
 //# sourceMappingURL=server.js.map

package/dist/mcp/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,gBAAkC;IACrE,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAK,aAAa;QACtB,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IAEH,aAAa,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAExC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAE9C,4EAA4E;IAC5E,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QAC9B,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAG1E,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9E,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAEtC,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,gBAAkC,EAClC,WAAwB;IAExB,MAAM,IAAI,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uDAAuD;YACvD,0BAA0B;YAC1B,mDAAmD;YACnD,iDAAiD;YACjD,sCAAsC;YACtC,2CAA2C;YAC3C,iFAAiF,CAClF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,eAAe,EAAE,EAAE,YAAY,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAElF,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/D,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,GAAG,CAAC,KAAK,CAAC,uCAAuC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IAEhE,4EAA4E;IAC5E,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QAC9B,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,WAAwB;IACvD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,gBAAkC,EAClC,WAAwB,EACxB,IAAc;IAEd,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,eAAe,EAAE,EAAE,YAAY,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAClF,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/D,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GAAG,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;IAChF,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAEtC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,+BAA+B,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACvF,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/mcp/state-signer.d.ts

@@ -0,0 +1,62 @@
+/**
+ * OAuth state signer
+ *
+ * Signs the `state` parameter on outbound OAuth flows so the server can prove,
+ * on callback/claim, that the userId + connector + origin it sees were minted
+ * by this instance — not forged by an attacker controlling a callback URL.
+ *
+ * Without integrity protection on `state`, an attacker who controls a
+ * `/api/oauth/callback/:name` or `/api/oauth/claim/:connector` URL can
+ * forge `{c, u, o}` to bind their own OAuth tokens against a victim's
+ * userId. This module closes that gap.
+ *
+ * Signing key is derived from the workspace master key via HKDF
+ * (info="studiograph-oauth-state-v1") so it's distinct from the AEAD key
+ * used for at-rest encryption — a leak of one doesn't compromise the other.
+ *
+ * The serialized state is a base64url-encoded JSON object:
+ *   { c, u, o, t, s }
+ * where `s` is the base64url HMAC-SHA256 over the canonical message
+ * (a JSON array of [c, u, o, t]). The OAuth broker continues to decode
+ * `c`, `u`, `o` from this JSON unchanged — adding `t` and `s` is forward-
+ * compatible.
+ */
+export interface OAuthStateClaims {
+    connectorName: string;
+    userId: number;
+    origin: string;
+}
+export interface OAuthStateSigner {
+    sign(claims: OAuthStateClaims): string;
+    verify(state: string, opts?: {
+        maxAgeMs?: number;
+    }): OAuthStateClaims | null;
+}
+/**
+ * Derive a 32-byte signing key from the workspace master key. The `info`
+ * binding ensures this key is domain-separated from the AEAD key used to
+ * encrypt secrets at rest.
+ */
+export declare function deriveStateSigningKey(masterKey: Uint8Array): Uint8Array;
+export declare function createOAuthStateSigner(key: Uint8Array): OAuthStateSigner;
+export interface PayloadSigner {
+    sign(payload: Record<string, unknown>): string;
+    verify(token: string, opts?: {
+        maxAgeMs?: number;
+    }): Record<string, unknown> | null;
+}
+/**
+ * Derive the consent signing key from the JWT secret via HKDF. Domain-separated
+ * from session JWTs (different mechanism entirely) and from the outbound state
+ * signer (different `info`). Keying off the JWT secret — rather than the master
+ * key — means the authorization server works on every boot, including
+ * non-encrypted/test boots where no master key is wired.
+ */
+export declare function deriveConsentSigningKey(jwtSecret: string): Uint8Array;
+/**
+ * Generic HMAC payload signer: serializes `{ p: <payload>, t: <ts> }`, signs
+ * the canonical JSON with HMAC-SHA256, and base64url-encodes the blob. `verify`
+ * recomputes the HMAC with `timingSafeEqual`, enforces a max age, and rejects
+ * future-dated tokens. Returns the payload object on success, null otherwise.
+ */
+export declare function createConsentSigner(key: Uint8Array): PayloadSigner;