studiograph 1.3.48-next.35 → 1.3.48-next.36

package/dist/cli/commands/mcp.js

@@ -27,6 +27,7 @@ import { Command } from 'commander';
 import { Workspace } from '../../core/workspace.js';
 import { WorkspaceManager } from '../../core/workspace-manager.js';
 import { loadUserConfig } from '../../core/user-config.js';
+import { AuthService } from '../../services/auth-service.js';
 import { startMcpServer } from '../../mcp/server.js';
 export const mcpCommand = new Command('mcp')
     .description('Start the Studiograph MCP server for Claude Desktop integration')
@@ -52,6 +53,7 @@ export const mcpCommand = new Command('mcp')
         email: 'noreply@studiograph.local',
     };
     const workspaceManager = new WorkspaceManager(workspacePath, config, gitUser);
-    await startMcpServer(workspaceManager);
+    const authService = new AuthService(workspacePath);
+    await startMcpServer(workspaceManager, authService);
 });
 //# sourceMappingURL=mcp.js.map

package/dist/cli/commands/mcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../src/cli/commands/mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC;KACzC,WAAW,CAAC,iEAAiE,CAAC;KAC9E,QAAQ,CAAC,aAAa,EAAE,mDAAmD,CAAC;KAC5E,MAAM,CAAC,KAAK,EAAE,YAAqB,EAAE,EAAE;IACtC,MAAM,aAAa,GAAG,YAAY,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACpD,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,aAAa,CAAC,CAAC;IAE/C,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gCAAgC;YAChC,gGAAgG,CACjG,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,CAAC;IAE5C,kEAAkE;IAClE,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,IAAI,UAAU,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,UAAU,CAAC,OAAO,CAAC;IACrD,CAAC;IAED,2EAA2E;IAC3E,MAAM,OAAO,GAAG;QACd,EAAE,EAAK,KAAK;QACZ,IAAI,EAAG,iBAAiB;QACxB,KAAK,EAAE,2BAA2B;KACnC,CAAC;IAEF,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,aAAa,EACb,MAAM,EACN,OAAO,CACR,CAAC;IAEF,MAAM,cAAc,CAAC,gBAAgB,CAAC,CAAC;AACzC,CAAC,CAAC,CAAC"}
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../src/cli/commands/mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC;KACzC,WAAW,CAAC,iEAAiE,CAAC;KAC9E,QAAQ,CAAC,aAAa,EAAE,mDAAmD,CAAC;KAC5E,MAAM,CAAC,KAAK,EAAE,YAAqB,EAAE,EAAE;IACtC,MAAM,aAAa,GAAG,YAAY,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACpD,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,aAAa,CAAC,CAAC;IAE/C,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gCAAgC;YAChC,gGAAgG,CACjG,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,CAAC;IAE5C,kEAAkE;IAClE,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,IAAI,UAAU,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,UAAU,CAAC,OAAO,CAAC;IACrD,CAAC;IAED,2EAA2E;IAC3E,MAAM,OAAO,GAAG;QACd,EAAE,EAAK,KAAK;QACZ,IAAI,EAAG,iBAAiB;QACxB,KAAK,EAAE,2BAA2B;KACnC,CAAC;IAEF,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,aAAa,EACb,MAAM,EACN,OAAO,CACR,CAAC;IAEF,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,aAAa,CAAC,CAAC;IAEnD,MAAM,cAAc,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;AACtD,CAAC,CAAC,CAAC"}

package/dist/core/types.d.ts

@@ -104,16 +104,16 @@ export declare const FieldDefinitionSchema: z.ZodObject<{
     type: "string" | "number" | "boolean" | "enum" | "string[]";
     name: string;
     required: boolean;
+    default?: unknown;
     description?: string | undefined;
     enum_values?: string[] | undefined;
-    default?: unknown;
 }, {
     type: "string" | "number" | "boolean" | "enum" | "string[]";
     name: string;
+    default?: unknown;
     required?: boolean | undefined;
     description?: string | undefined;
     enum_values?: string[] | undefined;
-    default?: unknown;
 }>;
 export type FieldDefinition = z.infer<typeof FieldDefinitionSchema>;
 /**
@@ -133,16 +133,16 @@ export declare const SchemaExtensionSchema: z.ZodObject<{
         type: "string" | "number" | "boolean" | "enum" | "string[]";
         name: string;
         required: boolean;
+        default?: unknown;
         description?: string | undefined;
         enum_values?: string[] | undefined;
-        default?: unknown;
     }, {
         type: "string" | "number" | "boolean" | "enum" | "string[]";
         name: string;
+        default?: unknown;
         required?: boolean | undefined;
         description?: string | undefined;
         enum_values?: string[] | undefined;
-        default?: unknown;
     }>, "many">>;
     fields: z.ZodOptional<z.ZodArray<z.ZodObject<{
         name: z.ZodString;
@@ -155,16 +155,16 @@ export declare const SchemaExtensionSchema: z.ZodObject<{
         type: "string" | "number" | "boolean" | "enum" | "string[]";
         name: string;
         required: boolean;
+        default?: unknown;
         description?: string | undefined;
         enum_values?: string[] | undefined;
-        default?: unknown;
     }, {
         type: "string" | "number" | "boolean" | "enum" | "string[]";
         name: string;
+        default?: unknown;
         required?: boolean | undefined;
         description?: string | undefined;
         enum_values?: string[] | undefined;
-        default?: unknown;
     }>, "many">>;
     body_template: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
@@ -174,17 +174,17 @@ export declare const SchemaExtensionSchema: z.ZodObject<{
         type: "string" | "number" | "boolean" | "enum" | "string[]";
         name: string;
         required: boolean;
+        default?: unknown;
         description?: string | undefined;
         enum_values?: string[] | undefined;
-        default?: unknown;
     }[] | undefined;
     fields?: {
         type: "string" | "number" | "boolean" | "enum" | "string[]";
         name: string;
         required: boolean;
+        default?: unknown;
         description?: string | undefined;
         enum_values?: string[] | undefined;
-        default?: unknown;
     }[] | undefined;
     body_template?: string | undefined;
 }, {
@@ -193,18 +193,18 @@ export declare const SchemaExtensionSchema: z.ZodObject<{
     additional_fields?: {
         type: "string" | "number" | "boolean" | "enum" | "string[]";
         name: string;
+        default?: unknown;
         required?: boolean | undefined;
         description?: string | undefined;
         enum_values?: string[] | undefined;
-        default?: unknown;
     }[] | undefined;
     fields?: {
         type: "string" | "number" | "boolean" | "enum" | "string[]";
         name: string;
+        default?: unknown;
         required?: boolean | undefined;
         description?: string | undefined;
         enum_values?: string[] | undefined;
-        default?: unknown;
     }[] | undefined;
     body_template?: string | undefined;
 }>;
@@ -337,16 +337,16 @@ export declare const WorkspaceConfigSchema: z.ZodObject<{
             type: "string" | "number" | "boolean" | "enum" | "string[]";
             name: string;
             required: boolean;
+            default?: unknown;
             description?: string | undefined;
             enum_values?: string[] | undefined;
-            default?: unknown;
         }, {
             type: "string" | "number" | "boolean" | "enum" | "string[]";
             name: string;
+            default?: unknown;
             required?: boolean | undefined;
             description?: string | undefined;
             enum_values?: string[] | undefined;
-            default?: unknown;
         }>, "many">>;
         fields: z.ZodOptional<z.ZodArray<z.ZodObject<{
             name: z.ZodString;
@@ -359,16 +359,16 @@ export declare const WorkspaceConfigSchema: z.ZodObject<{
             type: "string" | "number" | "boolean" | "enum" | "string[]";
             name: string;
             required: boolean;
+            default?: unknown;
             description?: string | undefined;
             enum_values?: string[] | undefined;
-            default?: unknown;
         }, {
             type: "string" | "number" | "boolean" | "enum" | "string[]";
             name: string;
+            default?: unknown;
             required?: boolean | undefined;
             description?: string | undefined;
             enum_values?: string[] | undefined;
-            default?: unknown;
         }>, "many">>;
         body_template: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
@@ -378,17 +378,17 @@ export declare const WorkspaceConfigSchema: z.ZodObject<{
             type: "string" | "number" | "boolean" | "enum" | "string[]";
             name: string;
             required: boolean;
+            default?: unknown;
             description?: string | undefined;
             enum_values?: string[] | undefined;
-            default?: unknown;
         }[] | undefined;
         fields?: {
             type: "string" | "number" | "boolean" | "enum" | "string[]";
             name: string;
             required: boolean;
+            default?: unknown;
             description?: string | undefined;
             enum_values?: string[] | undefined;
-            default?: unknown;
         }[] | undefined;
         body_template?: string | undefined;
     }, {
@@ -397,18 +397,18 @@ export declare const WorkspaceConfigSchema: z.ZodObject<{
         additional_fields?: {
             type: "string" | "number" | "boolean" | "enum" | "string[]";
             name: string;
+            default?: unknown;
             required?: boolean | undefined;
             description?: string | undefined;
             enum_values?: string[] | undefined;
-            default?: unknown;
         }[] | undefined;
         fields?: {
             type: "string" | "number" | "boolean" | "enum" | "string[]";
             name: string;
+            default?: unknown;
             required?: boolean | undefined;
             description?: string | undefined;
             enum_values?: string[] | undefined;
-            default?: unknown;
         }[] | undefined;
         body_template?: string | undefined;
     }>>>;
@@ -515,17 +515,17 @@ export declare const WorkspaceConfigSchema: z.ZodObject<{
             type: "string" | "number" | "boolean" | "enum" | "string[]";
             name: string;
             required: boolean;
+            default?: unknown;
             description?: string | undefined;
             enum_values?: string[] | undefined;
-            default?: unknown;
         }[] | undefined;
         fields?: {
             type: "string" | "number" | "boolean" | "enum" | "string[]";
             name: string;
             required: boolean;
+            default?: unknown;
             description?: string | undefined;
             enum_values?: string[] | undefined;
-            default?: unknown;
         }[] | undefined;
         body_template?: string | undefined;
     }> | undefined;
@@ -582,18 +582,18 @@ export declare const WorkspaceConfigSchema: z.ZodObject<{
         additional_fields?: {
             type: "string" | "number" | "boolean" | "enum" | "string[]";
             name: string;
+            default?: unknown;
             required?: boolean | undefined;
             description?: string | undefined;
             enum_values?: string[] | undefined;
-            default?: unknown;
         }[] | undefined;
         fields?: {
             type: "string" | "number" | "boolean" | "enum" | "string[]";
             name: string;
+            default?: unknown;
             required?: boolean | undefined;
             description?: string | undefined;
             enum_values?: string[] | undefined;
-            default?: unknown;
         }[] | undefined;
         body_template?: string | undefined;
     }> | undefined;

package/dist/mcp/server.d.ts

@@ -1,11 +1,17 @@
 /**
- * Studiograph MCP server
+ * Studiograph MCP server (stdio transport)
  *
  * Creates a McpServer instance, registers all tools, and connects via stdio
  * transport for integration with Claude Desktop and other MCP clients.
  *
+ * Identity: requires STUDIOGRAPH_MCP_TOKEN to be set to a per-user API token
+ * (or a JWT). The token is resolved against the workspace's AuthService to
+ * produce the caller identity used by every tool's access control check.
+ * Fails closed — if the token is missing or invalid the process exits.
+ *
  * NOTE: All logging uses console.error() — stdout is reserved for the
  * JSON-RPC protocol messages and must not be written to directly.
  */
 import { WorkspaceManager } from '../core/workspace-manager.js';
-export declare function startMcpServer(workspaceManager: WorkspaceManager): Promise<void>;
+import { AuthService } from '../services/auth-service.js';
+export declare function startMcpServer(workspaceManager: WorkspaceManager, authService: AuthService): Promise<void>;

package/dist/mcp/server.js

@@ -1,28 +1,50 @@
 /**
- * Studiograph MCP server
+ * Studiograph MCP server (stdio transport)
  *
  * Creates a McpServer instance, registers all tools, and connects via stdio
  * transport for integration with Claude Desktop and other MCP clients.
  *
+ * Identity: requires STUDIOGRAPH_MCP_TOKEN to be set to a per-user API token
+ * (or a JWT). The token is resolved against the workspace's AuthService to
+ * produce the caller identity used by every tool's access control check.
+ * Fails closed — if the token is missing or invalid the process exits.
+ *
  * NOTE: All logging uses console.error() — stdout is reserved for the
  * JSON-RPC protocol messages and must not be written to directly.
  */
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { registerTools } from './tools.js';
-export async function startMcpServer(workspaceManager) {
+export async function startMcpServer(workspaceManager, authService) {
+    const user = resolveStdioUser(authService);
+    if (!user) {
+        process.stderr.write('Studiograph MCP: STUDIOGRAPH_MCP_TOKEN is required.\n' +
+            'Generate a token with:\n' +
+            '  curl -X POST http://<host>/api/auth/tokens \\\n' +
+            '       -H "Content-Type: application/json" \\\n' +
+            '       -b __sg_token=<your-jwt> \\\n' +
+            '       -d \'{"name":"claude-desktop"}\'\n' +
+            'Then set STUDIOGRAPH_MCP_TOKEN=<token> in your Claude Desktop MCP config env.\n');
+        process.exit(1);
+    }
     const server = new McpServer({
         name: 'studiograph',
         version: '1.0.0',
     });
-    registerTools(server, workspaceManager);
+    registerTools(server, workspaceManager, authService, { user });
     const transport = new StdioServerTransport();
     await server.connect(transport);
-    console.error('Studiograph MCP server ready');
+    console.error(`Studiograph MCP server ready (user: ${user.email})`);
     // Keep the process alive — the transport closes when the client disconnects
     process.on('SIGINT', async () => {
         await server.close();
         process.exit(0);
     });
 }
+function resolveStdioUser(authService) {
+    const token = process.env.STUDIOGRAPH_MCP_TOKEN?.trim();
+    if (!token)
+        return null;
+    return authService.verifyApiToken(token) ?? authService.verifyToken(token);
+}
 //# sourceMappingURL=server.js.map

package/dist/mcp/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,gBAAkC;IACrE,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAK,aAAa;QACtB,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IAEH,aAAa,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAExC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAE9C,4EAA4E;IAC5E,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QAC9B,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAGjF,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,gBAAkC,EAClC,WAAwB;IAExB,MAAM,IAAI,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uDAAuD;YACvD,0BAA0B;YAC1B,mDAAmD;YACnD,iDAAiD;YACjD,sCAAsC;YACtC,2CAA2C;YAC3C,iFAAiF,CAClF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAK,aAAa;QACtB,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IAEH,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/D,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,OAAO,CAAC,KAAK,CAAC,uCAAuC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IAEpE,4EAA4E;IAC5E,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QAC9B,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,WAAwB;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC"}

package/dist/mcp/tools.d.ts

@@ -5,11 +5,20 @@
  * methods — no new business logic. Results are returned as JSON text so the
  * MCP client (Claude Desktop) can process structured data.
  *
+ * Every tool enforces per-user access control via `services/access-control.ts`.
+ * Callers (the HTTP /mcp route, the stdio MCP server) must resolve a user
+ * identity before registering tools — `registerTools` requires a user in its
+ * `McpAccessContext` argument so there is no anonymous MCP path.
+ *
  * Note: `inputSchema` is cast to `any` at each call site because the MCP SDK's
  * ZodRawShapeCompat type does not accept ZodObject in TypeScript's strict mode.
  * Runtime schema validation is handled correctly by the SDK regardless.
  */
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { WorkspaceManager } from '../core/workspace-manager.js';
-import type { AuthService } from '../services/auth-service.js';
-export declare function registerTools(server: McpServer, wm: WorkspaceManager, authService?: AuthService | null): void;
+import type { AuthService, AuthUser } from '../services/auth-service.js';
+/** The resolved caller identity for an MCP session. */
+export interface McpAccessContext {
+    user: AuthUser;
+}
+export declare function registerTools(server: McpServer, wm: WorkspaceManager, authService: AuthService, ctx: McpAccessContext): void;