fabric-vibecoding-settings 0.2__tar.gz → 0.3__tar.gz

{fabric_vibecoding_settings-0.2 → fabric_vibecoding_settings-0.3}/.gitignore

@@ -13,6 +13,7 @@
 logs/
 src/
 !cli/src/
+!frontend/src/
 fabric_notebooks/
 _delta_log/
 *.checkpoint.parquet
@@ -60,4 +61,7 @@ Thumbs.db
 .vscode/
 .idea/
 *.swp
-.pytest_cache/
+.pytest_cache/
+.agents
+.claude
+skills-lock.json

{fabric_vibecoding_settings-0.2 → fabric_vibecoding_settings-0.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fabric-vibecoding-settings
-Version: 0.2
+Version: 0.3
 Summary: Install Microsoft Fabric agent profiles (Claude Code and Codex) into a target repository.
 License: MIT
 License-File: LICENSE
@@ -17,9 +17,6 @@ Requires-Dist: pydantic>=2.7; extra == 'server'
 Requires-Dist: pyjwt>=2.8; extra == 'server'
 Requires-Dist: rank-bm25>=0.2.2; extra == 'server'
 Requires-Dist: uvicorn>=0.30; extra == 'server'
-Provides-Extra: server-azure
-Requires-Dist: azure-identity>=1.16; extra == 'server-azure'
-Requires-Dist: azure-storage-blob>=12.19; extra == 'server-azure'
 Description-Content-Type: text/markdown
 
 # Fabric Agent Pack

{fabric_vibecoding_settings-0.2 → fabric_vibecoding_settings-0.3}/cli/profiles/claude/CLAUDE.md

@@ -12,8 +12,8 @@ directly; use the graph.
 ## How to work
 
 The `fabric-server` MCP is a separate process — a Docker container the
-human starts with `docker compose up` from the source repo's `server/`
-directory before opening Claude. The project MCP config generated by
+human starts with `docker compose up` from the source repo root
+before opening Claude. The project MCP config generated by
 `fabric-vibe setup` points clients to its Fabric and graph tools. If
 `tools/list` returns nothing the container probably isn't running.
 

{fabric_vibecoding_settings-0.2 → fabric_vibecoding_settings-0.3}/cli/profiles/codex/AGENTS.md

@@ -12,8 +12,8 @@ directly; use the graph.
 ## How to work
 
 The `fabric-server` MCP is a separate process — a Docker container the
-human starts with `docker compose up` from the source repo's `server/`
-directory before opening Codex. The project MCP config generated by
+human starts with `docker compose up` from the source repo root
+before opening Codex. The project MCP config generated by
 `fabric-vibe setup` points clients to its Fabric and graph tools. If
 `tools/list` returns nothing the container probably isn't running.
 

{fabric_vibecoding_settings-0.2 → fabric_vibecoding_settings-0.3}/cli/profiles/codex/config.toml

@@ -15,7 +15,20 @@ ignore_default_excludes = false
 # Single HTTP MCP server, served by the local Docker container
 # (`docker compose up` from the source repo's server/ directory).
 # The target bootstrap patches this URL for the local Fabric MCP server.
-[mcp_servers.fabric-server]
+[mcp_servers.fabric_server]
 url = "http://127.0.0.1:8000/mcp"
 startup_timeout_ms = 20000
 tool_timeout_ms = 120000
+
+[mcp_servers.fabric_server.tools.graph_get_entry]
+approval_mode = "approve"
+
+[mcp_servers.fabric_server.tools.graph_get_linked]
+approval_mode = "approve"
+
+[mcp_servers.fabric_server.tools.graph_get_node]
+approval_mode = "approve"
+
+[mcp_servers.fabric_server.tools.graph_search]
+approval_mode = "approve"
+

{fabric_vibecoding_settings-0.2 → fabric_vibecoding_settings-0.3}/cli/setup/setup.ps1

@@ -14,12 +14,11 @@
 #   5. Prompts for FABRIC_CLIENT_SECRET and persists to the user's OS env
 #      (NOT .env - secrets stay in the OS env).
 #   6. Prompts for MCP_SERVER_URL.
-#   7. Writes .mcp.json and patches .codex/config.toml's [mcp_servers.fabric-server]
+#   7. Writes .mcp.json and patches .codex/config.toml's [mcp_servers.fabric_server]
 #      url (if installed).
-#   8. Prompts for FABRIC_MCP_API_KEY (from server admin) and persists it to the
-#      OS user environment (registry). Runs fabric-vibe auth refresh, which calls
-#      /auth/login with the API key, receives a short-lived JWT, and writes it
-#      into the MCP client headers.
+#   8. Prompts for FABRIC_MCP_AUTH_URL (auth service base URL; defaults to
+#      MCP_SERVER_URL/api/auth) and FABRIC_MCP_API_KEY (from server admin).
+#      Runs fabric-vibe auth refresh to obtain a short-lived JWT.
 #   9. Verifies SPN auth by calling `fab api workspaces`.
 #  10. Runs fabric-vibe workspace init to populate workspaces.json.
 #  11. Prompts to select the active workspace.
@@ -179,11 +178,28 @@ if ($env:MCP_SERVER_URL) {
     if (-not $mcpServerUrl) { $mcpServerUrl = "http://127.0.0.1:8000" }
 }
 
+# -- MCP auth URL ------------------------------------------------------------
+# Base URL for the auth service (without /login or /refresh). This varies by
+# deployment — e.g. a reverse proxy may expose it at /server/auth rather than
+# /api/auth. fabric-vibe auth refresh appends /login or /refresh as needed.
+Write-Host ""
+Write-Host "-- MCP auth URL"
+$defaultAuthUrl = "$($mcpServerUrl.TrimEnd('/'))/api/auth"
+if ($env:FABRIC_MCP_AUTH_URL) {
+    Write-Host "  FABRIC_MCP_AUTH_URL already set - keeping $($env:FABRIC_MCP_AUTH_URL)"
+} else {
+    $authUrl = Read-Host "  FABRIC_MCP_AUTH_URL [$defaultAuthUrl]"
+    if (-not $authUrl) { $authUrl = $defaultAuthUrl }
+    [System.Environment]::SetEnvironmentVariable("FABRIC_MCP_AUTH_URL", $authUrl, "User")
+    $env:FABRIC_MCP_AUTH_URL = $authUrl
+    $Actions.Add("FABRIC_MCP_AUTH_URL persisted to OS user environment (registry)")
+}
+
 # -- MCP API key -------------------------------------------------------------
 # The MCP server validates this key and issues a short-lived JWT. fabric-vibe
-# auth refresh reads FABRIC_MCP_API_KEY, calls /auth/login, and injects the JWT
-# into the MCP client headers. The key is persisted to the OS user environment
-# (registry), not to .env, so it is never committed to the repository.
+# auth refresh reads FABRIC_MCP_API_KEY, calls FABRIC_MCP_AUTH_URL/login, and
+# injects the JWT into the MCP client auth config. The key is persisted to the OS
+# user environment (registry), not to .env, so it is never committed.
 Write-Host ""
 Write-Host "-- MCP API key"
 if ($env:FABRIC_MCP_API_KEY) {
@@ -198,22 +214,22 @@ if ($env:FABRIC_MCP_API_KEY) {
 }
 
 # -- MCP client config (.mcp.json) -------------------------------------------
-# Write url only; fabric-vibe auth refresh calls /auth/login with FABRIC_MCP_API_KEY
-# and writes the returned JWT into the MCP client headers below.
+# Write url only; fabric-vibe auth refresh calls FABRIC_MCP_AUTH_URL/login with
+# FABRIC_MCP_API_KEY and writes the returned JWT into the MCP client auth config below.
 $McpJson = Join-Path $ProjectRoot ".mcp.json"
 $mcpUrl  = "$($mcpServerUrl.TrimEnd('/'))/mcp"
 $mcpDoc  = [ordered]@{ mcpServers = [ordered]@{ "fabric-server" = [ordered]@{ type = "http"; url = $mcpUrl } } }
 $mcpDoc | ConvertTo-Json -Depth 5 | Set-Content -LiteralPath $McpJson -Encoding utf8
 $Actions.Add(".mcp.json written ($mcpUrl)")
 
-# Keep Codex's MCP config url aligned (auth header is written by fabric-vibe auth refresh).
+# Keep Codex's MCP config url aligned (auth config is written by fabric-vibe auth refresh).
 $CodexConfig = Join-Path $ProjectRoot ".codex/config.toml"
 if (Test-Path -LiteralPath $CodexConfig) {
     $lines    = [System.IO.File]::ReadAllLines($CodexConfig)
     $out      = [System.Collections.Generic.List[string]]::new()
     $inFabric = $false
     foreach ($line in $lines) {
-        if ($line -match '^\[mcp_servers\.fabric-server\]') { $inFabric = $true;  $out.Add($line); continue }
+        if ($line -match '^\[mcp_servers\.(?:"fabric-server"|fabric-server|fabric_server)\]') { $inFabric = $true;  $out.Add("[mcp_servers.fabric_server]"); continue }
         if ($line -match '^\[')                             { $inFabric = $false }
         if ($inFabric -and $line -match '^\s*url\s*=')     { $out.Add("url = `"$mcpUrl`""); continue }
         $out.Add($line)
@@ -227,7 +243,7 @@ Write-Host ""
 Write-Host "-- MCP client token"
 fabric-vibe auth refresh
 if ($LASTEXITCODE -ne 0) { Write-Warning "MCP token refresh failed; run 'fabric-vibe auth refresh' manually." }
-else { $Actions.Add("MCP token written to MCP client headers") }
+else { $Actions.Add("MCP token written to MCP client auth config") }
 
 # -- Authenticate ------------------------------------------------------------
 # Use explicit SPN login. fab does NOT pick up AZURE_* env vars implicitly —

{fabric_vibecoding_settings-0.2 → fabric_vibecoding_settings-0.3}/cli/setup/setup.sh

@@ -4,8 +4,7 @@
 # Scope: configure the user's laptop so Claude/Codex can talk to the Fabric
 # MCP server AND drive the local Fabric CLI (fab) for notebook / pipeline /
 # lakehouse / workspace work. The MCP server itself lives in Docker — start
-# it separately with `docker compose up --build` from the source repo's
-# `server/` directory.
+# it separately with `docker compose up --build` from the source repo root.
 #
 # This script:
 #   1. Verifies uv is installed.
@@ -16,10 +15,11 @@
 #      profile (NOT .env — secrets stay in the OS env).
 #   6. Prompts for MCP_SERVER_URL and the FABRIC_MCP_API_KEY (from server admin).
 #      The API key is persisted to the shell profile (chmod 600), not .env.
-#   7. Writes .mcp.json and patches .codex/config.toml's [mcp_servers.fabric-server]
+#   7. Writes .mcp.json and patches .codex/config.toml's [mcp_servers.fabric_server]
 #      url (if installed).
-#   8. Runs fabric-vibe auth refresh, which calls /auth/login with the API key,
-#      receives a short-lived JWT, and writes it into the MCP client headers.
+#   8. Prompts for FABRIC_MCP_AUTH_URL (auth service base URL; defaults to
+#      MCP_SERVER_URL/api/auth) and FABRIC_MCP_API_KEY (from server admin).
+#      Runs fabric-vibe auth refresh to obtain a short-lived JWT.
 #   9. Verifies SPN auth by calling `fab api workspaces`.
 #  10. Runs fabric-vibe workspace init to populate workspaces.json.
 #  11. Prompts to select the active workspace.
@@ -205,11 +205,28 @@ else
   mcp_server_url="${mcp_server_url:-http://127.0.0.1:8000}"
 fi
 
+# ── MCP auth URL ─────────────────────────────────────────────────────────────
+# Base URL for the auth service (without /login or /refresh). This varies by
+# deployment — e.g. a reverse proxy may expose it at /server/auth rather than
+# /api/auth. fabric-vibe auth refresh appends /login or /refresh as needed.
+echo ""
+echo "-- MCP auth URL"
+_default_auth_url="${mcp_server_url%/}/api/auth"
+if [[ -n "${FABRIC_MCP_AUTH_URL:-}" ]]; then
+  echo "  FABRIC_MCP_AUTH_URL already set — keeping ${FABRIC_MCP_AUTH_URL}"
+else
+  read -rp "  FABRIC_MCP_AUTH_URL [${_default_auth_url}]: " FABRIC_MCP_AUTH_URL
+  FABRIC_MCP_AUTH_URL="${FABRIC_MCP_AUTH_URL:-${_default_auth_url}}"
+  export FABRIC_MCP_AUTH_URL
+  persist_secret "FABRIC_MCP_AUTH_URL" "${FABRIC_MCP_AUTH_URL}"
+  actions+=("FABRIC_MCP_AUTH_URL persisted to shell profile")
+fi
+
 # ── MCP API key ───────────────────────────────────────────────────────────────
 # The MCP server validates this key and issues a short-lived JWT. fabric-vibe
-# auth refresh reads FABRIC_MCP_API_KEY, calls /auth/login, and injects the JWT
-# into the MCP client headers. The key is persisted to the shell profile (chmod
-# 600), not to .env, so it is never committed to the repository.
+# auth refresh reads FABRIC_MCP_API_KEY, calls FABRIC_MCP_AUTH_URL/login, and
+# injects the JWT into the MCP client auth config. The key is persisted to the
+# shell profile (chmod 600), not to .env, so it is never committed.
 echo ""
 echo "-- MCP API key"
 if [[ -n "${FABRIC_MCP_API_KEY:-}" ]]; then
@@ -224,8 +241,8 @@ else
 fi
 
 # ── MCP client config (.mcp.json) ─────────────────────────────────────────────
-# Write url only; fabric-vibe auth refresh calls /auth/login with FABRIC_MCP_API_KEY
-# and writes the returned JWT into the MCP client headers below.
+# Write url only; fabric-vibe auth refresh calls FABRIC_MCP_AUTH_URL/login with
+# FABRIC_MCP_API_KEY and writes the returned JWT into the MCP client auth config below.
 MCP_JSON="${PROJECT_ROOT}/.mcp.json"
 mcp_url="${mcp_server_url%/}/mcp"
 cat > "$MCP_JSON" <<EOF
@@ -240,12 +257,12 @@ cat > "$MCP_JSON" <<EOF
 EOF
 actions+=(".mcp.json written (${mcp_url})")
 
-# Keep Codex's MCP config url aligned (auth header written by fabric-vibe auth refresh).
+# Keep Codex's MCP config url aligned (auth config written by fabric-vibe auth refresh).
 CODEX_CONFIG="${PROJECT_ROOT}/.codex/config.toml"
 if [[ -f "$CODEX_CONFIG" ]]; then
   _codex_tmp="$(mktemp)"
   awk -v url="$mcp_url" '
-    /^\[mcp_servers\.fabric-server\]/ { print; in_section=1; next }
+    /^\[mcp_servers\.("fabric-server"|fabric-server|fabric_server)\]/ { print "[mcp_servers.fabric_server]"; in_section=1; next }
     /^\[/                             { in_section=0 }
     in_section && /^[[:space:]]*url[[:space:]]*=/ { print "url = \"" url "\""; next }
     { print }
@@ -257,7 +274,7 @@ fi
 echo ""
 echo "-- MCP client token"
 if fabric-vibe auth refresh; then
-  actions+=("MCP token written to MCP client headers")
+  actions+=("MCP token written to MCP client auth config")
 else
   echo "  MCP token refresh failed; run 'fabric-vibe auth refresh' manually." >&2
 fi
@@ -304,6 +321,6 @@ echo "Setup complete."
 for a in "${actions[@]}"; do echo "- $a"; done
 echo ""
 echo "Next: start the Fabric MCP server."
-echo "  cd <fabric-vibecoding-settings>/server"
+echo "  cd <fabric-vibecoding-settings>"
 echo "  docker compose up --build"
 echo "Then open Claude Code (or Codex) in this project."

{fabric_vibecoding_settings-0.2 → fabric_vibecoding_settings-0.3}/cli/src/fabric_skills_settings/runtime_cli.py

@@ -198,7 +198,7 @@ def precommit(ctx: typer.Context) -> None:
 
 @auth_app.command("refresh", context_settings=_PASSTHROUGH_CONTEXT)
 def auth_refresh(ctx: typer.Context) -> None:
-    """Generate the MCP identity key, sign your email, and update MCP configs."""
+    """Exchange FABRIC_MCP_API_KEY for a short-lived JWT and inject it into MCP client configs."""
     script = _require_tool_script(Path("auth/refresh.py"))
     raise typer.Exit(code=_dispatch_python(script, ctx.args))
 

fabric_vibecoding_settings-0.3/cli/tools/auth/refresh.py

@@ -0,0 +1,333 @@
+#!/usr/bin/env python3
+"""Fetch a short-lived JWT from the MCP server using an API key.
+
+Saves the JWT into the Claude and Codex MCP client configuration files so
+Claude Code and Codex pick it up on next session load. Each run mints a fresh
+token so client configs recover from server restarts, signing-secret rotation,
+or server-side token-store resets.
+
+The API key is read from FABRIC_MCP_API_KEY. If that variable is not set,
+the command prompts for it interactively (input is hidden).
+
+The auth service base URL is read from FABRIC_MCP_AUTH_URL (e.g.
+https://host/server/auth). If not set, it defaults to
+{MCP_SERVER_URL}/api/auth. Pass --auth-url to override at runtime.
+
+Usage:
+    fabric-vibe auth refresh [--server-url https://host:port]
+"""
+
+from __future__ import annotations
+
+import base64
+import getpass
+import json
+import os
+import re
+import sys
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+from datetime import datetime
+from pathlib import Path
+
+ROOT = Path.cwd()
+
+_STATE_DIR = Path.home() / ".fabric-vibecoding"
+_TOKEN_FILE = _STATE_DIR / "mcp-token.json"
+_REFRESH_MARGIN = 300  # refresh when fewer than 5 min remain
+_CODEX_MCP_SECTION = "mcp_servers.fabric_server"
+_CODEX_MCP_HEADERS_SECTION = "mcp_servers.fabric_server.http_headers"
+
+
+# ── JWT expiry helper (no external deps) ─────────────────────────────────────
+
+def _jwt_expiry(token: str) -> float | None:
+    """Extract the exp claim from a JWT payload without verifying the signature."""
+    try:
+        parts = token.split(".")
+        if len(parts) != 3:
+            return None
+        padding = "=" * (-len(parts[1]) % 4)
+        payload = json.loads(base64.urlsafe_b64decode(parts[1] + padding).decode("utf-8"))
+        return float(payload["exp"])
+    except Exception:
+        return None
+
+
+# ── Persisted token ───────────────────────────────────────────────────────────
+
+def _load_saved_token() -> tuple[str, float] | tuple[None, None]:
+    if not _TOKEN_FILE.exists():
+        return None, None
+    try:
+        data = json.loads(_TOKEN_FILE.read_text(encoding="utf-8"))
+        return data.get("token"), float(data.get("expires_at", 0))
+    except Exception:
+        return None, None
+
+
+def _save_token(token: str, expires_at: float) -> None:
+    _STATE_DIR.mkdir(parents=True, exist_ok=True)
+    _TOKEN_FILE.write_text(
+        json.dumps({"token": token, "expires_at": expires_at}), encoding="utf-8"
+    )
+    try:
+        os.chmod(_TOKEN_FILE, 0o600)
+    except OSError:
+        pass
+
+
+# ── URL resolution ────────────────────────────────────────────────────────────
+
+def _resolve_server_url(argv: list[str], root: Path) -> str:
+    """Resolve MCP server base URL from --server-url arg, env, or .mcp.json."""
+    if "--server-url" in argv:
+        idx = argv.index("--server-url")
+        if idx + 1 < len(argv):
+            return argv[idx + 1].rstrip("/")
+    url = os.environ.get("MCP_SERVER_URL", "").strip().rstrip("/")
+    if url:
+        return url
+    mcp_json = root / ".mcp.json"
+    if mcp_json.exists():
+        try:
+            doc = json.loads(mcp_json.read_text(encoding="utf-8-sig"))
+            raw = doc.get("mcpServers", {}).get("fabric-server", {}).get("url", "")
+            if raw:
+                return raw.rstrip("/").removesuffix("/mcp")
+        except Exception:
+            pass
+    return "http://127.0.0.1:8000"
+
+
+def _resolve_auth_base_url(argv: list[str], server_url: str) -> str:
+    """Resolve auth service base URL.
+
+    Priority: --auth-url flag > FABRIC_MCP_AUTH_URL env var > {server_url}/api/auth.
+
+    The base URL is the path up to but not including /login or /refresh,
+    e.g. https://host/server/auth or https://host/api/auth.
+    """
+    if "--auth-url" in argv:
+        idx = argv.index("--auth-url")
+        if idx + 1 < len(argv):
+            return argv[idx + 1].rstrip("/")
+    url = os.environ.get("FABRIC_MCP_AUTH_URL", "").strip().rstrip("/")
+    if url:
+        return url
+    return f"{server_url}/api/auth"
+
+
+# ── API key resolution ────────────────────────────────────────────────────────
+
+def _prompt_api_key() -> str | None:
+    """Return the API key from env or an interactive prompt. Returns None to skip."""
+    key = os.environ.get("FABRIC_MCP_API_KEY", "").strip()
+    if key:
+        return key
+    print("  FABRIC_MCP_API_KEY is not set.")
+    try:
+        key = getpass.getpass("  Enter your MCP API key (empty to skip): ").strip()
+    except (EOFError, KeyboardInterrupt):
+        print()
+        return None
+    return key or None
+
+
+# ── Token fetch / refresh ─────────────────────────────────────────────────────
+
+def _post(url: str, body: bytes, headers: dict[str, str]) -> tuple[int, dict]:
+    req = urllib.request.Request(url, data=body, headers=headers, method="POST")
+    try:
+        with urllib.request.urlopen(req, timeout=10) as resp:
+            return resp.status, json.loads(resp.read().decode("utf-8"))
+    except urllib.error.HTTPError as exc:
+        try:
+            return exc.code, json.loads(exc.read().decode("utf-8"))
+        except Exception:
+            return exc.code, {"error": exc.reason}
+    except Exception as exc:
+        raise SystemExit(f"Cannot reach MCP server at {url}: {exc}") from exc
+
+
+def _discover_token_endpoint(server_url: str) -> str | None:
+    """Fetch /.well-known/oauth-authorization-server and return the token_endpoint.
+
+    Returns None if the endpoint is unreachable or the server has no OAuth2 AS.
+    """
+    discovery_url = f"{server_url}/.well-known/oauth-authorization-server"
+    req = urllib.request.Request(discovery_url, method="GET")
+    try:
+        with urllib.request.urlopen(req, timeout=5) as resp:
+            if resp.status == 200:
+                meta = json.loads(resp.read().decode("utf-8"))
+                return meta.get("token_endpoint") or None
+    except Exception:
+        pass
+    return None
+
+
+def _fetch_token(server_url: str, api_key: str) -> tuple[str, float]:
+    """Exchange an API key for a JWT.
+
+    Discovers the token endpoint from the server's OAuth2 AS metadata
+    (``/.well-known/oauth-authorization-server``) and uses the standard
+    client_credentials grant. Falls back to the legacy JSON endpoint
+    (``{server_url}/api/auth/login``) for servers that pre-date OAuth2 support.
+    """
+    # ── OAuth2 client credentials — endpoint discovered at runtime ────────────
+    oauth_url = _discover_token_endpoint(server_url)
+    if oauth_url:
+        form_body = urllib.parse.urlencode({
+            "grant_type": "client_credentials",
+            "client_id": api_key,
+        }).encode("ascii")
+        status, body = _post(oauth_url, form_body, {"Content-Type": "application/x-www-form-urlencoded"})
+        if status == 200:
+            token = body.get("access_token", "")
+            if token:
+                expires_in = body.get("expires_in", 3600)
+                expires_at = body.get("expires_at") or (time.time() + expires_in)
+                return token, float(expires_at)
+        if status not in (404, 405):
+            raise SystemExit(f"OAuth2 token request failed ({status}): {body.get('error', body)}")
+
+    # ── Legacy JSON endpoint (backward compat) ────────────────────────────────
+    legacy_url = f"{server_url}/api/auth/login"
+    status, body = _post(
+        legacy_url,
+        json.dumps({"api_key": api_key}).encode("utf-8"),
+        {"Content-Type": "application/json"},
+    )
+    if status == 404:
+        raise SystemExit(
+            f"No auth endpoint found at {server_url}.\n"
+            "Check FABRIC_MCP_API_KEY and MCP_SERVER_URL."
+        )
+    if status != 200:
+        raise SystemExit(f"Login failed ({status}): {body.get('error', body)}")
+    token = body.get("token", "")
+    if not token:
+        raise SystemExit(f"Server returned no token: {body}")
+    expires_at = body.get("expires_at") or _jwt_expiry(token) or (time.time() + 3600)
+    return token, float(expires_at)
+
+
+def _refresh_token(auth_base_url: str, current_token: str) -> tuple[str, float] | tuple[None, None]:
+    """POST to {auth_base_url}/refresh. Returns (new_token, expires_at) or (None, None)."""
+    status, body = _post(
+        f"{auth_base_url}/refresh",
+        b"",
+        {"Content-Type": "application/json", "Authorization": f"Bearer {current_token}"},
+    )
+    if status != 200:
+        return None, None
+    token = body.get("token", "")
+    if not token:
+        return None, None
+    expires_at = body.get("expires_at") or _jwt_expiry(token) or (time.time() + 3600)
+    return token, float(expires_at)
+
+
+# ── Config injection ──────────────────────────────────────────────────────────
+
+def update_mcp_json(root: Path, token: str) -> None:
+    mcp_json = root / ".mcp.json"
+    if not mcp_json.exists():
+        print(f"  .mcp.json not found at {mcp_json}; skipping", file=sys.stderr)
+        return
+    doc = json.loads(mcp_json.read_text(encoding="utf-8-sig"))
+    (
+        doc.setdefault("mcpServers", {})
+        .setdefault("fabric-server", {})
+        .setdefault("headers", {})["Authorization"]
+    ) = f"Bearer {token}"
+    mcp_json.write_text(json.dumps(doc, indent=2) + "\n", encoding="utf-8")
+    print("  Updated .mcp.json")
+
+
+def _normalize_codex_mcp_section_names(text: str) -> str:
+    """Migrate old hyphenated Codex MCP ids to the stable tool namespace id."""
+    text = re.sub(
+        r'^\[mcp_servers\.(?:"fabric-server"|fabric-server)\]$',
+        f"[{_CODEX_MCP_SECTION}]",
+        text,
+        flags=re.MULTILINE,
+    )
+    return re.sub(
+        r'^\[mcp_servers\.(?:"fabric-server"|fabric-server|fabric_server)\.(?:headers|http_headers)\]$',
+        f"[{_CODEX_MCP_HEADERS_SECTION}]",
+        text,
+        flags=re.MULTILINE,
+    )
+
+
+def _upsert_toml_section_key(text: str, section: str, key: str, value: str) -> str:
+    header = f"[{section}]"
+    key_line = f'{key} = "{value}"'
+    section_re = re.compile(
+        rf"(^\[{re.escape(section)}\]\r?\n)(.*?)(?=^\[|\Z)",
+        flags=re.MULTILINE | re.DOTALL,
+    )
+    match = section_re.search(text)
+    if not match:
+        return text.rstrip() + f"\n\n{header}\n{key_line}\n"
+
+    body = match.group(2)
+    if re.search(rf"^\s*{re.escape(key)}\s*=", body, flags=re.MULTILINE):
+        body = re.sub(
+            rf"^\s*{re.escape(key)}\s*=.*$",
+            key_line,
+            body,
+            flags=re.MULTILINE,
+        )
+    else:
+        body = body.rstrip() + f"\n{key_line}\n"
+    return text[: match.start(2)] + body + text[match.end(2):]
+
+
+def update_codex_config(root: Path, token: str) -> None:
+    config = root / ".codex" / "config.toml"
+    if not config.exists():
+        return
+    text = _normalize_codex_mcp_section_names(config.read_text(encoding="utf-8"))
+    text = _upsert_toml_section_key(
+        text,
+        _CODEX_MCP_HEADERS_SECTION,
+        "Authorization",
+        f"Bearer {token}",
+    )
+    config.write_text(text, encoding="utf-8")
+    print("  Updated .codex/config.toml")
+
+
+# ── Entry point ───────────────────────────────────────────────────────────────
+
+def main(argv: list[str] | None = None) -> int:
+    argv = sys.argv[1:] if argv is None else argv
+
+    api_key = _prompt_api_key()
+    if not api_key:
+        print("  No API key provided — skipping auth.")
+        return 0
+
+    server_url = _resolve_server_url(argv, ROOT)
+    # Always mint a fresh token. A cached JWT can be timestamp-valid but still
+    # rejected after a server restart, signing-secret rotation, or JTI-store reset.
+    # _fetch_token tries OAuth2 client_credentials first, legacy JSON second.
+    token, expires_at = _fetch_token(server_url, api_key)
+
+    _save_token(token, expires_at)
+    update_mcp_json(ROOT, token)
+    update_codex_config(ROOT, token)
+
+    expiry_str = datetime.fromtimestamp(expires_at).strftime("%Y-%m-%d %H:%M:%S")
+    print(f"\nMCP token written to client config. Expires: {expiry_str}")
+    print("Reload your Claude Code / Codex session to pick up the new token.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

{fabric_vibecoding_settings-0.2 → fabric_vibecoding_settings-0.3}/pyproject.toml

@@ -19,7 +19,7 @@ fabric-vibecoding-agents = "fabric_skills_settings.cli:app"
 fabric-vibe = "fabric_skills_settings.runtime_cli:app"
 
 [dependency-groups]
-dev = ["pytest>=8", "Faker>=26", "mimesis>=18", "scikit-learn>=1.5", "pandas>=2", "networkx>=3.2", "rank_bm25>=0.2.2", "PyJWT>=2.8", "mcp>=1.0", "uvicorn>=0.30"]
+dev = ["pytest>=8", "Faker>=26", "mimesis>=18", "scikit-learn>=1.5", "pandas>=2", "networkx>=3.2", "rank_bm25>=0.2.2", "PyJWT>=2.8", "mcp>=1.0", "uvicorn>=0.30", "sqlalchemy>=2.0"]
 
 [project.optional-dependencies]
 graph = ["networkx>=3.2", "rank_bm25>=0.2.2"]
@@ -31,11 +31,6 @@ server = [
     "rank_bm25>=0.2.2",
     "PyJWT>=2.8",
 ]
-# Only needed when FABRIC_MCP_API_KEYS_SOURCE=azure-blob. File mode needs nothing extra.
-server-azure = [
-    "azure-storage-blob>=12.19",
-    "azure-identity>=1.16",
-]
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]

{fabric_vibecoding_settings-0.2 → fabric_vibecoding_settings-0.3}/server/Dockerfile

@@ -12,16 +12,14 @@ COPY server /build/server
 
 # Runtime deps only. We do NOT install ms-fabric-cli — fab-dependent tools
 # live in cli/ and run on the user's laptop, not in this container.
-# For FABRIC_MCP_API_KEYS_SOURCE=azure-blob, also add the 'server-azure' extra
-# packages here: "azure-storage-blob>=12.19" "azure-identity>=1.16". They are
-# omitted by default to keep the file-source image lean.
 RUN uv pip install --system --no-cache \
     "mcp>=1.0" \
     "uvicorn>=0.30" \
     "pydantic>=2.7" \
     "networkx>=3.2" \
     "rank_bm25>=0.2.2" \
-    "PyJWT>=2.8"
+    "PyJWT>=2.8" \
+    "sqlalchemy>=2.0"
 
 # Build the knowledge graph from server/content + server/skills.
 # Output: /build/dist/.graph/{graph.json, graph-bm25.pkl, materialized-graph.{html,svg}}
@@ -37,6 +35,14 @@ COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/pytho
 COPY --from=builder /build/server                /app/server
 COPY --from=builder /build/dist/.graph           /app/dist/.graph
 
+# Create managed content directories (volume-mounted at runtime for persistence).
+RUN mkdir -p /app/server/managed/skills \
+             /app/server/managed/content/rules \
+             /app/server/managed/content/skill-fixes \
+             /app/server/managed/content/memory && \
+    mkdir -p /config && \
+    chown -R server:server /app/server/managed /config
+
 WORKDIR /app
 USER server
 EXPOSE 8000