nocfo-cli 1.5.3__tar.gz → 1.9.0__tar.gz

{nocfo_cli-1.5.3 → nocfo_cli-1.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: nocfo-cli
-Version: 1.5.3
+Version: 1.9.0
 Summary: NoCFO CLI, MCP server, and Cursor skill toolkit.
 License: MIT
 License-File: LICENSE

{nocfo_cli-1.5.3 → nocfo_cli-1.9.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "poetry.core.masonry.api"
 
 [tool.poetry]
 name = "nocfo-cli"
-version = "1.5.3"
+version = "1.9.0"
 description = "NoCFO CLI, MCP server, and Cursor skill toolkit."
 authors = ["NoCFO"]
 readme = "README.md"

{nocfo_cli-1.5.3 → nocfo_cli-1.9.0}/src/nocfo_toolkit/cli/app.py

@@ -121,19 +121,12 @@ def run_mcp_server(
             "context by exposing search_tools + call_tool."
         ),
     ),
-    skip_confirmation: bool = typer.Option(
-        False,
-        "--skip-confirmation/--require-confirmation",
-        help=(
-            "Skip interactive mutation confirmation elicitation. "
-            "Use only in trusted automation environments."
-        ),
-    ),
 ) -> None:
     """Run NoCFO MCP server over stdio or HTTP transport.
 
     Stdio mode accepts either NOCFO_JWT_TOKEN or NOCFO_API_TOKEN.
-    Optional NOCFO_CLIENT overrides default `nocfo-mcp` x-nocfo-client.
+    Optional NOCFO_CLIENT overrides default `nocfo-mcp` x-nocfo-client header.
+    Use `nocfo-agent` for internal agent MCP and `nocfo-mcp` for external MCP.
     HTTP oauth mode uses connector bearer verification + JWT exchange flow.
     """
 
@@ -173,12 +166,6 @@ def run_mcp_server(
         if env_tool_search
         else tool_search
     )
-    env_skip_confirmation = os.getenv("NOCFO_MCP_SKIP_CONFIRMATION", "").strip().lower()
-    skip_confirmation_enabled = (
-        env_skip_confirmation in {"1", "true", "yes", "on"}
-        if env_skip_confirmation
-        else skip_confirmation
-    )
 
     options = MCPServerOptions(
         auth_mode=auth_mode_value,
@@ -186,7 +173,6 @@ def run_mcp_server(
         required_scopes=scope_items,
         stateless_http=stateless_http,
         tool_search=tool_search_enabled,
-        skip_confirmation=skip_confirmation_enabled,
     )
 
     if transport_normalized == "http":

{nocfo_cli-1.5.3 → nocfo_cli-1.9.0}/src/nocfo_toolkit/config.py

@@ -20,6 +20,10 @@ except ModuleNotFoundError:  # pragma: no cover - fallback for minimal environme
 DEFAULT_BASE_URL = "https://api-prd.nocfo.io"
 AUTH_HEADER_SCHEME = "Token"
 MIN_PAT_LENGTH = 8
+NOCFO_CLIENT_HEADER = "x-nocfo-client"
+NOCFO_CLIENT_MCP = "nocfo-mcp"
+NOCFO_CLIENT_AGENT = "nocfo-agent"
+NOCFO_CLIENT_DEFAULT = NOCFO_CLIENT_MCP
 
 
 class OutputFormat(str, Enum):

{nocfo_cli-1.5.3 → nocfo_cli-1.9.0}/src/nocfo_toolkit/mcp/auth.py

@@ -23,7 +23,12 @@ from starlette.datastructures import MutableHeaders
 from starlette.responses import JSONResponse, Response
 from starlette.routing import Route
 
-from nocfo_toolkit.config import AUTH_HEADER_SCHEME, ToolkitConfig
+from nocfo_toolkit.config import (
+    AUTH_HEADER_SCHEME,
+    NOCFO_CLIENT_DEFAULT,
+    NOCFO_CLIENT_HEADER,
+    ToolkitConfig,
+)
 
 logger = logging.getLogger(__name__)
 
@@ -47,11 +52,21 @@ def _split_csv(raw: str | None) -> list[str]:
 
 
 def _incoming_mcp_client() -> str | None:
-    headers = get_http_headers(include={"x-nocfo-client"})
-    nocfo_client = (headers.get("x-nocfo-client") or "").strip()
+    headers = get_http_headers(include={NOCFO_CLIENT_HEADER})
+    nocfo_client = (headers.get(NOCFO_CLIENT_HEADER) or "").strip()
     return nocfo_client or None
 
 
+def resolve_nocfo_client(*, default_client: str | None = None) -> str:
+    """Resolve x-nocfo-client from incoming MCP request or configured default."""
+    incoming_client = _incoming_mcp_client()
+    if incoming_client:
+        return incoming_client
+    if default_client:
+        return default_client
+    return NOCFO_CLIENT_DEFAULT
+
+
 @dataclass(frozen=True)
 class MCPAuthOptions:
     """Runtime auth settings used by the MCP server."""
@@ -265,11 +280,13 @@ class JwtExchangeAuth(httpx.Auth):
         *,
         exchange_path: str = "/auth/jwt/",
         refresh_skew_seconds: int = 60,
+        default_client: str | None = None,
     ) -> None:
         self._exchange_path = (
             exchange_path if exchange_path.startswith("/") else f"/{exchange_path}"
         )
         self._refresh_skew_seconds = max(0, refresh_skew_seconds)
+        self._default_client = default_client
         self._cache: dict[str, tuple[str, int | None]] = {}
         self._locks: dict[str, asyncio.Lock] = {}
 
@@ -312,7 +329,7 @@ class JwtExchangeAuth(httpx.Auth):
         bearer_token = access.token if access else None
         if not bearer_token:
             raise RuntimeError("Missing OAuth bearer token for MCP request.")
-        incoming_nocfo_client = _incoming_mcp_client()
+        nocfo_client = resolve_nocfo_client(default_client=self._default_client)
 
         claims = access.claims if access and isinstance(access.claims, dict) else {}
         cache_key = self._cache_key(bearer_token, claims)
@@ -332,11 +349,7 @@ class JwtExchangeAuth(httpx.Auth):
                             "Authorization": f"Bearer {bearer_token}",
                             "Content-Type": "application/json",
                             "Accept": "application/json",
-                            **(
-                                {"x-nocfo-client": incoming_nocfo_client}
-                                if incoming_nocfo_client
-                                else {}
-                            ),
+                            NOCFO_CLIENT_HEADER: nocfo_client,
                         },
                         content=b"{}",
                     )
@@ -382,23 +395,25 @@ class JwtExchangeAuth(httpx.Auth):
                     self._cache[cache_key] = (jwt_token, self._decode_exp(jwt_token))
 
         request.headers["Authorization"] = f"{AUTH_HEADER_SCHEME} {jwt_token}"
-        if incoming_nocfo_client:
-            request.headers["x-nocfo-client"] = incoming_nocfo_client
+        request.headers[NOCFO_CLIENT_HEADER] = nocfo_client
         yield request
 
 
 class PassthroughAuth(httpx.Auth):
     """Forward incoming HTTP Authorization header to downstream API requests."""
 
+    def __init__(self, *, default_client: str | None = None) -> None:
+        self._default_client = default_client
+
     async def async_auth_flow(self, request: httpx.Request):
-        headers = get_http_headers(include={"authorization", "x-nocfo-client"})
+        headers = get_http_headers(include={"authorization", NOCFO_CLIENT_HEADER})
         authorization = headers.get("authorization")
         if not authorization:
             raise RuntimeError("Missing Authorization header for MCP passthrough mode.")
         request.headers["Authorization"] = authorization
-        nocfo_client = (headers.get("x-nocfo-client") or "").strip()
-        if nocfo_client:
-            request.headers["x-nocfo-client"] = nocfo_client
+        request.headers[NOCFO_CLIENT_HEADER] = resolve_nocfo_client(
+            default_client=self._default_client
+        )
         yield request
 
 

nocfo_cli-1.9.0/src/nocfo_toolkit/mcp/curated/batch.py

@@ -0,0 +1,95 @@
+"""Sequential, best-effort batch runner for mutating curated MCP tools.
+
+One tool call targets many resources, so one confirmation covers the whole batch.
+Each target runs the tool's existing single-target logic; a failing target is
+captured as a failed result instead of aborting the batch.
+"""
+
+from __future__ import annotations
+
+import json
+from collections.abc import Awaitable, Callable, Sequence
+from typing import Any
+
+from fastmcp.exceptions import ToolError
+
+from nocfo_toolkit.mcp.curated.errors import raise_tool_error
+from nocfo_toolkit.mcp.curated.schemas import (
+    BatchItemResult,
+    BatchResponse,
+    ToolErrorPayload,
+    dump_model,
+)
+
+
+def _error_payload(exc: ToolError) -> ToolErrorPayload:
+    raw = exc.args[0] if exc.args else str(exc)
+    try:
+        data = json.loads(raw)
+    except (TypeError, ValueError):
+        data = None
+    if isinstance(data, dict):
+        try:
+            return ToolErrorPayload.model_validate(data)
+        except Exception:  # noqa: BLE001 - fall back to a plain message payload
+            pass
+    return ToolErrorPayload(error_type="tool_error", message=str(raw))
+
+
+async def run_batch(
+    targets: Sequence[Any],
+    handler: Callable[[Any], Awaitable[dict[str, Any]]],
+    *,
+    label: Callable[[Any], Any] = lambda target: target,
+) -> dict[str, Any]:
+    """Run ``handler`` for each target, aggregating per-target results.
+
+    ``handler`` returns the same dict a single-target tool would return.
+    ``label`` maps a target to the value echoed back in ``results[].target``.
+    """
+    if not targets:
+        raise_tool_error(
+            "invalid_request",
+            "No targets provided for this batch operation.",
+            "Provide at least one target (id, number, tool_handle, or payload).",
+            status_code=400,
+        )
+    results: list[BatchItemResult] = []
+    for target in targets:
+        # Resolve the echo key once, fault-isolated, so a misbehaving label callable
+        # can never abort the batch or mislabel a target across branches.
+        try:
+            key = label(target)
+        except Exception:  # noqa: BLE001 - labelling must never abort the batch
+            key = None
+        try:
+            payload = await handler(target)
+            results.append(BatchItemResult(ok=True, target=key, result=payload))
+        except ToolError as exc:
+            results.append(
+                BatchItemResult(ok=False, target=key, error=_error_payload(exc))
+            )
+        except Exception as exc:  # noqa: BLE001 - isolate unexpected per-target failures
+            # Keep the batch best-effort: a non-ToolError (e.g. response validation
+            # or transport error) on one target must not discard the results of the
+            # targets already processed. CancelledError/KeyboardInterrupt are
+            # BaseException and intentionally still propagate.
+            results.append(
+                BatchItemResult(
+                    ok=False,
+                    target=key,
+                    error=ToolErrorPayload(
+                        error_type="internal_error",
+                        message=str(exc) or exc.__class__.__name__,
+                    ),
+                )
+            )
+    succeeded = sum(1 for item in results if item.ok)
+    return dump_model(
+        BatchResponse(
+            total=len(results),
+            succeeded=succeeded,
+            failed=len(results) - succeeded,
+            results=results,
+        )
+    )

nocfo_cli-1.9.0/src/nocfo_toolkit/mcp/curated/bookkeeping/account.py

@@ -0,0 +1,228 @@
+"""Bookkeeping account MCP tools."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from fastmcp.tools import tool
+from fastmcp.tools.tool import ToolAnnotations
+from nocfo_toolkit.mcp.curated.batch import run_batch
+from nocfo_toolkit.mcp.curated.runtime import business_slug, get_client
+from nocfo_toolkit.mcp.curated.schemas import (
+    AccountListItem,
+    AccountListInput,
+    AccountNumbersActionInput,
+    AccountNumbersInput,
+    AccountNumbersPayloadInput,
+    AccountRetrieveInput,
+    AccountSummary,
+    ActionResponse,
+    BatchResponse,
+    DeletedResponse,
+    ListEnvelope,
+    PayloadsInput,
+    dump_model,
+    dump_model_from_backend,
+)
+from nocfo_toolkit.mcp.curated.utils import decode_tool_handle
+
+
+account_fields = (
+    "number",
+    "name",
+    "type",
+    "description",
+    "is_shown",
+    "is_used",
+    "balance",
+    "header_id",
+    "header_path",
+    "default_vat_code",
+    "default_vat_rate",
+)
+
+
+@tool(
+    name="bookkeeping_accounts_list",
+    annotations=ToolAnnotations(
+        readOnlyHint=True,
+        destructiveHint=False,
+        idempotentHint=True,
+        openWorldHint=False,
+    ),
+    description="List bookkeeping accounts by account number, account range, name query, type, usage, or visibility. Use this first to ground exact account numbers/tool_handles before updating, deleting, showing, or hiding accounts. Use account numbers when talking with users.",
+    output_schema=ListEnvelope[AccountListItem].model_json_schema(),
+)
+async def bookkeeping_accounts_list(params: AccountListInput) -> dict[str, Any]:
+    args = params
+    slug = await business_slug(args.business)
+    return await get_client().list_page(
+        f"/v1/business/{slug}/account/",
+        params=args.query_params(),
+        cursor=args.cursor,
+        limit=args.limit,
+        business_slug=slug,
+        fields=account_fields,
+        item_model=AccountListItem,
+        handle_resource="bookkeeping_account",
+        usage_hint=(
+            "For account number lookup (e.g. 1910), set number filter and then use tool_handle with "
+            "bookkeeping_account_retrieve. Before update/delete/show/hide actions, ground the exact targets here "
+            "first and then batch the confirmed account numbers into one mutation call."
+        ),
+    )
+
+
+@tool(
+    name="bookkeeping_account_retrieve",
+    annotations=ToolAnnotations(
+        readOnlyHint=True,
+        destructiveHint=False,
+        idempotentHint=True,
+        openWorldHint=False,
+    ),
+    description="Retrieve one account from bookkeeping_accounts_list.items[].tool_handle. Use this to verify an account before updating, deleting, showing, or hiding it.",
+)
+async def bookkeeping_account_retrieve(
+    params: AccountRetrieveInput,
+) -> dict[str, Any]:
+    args = params
+    slug = await business_slug(args.business)
+    account_id = decode_tool_handle(
+        args.tool_handle,
+        expected_resource="bookkeeping_account",
+    )
+    result = await get_client().request(
+        "GET",
+        f"/v1/business/{slug}/account/{account_id}/",
+        business_slug=slug,
+    )
+    return dump_model_from_backend(AccountSummary, result)
+
+
+@tool(
+    name="bookkeeping_account_create",
+    annotations=ToolAnnotations(
+        readOnlyHint=False,
+        destructiveHint=False,
+        idempotentHint=False,
+        openWorldHint=False,
+    ),
+    description="Create one or more bookkeeping accounts in a single call — pass each new account as an entry in payloads. Use account numbers and names that match the user request.",
+    output_schema=BatchResponse.model_json_schema(),
+)
+async def bookkeeping_account_create(params: PayloadsInput) -> dict[str, Any]:
+    slug = await business_slug(params.business)
+    path = f"/v1/business/{slug}/account/"
+
+    async def _create(payload: dict[str, Any]) -> dict[str, Any]:
+        result = await get_client().request(
+            "POST", path, json_body=payload, business_slug=slug
+        )
+        return dump_model_from_backend(AccountSummary, result)
+
+    return await run_batch(
+        params.payloads,
+        _create,
+        label=lambda payload: payload.get("number") or payload.get("name"),
+    )
+
+
+@tool(
+    name="bookkeeping_account_update",
+    annotations=ToolAnnotations(
+        readOnlyHint=False,
+        destructiveHint=False,
+        idempotentHint=False,
+        openWorldHint=False,
+    ),
+    description="Update one or more bookkeeping accounts selected by account_numbers; the same payload is applied to every account. Ground the exact account numbers first, then batch all confirmed targets into one call.",
+    output_schema=BatchResponse.model_json_schema(),
+)
+async def bookkeeping_account_update(
+    params: AccountNumbersPayloadInput,
+) -> dict[str, Any]:
+    slug = await business_slug(params.business)
+
+    async def _update(account_number: int) -> dict[str, Any]:
+        account_id = await get_client().resolve_id(
+            f"/v1/business/{slug}/account/",
+            lookup_field="number",
+            lookup_value=account_number,
+            business_slug=slug,
+        )
+        result = await get_client().request(
+            "PATCH",
+            f"/v1/business/{slug}/account/{account_id}/",
+            json_body=params.payload,
+            business_slug=slug,
+        )
+        return dump_model_from_backend(AccountSummary, result)
+
+    return await run_batch(params.account_numbers, _update)
+
+
+@tool(
+    name="bookkeeping_account_delete",
+    annotations=ToolAnnotations(
+        readOnlyHint=False,
+        destructiveHint=True,
+        idempotentHint=False,
+        openWorldHint=False,
+    ),
+    description="Delete one or more bookkeeping accounts in a single call — pass every target in account_numbers. Ground the exact account numbers first with bookkeeping_accounts_list and/or bookkeeping_account_retrieve, then batch all confirmed targets into one call. Never call this with guessed placeholders or an empty target set. Prefer one batched call over repeated single-target calls (each call needs its own confirmation).",
+    output_schema=BatchResponse.model_json_schema(),
+)
+async def bookkeeping_account_delete(params: AccountNumbersInput) -> dict[str, Any]:
+    slug = await business_slug(params.business)
+
+    async def _delete(account_number: int) -> dict[str, Any]:
+        account_id = await get_client().resolve_id(
+            f"/v1/business/{slug}/account/",
+            lookup_field="number",
+            lookup_value=account_number,
+            business_slug=slug,
+        )
+        await get_client().request(
+            "DELETE",
+            f"/v1/business/{slug}/account/{account_id}/",
+            business_slug=slug,
+        )
+        return dump_model(DeletedResponse(account_number=account_number))
+
+    return await run_batch(params.account_numbers, _delete)
+
+
+@tool(
+    name="bookkeeping_account_action",
+    annotations=ToolAnnotations(
+        readOnlyHint=False,
+        destructiveHint=False,
+        idempotentHint=False,
+        openWorldHint=False,
+    ),
+    description="Show or hide one or more bookkeeping accounts in a single call — pass every target in account_numbers and the same action applies to all. First obtain the exact account numbers from bookkeeping_accounts_list or bookkeeping_account_retrieve, then pass those values unchanged here. Prefer one batched call over repeated single-account calls.",
+    output_schema=BatchResponse.model_json_schema(),
+)
+async def bookkeeping_account_action(
+    params: AccountNumbersActionInput,
+) -> dict[str, Any]:
+    slug = await business_slug(params.business)
+
+    async def _act(account_number: int) -> dict[str, Any]:
+        account_id = await get_client().resolve_id(
+            f"/v1/business/{slug}/account/",
+            lookup_field="number",
+            lookup_value=account_number,
+            business_slug=slug,
+        )
+        await get_client().request(
+            "POST",
+            f"/v1/business/{slug}/account/{account_id}/{params.action.value}/",
+            business_slug=slug,
+        )
+        return dump_model(
+            ActionResponse(account_number=account_number, action=params.action.value)
+        )
+
+    return await run_batch(params.account_numbers, _act)