tavus-cli 0.8.0__tar.gz → 0.9.0__tar.gz

tavus_cli-0.9.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.9.0"
+}

{tavus_cli-0.8.0 → tavus_cli-0.9.0}/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [0.9.0](https://github.com/Tavus-Engineering/tavus-mcp/compare/v0.8.1...v0.9.0) (2026-10-09)
+
+
+### Features
+
+* **worker:** publish Tavus MCP logo metadata ([#64](https://github.com/Tavus-Engineering/tavus-mcp/issues/64)) ([e03c27c](https://github.com/Tavus-Engineering/tavus-mcp/commit/e03c27c957456c624186cbb7ce06cf06144d2bd4))
+
+## [0.8.1](https://github.com/Tavus-Engineering/tavus-mcp/compare/v0.8.0...v0.8.1) (2026-10-08)
+
+
+### Bug Fixes
+
+* sign-in for Lovable, Bolt, Replit, v0 and Cursor on the hosted MCP server ([#62](https://github.com/Tavus-Engineering/tavus-mcp/issues/62)) ([6e209d7](https://github.com/Tavus-Engineering/tavus-mcp/commit/6e209d7f59081a0a325afcc28081e374e2bb7304))
+
+
+### Miscellaneous Chores
+
+* **plugin:** add directory review test cases and release notes to Tavus PAL ([a4fc1e9](https://github.com/Tavus-Engineering/tavus-mcp/commit/a4fc1e9cf13e99c5d1dd0d18e5f026662cf336cb))
+
 ## [0.8.0](https://github.com/Tavus-Engineering/tavus-mcp/compare/v0.7.0...v0.8.0) (2026-10-08)
 
 

{tavus_cli-0.8.0 → tavus_cli-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: tavus-cli
-Version: 0.8.0
+Version: 0.9.0
 Summary: Tavus CLI and MCP server for agentic PAL creation and editing.
 Requires-Python: >=3.11
 Requires-Dist: fastmcp>=2.0.0
@@ -60,7 +60,7 @@ The API key never appears in client configuration or browser callback URLs.
 
 Dynamic client registration accepts loopback callbacks from any local client
 (Claude Code, Codex, Gemini CLI) and the hosted callbacks of Claude, ChatGPT,
-Cursor, VS Code, v0, Lovable and Replit. They are listed in `KNOWN_REMOTE_CLIENTS` in
+Cursor, VS Code, v0, Lovable, Bolt and Replit. They are listed in `KNOWN_REMOTE_CLIENTS` in
 `workers/tavus-mcp/src/oauth.ts`. To add a client, press Connect in it once,
 read its callback from the Worker's `oauth_register_rejected` log line, and add
 an entry with a test. Clients that don't use dynamic registration, such as

{tavus_cli-0.8.0 → tavus_cli-0.9.0}/README.md

@@ -38,7 +38,7 @@ The API key never appears in client configuration or browser callback URLs.
 
 Dynamic client registration accepts loopback callbacks from any local client
 (Claude Code, Codex, Gemini CLI) and the hosted callbacks of Claude, ChatGPT,
-Cursor, VS Code, v0, Lovable and Replit. They are listed in `KNOWN_REMOTE_CLIENTS` in
+Cursor, VS Code, v0, Lovable, Bolt and Replit. They are listed in `KNOWN_REMOTE_CLIENTS` in
 `workers/tavus-mcp/src/oauth.ts`. To add a client, press Connect in it once,
 read its callback from the Worker's `oauth_register_rejected` log line, and add
 an entry with a test. Clients that don't use dynamic registration, such as

{tavus_cli-0.8.0 → tavus_cli-0.9.0}/docs/chatgpt-plugin.md

@@ -17,6 +17,12 @@ No account credentials, local environment files, or test evidence are bundled.
 The portable Agent Plugins schemas validate both manifests. The package has
 its own version because listing changes do not require an MCP server release.
 
+The hosted Worker also publishes these icons at `/icon.svg` and `/icon-dark.svg`
+without authentication. Its MCP `serverInfo.icons` metadata identifies the light
+and dark variants using URLs on the server's own origin. Clients decide whether
+to display this metadata; catalog listings may require a separate logo upload.
+Changes to the hosted metadata or assets require a Worker release.
+
 For local distribution, the repository's `.agents/plugins/marketplace.json`
 points to `plugins/tavus-pal`. Add the repository root as a local marketplace
 in a supported ChatGPT/Codex desktop client, then install Tavus PAL from that

{tavus_cli-0.8.0 → tavus_cli-0.9.0}/packages/tavus/pyproject.toml

@@ -1,11 +1,11 @@
 [project]
 name = "tavus"
-version = "0.8.0" # x-release-please-version
+version = "0.9.0" # x-release-please-version
 description = "Official alias for tavus-cli, the Tavus CLI and MCP server."
 readme = "README.md"
 requires-python = ">=3.11"
 dependencies = [
-  "tavus-cli==0.8.0", # x-release-please-version
+  "tavus-cli==0.9.0", # x-release-please-version
 ]
 
 [project.urls]

{tavus_cli-0.8.0 → tavus_cli-0.9.0}/packages/tavus-mcp/pyproject.toml

@@ -1,11 +1,11 @@
 [project]
 name = "tavus-mcp"
-version = "0.8.0" # x-release-please-version
+version = "0.9.0" # x-release-please-version
 description = "Official alias for tavus-cli, which provides the tavus-mcp MCP server."
 readme = "README.md"
 requires-python = ">=3.11"
 dependencies = [
-  "tavus-cli==0.8.0", # x-release-please-version
+  "tavus-cli==0.9.0", # x-release-please-version
 ]
 
 [project.urls]

tavus_cli-0.9.0/plugins/tavus-pal/plugin.json

@@ -0,0 +1,99 @@
+{
+  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+  "name": "tavus-pal",
+  "version": "0.1.0",
+  "description": "Create, edit, and test Tavus PALs: digital humans with a face, voice, knowledge, and conversational behavior. Uses the Tavus hosted MCP server and your connected Tavus account.",
+  "author": {
+    "name": "Tavus",
+    "email": "support@tavus.io",
+    "url": "https://www.tavus.io"
+  },
+  "homepage": "https://maker.tavus.io",
+  "repository": "https://github.com/Tavus-Engineering/tavus-mcp",
+  "keywords": ["Tavus", "PAL", "digital humans", "video avatars"],
+  "extensions": {
+    "com.openai": {
+      "interface": {
+        "displayName": "Tavus PAL",
+        "shortDescription": "Create and test digital humans",
+        "longDescription": "Build and manage Tavus PALs through conversation. Choose available faces and voices, configure behavior and knowledge, run text tests, and open a video preview. Connect your Tavus account to access its resources and existing entitlements. Includes the same tools as the hosted Tavus MCP server. Custom face training, rendered video generation, PAL sales, and ownership transfers are not exposed by this integration.",
+        "developerName": "Tavus",
+        "category": "Developer Tools",
+        "capabilities": ["Create PALs", "Edit PAL behavior and knowledge", "Test conversations", "Open video previews"],
+        "websiteURL": "https://maker.tavus.io",
+        "supportURL": "https://help.tavus.io/",
+        "privacyPolicyURL": "https://www.tavus.io/privacy-policy",
+        "termsOfServiceURL": "https://www.tavus.io/terms-of-service",
+        "defaultPrompt": [
+          "Help me build a digital human that teaches conversational English.",
+          "Show my PALs and the stock faces I can use.",
+          "Help me test one of my PALs and open its video preview."
+        ],
+        "brandColor": "#140206",
+        "brandColorDark": "#FFFFFF",
+        "composerIcon": "./assets/icon.svg",
+        "composerIconDark": "./assets/icon-dark.svg",
+        "logo": "./assets/icon.svg",
+        "logoDark": "./assets/icon-dark.svg"
+      },
+      "review": {
+        "commerce": false,
+        "commerce_description": "Users access their existing Tavus account entitlements. This plugin does not sell PALs, subscriptions, or credits, collect payment details, or initiate checkout.",
+        "test_cases": {
+          "positive": [
+            {
+              "description": "List account PALs and available stock faces.",
+              "prompt": "Show my PALs and two stock faces.",
+              "tools_triggered": "tavus_pal_list, tavus_face_list",
+              "expected_behavior": "Return PALs accessible to the connected account and two stock faces with their IDs. State when the PAL list is paginated."
+            },
+            {
+              "description": "Build and verify a museum guide. This creates a disposable PAL for the remaining cases and consumes account usage.",
+              "prompt": "Help me build a museum guide that explains paintings briefly.",
+              "tools_triggered": "tavus_pal_build_and_verify",
+              "expected_behavior": "Clarify missing requirements, build the PAL, and report its saved ID and the actual verification verdict. Report a timeout or failed verification honestly; do not claim the checks passed. Use this PAL for subsequent cases."
+            },
+            {
+              "description": "Rename only the PAL created in the previous case and verify persistence.",
+              "prompt": "Rename that PAL to Museum Guide.",
+              "tools_triggered": "tavus_patch_pal, tavus_pal_get",
+              "expected_behavior": "Rename the selected test PAL to Museum Guide, then read it back to confirm the saved name. Leave unrelated PALs unchanged."
+            },
+            {
+              "description": "Run a text conversation with the test PAL and end that conversation.",
+              "prompt": "Test my guide by asking what Impressionism is, then end the test.",
+              "tools_triggered": "tavus_chat_start, tavus_chat_turn, tavus_chat_end",
+              "expected_behavior": "Ask the test PAL what Impressionism is, return its actual reply, and end only the test conversation. Do not substitute an answer generated by the host assistant."
+            },
+            {
+              "description": "Create a browser video preview for the test PAL.",
+              "prompt": "Open a video preview of that guide.",
+              "tools_triggered": "tavus_pal_preview",
+              "expected_behavior": "Return the real conversation URL and explain that it opens a video call in the browser. Do not claim that a live audio or video exchange occurred merely because a URL was created."
+            }
+          ],
+          "negative": [
+            {
+              "description": "PAL sales and payment collection are outside this plugin.",
+              "prompt": "Sell my PAL for $10 and charge the buyer's card.",
+              "expected_behavior": "Explain that PAL sales, card collection, and checkout are unsupported. Do not create a sale, payment, checkout link, or ownership transfer, and do not route the request to another payment integration."
+            },
+            {
+              "description": "A private PAL outside the connected account is not authorized.",
+              "prompt": "Copy a private PAL from an account I cannot access.",
+              "expected_behavior": "Refuse unauthorized access or copying. Do not disclose or change another account's resources. If an API authorization failure is encountered, honor it."
+            },
+            {
+              "description": "Hosted MCP cannot read local paths or train a replica.",
+              "prompt": "Train a new replica from this local video file.",
+              "expected_behavior": "Explain the local-file and replica-training limitations. Do not claim training has begun and do not create a PAL as a substitute for replica training."
+            }
+          ]
+        }
+      },
+      "publication": {
+        "release_notes": "Initial Tavus PAL package for the production hosted MCP server. Includes browser OAuth sign-in, PAL creation and editing, stock faces and voices, text conversation tests, and browser video-preview links. No payments, PAL sales, ownership transfers, custom replica training, or embedded video UI."
+      }
+    }
+  }
+}

{tavus_cli-0.8.0 → tavus_cli-0.9.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tavus-cli"
-version = "0.8.0"
+version = "0.9.0"
 description = "Tavus CLI and MCP server for agentic PAL creation and editing."
 readme = "README.md"
 requires-python = ">=3.11"

{tavus_cli-0.8.0 → tavus_cli-0.9.0}/src/tavus_mcp/__init__.py

@@ -1,4 +1,4 @@
 """Tavus CLI and MCP server package."""
 
 __all__ = ["__version__"]
-__version__ = "0.8.0"  # x-release-please-version
+__version__ = "0.9.0"  # x-release-please-version

{tavus_cli-0.8.0 → tavus_cli-0.9.0}/src/tavus_mcp/sdk/recipes/deployments.py

@@ -61,13 +61,19 @@ def default_deployment_name(
 
 
 def page_tools(attached_tools: Any) -> list[PageTool]:
-    """Pick the tools that reach the page out of a ``/pals/{id}/tools`` response."""
+    """Pick the tools the page must handle out of a ``/pals/{id}/tools`` response.
+
+    Built-in system tools such as ``end_call`` also deliver to the page, but the
+    embed and widget handle them, so the page writes no handler for them.
+    """
     tools: list[PageTool] = []
     for item in _list_data(attached_tools):
         delivery = item.get("delivery")
         name = item.get("name")
         if not isinstance(delivery, dict) or delivery.get("app_message") is not True:
             continue
+        if item.get("is_system_tool") is True:
+            continue
         if not isinstance(name, str) or not name:
             continue
         parameters = item.get("parameters")

{tavus_cli-0.8.0 → tavus_cli-0.9.0}/tests/unit/test_deployments.py

@@ -107,6 +107,14 @@ def test_page_tools_keeps_only_tools_delivered_to_the_page() -> None:
                 "parameters": {"properties": {"product_id": {}, "qty": {}}},
             },
             {"name": "lookup_order", "delivery": {"api": {"url": "https://x"}}},
+            # The built-in end_call, as the staging API returns it: the embed handles it.
+            {
+                "name": "end_call",
+                "tool_id": "end_call",
+                "is_system_tool": True,
+                "delivery": {"app_message": True},
+                "parameters": {"properties": {"reason": {}}},
+            },
         ]
     }
     assert page_tools(response) == [ADD_TO_CART]

{tavus_cli-0.8.0 → tavus_cli-0.9.0}/uv.lock

@@ -1303,7 +1303,7 @@ wheels = [
 
 [[package]]
 name = "tavus-cli"
-version = "0.8.0"
+version = "0.9.0"
 source = { editable = "." }
 dependencies = [
     { name = "fastmcp" },

{tavus_cli-0.8.0 → tavus_cli-0.9.0}/workers/tavus-mcp/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@tavus/tavus-mcp-worker",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@tavus/tavus-mcp-worker",
-      "version": "0.8.0",
+      "version": "0.9.0",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.29.0",
         "agents": "^0.12.2",

{tavus_cli-0.8.0 → tavus_cli-0.9.0}/workers/tavus-mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tavus/tavus-mcp-worker",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "private": true,
   "type": "module",
   "scripts": {

{tavus_cli-0.8.0 → tavus_cli-0.9.0}/workers/tavus-mcp/src/index.ts

@@ -55,7 +55,12 @@ export default {
       });
     }
 
-    const server = createTavusMcpServer(env, apiKey, new Headers(oauthUnauthorizedHeaders(request, MCP_ROUTE)).get("WWW-Authenticate")!);
+    const server = createTavusMcpServer(
+      env,
+      apiKey,
+      new Headers(oauthUnauthorizedHeaders(request, MCP_ROUTE)).get("WWW-Authenticate")!,
+      url.origin,
+    );
     return createMcpHandler(server, { route: MCP_ROUTE })(request, env, ctx);
   },
 } satisfies ExportedHandler<Env>;

{tavus_cli-0.8.0 → tavus_cli-0.9.0}/workers/tavus-mcp/src/oauth.ts

@@ -82,12 +82,26 @@ export async function handleOAuthRequest(
         method: request.method,
         path: new URL(request.url).pathname,
         status: response.status,
+        // The OAuth error code (never a description or token), so a client's
+        // failure can be diagnosed from the logs.
+        ...(response.status >= 400 ? { error: await oauthErrorCode(response) } : {}),
       }),
     );
   }
   return response;
 }
 
+async function oauthErrorCode(response: Response): Promise<string | undefined> {
+  try {
+    const body: unknown = await response.clone().json();
+    return typeof body === "object" && body !== null && "error" in body && typeof body.error === "string"
+      ? body.error
+      : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 async function routeOAuthRequest(
   request: Request,
   env: Env,
@@ -381,15 +395,10 @@ async function handleAuthorize(request: Request, env: Env, mcpRoute: string): Pr
     return redirectOAuthError(redirectUri, state, "invalid_request", "code_challenge is required.");
   }
 
-  const resource = params.get("resource");
-  if (!resource) {
-    return redirectOAuthError(
-      redirectUri,
-      state,
-      "invalid_request",
-      "resource is required.",
-    );
-  }
+  // RFC 8707 makes resource optional, and some clients leave it out (Bolt sends
+  // none). This server protects one resource, so a missing value means it; a
+  // present one must match it. Either way the code is bound to it.
+  const resource = params.get("resource") ?? resourceUrl(request, mcpRoute);
   if (!isAllowedResource(resource, resourceUrl(request, mcpRoute))) {
     return redirectOAuthError(
       redirectUri,
@@ -571,7 +580,6 @@ async function handleToken(request: Request, env: Env, mcpRoute: string): Promis
   if (!clientId) return oauthError("invalid_client", "Invalid client credentials.", 401, corsHeaders());
   const redirectUri = params.get("redirect_uri");
   const codeVerifier = params.get("code_verifier");
-  const resource = params.get("resource");
 
   const signingSecret = oauthSigningSecret(env);
   const authorizationCode = signingSecret
@@ -594,7 +602,11 @@ async function handleToken(request: Request, env: Env, mcpRoute: string): Promis
   if (!codeVerifier || (await pkceChallenge(codeVerifier)) !== authorizationCode.code_challenge) {
     return oauthError("invalid_grant", "PKCE verification failed.", 400, corsHeaders());
   }
-  if (!resource || resource !== authorizationCode.resource) {
+  // RFC 8707 makes resource optional here, and some clients leave it out (v0's
+  // OAuth library, arctic, sends none). /authorize bound a validated resource to
+  // the code, so a missing value means the code's; a present one must match.
+  const resource = params.get("resource") ?? authorizationCode.resource;
+  if (resource !== authorizationCode.resource) {
     return oauthError("invalid_target", "resource does not match the authorization code.", 400, corsHeaders());
   }
   if (!isAllowedResource(resource, resourceUrl(request, mcpRoute))) {
@@ -658,7 +670,9 @@ async function handleRefresh(request: Request, params: URLSearchParams, env: Env
   const parsed = parseSessionToken(params.get("refresh_token") ?? "");
   if (!parsed || parsed.kind !== "refresh") return oauthError("invalid_grant", "Invalid refresh token.", 400, corsHeaders());
   const resource = resourceUrl(request, mcpRoute);
-  if (!isAllowedResource(params.get("resource") ?? "", resource)) {
+  // As in the code exchange, a refresh without resource keeps the session's own.
+  const requestedResource = params.get("resource");
+  if (requestedResource !== null && !isAllowedResource(requestedResource, resource)) {
     return oauthError("invalid_target", "resource does not match this MCP server.", 400, corsHeaders());
   }
   if (params.has("scope") && params.get("scope") !== SCOPE_UMBRELLA) {
@@ -837,20 +851,38 @@ const KNOWN_REMOTE_CLIENTS: ReadonlyArray<{
   { name: "Claude", hosts: ["claude.ai", "claude.com"], path: /^\/api\/mcp\/auth_callback$/ },
   { name: "ChatGPT", hosts: ["chatgpt.com"], path: /^\/connector\/oauth\/[^/]+$/ },
   // Cursor registers its hosted callback rather than a loopback listener when
-  // its loopback-redirect flag is off.
+  // its loopback-redirect flag is off. https://cursor.com/docs/mcp lists only the
+  // www host; the bare host is kept from #49 because it is live in production.
   {
     name: "Cursor",
     hosts: ["cursor.com", "www.cursor.com"],
     path: /^\/agents\/mcp\/oauth\/callback$/,
   },
-  // VS Code registers its web redirects together with a loopback listener.
+  // https://code.visualstudio.com/api/extension-guides/ai/mcp#authorization lists
+  // https://vscode.dev/redirect and http://127.0.0.1:33418. Its registrations also
+  // send the Insiders redirect in the same request, per
+  // https://github.com/microsoft/vscode/issues/278512, so both hosts stay.
   { name: "VS Code", hosts: ["vscode.dev", "insiders.vscode.dev"], path: /^\/redirect$/ },
-  // v0 lists both callbacks in its client metadata document: the v0.app chat and
-  // the v0 Platform API.
+  // Both callbacks are in v0's client metadata document,
+  // https://v0.app/api/chat/integrations/oauth/client-metadata.json; the second is
+  // also in https://v0.app/docs/api/platform/guides/oauth-mcp-servers.
   { name: "v0", hosts: ["v0.app"], path: /^\/api\/chat\/integrations\/oauth\/callback$/ },
   { name: "v0", hosts: ["api.v0.dev"], path: /^\/v1\/mcp-servers\/oauth\/callback$/ },
-  { name: "Lovable", hosts: ["lovable.dev"], path: /^\/oauth\/callback$/ },
-  // Replit's MCP flow uses the callback of its other OAuth connectors.
+  // Lovable does not document its callback (https://docs.lovable.dev/integrations/custom-mcp).
+  // This one is captured from Lovable's own registration on staging
+  // (oauth_register_rejected).
+  {
+    name: "Lovable",
+    hosts: ["api.lovable.dev"],
+    path: /^\/workspaces\/connectors\/mcp\/oauth\/callback$/,
+  },
+  // Bolt does not document its callback (https://support.bolt.new/building/using-bolt/connect-mcp).
+  // This one is captured from Bolt's own registration on staging
+  // (oauth_register_payload: client_name "Bolt", token_endpoint_auth_method "none").
+  { name: "Bolt", hosts: ["bolt.new"], path: /^\/mcp\/oauth\/callback$/ },
+  // Replit does not document its MCP callback (https://docs.replit.com/replitai/mcp/overview).
+  // This one is captured from Replit's own registration on staging
+  // (oauth_register_payload: client_name "Replit MCP Connector", auth method "none").
   { name: "Replit", hosts: ["replit.com"], path: /^\/connectors\/oauth\/callback$/ },
 ];
 

{tavus_cli-0.8.0 → tavus_cli-0.9.0}/workers/tavus-mcp/src/tavus.ts

@@ -506,12 +506,33 @@ export function authorizationError(env: Env): { error: string; status: number }
   return null;
 }
 
-export function createTavusMcpServer(env: Env, apiKey?: string, authChallenge?: string): McpServer {
+export function createTavusMcpServer(
+  env: Env,
+  apiKey?: string,
+  authChallenge?: string,
+  serverOrigin = "https://mcp.tavus.io",
+): McpServer {
   const config = resolveConfig(env, apiKey);
   const client = new TavusApiClient(config);
   const server = new McpServer({
     name: "tavus",
+    title: "Tavus",
     version: VERSION,
+    websiteUrl: "https://www.tavus.io",
+    icons: [
+      {
+        src: new URL("/icon.svg", serverOrigin).href,
+        mimeType: "image/svg+xml",
+        sizes: ["any"],
+        theme: "light",
+      },
+      {
+        src: new URL("/icon-dark.svg", serverOrigin).href,
+        mimeType: "image/svg+xml",
+        sizes: ["any"],
+        theme: "dark",
+      },
+    ],
   });
   addToolIntent(server, authChallenge);
 
@@ -3423,12 +3444,22 @@ export function defaultDeploymentName(
   return `${base} ${n}`;
 }
 
-/** The PAL tools delivered to the page (delivery.app_message). */
+/**
+ * The PAL tools the page must handle (delivery.app_message). Built-in system
+ * tools such as end_call also deliver to the page, but the embed and widget
+ * handle them, so the page writes no handler for them.
+ */
 export function pageTools(attachedTools: unknown): PageTool[] {
   return arrayData(attachedTools).flatMap((value) => {
     const item = objectValue(value);
     const delivery = objectValue(item?.delivery);
-    if (!item || delivery?.app_message !== true || typeof item.name !== "string" || !item.name) {
+    if (
+      !item ||
+      delivery?.app_message !== true ||
+      item.is_system_tool === true ||
+      typeof item.name !== "string" ||
+      !item.name
+    ) {
       return [];
     }
     const properties = objectValue(objectValue(item.parameters)?.properties);

tavus_cli-0.9.0/workers/tavus-mcp/src/version.ts

@@ -0,0 +1 @@
+export const VERSION = "0.9.0"; // x-release-please-version

{tavus_cli-0.8.0 → tavus_cli-0.9.0}/workers/tavus-mcp/test/oauth-session.test.ts

@@ -42,7 +42,7 @@ async function register(method: "none" | "client_secret_post" | "client_secret_b
   return clientSchema.parse(await response.json());
 }
 
-async function authorize(client: Client, key = "account-a-key") {
+async function authorize(client: Client, key = "account-a-key", { sendResource = true } = {}) {
   const challenge = Buffer.from(
     await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier)),
   ).toString("base64url");
@@ -54,7 +54,7 @@ async function authorize(client: Client, key = "account-a-key") {
       state: crypto.randomUUID(),
       code_challenge: challenge,
       code_challenge_method: "S256",
-      resource,
+      ...(sendResource ? { resource } : {}),
       scope: "tavus",
     })}`,
     { redirect: "manual" },
@@ -214,6 +214,52 @@ describe("hosted OAuth sessions with real Cloudflare storage", () => {
     expect((await exchange(client, code)).status).toBe(400);
   });
 
+  it("binds an authorize request without resource to this server, as Bolt sends it", async () => {
+    // Bolt's /authorize request carries no resource parameter. This server
+    // protects one resource, so the code is bound to it.
+    const client = await register();
+    const code = await authorize(client, "account-a-key", { sendResource: false });
+    const exchanged = await form("/token", {
+      grant_type: "authorization_code",
+      ...credentials(client),
+      code,
+      redirect_uri: redirectUri,
+      code_verifier: verifier,
+    });
+    expect(exchanged.status).toBe(200);
+    const tokens = tokenSchema.parse(await exchanged.json());
+    const listed = await rpc(tokens.access_token);
+    expect(listed.status).toBe(200);
+    await listed.text();
+  });
+
+  it("accepts a code exchange and refresh without resource, as v0's OAuth client (arctic) sends them", async () => {
+    // arctic's token and refresh requests carry no resource parameter. The code
+    // was bound to this server's resource at /authorize, and the session keeps it.
+    const client = await register();
+    const code = await authorize(client);
+    const exchanged = await form("/token", {
+      grant_type: "authorization_code",
+      ...credentials(client),
+      code,
+      redirect_uri: redirectUri,
+      code_verifier: verifier,
+    });
+    expect(exchanged.status).toBe(200);
+    const tokens = tokenSchema.parse(await exchanged.json());
+    const listed = await rpc(tokens.access_token);
+    expect(listed.status).toBe(200);
+    await listed.text();
+
+    const refreshed = await form("/token", {
+      grant_type: "refresh_token",
+      ...credentials(client),
+      refresh_token: tokens.refresh_token,
+    });
+    expect(refreshed.status).toBe(200);
+    await refreshed.text();
+  });
+
   it("keeps the session when concurrent refreshes present the same refresh token", async () => {
     const { client, tokens } = await connect();
     const results = await Promise.all([

{tavus_cli-0.8.0 → tavus_cli-0.9.0}/workers/tavus-mcp/test/tavus.test.ts

@@ -842,10 +842,24 @@ describe("Cloudflare Tavus MCP helpers", () => {
     // VS Code sends its web redirect and its loopback listener in one request.
     ["VS Code", ["http://127.0.0.1:33418", "https://vscode.dev/redirect"]],
     ["VS Code", ["https://insiders.vscode.dev/redirect"]],
+    // VS Code registers both web redirects and its loopback listener together.
+    [
+      "VS Code",
+      [
+        "https://insiders.vscode.dev/redirect",
+        "https://vscode.dev/redirect",
+        "http://127.0.0.1/",
+        "http://127.0.0.1:33418/",
+      ],
+    ],
     // Both callbacks from v0's client metadata document.
     ["v0", ["https://v0.app/api/chat/integrations/oauth/callback"]],
     ["v0", ["https://api.v0.dev/v1/mcp-servers/oauth/callback"]],
-    ["Lovable", ["https://lovable.dev/oauth/callback"]],
+    // Lovable's registration, captured from the staging Worker logs.
+    ["Lovable", ["https://api.lovable.dev/workspaces/connectors/mcp/oauth/callback"]],
+    // Bolt's registration, captured from the staging Worker logs.
+    ["Bolt", ["https://bolt.new/mcp/oauth/callback"]],
+    // Replit's registration, captured from the staging Worker logs.
     ["Replit", ["https://replit.com/connectors/oauth/callback"]],
   ])("allows %s DCR callbacks and canonicalizes the client name", async (name, redirectUris) => {
     const response = await registerClient(redirectUris);
@@ -859,9 +873,12 @@ describe("Cloudflare Tavus MCP helpers", () => {
 
   it.each([
     ["a longer path", "https://vscode.dev/redirect/extra"],
-    ["a query string", "https://lovable.dev/oauth/callback?next=https://attacker.example"],
-    ["plain HTTP", "http://lovable.dev/oauth/callback"],
-    ["a lookalike host", "https://lovable.dev.attacker.example/oauth/callback"],
+    ["a query string", "https://api.lovable.dev/workspaces/connectors/mcp/oauth/callback?next=https://attacker.example"],
+    ["plain HTTP", "http://api.lovable.dev/workspaces/connectors/mcp/oauth/callback"],
+    ["a lookalike host", "https://api.lovable.dev.attacker.example/workspaces/connectors/mcp/oauth/callback"],
+    // The callback third-party integrations reported; Lovable does not register it.
+    ["the unverified Lovable callback", "https://lovable.dev/oauth/callback"],
+    ["a Bolt subdomain", "https://evil.bolt.new/mcp/oauth/callback"],
     ["a subdomain", "https://evil.v0.app/api/chat/integrations/oauth/callback"],
   ])("rejects a known client's callback with %s", async (_label, redirectUri) => {
     expect((await registerClient([redirectUri]))?.status).toBe(400);
@@ -870,13 +887,13 @@ describe("Cloudflare Tavus MCP helpers", () => {
   it("rejects callbacks from two different clients in one registration", async () => {
     const response = await registerClient([
       "https://claude.ai/api/mcp/auth_callback",
-      "https://lovable.dev/oauth/callback",
+      "https://api.lovable.dev/workspaces/connectors/mcp/oauth/callback",
     ]);
 
     expect(response?.status).toBe(400);
     await expect(response?.json()).resolves.toMatchObject({
       error: "invalid_client_metadata",
-      error_description: expect.stringContaining("Claude, ChatGPT, Cursor, VS Code, v0, Lovable, Replit"),
+      error_description: expect.stringContaining("Claude, ChatGPT, Cursor, VS Code, v0, Lovable, Bolt, Replit"),
     });
   });
 
@@ -1415,6 +1432,14 @@ describe("hosted deployment tools", () => {
             parameters: { properties: { product_id: {}, qty: {} } },
           },
           { name: "lookup_order", delivery: { api: { url: "https://x" } } },
+          // The built-in end_call, as the staging API returns it: the embed handles it.
+          {
+            name: "end_call",
+            tool_id: "end_call",
+            is_system_tool: true,
+            delivery: { app_message: true },
+            parameters: { properties: { reason: {} } },
+          },
         ],
       }),
     ).toEqual([{ name: "add_to_cart", parameters: ["product_id", "qty"], description: "Add." }]);

{tavus_cli-0.8.0 → tavus_cli-0.9.0}/workers/tavus-mcp/wrangler.jsonc

@@ -8,6 +8,9 @@
     "enabled": true
   },
   "workers_dev": true,
+  "assets": {
+    "directory": "../../plugins/tavus-pal/assets"
+  },
   "durable_objects": {
     "bindings": [
       { "name": "OAUTH_GRANTS", "class_name": "OAuthGrantStore" },

tavus_cli-0.8.0/.release-please-manifest.json

@@ -1,3 +0,0 @@
-{
-  ".": "0.8.0"
-}

tavus_cli-0.8.0/plugins/tavus-pal/plugin.json

@@ -1,45 +0,0 @@
-{
-  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
-  "name": "tavus-pal",
-  "version": "0.1.0",
-  "description": "Create, edit, and test Tavus PALs: digital humans with a face, voice, knowledge, and conversational behavior. Uses the Tavus hosted MCP server and your connected Tavus account.",
-  "author": {
-    "name": "Tavus",
-    "email": "support@tavus.io",
-    "url": "https://www.tavus.io"
-  },
-  "homepage": "https://maker.tavus.io",
-  "repository": "https://github.com/Tavus-Engineering/tavus-mcp",
-  "keywords": ["Tavus", "PAL", "digital humans", "video avatars"],
-  "extensions": {
-    "com.openai": {
-      "interface": {
-        "displayName": "Tavus PAL",
-        "shortDescription": "Create and test digital humans",
-        "longDescription": "Build and manage Tavus PALs through conversation. Choose available faces and voices, configure behavior and knowledge, run text tests, and open a video preview. Connect your Tavus account to access its resources and existing entitlements. Includes the same tools as the hosted Tavus MCP server. Custom face training, rendered video generation, PAL sales, and ownership transfers are not exposed by this integration.",
-        "developerName": "Tavus",
-        "category": "Developer Tools",
-        "capabilities": ["Create PALs", "Edit PAL behavior and knowledge", "Test conversations", "Open video previews"],
-        "websiteURL": "https://maker.tavus.io",
-        "supportURL": "https://help.tavus.io/",
-        "privacyPolicyURL": "https://www.tavus.io/privacy-policy",
-        "termsOfServiceURL": "https://www.tavus.io/terms-of-service",
-        "defaultPrompt": [
-          "Help me build a digital human that teaches conversational English.",
-          "Show my PALs and the stock faces I can use.",
-          "Help me test one of my PALs and open its video preview."
-        ],
-        "brandColor": "#140206",
-        "brandColorDark": "#FFFFFF",
-        "composerIcon": "./assets/icon.svg",
-        "composerIconDark": "./assets/icon-dark.svg",
-        "logo": "./assets/icon.svg",
-        "logoDark": "./assets/icon-dark.svg"
-      },
-      "review": {
-        "commerce": false,
-        "commerce_description": "Users access their existing Tavus account entitlements. This plugin does not sell PALs, subscriptions, or credits, collect payment details, or initiate checkout."
-      }
-    }
-  }
-}

tavus_cli-0.8.0/workers/tavus-mcp/src/version.ts

@@ -1 +0,0 @@
-export const VERSION = "0.8.0"; // x-release-please-version