@cachly-dev/mcp-server 0.10.118 → 0.10.120

package/dist/src/index.d.ts

@@ -1,4 +1,23 @@
 #!/usr/bin/env node
+interface DeviceFlowState {
+    deviceCode: string;
+    userCode: string;
+    verifyUrl: string;
+    pollInterval: number;
+    deadline: number;
+    polling: boolean;
+}
+/**
+ * Once the device code is issued, poll in the BACKGROUND on the flow's interval
+ * so browser sign-in self-completes. Without this, the flow only advanced when
+ * the user manually triggered ANOTHER tool call — the #1 onboarding drop-off
+ * (report: device flow 36→1 = 3%). Now the user signs in and their Brain
+ * activates on its own; their next natural request just works instead of
+ * showing "still waiting". Bounded by the flow deadline, timer unref'd so it
+ * never keeps the process alive, fully fail-safe (never throws). `poll` and
+ * `isCurrent` are injectable for testing.
+ */
+export declare function startBackgroundDevicePoll(flow: DeviceFlowState, poll?: (f: DeviceFlowState) => Promise<'pending' | 'expired' | 'done'>, isCurrent?: (f: DeviceFlowState) => boolean, schedule?: (fn: () => void, ms: number) => void): void;
 import { tokenize, splitMultiQuery, levenshtein, recencyBoost, extractTimestamp, STOPWORDS, katakanaToRomaji, arabicLightStem, expandCrossLingual, CROSS_LINGUAL_MAP } from './search.js';
 export { tokenize, splitMultiQuery, levenshtein, recencyBoost, extractTimestamp, STOPWORDS, katakanaToRomaji, arabicLightStem, expandCrossLingual, CROSS_LINGUAL_MAP };
 export declare const EDITOR_FILES: Record<string, string>;

package/dist/src/index.js

@@ -524,6 +524,60 @@ async function pollDeviceFlow(flow) {
         return 'pending';
     }
 }
+/**
+ * Mutex wrapper so the background poller (below) and a user-triggered tool call
+ * never poll the same device code concurrently — a double poll can race the
+ * one-time JWT→API-key exchange.
+ */
+async function pollDeviceFlowGuarded(flow) {
+    if (flow.polling)
+        return 'pending'; // another poll owns this tick
+    flow.polling = true;
+    try {
+        return await pollDeviceFlow(flow);
+    }
+    finally {
+        flow.polling = false;
+    }
+}
+/**
+ * Once the device code is issued, poll in the BACKGROUND on the flow's interval
+ * so browser sign-in self-completes. Without this, the flow only advanced when
+ * the user manually triggered ANOTHER tool call — the #1 onboarding drop-off
+ * (report: device flow 36→1 = 3%). Now the user signs in and their Brain
+ * activates on its own; their next natural request just works instead of
+ * showing "still waiting". Bounded by the flow deadline, timer unref'd so it
+ * never keeps the process alive, fully fail-safe (never throws). `poll` and
+ * `isCurrent` are injectable for testing.
+ */
+export function startBackgroundDevicePoll(flow, poll = pollDeviceFlowGuarded, isCurrent = (f) => _deviceFlow === f, schedule = defaultUnrefTimeout) {
+    const tick = async () => {
+        if (!isCurrent(flow))
+            return; // superseded or already completed → stop
+        let status = 'pending';
+        try {
+            status = await poll(flow);
+        }
+        catch {
+            /* keep polling — a transient network error must not abort sign-in */
+        }
+        if (status === 'done')
+            return; // poll already set JWT + persisted the key
+        if (status === 'expired') {
+            if (isCurrent(flow))
+                _deviceFlow = null;
+            return;
+        }
+        if (isCurrent(flow))
+            schedule(tick, flow.pollInterval);
+    };
+    schedule(tick, flow.pollInterval);
+}
+function defaultUnrefTimeout(fn, ms) {
+    const t = setTimeout(fn, ms);
+    if (typeof t.unref === 'function')
+        t.unref();
+}
 // ── Embeddings (imported from embeddings.ts) ────────────────────────────────
 import { setEmbedJwt } from './embeddings.js';
 // ── Search Engine (imported from search.ts) ─────────────────────────────────
@@ -622,7 +676,14 @@ async function getConnection(instance_id) {
         connectTimeout: 8000,
         retryStrategy: () => null, // fail fast, no reconnect loops in MCP context
     });
-    const evict = () => pool.delete(instance_id);
+    // Drop the client from the pool AND close its socket on error/end, so a
+    // mid-session Redis drop doesn't leak sockets across reconnects. disconnect()
+    // is idempotent and safe to call from these handlers. The next tool call
+    // rebuilds the connection (self-healing).
+    const evict = () => {
+        pool.delete(instance_id);
+        client.disconnect();
+    };
     client.on('error', evict);
     client.on('end', evict);
     try {
@@ -697,6 +758,8 @@ import { installClsPostCommitHook, CLS_HOOK_VERSION } from './cls-hook.js';
 import { installAmbientHooks, AMBIENT_HOOK_VERSION } from './ambient-hooks.js';
 import { runAmbient, truncateToTokens, parseHookPayload, stopObservation } from './ambient-cli.js';
 import { appendLedgerEntry, readLedger, defaultLedgerPath } from './ambient-ledger.js';
+import { detectEditor as detectEditorImpl } from './editor.js';
+import { milestoneSent, markMilestoneSent } from './funnel-milestones.js';
 import { netBalance, shouldBackoff } from './ambient-recall.js';
 import { handleShareTool } from './handlers/share.js';
 import { handleVizTool } from './handlers/viz.js';
@@ -707,12 +770,10 @@ import { TOOLS } from './tools.js';
 let _telemetryPingSent = false;
 // Fires once per process on the first successful Brain tool call — key activation metric
 let _firstCallSuccessSent = false;
+// Host detection lives in editor.ts (pure + unit-tested). Kept as a thin
+// wrapper so the many call sites here stay unchanged.
 function detectEditor() {
-    return process.env.CURSOR_TRACE_ID ? 'cursor'
-        : process.env.WINDSURF_SESSION_ID ? 'windsurf'
-            : process.env.GITHUB_COPILOT_WORKSPACE ? 'copilot'
-                : process.env.CLAUDE_CODE_ENTRYPOINT ? 'claude'
-                    : 'unknown';
+    return detectEditorImpl();
 }
 /** Derive an anonymous, non-reversible fingerprint from the JWT sub claim. */
 function _jwtUserFingerprint(jwt) {
@@ -852,7 +913,7 @@ async function handleTool(name, args) {
         // 1st call: start device flow, return code + URL
         // 2nd+ calls: poll for token; once authenticated, proceed transparently
         if (_deviceFlow) {
-            const result = await pollDeviceFlow(_deviceFlow);
+            const result = await pollDeviceFlowGuarded(_deviceFlow);
             if (result === 'done') {
                 // Auth complete — re-enter handleTool with now-valid JWT
                 return handleTool(name, args);
@@ -862,14 +923,14 @@ async function handleTool(name, args) {
                 _deviceFlow = null;
                 return '⌛ **Authentication timed out.** Please call any tool again to restart the sign-in flow.';
             }
-            // Still pending
+            // Still pending — the background poller will complete sign-in on its own.
             return [
-                '⏳ **Waiting for authentication...**',
+                '⏳ **Signing you in…**',
                 '',
-                `Sign in at: **${_deviceFlow.verifyUrl}**`,
-                `Enter code: **${_deviceFlow.userCode}**`,
+                `Finish in your browser: **${_deviceFlow.verifyUrl}**`,
+                `Code: **${_deviceFlow.userCode}**`,
                 '',
-                'Once you complete sign-in in your browser, call this tool again and it will proceed automatically.',
+                'This completes automatically once you sign in — no need to come back here.',
             ].join('\n');
         }
         // No pending flow — start a new one
@@ -879,6 +940,9 @@ async function handleTool(name, args) {
             sendFunnelEvent('device_flow_started', { tool: name });
             // Try to open the browser automatically — fire-and-forget, never block
             openInBrowser(flow.verifyUrl);
+            // Poll in the background so sign-in self-completes — the user no longer
+            // has to trigger another tool call to drive the flow (the #1 drop-off).
+            startBackgroundDevicePoll(flow);
             return [
                 '🧠 **cachly AI Brain — sign in to activate** (browser opening...)',
                 '',
@@ -886,7 +950,8 @@ async function handleTool(name, args) {
                 '',
                 `Code: **${flow.userCode}** (pre-filled if browser opened automatically)`,
                 '',
-                'After sign-in: call **any tool again** — your Brain activates instantly.',
+                'That’s it — your Brain activates automatically the moment you finish',
+                'signing in. Just keep working; your next request arrives brain-powered.',
                 '',
                 '✨ Free forever · No credit card · 126 MCP tools · GDPR · EU servers',
             ].join('\n');
@@ -923,7 +988,12 @@ async function handleTool(name, args) {
     if (brainResult !== null) {
         if (!_firstCallSuccessSent && JWT) {
             _firstCallSuccessSent = true;
-            sendFunnelEvent('first_call_success', { tool: name, instance_id: args.instance_id ?? _defaultInstanceId ?? '' });
+            // Persistent guard: ambient hooks spawn a fresh process per prompt, so the
+            // in-memory flag alone re-sent "first call" on every hook invocation.
+            if (!milestoneSent('first_call_success')) {
+                markMilestoneSent('first_call_success');
+                sendFunnelEvent('first_call_success', { tool: name, instance_id: args.instance_id ?? _defaultInstanceId ?? '' });
+            }
         }
         // Per-tool telemetry — fires after every successful brain tool call.
         // api_key carries the cky_live_... token so the backend can resolve tenant + increment counters.
@@ -1026,7 +1096,12 @@ async function handleTool(name, args) {
     if (contextResult !== null) {
         if (!_firstCallSuccessSent && JWT) {
             _firstCallSuccessSent = true;
-            sendFunnelEvent('first_call_success', { tool: name, instance_id: args.instance_id ?? _defaultInstanceId ?? '' });
+            // Persistent guard: ambient hooks spawn a fresh process per prompt, so the
+            // in-memory flag alone re-sent "first call" on every hook invocation.
+            if (!milestoneSent('first_call_success')) {
+                markMilestoneSent('first_call_success');
+                sendFunnelEvent('first_call_success', { tool: name, instance_id: args.instance_id ?? _defaultInstanceId ?? '' });
+            }
         }
         return contextResult;
     }
@@ -1332,6 +1407,20 @@ process.on('unhandledRejection', (reason) => {
     // Write to stderr only (stdout is the JSON-RPC channel)
     process.stderr.write(`[cachly-mcp] unhandledRejection: ${msg}\n`);
 });
+// Symmetric net for synchronous/async *exceptions* thrown outside a try/catch
+// (a timer or stream callback, the background device poller, ioredis internals).
+// Without this the process exits hard and the editor reports "Connection is
+// closed" mid-session. Log to stderr and stay alive — never exit here.
+process.on('uncaughtException', (err) => {
+    process.stderr.write(`[cachly-mcp] uncaughtException: ${err?.stack ?? String(err)}\n`);
+});
+// The single most common stdio-MCP killer: the editor closes the read side of
+// our stdout pipe (window closed, server restart, client reconnect) and the
+// next JSON-RPC write throws EPIPE — an async stream error that would otherwise
+// crash the process. Swallow stream errors on both stdio ends so a client that
+// closes its pipe can never take the server down with it.
+process.stdout.on('error', () => { });
+process.stdin.on('error', () => { });
 // ── CLI helpers ───────────────────────────────────────────────────────────────
 export const EDITOR_FILES = {
     claude: '.mcp.json',