@cachly-dev/mcp-server 0.10.14 → 0.10.16

package/README.md

@@ -1,58 +1,93 @@
 # 🧠 cachly AI Brain — MCP Server
 
-> **Your AI forgot that 3-hour fix. Again.**  
-> cachly gives every AI coding assistant — Claude Code, Cursor, GitHub Copilot, Windsurf, Cline & Zed — **permanent memory across all sessions, all projects, all editors.**
-
-<p align="center">
-  <a href="https://cachly.dev?utm_source=npm&utm_medium=readme&utm_campaign=mcp-server">
-    <img src="https://img.shields.io/badge/▶_Free_Brain_in_30s-cachly.dev-7c3aed?style=for-the-badge" alt="Free Brain" />
-  </a>
-  &nbsp;&nbsp;
-  <a href="https://marketplace.visualstudio.com/items?itemName=cachly-dev.cachly-brain">
-    <img src="https://img.shields.io/badge/VS_Code_Extension-Install_Free-0078d7?style=for-the-badge&logo=visual-studio-code" alt="VS Code Extension" />
-  </a>
-</p>
+> **Persistent memory for Claude Code, Cursor, GitHub Copilot, Windsurf, Cline & Zed.**  
+> Your AI remembers every lesson, every fix, every architecture decision — forever.
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@cachly-dev/mcp-server">
-    <img src="https://img.shields.io/npm/v/@cachly-dev/mcp-server?color=red&logo=npm" alt="npm version" />
+    <img src="https://img.shields.io/npm/v/@cachly-dev/mcp-server?color=violet&logo=npm" alt="npm version" />
   </a>
   &nbsp;
   <a href="https://www.npmjs.com/package/@cachly-dev/mcp-server">
-    <img src="https://img.shields.io/npm/dw/@cachly-dev/mcp-server?color=blue&label=weekly%20installs" alt="weekly installs" />
+    <img src="https://img.shields.io/npm/dw/@cachly-dev/mcp-server?color=blue&label=weekly%20installs" alt="npm downloads" />
   </a>
   &nbsp;
-  <a href="https://www.npmjs.com/package/@cachly-dev/mcp-server">
-    <img src="https://img.shields.io/npm/dt/@cachly-dev/mcp-server?color=blueviolet&label=total%20installs" alt="total installs" />
-  </a>
-  &nbsp;
-  <a href="https://cachly.dev?utm_source=npm&utm_medium=readme&utm_campaign=mcp-server">
-    <img src="https://img.shields.io/badge/Free%20tier-€0%2Fmo%20forever-brightgreen" alt="Free tier" />
+  <a href="https://cachly.dev">
+    <img src="https://img.shields.io/badge/Free%20tier-€0%2Fmo-brightgreen" alt="Free tier" />
   </a>
   &nbsp;
   <a href="https://cachly.dev/legal">
-    <img src="https://img.shields.io/badge/GDPR-EU%20servers-green" alt="GDPR: EU only" />
+    <img src="https://img.shields.io/badge/GDPR-EU%20servers-green" alt="GDPR: EU servers" />
   </a>
   &nbsp;
+  <img src="https://img.shields.io/badge/89%20MCP%20tools-violet" alt="89 MCP tools" />
+  &nbsp;
   <img src="https://img.shields.io/badge/License-Apache--2.0-yellow" alt="License: Apache-2.0" />
+  &nbsp;
+  <a href="https://cachly.dev">
+    <img src="https://img.shields.io/badge/Brain%20badge-embed%20in%20README-7c3aed" alt="Brain badge" />
+  </a>
 </p>
 
 ---
 
+## Try it right now — no account needed
+
+```bash
+npx @cachly-dev/mcp-server@latest demo
+```
+
+Run this in any project directory. It reads your git history and shows exactly what your AI would know:
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│  🧠 Brain Preview — What your AI would know                 │
+├─────────────────────────────────────────────────────────────┤
+│  Commits analysed : 847     Date range: 2024-01-12 → 2026-05-14  │
+│  Lessons extracted: 634     Contributors: 7                  │
+├─────────────────────────────────────────────────────────────┤
+│  Category breakdown:                                         │
+│  🔧 fix        ████████████████████ 312                     │
+│  ✨ feat        ███████████████     189                     │
+│  🔒 security    ██                   18                     │
+│  🚀 deploy      ██                   15                     │
+├─────────────────────────────────────────────────────────────┤
+│  🔒 Security fixes your AI would know:                      │
+│  • fix(auth): JWT expiry check before signature validation   │
+│  • security: sanitize webhook payload before JSON.parse      │
+├─────────────────────────────────────────────────────────────┤
+│  🔧 Bug fixes your AI would remember:                       │
+│  • fix: Redis pub/sub race condition under high concurrency  │
+│  • fix: k8s readinessProbe threshold too low for cold start  │
+│  • fix: Stripe idempotency_key missing on retry path         │
+│  • fix: tRPC context not forwarded to background jobs        │
+├─────────────────────────────────────────────────────────────┤
+│  💡 With cachly, your AI arrives pre-briefed every session. │
+│     No more re-explaining. No more repeated mistakes.        │
+└─────────────────────────────────────────────────────────────┘
+
+  Make this permanent (free, 30 seconds):
+  $ npx @cachly-dev/mcp-server@latest setup
+
+  Works with: Claude Code · Cursor · Windsurf · Copilot · Cline · Zed
+  Free forever · GDPR · German servers · No credit card
+```
+
+---
+
 ## The Problem
 
 Every morning, you open your AI coding assistant. It doesn't remember yesterday.  
 You explain your architecture. You explain the deployment process. You explain the bug you fixed last week.
 
-**The average developer wastes 45 minutes/day re-establishing context.**  
-That's ~$18,000/year per developer — before you even count the re-discovered bugs.
+**The average developer wastes 45 minutes/day re-establishing context.**
 
 ---
 
 ## One Command. Fully Automatic.
 
 ```bash
-npx @cachly-dev/init
+npx @cachly-dev/mcp-server@latest setup
 ```
 
 Run it once. It handles everything:
@@ -61,37 +96,15 @@ Run it once. It handles everything:
 2. **Detects your editors** — Claude Code, Cursor, Windsurf, VS Code, Copilot, Cline & Zed
 3. **Writes the MCP config** for every detected editor automatically
 4. **Creates `CLAUDE.md`** with Brain rules so your AI acts autonomously
-5. **Installs a git hook** that learns from every commit automatically
+5. **Reads your git history** — extracts lessons from years of commits before your first session
+6. **Installs a git hook** — learns from every future commit automatically
 
 **Restart your editor.** From now on your AI arrives pre-briefed — every session.
 
-> **Also a VS Code user?** Install the **[cachly Brain extension](https://marketplace.visualstudio.com/items?itemName=cachly-dev.cachly-brain)** — see your AI's memory, lesson count, and tokens saved right in the status bar.
-
----
-
-## 🆓 What You Get for Free
-
-No credit card. No expiry. No catch.
-
-| Feature | Free tier |
-|---------|-----------|
-| Brain storage | 25 MB |
-| MCP tools | All 89 |
-| Sessions | Unlimited |
-| Projects | Unlimited |
-| Team sharing | 1 shared Brain |
-| Git hook learning | ✅ |
-| Causal root cause analysis | ✅ |
-| Failure prediction | ✅ |
-
-**[→ Create your free Brain](https://cachly.dev?utm_source=npm&utm_medium=readme&utm_campaign=free-cta)**
-
 ---
 
 ## What happens after setup — everything is automatic
 
-You never type another command. The Brain runs entirely in the background:
-
 | Trigger | What the Brain does automatically |
 |---------|----------------------------------|
 | First tool call | Session starts, project gets indexed in background |
@@ -116,31 +129,61 @@ You never type another command. The Brain runs entirely in the background:
 
 ---
 
+## CLI Commands
+
+```bash
+npx @cachly-dev/mcp-server@latest demo     # Preview your Brain (no account needed)
+npx @cachly-dev/mcp-server@latest setup    # Wire up all your AI editors (30 seconds)
+npx @cachly-dev/mcp-server@latest health   # Check token, API, editors, git hook
+npx @cachly-dev/mcp-server@latest digest   # Weekly Brain summary — shareable
+npx @cachly-dev/mcp-server@latest share    # Generate a shareable stats card + tweet
+npx @cachly-dev/mcp-server@latest badge    # Get a live README badge for your Brain
+npx @cachly-dev/mcp-server@latest invite   # Invite a teammate to share your Brain
+```
+
+---
+
+## Brain Badge — show your lessons live
+
+Add a live lesson-count badge to any README — updates every hour, no auth required:
+
+```bash
+npx @cachly-dev/mcp-server@latest badge
+```
+
+Outputs your personal Markdown snippet:
+
+```markdown
+[![cachly Brain](https://api.cachly.dev/api/v1/badge/YOUR_INSTANCE_ID)](https://cachly.dev)
+```
+
+Drop it in your repo's README and anyone visiting sees how many lessons your AI has accumulated. The badge endpoint is public, rate-limited, and only exposes the lesson count — no topic names, no content.
+
+---
+
 ## What makes cachly different
 
 | Feature | What it does |
 |---------|-------------|
 | **`causal_trace`** | Root Cause Analysis through memory: problem → chain → solution. **No other system does this.** |
+| **`brain_from_git`** | Reads your entire git history and loads every lesson before your first session. Incremental on repeat runs. |
+| **`brain_predict`** | Predicts failures before they happen based on past incident patterns |
 | **`memory_consolidate`** | Weekly garbage collector — detects contradictions, merges duplicates, expires stale lessons |
-| **`brain_predict`** | Predicts failures before they happen based on past patterns |
 | **Team Brain** | Shared lessons across your whole team with author attribution |
 | **Ambient Git** | git hook auto-extracts lessons from every commit. Zero extra calls. |
 | **Memory Crystals** | Distills all lessons into a compact snapshot for instant session briefing |
 | **11 languages** | BM25+ search in EN, DE, FR, ES, IT, PT, ZH, JA, KO, AR, HE — no config |
 
-**The `causal_trace` moment:**
+**`causal_trace` in action:**
 ```
 causal_trace(problem="auth breaks after restart")
 
 → Root: k8s:namespace-terminating
-→ Via:  keycloak:jwks-race  
+→ Via:  keycloak:jwks-race
 → Fix:  PollUntilContextTimeout 3min  ← used this March 12, worked
 ```
 *30 minutes of git blame in one call.*
 
-**The `autopilot` command:**  
-Run `autopilot` once and it generates a fully self-managing `CLAUDE.md` or `copilot-instructions.md` — tailored to your actual Brain content. Every AI (Claude, Cursor, Copilot, Windsurf, Gemini) gets the full ruleset for your project. No copy-paste, no manual writing. As the Brain learns more, re-run `autopilot` to upgrade the file.
-
 ---
 
 ## cachly vs. alternatives
@@ -171,10 +214,10 @@ Run `autopilot` once and it generates a fully self-managing `CLAUDE.md` or `copi
 | **`learn_from_attempts`** | Store structured lessons after any fix, deploy, or discovery |
 | **`recall_best_solution`** | Best known solution for a topic — with success/failure history |
 | **`remember_context`** | Cache architecture findings, decisions, file summaries |
-| **`recall_context`** | Get exact context by key (supports glob) |
 | **`smart_recall`** | BM25+ full-text search across all brain data — 11 languages |
 | **`causal_trace`** | Root cause analysis through memory |
 | **`brain_predict`** | Predict likely failures before they happen |
+| **`brain_from_git`** | Bootstrap from git history — incremental, only new commits each run |
 | **`memory_consolidate`** | Deduplicate and expire stale lessons |
 | **`compact_recover`** | Full context recovery after hitting context window limit |
 
@@ -187,26 +230,22 @@ Run `autopilot` once and it generates a fully self-managing `CLAUDE.md` or `copi
 | `madc_deliberate` | 6 specialist AI agents vote to resolve contradictory lessons |
 | `memory_crystalize` | Distill all lessons into a Crystal for instant team context |
 | `brain_doctor` | Health check: lesson count, IQ boost %, open failures |
-| `autopilot` | Generate a self-managing `CLAUDE.md` / `copilot-instructions.md` from Brain content |
+| `autopilot` | Generate a self-managing `CLAUDE.md` from Brain content |
 | `global_learn` / `global_recall` | Cross-project universal lessons |
-| `publish_lesson` / `import_public_brain` | Share/import community knowledge |
 
-### 🌍 Knowledge Commons (Global)
+### 🌍 Knowledge Commons
 
 | Tool | What it does |
 |------|-------------|
 | `syndicate` | Contribute verified lesson to global Knowledge Commons |
-| `syndicate_search` | Search community solutions by tech stack |
-| `fedbrain_contribute` | Contribute with cryptographic provenance certificate |
 | `fedbrain_search` | Context-weighted global search |
 
-### ⚙️ Cache & Infrastructure
+### ⚙️ Infrastructure
 
 | Tool | What it does |
 |------|-------------|
 | `list_instances` / `create_instance` / `delete_instance` | Manage Brain instances |
 | `cache_get` / `cache_set` / `cache_delete` | Standard cache operations |
-| `cache_mget` / `cache_mset` | Bulk pipeline (single round-trip) |
 | `semantic_search` | Find cached entries by meaning |
 | `index_project` | Index source files for semantic retrieval |
 
@@ -224,33 +263,27 @@ Run `autopilot` once and it generates a fully self-managing `CLAUDE.md` or `copi
 **Does my AI need to call `session_start` manually?**  
 No. Sessions start and end automatically on the first tool call and when the editor closes.
 
-**What happens to memory if I switch projects?**  
-Memory is scoped per Brain instance. You can have one instance per project, or one shared instance across projects.
+**What is incremental `brain_from_git`?**  
+After the first run, only new commits since the last scan are processed. Repeated calls are instant.
 
 **Can my whole team share the same Brain?**  
-Yes. `team_learn` / `team_recall` share lessons with author attribution. `memory_crystalize` gives any new team member instant full context.
+Yes. Use `team_learn` / `team_recall` or run `npx @cachly-dev/mcp-server@latest invite teammate@example.com`.
 
 **What is a Memory Crystal?**  
-A compressed snapshot of all lessons distilled into a compact briefing. Injected at every session start so the AI arrives pre-briefed even with a cold context window.
-
-**What is causal_trace and why is it unique?**  
-Given any error or problem, `causal_trace` walks the Causal Knowledge Graph (CKG) to find: the root cause, intermediate causes, and the exact fix that worked — including the date and commands used. No other memory system builds or queries a causal graph.
+A compressed snapshot of all lessons injected at every session start. The AI arrives pre-briefed even with a cold context window.
 
-**How does cachly learn from git commits?**  
-The `setup` wizard installs a git post-commit hook. After each commit, the hook calls `cls_ingest` with the commit message and changed files. The Brain extracts lessons automatically — no `session_end` required.
-
-**What happens if I hit the context window limit mid-session?**  
-Call `compact_recover`. It reconstructs full context from the Memory Crystal + recent sessions + WIP registry entries — typically restoring full context in one tool call.
+**What is `causal_trace` and why is it unique?**  
+Given any error, `causal_trace` walks the Causal Knowledge Graph to find: root cause, intermediate causes, and the exact fix that worked — including the date and commands used. No other memory system builds or queries a causal graph.
 
 **Is my code sent to cachly servers?**  
-No code content is stored. cachly stores: lesson text, commit messages, session summaries, and key-value context entries. All data is on German servers, GDPR-compliant.
+No code content is stored. cachly stores: lesson text, commit messages, session summaries, key-value context entries. All data on German servers, GDPR-compliant.
 
-**Does cachly work without an internet connection?**  
-No — cachly is a managed cloud service. The MCP server is a thin client; the Brain runs on cachly's infrastructure.
+**What if I hit the context window limit mid-session?**  
+Call `compact_recover`. It reconstructs full context from Memory Crystal + recent sessions + WIP registry — typically one tool call.
 
 ---
 
-## Manual Setup (alternative to the wizard)
+## Manual Setup
 
 <details>
 <summary><b>Claude Code</b> (<code>~/.claude/mcp.json</code> or <code>.mcp.json</code>)</summary>
@@ -269,7 +302,7 @@ On the first tool call your AI will prompt you to sign in — takes 10 seconds.
 </details>
 
 <details>
-<summary><b>Cursor / Windsurf / VS Code / Copilot / Cline</b> (<code>.cursor/mcp.json</code> / <code>.mcp.json</code>)</summary>
+<summary><b>Cursor / Windsurf / VS Code / Copilot / Cline</b></summary>
 
 ```json
 {
@@ -284,6 +317,23 @@ On the first tool call your AI will prompt you to sign in — takes 10 seconds.
 ```
 </details>
 
+<details>
+<summary><b>Zed</b> (<code>.zed/settings.json</code>)</summary>
+
+```json
+{
+  "context_servers": {
+    "cachly": {
+      "command": {
+        "path": "npx",
+        "args": ["-y", "@cachly-dev/mcp-server@latest"]
+      }
+    }
+  }
+}
+```
+</details>
+
 ---
 
 ## Pricing
@@ -302,12 +352,10 @@ On the first tool call your AI will prompt you to sign in — takes 10 seconds.
 
 ## Environment Variables
 
-Set automatically by the setup wizard — only needed for manual configuration.
-
 | Variable | Default | Description |
 |----------|---------|-------------|
-| `CACHLY_JWT` | — | API token (set by wizard, or get from cachly.dev) |
-| `CACHLY_BRAIN_INSTANCE_ID` | — | Default instance UUID (optional if passed per-call) |
+| `CACHLY_JWT` | — | API token (set by wizard automatically) |
+| `CACHLY_BRAIN_INSTANCE_ID` | — | Default instance UUID (optional — auto-resolved) |
 | `CACHLY_API_URL` | `https://api.cachly.dev` | Override for self-hosted |
 | `CACHLY_NO_TELEMETRY` | unset | Set to `1` to disable anonymous usage pings |
 
@@ -315,40 +363,16 @@ Set automatically by the setup wizard — only needed for manual configuration.
 
 ## 🛠️ Ecosystem
 
-| Package / Extension | What it does |
-|---------------------|-------------|
-| **[`@cachly-dev/mcp-server`](https://www.npmjs.com/package/@cachly-dev/mcp-server)** | ← you are here — AI Brain for all MCP-compatible editors |
-| **[VS Code Extension](https://marketplace.visualstudio.com/items?itemName=cachly-dev.cachly-brain)** | See your Brain's lessons, health & tokens saved inside VS Code |
-| **[`@cachly-dev/init`](https://www.npmjs.com/package/@cachly-dev/init)** | One-command setup wizard — detects editors, writes configs automatically |
-| **[`@cachly-dev/openclaw`](https://www.npmjs.com/package/@cachly-dev/openclaw)** | Cut LLM costs 60–90% with semantic caching in JS/TS apps |
-| **[`@cachly-dev/cli`](https://www.npmjs.com/package/@cachly-dev/cli)** | Terminal CLI — manage Brain instances from your shell |
-| **[Go SDK](https://github.com/cachly-dev/sdk-go)** | Native Go client for the cachly API |
-| **[Python SDK](https://github.com/cachly-dev/sdk-python)** | Native Python client |
-| **[Java / Kotlin / .NET / Rust / PHP / Swift](https://cachly.dev/docs)** | SDKs in 11 languages |
-
----
-
-## 📖 Blog & Guides
-
-- **[How to give Claude Code persistent memory](https://cachly.dev/blog/claude-code-mcp-memory)** — step-by-step
-- **[Windsurf persistent memory with cachly](https://cachly.dev/blog/windsurf-persistent-memory)** — full guide
-- **[Cline MCP memory — stop re-explaining everything](https://cachly.dev/blog/cline-mcp-memory)** — Cline setup
-- **[cachly vs. mem0 — full comparison](https://cachly.dev/blog)** — which is right for you
+| Package | What it does |
+|---------|-------------|
+| **[`@cachly-dev/mcp-server`](https://www.npmjs.com/package/@cachly-dev/mcp-server)** | ← you are here |
+| **[`@cachly-dev/openclaw`](https://www.npmjs.com/package/@cachly-dev/openclaw)** | Cut LLM costs 60–90% in JS/TS apps |
 
 ---
 
 ## Links
 
-- 🌐 [cachly.dev](https://cachly.dev?utm_source=npm&utm_medium=readme&utm_campaign=mcp-server) — Dashboard & free Brain signup
+- 🌐 [cachly.dev](https://cachly.dev) — Dashboard & free signup
 - 📖 [Docs](https://cachly.dev/docs/ai-memory) — Full documentation
-- 🔌 [VS Code Extension](https://marketplace.visualstudio.com/items?itemName=cachly-dev.cachly-brain) — Brain panel inside VS Code
 - 💬 [GitHub Issues](https://github.com/cachly-dev/cachly-mcp/issues) — Bug reports & feature requests
 - ⭐ [Star on GitHub](https://github.com/cachly-dev/cachly-mcp) — If cachly saves you time, a star means a lot!
-
----
-
-<p align="center">
-  <a href="https://cachly.dev?utm_source=npm&utm_medium=readme&utm_campaign=mcp-bottom">
-    <strong>→ Start free at cachly.dev — no credit card, no expiry</strong>
-  </a>
-</p>

package/dist/__tests__/auth.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/auth.test.js

@@ -0,0 +1,107 @@
+import { describe, it, expect } from 'vitest';
+import { ErrorCode } from '@modelcontextprotocol/sdk/types.js';
+import { jwtExpiryMs, checkJwt, handleApiError } from '../auth.js';
+function makeJwt(payload) {
+    const header = Buffer.from(JSON.stringify({ alg: 'HS256', typ: 'JWT' })).toString('base64url');
+    const body = Buffer.from(JSON.stringify(payload)).toString('base64url');
+    return `${header}.${body}.fakesig`;
+}
+const nowSec = () => Math.floor(Date.now() / 1000);
+describe('jwtExpiryMs', () => {
+    it('returns null for an empty string', () => {
+        expect(jwtExpiryMs('')).toBeNull();
+    });
+    it('returns null for a plain (non-JWT) string', () => {
+        expect(jwtExpiryMs('not-a-token')).toBeNull();
+    });
+    it('returns null when the JWT has only two parts', () => {
+        expect(jwtExpiryMs('header.payload')).toBeNull();
+    });
+    it('returns null when the JWT has four parts', () => {
+        expect(jwtExpiryMs('a.b.c.d')).toBeNull();
+    });
+    it('returns null when the payload base64 is invalid', () => {
+        expect(jwtExpiryMs('header.!!!.sig')).toBeNull();
+    });
+    it('returns null when the payload has no exp field', () => {
+        expect(jwtExpiryMs(makeJwt({ sub: 'user-123', iat: nowSec() }))).toBeNull();
+    });
+    it('returns null when exp is 0', () => {
+        expect(jwtExpiryMs(makeJwt({ exp: 0 }))).toBeNull();
+    });
+    it('converts exp (seconds) to milliseconds', () => {
+        const expSec = nowSec() + 3600;
+        expect(jwtExpiryMs(makeJwt({ exp: expSec }))).toBe(expSec * 1000);
+    });
+    it('returns a past timestamp for an expired token', () => {
+        expect(jwtExpiryMs(makeJwt({ exp: nowSec() - 300 }))).toBeLessThan(Date.now());
+    });
+    it('returns a future timestamp for a valid token', () => {
+        expect(jwtExpiryMs(makeJwt({ exp: nowSec() + 86400 }))).toBeGreaterThan(Date.now());
+    });
+    it('handles a token expiring in less than 60 minutes', () => {
+        const expSec = nowSec() + 30 * 60;
+        const result = jwtExpiryMs(makeJwt({ exp: expSec }));
+        const minsLeft = Math.floor((result - Date.now()) / 60_000);
+        expect(minsLeft).toBeGreaterThanOrEqual(29);
+        expect(minsLeft).toBeLessThanOrEqual(30);
+    });
+    it('ignores extra claims', () => {
+        const expSec = nowSec() + 3600;
+        expect(jwtExpiryMs(makeJwt({ sub: 'u', iat: nowSec(), exp: expSec, plan: 'free' }))).toBe(expSec * 1000);
+    });
+    it('handles padding-free base64url payloads', () => {
+        // base64url (no =) — Buffer.from handles this natively
+        const expSec = nowSec() + 7200;
+        expect(jwtExpiryMs(makeJwt({ exp: expSec, x: 'a' }))).toBe(expSec * 1000);
+    });
+});
+describe('checkJwt', () => {
+    it('throws InvalidRequest when jwt is empty', () => {
+        expect(() => checkJwt('')).toThrowError(expect.objectContaining({ code: ErrorCode.InvalidRequest, message: expect.stringContaining('CACHLY_JWT env var not set') }));
+    });
+    it('throws with setup URL when jwt is missing', () => {
+        expect(() => checkJwt('')).toThrowError(expect.objectContaining({ message: expect.stringContaining('cachly.dev/setup-ai') }));
+    });
+    it('throws InvalidRequest with expiry timestamp for an expired token', () => {
+        const expSec = nowSec() - 60;
+        const token = makeJwt({ exp: expSec });
+        expect(() => checkJwt(token)).toThrowError(expect.objectContaining({
+            code: ErrorCode.InvalidRequest,
+            message: expect.stringContaining('expired at'),
+        }));
+    });
+    it('does not throw for a valid non-expired token', () => {
+        expect(() => checkJwt(makeJwt({ exp: nowSec() + 3600 }))).not.toThrow();
+    });
+    it('does not throw for a token with no exp claim', () => {
+        expect(() => checkJwt(makeJwt({ sub: 'user' }))).not.toThrow();
+    });
+});
+describe('handleApiError', () => {
+    it('throws InvalidRequest for 401 with the detail message', () => {
+        expect(() => handleApiError(401, 'token expired')).toThrowError(expect.objectContaining({
+            code: ErrorCode.InvalidRequest,
+            message: expect.stringContaining('Authentication failed (401): token expired'),
+        }));
+    });
+    it('throws InvalidRequest for 403 with the detail message', () => {
+        expect(() => handleApiError(403, 'plan limit reached')).toThrowError(expect.objectContaining({
+            code: ErrorCode.InvalidRequest,
+            message: expect.stringContaining('Access denied (403): plan limit reached'),
+        }));
+    });
+    it('throws InternalError for other status codes', () => {
+        expect(() => handleApiError(500, 'server crash')).toThrowError(expect.objectContaining({
+            code: ErrorCode.InternalError,
+            message: expect.stringContaining('cachly API error 500: server crash'),
+        }));
+    });
+    it('includes the cachly.dev/setup-ai link for 401 errors', () => {
+        expect(() => handleApiError(401, 'Unauthorized')).toThrowError(expect.objectContaining({ message: expect.stringContaining('cachly.dev/setup-ai') }));
+    });
+    it('includes account access hint for 403 errors', () => {
+        expect(() => handleApiError(403, 'Forbidden')).toThrowError(expect.objectContaining({ message: expect.stringContaining('access to this resource') }));
+    });
+});
+//# sourceMappingURL=auth.test.js.map

package/dist/__tests__/auth.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.test.js","sourceRoot":"","sources":["../../src/__tests__/auth.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAY,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEnE,SAAS,OAAO,CAAC,OAAgC;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/F,MAAM,IAAI,GAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1E,OAAO,GAAG,MAAM,IAAI,IAAI,UAAU,CAAC;AACrC,CAAC;AAED,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAEnD,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;QAC/B,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC;QAC5D,MAAM,CAAC,QAAQ,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,QAAQ,CAAC,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;QAC/B,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,uDAAuD;QACvD,MAAM,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;QAC/B,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;IACxB,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CACrC,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAC5H,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CACrC,MAAM,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,CAAC,CACrF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAI,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CACxC,MAAM,CAAC,gBAAgB,CAAC;YACtB,IAAI,EAAE,SAAS,CAAC,cAAc;YAC9B,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,YAAY,CAAC;SAC/C,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC,YAAY,CAC7D,MAAM,CAAC,gBAAgB,CAAC;YACtB,IAAI,EAAE,SAAS,CAAC,cAAc;YAC9B,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,4CAA4C,CAAC;SAC/E,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC,CAAC,YAAY,CAClE,MAAM,CAAC,gBAAgB,CAAC;YACtB,IAAI,EAAE,SAAS,CAAC,cAAc;YAC9B,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,yCAAyC,CAAC;SAC5E,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,YAAY,CAC5D,MAAM,CAAC,gBAAgB,CAAC;YACtB,IAAI,EAAE,SAAS,CAAC,aAAa;YAC7B,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,oCAAoC,CAAC;SACvE,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,YAAY,CAC5D,MAAM,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,CAAC,CACrF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,YAAY,CACzD,MAAM,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,CAAC,CACzF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/handlers/brain.js

@@ -5,13 +5,15 @@ import { safeJsonParse } from '../utils.js';
 import { keywordSearch, tokenize, splitMultiQuery, levenshtein, indexVocab as _indexVocab } from '../search.js';
 import { computeEmbedding, hasEmbedProvider } from '../embeddings.js';
 // ── Changelog (shown once per version in session_start) ──────────────────────
-const MCP_VERSION = '0.10.10';
+const MCP_VERSION = '0.10.0';
 const WHATS_NEW = {
-    '0.10.10': [
+    '0.10.0': [
         `🆕 **What's new in v${MCP_VERSION}:**`,
-        `  📌 **pin_lesson / unpin_lesson** — Pin critical lessons to always show in session_start`,
-        `  📊 **brain_stats** — At-a-glance health dashboard (lessons, streak, roadmap, pinned, top topics)`,
-        `  ✅ Pinned lessons appear at top of every session briefing — never decay, never forgotten`,
+        `  ✅ Zero-friction setup — auto-provisions your Brain, no manual config needed`,
+        `  ✅ 10× faster briefings — batch Redis fetches replace per-key loops`,
+        `  ✅ Crash-proof data reads — corrupted cache entries no longer break tools`,
+        `  ✅ \`session_end\` warns when called without an active session`,
+        `  ✅ \`get_api_status\` now shows live Redis ping + all instance statuses`,
     ],
 };
 export const BRAIN_TOOL_NAMES = new Set([
@@ -270,20 +272,6 @@ export async function handleBrainTool(name, args, getConnection, apiFetch) {
                 }
             }
             catch { /* CKG updates are non-critical */ }
-            // ── Auto-pin critical lessons ──────────────────────────────────────────
-            // severity=critical → always pin automatically so the lesson
-            // appears in every session_start without the user ever calling pin_lesson.
-            let autoPinNote = '';
-            if (severity === 'critical' && (outcome === 'success' || outcome === 'partial')) {
-                try {
-                    const alreadyPinned = await redis.exists(`cachly:lesson:pin:${topic}`);
-                    if (!alreadyPinned) {
-                        await redis.set(`cachly:lesson:pin:${topic}`, '1');
-                        autoPinNote = `📌 Auto-pinned (critical severity) — will appear in every session_start.`;
-                    }
-                }
-                catch { /* non-critical */ }
-            }
             const emoji = outcome === 'success' ? '✅' : outcome === 'partial' ? '⚠️' : '❌';
             const sevEmoji = severity === 'critical' ? '🔴' : severity === 'major' ? '🟡' : '🟢';
             const action = isUpdate ? 'updated' : 'stored';
@@ -304,7 +292,6 @@ export async function handleBrainTool(name, args, getConnection, apiFetch) {
                 depends_on.length > 0
                     ? `🔗 Depends on: ${depends_on.map(d => `\`${d}\``).join(', ')} → trace with \`trace_dependency\``
                     : '',
-                autoPinNote,
                 ...templateWarnings,
                 ...iWasWrongWarning,
             ].filter(l => l !== '').join('\n');
@@ -831,37 +818,6 @@ export async function handleBrainTool(name, args, getConnection, apiFetch) {
                 }
                 lines.push('');
             }
-            // ── Pinned lessons — always shown regardless of age/confidence ───────────
-            try {
-                const pinKeys = [];
-                const pinStream = redis.scanStream({ match: 'cachly:lesson:pin:*', count: 100 });
-                await new Promise((res, rej) => {
-                    pinStream.on('data', (b) => pinKeys.push(...b));
-                    pinStream.on('end', res);
-                    pinStream.on('error', rej);
-                });
-                if (pinKeys.length > 0) {
-                    const pinnedTopics = pinKeys.map(k => k.replace('cachly:lesson:pin:', ''));
-                    const pinLessonRaws = await redis.mget(...pinnedTopics.map(t => `cachly:lesson:best:${t}`));
-                    const pinLines = [];
-                    for (const raw of pinLessonRaws) {
-                        if (!raw)
-                            continue;
-                        const l = safeJsonParse(raw, null);
-                        if (!l)
-                            continue;
-                        const emoji = l.outcome === 'success' ? '✅' : l.outcome === 'partial' ? '⚠️' : '❌';
-                        const sev = l.severity === 'critical' ? '🔴' : l.severity === 'major' ? '🟡' : '';
-                        pinLines.push(`  📌${emoji}${sev} \`${l.topic}\` — ${l.what_worked.slice(0, 100)}`);
-                    }
-                    if (pinLines.length > 0) {
-                        lines.push(`📌 **Pinned lessons (always shown):**`);
-                        lines.push(...pinLines);
-                        lines.push('');
-                    }
-                }
-            }
-            catch { /* non-critical */ }
             // Recent lessons
             if (lessons.length > 0) {
                 lines.push(`🕐 **Recent lessons:**`);
@@ -1328,21 +1284,6 @@ export async function handleBrainTool(name, args, getConnection, apiFetch) {
                 catch { /* git not available or not a repo — silent skip */ }
             }
             const durationStr = durationMin !== undefined ? ` · ${durationMin} min` : '';
-            // ── Mini brain-stats snapshot at session end ───────────────────────────
-            let miniStatsLines = [];
-            try {
-                const totalLessons = await redis.keys('cachly:lesson:best:*').then(k => k.length).catch(() => 0);
-                const pinCount = await redis.keys('cachly:lesson:pin:*').then(k => k.length).catch(() => 0);
-                const streakRaw = await redis.get('cachly:streak:current');
-                const streak = streakRaw ? JSON.parse(streakRaw).days : 0;
-                const parts = [`📚 ${totalLessons} lesson${totalLessons !== 1 ? 's' : ''} total`];
-                if (pinCount > 0)
-                    parts.push(`📌 ${pinCount} pinned`);
-                if (streak > 1)
-                    parts.push(`🔥 ${streak}-day streak`);
-                miniStatsLines = [`🧠 **Brain:** ${parts.join(' · ')}`];
-            }
-            catch { /* non-critical */ }
             return [
                 `✅ **Session saved**${durationStr}`,
                 ``,
@@ -1351,7 +1292,6 @@ export async function handleBrainTool(name, args, getConnection, apiFetch) {
                 lessons_learned !== undefined ? `🧠 **Lessons stored:** ${lessons_learned}` : '',
                 autoLearned.length > 0 ? `🤖 **Auto-learned:** ${autoLearned.length} lessons extracted from summary (${autoLearned.slice(0, 3).map(t => `\`${t}\``).join(', ')}${autoLearned.length > 3 ? '…' : ''})` : '',
                 ambientLearned.length > 0 ? `🌿 **Ambient git learning:** ${ambientLearned.length} commit${ambientLearned.length > 1 ? 's' : ''} auto-learned (${ambientLearned.slice(0, 3).map(t => `\`${t}\``).join(', ')}${ambientLearned.length > 3 ? '…' : ''})` : '',
-                ...miniStatsLines,
                 ``,
                 `💡 Next session: \`session_start(focus="...")\` to see this summary.`,
             ].filter(l => l !== '').join('\n');