@cachly-dev/mcp-server 0.10.46 → 0.10.47

package/dist/index.js

@@ -45,11 +45,15 @@ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import { CallToolRequestSchema, ErrorCode, ListToolsRequestSchema, McpError, } from '@modelcontextprotocol/sdk/types.js';
 import { Redis } from 'ioredis';
+import { AsyncLocalStorage } from 'node:async_hooks';
 // ── Config ────────────────────────────────────────────────────────────────────
 const API_URL = process.env.CACHLY_API_URL ?? 'https://api.cachly.dev';
 let JWT = process.env.CACHLY_JWT ?? '';
 const EMBED_MODEL = process.env.CACHLY_EMBED_MODEL ?? '';
-const CURRENT_VERSION = '0.10.46';
+const CURRENT_VERSION = '0.10.47';
+const reqCtx = new AsyncLocalStorage();
+function getJWT() { return reqCtx.getStore()?.jwt || JWT; }
+function getDefaultInstanceId() { return reqCtx.getStore()?.instanceId || _defaultInstanceId; }
 // ── Default Instance Resolution (for Smithery & single-credential setups) ────
 // When CACHLY_BRAIN_INSTANCE_ID is set, tools can omit the instance_id parameter.
 // When neither is set, we auto-fetch the first running instance once per process.
@@ -57,9 +61,13 @@ let _defaultInstanceId = process.env.CACHLY_BRAIN_INSTANCE_ID ?? '';
 // Timestamp of last failed fetch — retries after 30 s (not permanently blocked).
 let _defaultInstanceLastAttempt = 0;
 async function resolveDefaultInstanceId() {
+    // In an HTTP request scope the instance ID is fixed by the caller's header.
+    const scopedId = reqCtx.getStore()?.instanceId;
+    if (scopedId)
+        return scopedId;
     if (_defaultInstanceId)
         return _defaultInstanceId;
-    if (!JWT)
+    if (!getJWT())
         return '';
     // Cooldown: don't hammer the API on every tool call after a transient failure.
     const now = Date.now();
@@ -68,7 +76,7 @@ async function resolveDefaultInstanceId() {
     _defaultInstanceLastAttempt = now;
     try {
         const res = await fetch(`${API_URL}/api/v1/instances`, {
-            headers: { Authorization: `Bearer ${JWT}`, Accept: 'application/json' },
+            headers: { Authorization: `Bearer ${getJWT()}`, Accept: 'application/json' },
             signal: AbortSignal.timeout(5000),
         });
         if (!res.ok)
@@ -154,7 +162,7 @@ async function pollDeviceFlow(flow) {
                 try {
                     const autoRes = await fetch(`${API_URL}/api/v1/instances/auto`, {
                         method: 'POST',
-                        headers: { Authorization: `Bearer ${JWT}`, 'Content-Type': 'application/json' },
+                        headers: { Authorization: `Bearer ${getJWT()}`, 'Content-Type': 'application/json' },
                         signal: AbortSignal.timeout(12000),
                     });
                     if (autoRes.ok) {
@@ -167,7 +175,7 @@ async function pollDeviceFlow(flow) {
                         // Log so telemetry can detect free-tier auto-provision failures
                         void fetch(`${API_URL}/api/v1/telemetry/mcp`, {
                             method: 'POST',
-                            headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${JWT}` },
+                            headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${getJWT()}` },
                             body: JSON.stringify({ event: 'auto_provision_failed', status: autoRes.status, version: CURRENT_VERSION }),
                             signal: AbortSignal.timeout(3000),
                         }).catch(() => { });
@@ -180,7 +188,7 @@ async function pollDeviceFlow(flow) {
             if (_defaultInstanceId) {
                 try {
                     const checkRes = await fetch(`${API_URL}/api/v1/instances/${_defaultInstanceId}`, {
-                        headers: { Authorization: `Bearer ${JWT}`, Accept: 'application/json' },
+                        headers: { Authorization: `Bearer ${getJWT()}`, Accept: 'application/json' },
                         signal: AbortSignal.timeout(4000),
                     });
                     if (checkRes.ok) {
@@ -191,7 +199,7 @@ async function pollDeviceFlow(flow) {
                             while (checkInst.status === 'provisioning' && Date.now() < pDeadline) {
                                 await new Promise(r => setTimeout(r, 3000));
                                 const rr = await fetch(`${API_URL}/api/v1/instances/${_defaultInstanceId}`, {
-                                    headers: { Authorization: `Bearer ${JWT}`, Accept: 'application/json' },
+                                    headers: { Authorization: `Bearer ${getJWT()}`, Accept: 'application/json' },
                                     signal: AbortSignal.timeout(4000),
                                 }).catch(() => null);
                                 if (rr?.ok) {
@@ -250,7 +258,7 @@ async function getConnection(instance_id) {
         // Telemetry: unreachable instance so the team can proactively investigate
         void fetch(`${API_URL}/api/v1/telemetry/mcp`, {
             method: 'POST',
-            headers: { 'Content-Type': 'application/json', ...(JWT ? { Authorization: `Bearer ${JWT}` } : {}) },
+            headers: { 'Content-Type': 'application/json', ...(getJWT() ? { Authorization: `Bearer ${getJWT()}` } : {}) },
             body: JSON.stringify({ event: 'instance_not_reachable', instance_id, status: inst.status, version: CURRENT_VERSION }),
             signal: AbortSignal.timeout(3000),
         }).catch(() => { });
@@ -319,7 +327,7 @@ async function getConnection(instance_id) {
         const msg = err instanceof Error ? err.message : String(err);
         void fetch(`${API_URL}/api/v1/telemetry/mcp`, {
             method: 'POST',
-            headers: { 'Content-Type': 'application/json', ...(JWT ? { Authorization: `Bearer ${JWT}` } : {}) },
+            headers: { 'Content-Type': 'application/json', ...(getJWT() ? { Authorization: `Bearer ${getJWT()}` } : {}) },
             body: JSON.stringify({ event: 'redis_connect_failed', instance_id, host: inst.host, port: inst.port, error: msg, version: CURRENT_VERSION }),
             signal: AbortSignal.timeout(3000),
         }).catch(() => { });
@@ -333,14 +341,14 @@ async function getConnection(instance_id) {
 }
 // ── API helper ────────────────────────────────────────────────────────────────
 async function apiFetch(path, options = {}) {
-    checkJwt(JWT);
+    checkJwt(getJWT());
     const timeoutMs = Number(process.env.CACHLY_API_TIMEOUT_MS ?? 15_000);
     const res = await fetch(`${API_URL}${path}`, {
         ...options,
         signal: AbortSignal.timeout(timeoutMs),
         headers: {
             'Content-Type': 'application/json',
-            Authorization: `Bearer ${JWT}`,
+            Authorization: `Bearer ${getJWT()}`,
             ...options.headers,
         },
     });
@@ -384,7 +392,7 @@ function sendFunnelEvent(event, extra) {
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({
             event, version: CURRENT_VERSION, editor: detectEditor(),
-            ...(JWT ? { jwt: JWT } : {}),
+            ...(getJWT() ? { jwt: getJWT() } : {}),
             ...extra,
         }),
         signal: AbortSignal.timeout(3000),
@@ -408,7 +416,7 @@ async function sendAnonymousTelemetry(toolName) {
 }
 async function handleTool(name, args) {
     // Guard: if no JWT, return actionable onboarding message instead of HTTP 401
-    if (!JWT) {
+    if (!getJWT()) {
         void sendAnonymousTelemetry(name);
         // ── Zero-credential device flow ─────────────────────────────────────
         // 1st call: start device flow, return code + URL
@@ -485,14 +493,14 @@ async function handleTool(name, args) {
     // Delegate brain tools (learn, recall, session, etc.)
     const brainResult = await handleBrainTool(name, args, getConnection, apiFetch);
     if (brainResult !== null) {
-        if (!_firstCallSuccessSent && JWT) {
+        if (!_firstCallSuccessSent && getJWT()) {
             _firstCallSuccessSent = true;
-            sendFunnelEvent('first_call_success', { tool: name, instance_id: args.instance_id ?? _defaultInstanceId ?? '' });
+            sendFunnelEvent('first_call_success', { tool: name, instance_id: args.instance_id ?? getDefaultInstanceId() ?? '' });
         }
         // Per-tool telemetry — fires after every successful brain tool call.
         // api_key carries the cky_live_... token so the backend can resolve tenant + increment counters.
-        const instanceId = args.instance_id ?? _defaultInstanceId ?? '';
-        const telemetryExtra = JWT ? { api_key: JWT, instance_id: instanceId } : { instance_id: instanceId };
+        const instanceId = args.instance_id ?? getDefaultInstanceId() ?? '';
+        const telemetryExtra = getJWT() ? { api_key: getJWT(), instance_id: instanceId } : { instance_id: instanceId };
         if (name === 'recall_best_solution') {
             // recall_best_solution → increments BrainRecallCount + triggers level-up logic
             sendFunnelEvent('recall_best_solution', telemetryExtra);
@@ -557,9 +565,9 @@ async function handleTool(name, args) {
     // Delegate context tools (remember/recall/list/forget)
     const contextResult = await handleContextTool(name, args, getConnection, apiFetch);
     if (contextResult !== null) {
-        if (!_firstCallSuccessSent && JWT) {
+        if (!_firstCallSuccessSent && getJWT()) {
             _firstCallSuccessSent = true;
-            sendFunnelEvent('first_call_success', { tool: name, instance_id: args.instance_id ?? _defaultInstanceId ?? '' });
+            sendFunnelEvent('first_call_success', { tool: name, instance_id: args.instance_id ?? getDefaultInstanceId() ?? '' });
         }
         return contextResult;
     }
@@ -584,8 +592,8 @@ async function handleTool(name, args) {
     if (syndicateResult !== null) {
         // brain_predict is in syndicate handler — track telemetry here.
         if (name === 'brain_predict') {
-            const instanceId = args.instance_id ?? _defaultInstanceId ?? '';
-            const telemetryExtra = JWT ? { api_key: JWT, instance_id: instanceId } : { instance_id: instanceId };
+            const instanceId = args.instance_id ?? getDefaultInstanceId() ?? '';
+            const telemetryExtra = getJWT() ? { api_key: getJWT(), instance_id: instanceId } : { instance_id: instanceId };
             sendFunnelEvent('brain_predict', telemetryExtra);
         }
         return syndicateResult;
@@ -593,8 +601,8 @@ async function handleTool(name, args) {
     const fedbrainResult = await handleFedbrainTool(name, args, getConnection, apiFetch);
     if (fedbrainResult !== null) {
         // brain_from_git and brain_predict_failures are in fedbrain handler.
-        const instanceId = args.instance_id ?? _defaultInstanceId ?? '';
-        const telemetryExtra = JWT ? { api_key: JWT, instance_id: instanceId } : { instance_id: instanceId };
+        const instanceId = args.instance_id ?? getDefaultInstanceId() ?? '';
+        const telemetryExtra = getJWT() ? { api_key: getJWT(), instance_id: instanceId } : { instance_id: instanceId };
         if (name === 'brain_from_git') {
             sendFunnelEvent('brain_from_git', telemetryExtra);
         }
@@ -622,7 +630,7 @@ async function handleTool(name, args) {
                 healthStatus = `unreachable: ${e.message}`;
             }
             // Check JWT / auth
-            if (!JWT) {
+            if (!getJWT()) {
                 return [
                     `📡 **cachly API Status**`,
                     ``,
@@ -636,7 +644,7 @@ async function handleTool(name, args) {
             // Decode JWT claims (inspection only, no verification)
             let authInfo = '❌ invalid JWT format';
             try {
-                const parts = JWT.split('.');
+                const parts = getJWT().split('.');
                 if (parts.length === 3) {
                     const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf-8'));
                     const sub = payload.sub ?? '(unknown)';
@@ -668,7 +676,7 @@ async function handleTool(name, args) {
                     const lines = ['\n\n🧠 **Brain Instances:**'];
                     for (const inst of instances) {
                         const badge = inst.status === 'running' ? '🟢' : inst.status === 'provisioning' ? '🟡' : '🔴';
-                        const defaultMark = inst.id === _defaultInstanceId ? ' ← active' : '';
+                        const defaultMark = inst.id === getDefaultInstanceId() ? ' ← active' : '';
                         lines.push(`  ${badge} **${inst.name}** (\`${inst.id}\`) · ${inst.status}${defaultMark}`);
                         if (inst.status === 'running' && inst.host) {
                             // Try a quick ping on the cached connection
@@ -2022,7 +2030,6 @@ if (process.argv[2] === 'setup') {
         const AUTH_BASE = 'https://auth.cachly.dev/realms/cachly/protocol/openid-connect';
         const CLIENT_ID = 'cachly-cli';
         console.log('Step 1: Sign in to cachly (free, no credit card)\n');
-        sendFunnelEvent('setup_auth_started');
         // Start device flow
         let deviceCode = '', userCode = '', verifyUri = '', pollInterval = 5000;
         try {
@@ -2048,7 +2055,6 @@ if (process.argv[2] === 'setup') {
                 rl.close();
                 process.exit(1);
             }
-            sendFunnelEvent('setup_auth_completed');
             console.log('');
             deviceCode = ''; // mark as fallback so we skip polling
         }
@@ -2081,7 +2087,6 @@ if (process.argv[2] === 'setup') {
                     if (tokenData.access_token) {
                         token = tokenData.access_token;
                         console.log(' \x1b[32m✓ Authorized!\x1b[0m\n');
-                        sendFunnelEvent('setup_auth_completed');
                         break;
                     }
                     // authorization_pending = keep polling; slow_down = increase interval
@@ -2216,7 +2221,6 @@ if (process.argv[2] === 'setup') {
         console.log(`   (Run with --instance-id <id> to use a different one)\n`);
     }
     console.log(`✓  Instance: ${instance.name} (${instance.id.slice(0, 8)}…)\n`);
-    sendFunnelEvent('setup_instance_ready', { instance_id: instance.id });
     // ── Step 3: Detect editors ────────────────────────────────────────────────
     const cwd = process.cwd();
     const detected = [];
@@ -2465,7 +2469,7 @@ if (process.argv[2] === 'index') {
     const instanceId = flag('instance-id') ?? process.env.CACHLY_BRAIN_INSTANCE_ID;
     const maxFiles = parseInt(flag('max-files') ?? '500', 10);
     const namespace = flag('namespace') ?? 'cachly:sem:code';
-    if (!instanceId || !JWT) {
+    if (!instanceId || !getJWT()) {
         console.error('\n❌  CACHLY_BRAIN_INSTANCE_ID and CACHLY_JWT must be set\n');
         console.error('   export CACHLY_BRAIN_INSTANCE_ID=<uuid>');
         console.error('   export CACHLY_JWT=<cky_live_...>');
@@ -2502,7 +2506,7 @@ if (process.argv[2] === 'learn-git') {
     const repoDir = resolve(flag('dir') ?? argv.find(a => !a.startsWith('--')) ?? '.');
     const instanceId = flag('instance-id') ?? process.env.CACHLY_BRAIN_INSTANCE_ID;
     const maxCommits = parseInt(flag('max-commits') ?? '50', 10);
-    if (!instanceId || !JWT) {
+    if (!instanceId || !getJWT()) {
         console.error('\n❌  CACHLY_BRAIN_INSTANCE_ID and CACHLY_JWT must be set\n');
         console.error('   export CACHLY_BRAIN_INSTANCE_ID=<uuid>');
         console.error('   export CACHLY_JWT=<cky_live_...>');
@@ -2534,7 +2538,8 @@ if (process.argv[2] === 'learn-git') {
 // actionable message in their editor's MCP log instead of silent failures.
 // Skip for CLI commands that intentionally run without credentials.
 const _cliNoAuthCommands = ['demo', 'share', 'health', 'setup', 'init', 'digest', 'invite', 'badge', 'join', 'upgrade'];
-if (!JWT && !_cliNoAuthCommands.includes(process.argv[2] ?? '') && !(!process.argv[2] && process.stdout.isTTY)) {
+// In multi-tenant HTTP mode (PORT set) we never need a startup JWT — per-request auth.
+if (!JWT && !process.env.PORT && !_cliNoAuthCommands.includes(process.argv[2] ?? '') && !(!process.argv[2] && process.stdout.isTTY)) {
     // No args + no JWT in a non-TTY context = running as MCP server without credentials.
     // Print actionable setup banner to stdout so it's captured by callers/tests.
     const banner = '\n' +
@@ -2601,9 +2606,39 @@ const httpPort = process.env.PORT ? parseInt(process.env.PORT, 10) : undefined;
 if (httpPort) {
     // ── HTTP mode (Streamable HTTP transport) ───────────────────────────────
     // Used for Smithery URL deployment: PORT=3000 node dist/index.js
+    // Multi-tenant: per-request JWT + instance ID resolved via:
+    //   1. Authorization: Bearer <jwt>  +  X-Cachly-Instance-Id: <uuid>
+    //   2. Smithery config: ?config=base64url({CACHLY_JWT, CACHLY_BRAIN_INSTANCE_ID, ...})
+    // Falls back to module-level env-derived values when neither is provided.
     const { createServer } = await import('node:http');
     const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
     await server.connect(transport);
+    function extractReqCtx(req, url) {
+        let jwtVal = '';
+        let instId = '';
+        const auth = req.headers['authorization'];
+        if (typeof auth === 'string' && auth.toLowerCase().startsWith('bearer ')) {
+            jwtVal = auth.slice(7).trim();
+        }
+        const hdrInst = req.headers['x-cachly-instance-id'];
+        if (typeof hdrInst === 'string')
+            instId = hdrInst.trim();
+        // Smithery passes user config as a base64url-encoded JSON blob in ?config=
+        const cfgParam = url.searchParams.get('config');
+        if (cfgParam && (!jwtVal || !instId)) {
+            try {
+                const b64 = cfgParam.replace(/-/g, '+').replace(/_/g, '/');
+                const padded = b64 + '='.repeat((4 - b64.length % 4) % 4);
+                const json = JSON.parse(Buffer.from(padded, 'base64').toString('utf8'));
+                if (!jwtVal && typeof json.CACHLY_JWT === 'string')
+                    jwtVal = json.CACHLY_JWT;
+                if (!instId && typeof json.CACHLY_BRAIN_INSTANCE_ID === 'string')
+                    instId = json.CACHLY_BRAIN_INSTANCE_ID;
+            }
+            catch { /* malformed config — ignore, fall back to globals */ }
+        }
+        return { jwt: jwtVal, instanceId: instId };
+    }
     const httpServer = createServer((req, res) => {
         const url = new URL(req.url ?? '/', `http://localhost:${httpPort}`);
         if (url.pathname === '/health') {
@@ -2611,6 +2646,8 @@ if (httpPort) {
             res.end(JSON.stringify({
                 status: 'ok',
                 version: CURRENT_VERSION,
+                transport: 'streamable-http',
+                multiTenant: true,
                 zeroResults: {
                     total: zeroResultsTotal,
                     last10: ZERO_RESULTS_LOG.slice(-10).map(e => ({ query: e.query, ts: new Date(e.ts).toISOString() })),
@@ -2619,7 +2656,16 @@ if (httpPort) {
             return;
         }
         if (url.pathname === '/mcp' || url.pathname === '/') {
-            transport.handleRequest(req, res);
+            const ctx = extractReqCtx(req, url);
+            reqCtx.run(ctx, () => {
+                transport.handleRequest(req, res).catch((err) => {
+                    process.stderr.write(`cachly-mcp HTTP handler error: ${err.message}\n`);
+                    if (!res.headersSent) {
+                        res.writeHead(500, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'internal_error' }));
+                    }
+                });
+            });
             return;
         }
         res.writeHead(404);