@cachly-dev/mcp-server 0.10.56 → 0.10.57

package/src/index.ts

@@ -1,6 +1,10 @@
 #!/usr/bin/env node
 import { jwtExpiryMs, checkJwt, handleApiError } from './auth.js';
+import { handleTcoTool, TCO_TOOL_NAMES } from './handlers/tco.js';
+import { notify } from './notifier.js';
 import { readFile } from 'node:fs/promises';
+import { execSync } from 'node:child_process';
+import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 // True only when this file is the entry point (not imported by tests or other modules).
@@ -35,11 +39,24 @@ const _isMain = process.argv[1] != null &&
  * ── Auth & Status ────────────────────────────────────────────────────────────
  *   • get_api_status        – check API health + JWT auth info (Keycloak)
  *
+ * ── Travel Chaos Organizer (TCO) ────────────────────────────────────────────
+ *   • tco_list_trips    – list all trips
+ *   • tco_create_trip   – create a new trip
+ *   • tco_get_timeline  – get timeline items for a trip
+ *   • tco_delete_trip   – delete a trip
+ *   • tco_inbox_list    – list Chaos Inbox items
+ *   • tco_inbox_assign  – assign inbox item to a trip
+ *   • tco_inbox_reject  – reject/discard an inbox item
+ *   • tco_parse_url     – fetch a URL and parse with Ollama
+ *   • tco_import_email  – import raw email text
+ *   (Requires TCO_API_URL env var; auth forwarded from CACHLY_JWT — same Keycloak realm)
+ *
  * Configuration (env vars):
  *   CACHLY_API_URL      – default https://api.cachly.dev
  *   CACHLY_JWT          – your JWT (Keycloak access token)
  *   CACHLY_EMBED_PROVIDER – embedding backend: openai (default), gemini, mistral, cohere, ollama, cachly (server fallback)
  *   CACHLY_EMBED_MODEL  – override embedding model (optional)
+ *   TCO_API_URL         – Travel Chaos Organizer backend URL (optional, enables tco_* tools)
  */
 
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
@@ -52,22 +69,19 @@ import {
   McpError,
 } from '@modelcontextprotocol/sdk/types.js';
 import { Redis } from 'ioredis';
-import { AsyncLocalStorage } from 'node:async_hooks';
 
 // ── Config ────────────────────────────────────────────────────────────────────
 
 const API_URL = process.env.CACHLY_API_URL ?? 'https://api.cachly.dev';
 let JWT = process.env.CACHLY_JWT ?? '';
-const CURRENT_VERSION = '0.10.55';
+const EMBED_MODEL = process.env.CACHLY_EMBED_MODEL ?? '';
+const CURRENT_VERSION = '0.10.49';
 
-// ── Per-request context (multi-tenant HTTP / Smithery) ───────────────────────
-// In stdio mode the module-level JWT/instance globals apply.
-// In HTTP mode, the request handler runs each request in an ALS scope that
-// shadows JWT + instance ID with per-user values extracted from headers.
-interface ReqCtx { jwt: string; instanceId: string; }
-const reqCtx = new AsyncLocalStorage<ReqCtx>();
-function getJWT(): string { return reqCtx.getStore()?.jwt || JWT; }
-function getDefaultInstanceId(): string { return reqCtx.getStore()?.instanceId || _defaultInstanceId; }
+// Max time to wait for a freshly-provisioned instance to become "running" before
+// giving up. Free-tier provisioning in high-latency regions can take 45–90s, so the
+// old hard-coded 25s caused spurious "instance_not_reachable" on first run.
+// Override via CACHLY_PROVISION_TIMEOUT_MS.
+const PROVISION_TIMEOUT_MS = Number(process.env.CACHLY_PROVISION_TIMEOUT_MS ?? 90_000);
 
 // ── Default Instance Resolution (for Smithery & single-credential setups) ────
 // When CACHLY_BRAIN_INSTANCE_ID is set, tools can omit the instance_id parameter.
@@ -77,28 +91,15 @@ let _defaultInstanceId: string = process.env.CACHLY_BRAIN_INSTANCE_ID ?? '';
 let _defaultInstanceLastAttempt = 0;
 
 async function resolveDefaultInstanceId(): Promise<string> {
-  // In an HTTP request scope the instance ID is fixed by the caller's header.
-  const scopedId = reqCtx.getStore()?.instanceId;
-  if (scopedId) return scopedId;
   if (_defaultInstanceId) return _defaultInstanceId;
-  if (!getJWT()) return '';
+  if (!JWT) return '';
   // Cooldown: don't hammer the API on every tool call after a transient failure.
-  // 10 s is enough to avoid rate-limit spam while not blocking the user for too long.
   const now = Date.now();
-  if (_defaultInstanceLastAttempt > 0 && now - _defaultInstanceLastAttempt < 10_000) {
-    throw new McpError(
-      ErrorCode.InvalidRequest,
-      '⚠️ Cachly Brain is temporarily unreachable (API error a few seconds ago).\n\n' +
-      'The server will retry automatically in a moment. If this persists:\n' +
-      '• Run `get_api_status` for a full diagnostic\n' +
-      '• Check that CACHLY_JWT is set and valid\n' +
-      '• Visit https://cachly.dev/instances to verify your Brain is running'
-    );
-  };
+  if (_defaultInstanceLastAttempt > 0 && now - _defaultInstanceLastAttempt < 30_000) return '';
   _defaultInstanceLastAttempt = now;
   try {
     const res = await fetch(`${API_URL}/api/v1/instances`, {
-      headers: { Authorization: `Bearer ${getJWT()}`, Accept: 'application/json' },
+      headers: { Authorization: `Bearer ${JWT}`, Accept: 'application/json' },
       signal: AbortSignal.timeout(5000),
     });
     if (!res.ok) return '';
@@ -185,28 +186,38 @@ async function pollDeviceFlow(flow: DeviceFlowState): Promise<'pending' | 'expir
       } catch { /* use raw JWT as fallback */ }
       JWT = apiKey;
       setEmbedJwt(apiKey); // keep embeddings.ts in sync
-      // Persist API key to ~/.claude/mcp.json so the next editor restart
-      // doesn't start over from a missing CACHLY_JWT (fixes BrainRecallCount=0 bug).
-      try {
-        const { resolve: _res, dirname: _dir } = await import('node:path');
-        const { homedir: _hd } = await import('node:os');
-        const { writeFile: _wf, mkdir: _mk, readFile: _rf } = await import('node:fs/promises');
-        const { existsSync: _ex } = await import('node:fs');
-        const globalJwtPath = _res(_hd(), '.claude', 'mcp.json');
-        await _mk(_dir(globalJwtPath), { recursive: true });
-        let cfg: { mcpServers?: Record<string, { env?: Record<string, string> }> } = {};
-        if (_ex(globalJwtPath)) {
-          try { cfg = JSON.parse(await _rf(globalJwtPath, 'utf-8')) as typeof cfg; } catch { /* corrupt — start fresh */ }
-        }
-        cfg.mcpServers ??= {};
-        cfg.mcpServers['cachly'] ??= {};
-        cfg.mcpServers['cachly'].env ??= {};
-        cfg.mcpServers['cachly'].env['CACHLY_JWT'] = apiKey;
-        if (_defaultInstanceId) cfg.mcpServers['cachly'].env['CACHLY_BRAIN_INSTANCE_ID'] = _defaultInstanceId;
-        await _wf(globalJwtPath, JSON.stringify(cfg, null, 2), 'utf-8');
-      } catch { /* non-fatal — editor will just prompt again on next restart */ }
       _deviceFlow = null;
       sendFunnelEvent('device_flow_completed');
+      // Persist the API key to ~/.claude/mcp.json so subsequent MCP server restarts
+      // keep the token. Without this, JWT is lost on restart and brain_recall_count
+      // is never incremented (telemetry has no api_key → no tenant resolution).
+      void (async () => {
+        try {
+          const { writeFile, mkdir, readFile } = await import('node:fs/promises');
+          const { existsSync } = await import('node:fs');
+          const { resolve, dirname } = await import('node:path');
+          const home = process.env.HOME ?? process.env.USERPROFILE ?? '';
+          if (!home) return;
+          const configPath = resolve(home, '.claude', 'mcp.json');
+          let cfg: { mcpServers?: Record<string, { command?: string; args?: string[]; env?: Record<string, string> }> } = {};
+          if (existsSync(configPath)) {
+            try { cfg = JSON.parse(await readFile(configPath, 'utf-8')) as typeof cfg; } catch { /* corrupt — start fresh */ }
+          }
+          cfg.mcpServers ??= {};
+          const existing = cfg.mcpServers['cachly'];
+          if (existing) {
+            existing.env ??= {};
+            existing.env['CACHLY_JWT'] = apiKey;
+          } else {
+            cfg.mcpServers['cachly'] = {
+              command: 'npx', args: ['-y', '@cachly-dev/mcp-server@latest'],
+              env: { CACHLY_JWT: apiKey },
+            };
+          }
+          await mkdir(dirname(configPath), { recursive: true });
+          await writeFile(configPath, JSON.stringify(cfg, null, 2), 'utf-8');
+        } catch { /* non-critical — don't break the flow on filesystem errors */ }
+      })();
       // Auto-provision: find or create the user's brain instance.
       _defaultInstanceLastAttempt = 0;
       await resolveDefaultInstanceId();
@@ -214,7 +225,7 @@ async function pollDeviceFlow(flow: DeviceFlowState): Promise<'pending' | 'expir
         try {
           const autoRes = await fetch(`${API_URL}/api/v1/instances/auto`, {
             method: 'POST',
-            headers: { Authorization: `Bearer ${getJWT()}`, 'Content-Type': 'application/json' },
+            headers: { Authorization: `Bearer ${JWT}`, 'Content-Type': 'application/json' },
             signal: AbortSignal.timeout(12000),
           });
           if (autoRes.ok) {
@@ -229,7 +240,7 @@ async function pollDeviceFlow(flow: DeviceFlowState): Promise<'pending' | 'expir
             // Log so telemetry can detect free-tier auto-provision failures
             void fetch(`${API_URL}/api/v1/telemetry/mcp`, {
               method: 'POST',
-              headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${getJWT()}` },
+              headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${JWT}` },
               body: JSON.stringify({ event: 'auto_provision_failed', status: autoRes.status, version: CURRENT_VERSION }),
               signal: AbortSignal.timeout(3000),
             }).catch(() => {});
@@ -241,7 +252,7 @@ async function pollDeviceFlow(flow: DeviceFlowState): Promise<'pending' | 'expir
       if (_defaultInstanceId) {
         try {
           const checkRes = await fetch(`${API_URL}/api/v1/instances/${_defaultInstanceId}`, {
-            headers: { Authorization: `Bearer ${getJWT()}`, Accept: 'application/json' },
+            headers: { Authorization: `Bearer ${JWT}`, Accept: 'application/json' },
             signal: AbortSignal.timeout(4000),
           });
           if (checkRes.ok) {
@@ -252,7 +263,7 @@ async function pollDeviceFlow(flow: DeviceFlowState): Promise<'pending' | 'expir
               while (checkInst.status === 'provisioning' && Date.now() < pDeadline) {
                 await new Promise(r => setTimeout(r, 3000));
                 const rr = await fetch(`${API_URL}/api/v1/instances/${_defaultInstanceId}`, {
-                  headers: { Authorization: `Bearer ${getJWT()}`, Accept: 'application/json' },
+                  headers: { Authorization: `Bearer ${JWT}`, Accept: 'application/json' },
                   signal: AbortSignal.timeout(4000),
                 }).catch(() => null);
                 if (rr?.ok) {
@@ -264,67 +275,51 @@ async function pollDeviceFlow(flow: DeviceFlowState): Promise<'pending' | 'expir
           }
         } catch { /* non-fatal — getConnection will handle the wait if still provisioning */ }
       }
+      // Persist instance_id to ~/.claude/mcp.json after it's known.
+      // Without this, every restart loses CACHLY_BRAIN_INSTANCE_ID → resolveDefaultInstanceId
+      // makes an extra API call on every startup (with 30s cooldown on failure).
+      if (_defaultInstanceId) {
+        void (async () => {
+          try {
+            const { writeFile, readFile } = await import('node:fs/promises');
+            const { existsSync } = await import('node:fs');
+            const { resolve } = await import('node:path');
+            const home = process.env.HOME ?? process.env.USERPROFILE ?? '';
+            if (!home) return;
+            const configPath = resolve(home, '.claude', 'mcp.json');
+            if (!existsSync(configPath)) return;
+            let cfg: { mcpServers?: Record<string, { env?: Record<string, string> }> } = {};
+            try { cfg = JSON.parse(await readFile(configPath, 'utf-8')) as typeof cfg; } catch { return; }
+            const entry = cfg.mcpServers?.['cachly'];
+            if (entry?.env) {
+              entry.env['CACHLY_BRAIN_INSTANCE_ID'] = _defaultInstanceId;
+              await writeFile(configPath, JSON.stringify(cfg, null, 2), 'utf-8');
+            }
+          } catch { /* non-critical */ }
+        })();
+      }
       return 'done';
     }
     if (data.error === 'slow_down') flow.pollInterval = Math.min(flow.pollInterval + 2000, 15000);
     return 'pending';
   } catch { return 'pending'; }
 }
-// ── Silent Auto-Setup (instant-trial, zero-click) ─────────────────────────
-// Attempts to provision a free trial silently on the first tool call when no
-// JWT is set. Returns true if credentials were written and the tool can
-// proceed transparently; false if the API is unreachable or trials are full.
-// Only runs once per process (subsequent failures short-circuit immediately).
-let _silentSetupAttempted = false;
-async function silentAutoSetup(): Promise<boolean> {
-  if (_silentSetupAttempted) return false;
-  _silentSetupAttempted = true;
-  try {
-    type TrialResp = { api_key: string; expires_at?: string; instance_id?: string; trial?: boolean };
-    const res = await fetch(`${API_URL}/auth/instant-trial`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({}),
-      signal: AbortSignal.timeout(8000),
-    });
-    if (!res.ok) return false;
-    const data = await res.json() as TrialResp;
-    if (!data.api_key) return false;
+// ── Confidence utils (imported from confidence.ts) ──────────────────────────
+import { calculateConfidence, confidenceBadge, STRUCTURED_TEMPLATES,
+         CONFIDENCE_WARN_VALUE, CONFIDENCE_STALE_VALUE, CONFIDENCE_WARN_DAYS,
+         CONFIDENCE_STALE_DAYS,
+         simpleHash } from './confidence.js';
 
-    JWT = data.api_key;
-    setEmbedJwt(data.api_key);
-    if (data.instance_id) _defaultInstanceId = data.instance_id;
-    sendFunnelEvent('trial_provisioned', { version: CURRENT_VERSION });
 
-    // Persist credentials so the next editor restart doesn't re-provision.
-    try {
-      const { resolve: _rp, dirname: _dn } = await import('node:path');
-      const { homedir: _hd } = await import('node:os');
-      const { writeFile: _wf, mkdir: _mk, readFile: _rf } = await import('node:fs/promises');
-      const { existsSync: _ex } = await import('node:fs');
-      const cfgPath = _rp(_hd(), '.claude', 'mcp.json');
-      await _mk(_dn(cfgPath), { recursive: true });
-      let cfg: { mcpServers?: Record<string, { env?: Record<string, string> }> } = {};
-      if (_ex(cfgPath)) {
-        try { cfg = JSON.parse(await _rf(cfgPath, 'utf-8')) as typeof cfg; } catch { /* corrupt — overwrite */ }
-      }
-      cfg.mcpServers ??= {};
-      cfg.mcpServers['cachly'] ??= {};
-      cfg.mcpServers['cachly'].env ??= {};
-      cfg.mcpServers['cachly'].env['CACHLY_JWT'] = data.api_key;
-      if (_defaultInstanceId) cfg.mcpServers['cachly'].env['CACHLY_BRAIN_INSTANCE_ID'] = _defaultInstanceId;
-      await _wf(cfgPath, JSON.stringify(cfg, null, 2), 'utf-8');
-    } catch { /* non-fatal — trial is active for this session even if persist fails */ }
-    return true;
-  } catch { return false; }
-}
 // ── Embeddings (imported from embeddings.ts) ────────────────────────────────
-import { setEmbedJwt } from './embeddings.js';
+import { embedConfig, setEmbedJwt, EMBED_PROVIDER, computeEmbedding,
+         hasEmbedProvider, embedProviderHint } from './embeddings.js';
 
 // ── Search Engine (imported from search.ts) ─────────────────────────────────
 import { tokenize, splitMultiQuery, levenshtein, recencyBoost, extractTimestamp, STOPWORDS,
          katakanaToRomaji, arabicLightStem, expandCrossLingual, CROSS_LINGUAL_MAP,
-         ZERO_RESULTS_LOG, zeroResultsTotal } from './search.js';
+         keywordSearch, ZERO_RESULTS_LOG, zeroResultsTotal, indexVocab as _indexVocab } from './search.js';
+import type { KeywordMatch } from './search.js';
 
 // ── Exported for testing (re-export from search.ts) ─────────────────────────
 export { tokenize, splitMultiQuery, levenshtein, recencyBoost, extractTimestamp, STOPWORDS,
@@ -333,6 +328,19 @@ export { tokenize, splitMultiQuery, levenshtein, recencyBoost, extractTimestamp,
 // ── Types ─────────────────────────────────────────────────────────────────────
 // Instance is imported from handlers/brain.ts
 
+interface CreateResponse {
+  instance_id: string;
+  checkout_url?: string;
+  status: string;
+}
+
+interface SemanticSearchResponse {
+  found: boolean;
+  id?: string;
+  similarity?: number;
+  prompt?: string;
+}
+
 // ── Connection pool ───────────────────────────────────────────────────────────
 
 /** Reuse Redis connections across tool calls (keyed by instance_id). */
@@ -349,27 +357,16 @@ async function getConnection(instance_id: string): Promise<Redis> {
     );
   }
 
-  if (pool.has(instance_id)) {
-    const cached = pool.get(instance_id)!;
-    // Verify the pooled connection is still alive before reusing it.
-    // ioredis 'error' eviction is async — a connection can be in the pool
-    // but already internally broken (status 'reconnecting' or 'end').
-    const status = (cached as { status?: string }).status;
-    if (status === 'ready' || status === 'connect') {
-      return cached;
-    }
-    // Stale — evict and fall through to reconnect.
-    pool.delete(instance_id);
-    cached.disconnect();
-  }
+  if (pool.has(instance_id)) return pool.get(instance_id)!;
 
-  // Fetch instance, waiting up to 8 s if it is still provisioning.
-  // (autoStartSession already gave the instance a head-start; 8 s covers any remaining gap.)
+  // Fetch instance, waiting up to PROVISION_TIMEOUT_MS if it is still provisioning.
+  // This covers the zero-friction path: device-flow auth → auto-provision → first tool call
+  // all happen in quick succession and the instance isn't running yet.
   let inst = await apiFetch<Instance>(`/api/v1/instances/${instance_id}`);
   if (inst.status === 'provisioning') {
-    const deadline = Date.now() + 8_000;
+    const deadline = Date.now() + PROVISION_TIMEOUT_MS;
     while (inst.status === 'provisioning' && Date.now() < deadline) {
-      await new Promise(r => setTimeout(r, 2000));
+      await new Promise(r => setTimeout(r, 3000));
       inst = await apiFetch<Instance>(`/api/v1/instances/${instance_id}`);
     }
   }
@@ -378,7 +375,7 @@ async function getConnection(instance_id: string): Promise<Redis> {
     // Telemetry: unreachable instance so the team can proactively investigate
     void fetch(`${API_URL}/api/v1/telemetry/mcp`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json', ...(getJWT() ? { Authorization: `Bearer ${getJWT()}` } : {}) },
+      headers: { 'Content-Type': 'application/json', ...(JWT ? { Authorization: `Bearer ${JWT}` } : {}) },
       body: JSON.stringify({ event: 'instance_not_reachable', instance_id, status: inst.status, version: CURRENT_VERSION }),
       signal: AbortSignal.timeout(3000),
     }).catch(() => {});
@@ -409,9 +406,7 @@ async function getConnection(instance_id: string): Promise<Redis> {
 
   // Fetch connection details (includes password) from the dedicated endpoint.
   let password: string | undefined;
-  // Default to false — most free/dev instances run without TLS.
-  // Only enable TLS when the API explicitly returns tls_enabled: true.
-  let tlsEnabled = inst.tls_enabled === true;
+  let tlsEnabled = inst.tls_enabled !== false; // default true
   try {
     const conn = await apiFetch<{ password?: string; tls_enabled?: boolean }>(
       `/api/v1/instances/${instance_id}/connection`
@@ -433,11 +428,11 @@ async function getConnection(instance_id: string): Promise<Redis> {
     host: inst.host,
     port: inst.port,
     password: password || undefined,
+    commandTimeout: 8000,
     ...(tlsEnabled ? { tls: {} } : {}),
     lazyConnect: true,
     enableReadyCheck: true,
     connectTimeout: 8000,
-    commandTimeout: 10000,
     retryStrategy: () => null,  // fail fast, no reconnect loops in MCP context
   });
 
@@ -445,46 +440,14 @@ async function getConnection(instance_id: string): Promise<Redis> {
   client.on('error', evict);
   client.on('end', evict);
 
-  // Retry up to 3 times with 2s backoff. Covers the window between K8s PodReady
-  // and Valkey actually accepting connections (RDB/AOF load, ~1-3s on cold start).
-  let connectErr: unknown;
-  for (let attempt = 0; attempt < 3; attempt++) {
-    try {
-      if (attempt > 0) {
-        await new Promise(r => setTimeout(r, 2000 * attempt));
-        // Fresh client on retry — ioredis doesn't allow reconnect after explicit disconnect.
-        client.disconnect();
-        const retryClient = new Redis({
-          host: inst.host,
-          port: inst.port,
-          password: password || undefined,
-          ...(tlsEnabled ? { tls: {} } : {}),
-          lazyConnect: true,
-          enableReadyCheck: true,
-          connectTimeout: 8000,
-          commandTimeout: 10000,
-          retryStrategy: () => null,
-        });
-        retryClient.on('error', () => pool.delete(instance_id));
-        retryClient.on('end', () => pool.delete(instance_id));
-        await retryClient.connect();
-        pool.set(instance_id, retryClient);
-        return retryClient;
-      }
-      await client.connect();
-      connectErr = undefined;
-      break;
-    } catch (err) {
-      connectErr = err;
-    }
-  }
-
-  if (connectErr) {
+  try {
+    await client.connect();
+  } catch (err: unknown) {
     client.disconnect();
-    const msg = connectErr instanceof Error ? connectErr.message : String(connectErr);
+    const msg = err instanceof Error ? err.message : String(err);
     void fetch(`${API_URL}/api/v1/telemetry/mcp`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json', ...(getJWT() ? { Authorization: `Bearer ${getJWT()}` } : {}) },
+      headers: { 'Content-Type': 'application/json', ...(JWT ? { Authorization: `Bearer ${JWT}` } : {}) },
       body: JSON.stringify({ event: 'redis_connect_failed', instance_id, host: inst.host, port: inst.port, error: msg, version: CURRENT_VERSION }),
       signal: AbortSignal.timeout(3000),
     }).catch(() => {});
@@ -504,14 +467,14 @@ async function getConnection(instance_id: string): Promise<Redis> {
 // ── API helper ────────────────────────────────────────────────────────────────
 
 async function apiFetch<T>(path: string, options: RequestInit = {}): Promise<T> {
-  checkJwt(getJWT());
+  checkJwt(JWT);
   const timeoutMs = Number(process.env.CACHLY_API_TIMEOUT_MS ?? 15_000);
   const res = await fetch(`${API_URL}${path}`, {
     ...options,
     signal: AbortSignal.timeout(timeoutMs),
     headers: {
       'Content-Type': 'application/json',
-      Authorization: `Bearer ${getJWT()}`,
+      Authorization: `Bearer ${JWT}`,
       ...options.headers,
     },
   });
@@ -524,6 +487,11 @@ async function apiFetch<T>(path: string, options: RequestInit = {}): Promise<T>
   return res.json() as Promise<T>;
 }
 
+import { detectNamespace } from './namespace.js';
+
+// ── CKG (imported from ckg.ts) ─────────────────────────────────────────────
+import type { CKGEdge, CKGNode } from './ckg.js';
+import { ckgSlug, extractProblemConcept, ckgUpsertNode, ckgUpdateEdge } from './ckg.js';
 import { handleBrainTool } from './handlers/brain.js';
 import { handleContextTool } from './handlers/context.js';
 import { handleInstanceTool } from './handlers/instances.js';
@@ -532,7 +500,7 @@ import { handleTeamTool } from './handlers/team.js';
 import { handleRoadmapTool } from './handlers/roadmap.js';
 import { handleAdvancedTool } from './handlers/advanced.js';
 import { handleSyndicateTool } from './handlers/syndicate.js';
-import { handleFedbrainTool } from './handlers/fedbrain.js';
+import { handleFedbrainTool, _lastBrainFromGitCounts } from './handlers/fedbrain.js';
 import type { Instance } from './handlers/brain.js';
 
 // ── Tools (imported from tools.ts) ─────────────────────────────────────────
@@ -561,10 +529,7 @@ function sendFunnelEvent(event: string, extra?: Record<string, unknown>): void {
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({
       event, version: CURRENT_VERSION, editor: detectEditor(),
-      // Send Cachly API keys (cky_*) for server-side tenant resolution (recall counting, emails).
-      // Raw Keycloak JWTs (eyJ...) are intentionally excluded — they are short-lived bearer tokens
-      // that should never leave the MCP process boundary.
-      ...(getJWT().startsWith('cky_') ? { api_key: getJWT() } : {}),
+      ...(JWT ? { jwt: JWT } : {}),
       ...extra,
     }),
     signal: AbortSignal.timeout(3000),
@@ -586,20 +551,12 @@ async function sendAnonymousTelemetry(toolName: string): Promise<void> {
 }
 
 async function handleTool(name: string, args: Record<string, unknown>): Promise<string> {
-  // Guard: if no JWT, try silent auto-setup first, then fall back to device flow.
-  if (!getJWT()) {
-    // ── Step 1: Silent instant-trial (zero-click) ────────────────────────
-    // On the very first tool call, attempt to silently provision a free trial.
-    // If it succeeds the user never sees an auth prompt — Brain is just active.
-    const provisioned = await silentAutoSetup();
-    if (provisioned) {
-      return handleTool(name, args); // Transparent re-entry with active credentials
-    }
-
+  // Guard: if no JWT, return actionable onboarding message instead of HTTP 401
+  if (!JWT) {
     void sendAnonymousTelemetry(name);
 
-    // ── Step 2: Zero-credential device flow ─────────────────────────────
-    // 1st call after silent setup fails: start device flow, return code + URL
+    // ── Zero-credential device flow ─────────────────────────────────────
+    // 1st call: start device flow, return code + URL
     // 2nd+ calls: poll for token; once authenticated, proceed transparently
     if (_deviceFlow) {
       const result = await pollDeviceFlow(_deviceFlow);
@@ -647,7 +604,7 @@ async function handleTool(name: string, args: Record<string, unknown>): Promise<
         '',
         'After sign-in: call **any tool again** — your Brain activates instantly.',
         '',
-        '✨ Free forever · No credit card · 89 MCP tools · GDPR · EU servers',
+        '✨ Free forever · No credit card · 95 MCP tools · GDPR · EU servers',
       ].join('\n');
     }
 
@@ -673,16 +630,16 @@ async function handleTool(name: string, args: Record<string, unknown>): Promise<
   }
 
   // Delegate brain tools (learn, recall, session, etc.)
-  let brainResult = await handleBrainTool(name, args, getConnection, apiFetch);
+  const brainResult = await handleBrainTool(name, args, getConnection, apiFetch);
   if (brainResult !== null) {
-    if (!_firstCallSuccessSent && getJWT()) {
+    if (!_firstCallSuccessSent && JWT) {
       _firstCallSuccessSent = true;
-      sendFunnelEvent('first_call_success', { tool: name, instance_id: args.instance_id ?? getDefaultInstanceId() ?? '' });
+      sendFunnelEvent('first_call_success', { tool: name, instance_id: args.instance_id ?? _defaultInstanceId ?? '' });
     }
     // Per-tool telemetry — fires after every successful brain tool call.
     // api_key carries the cky_live_... token so the backend can resolve tenant + increment counters.
-    const instanceId = (args.instance_id as string | undefined) ?? getDefaultInstanceId() ?? '';
-    const telemetryExtra = getJWT() ? { api_key: getJWT(), instance_id: instanceId } : { instance_id: instanceId };
+    const instanceId = (args.instance_id as string | undefined) ?? _defaultInstanceId ?? '';
+    const telemetryExtra = JWT ? { api_key: JWT, instance_id: instanceId } : { instance_id: instanceId };
     if (name === 'recall_best_solution') {
       // recall_best_solution → increments BrainRecallCount + triggers level-up logic
       sendFunnelEvent('recall_best_solution', telemetryExtra);
@@ -698,50 +655,25 @@ async function handleTool(name: string, args: Record<string, unknown>): Promise<
       if (!isFirstSession && resultText.length > 100) {
         // Existing brain — session_start acts as implicit recall → increment counter.
         sendFunnelEvent('recall_best_solution', telemetryExtra);
-      }
-
-      // Auto-bootstrap brain_from_git when workspace_path is provided and it hasn't run yet.
-      // We check a sentinel key in Valkey so this only fires once per workspace path,
-      // not just on the very first session (handles cases where brain was empty but
-      // session data existed, or where the user re-installed).
-      if (args.workspace_path) {
+      } else if (isFirstSession && args.workspace_path) {
+        // First session with a known workspace: auto-bootstrap from git history.
+        // Runs synchronously so the user sees the result in the same response.
         try {
-          const workspacePath = args.workspace_path as string;
-          const autoKey = `cachly:brain_from_git:auto_done:${Buffer.from(workspacePath).toString('base64').slice(0, 40)}`;
-          const redis = await getConnection(instanceId);
-          const alreadyDone = await redis.get(autoKey);
-          if (!alreadyDone) {
-            // Mark immediately to prevent concurrent runs across multiple MCP tool calls
-            await redis.set(autoKey, '1', 'EX', 365 * 86400);
-            // Append a placeholder so the user gets immediate feedback, then bootstrap in background.
-            // Running brain_from_git synchronously would block session_start for 30-120s on large repos.
-            const bgMsg = '\n\n---\n\n🚀 **Auto-indexing your git history in the background** — your Brain will learn from recent commits automatically. No action needed.';
-            if (typeof brainResult === 'object' && brainResult !== null && 'content' in brainResult) {
-              (brainResult as { content: { type: string; text: string }[] }).content.push({ type: 'text', text: bgMsg });
-            } else if (typeof brainResult === 'string') {
-              brainResult = brainResult + bgMsg;
+          const gitBootstrap = await handleFedbrainTool('brain_from_git', {
+            instance_id: instanceId,
+            repo_path: args.workspace_path as string,
+            limit: 50,
+          }, getConnection, apiFetch);
+          if (gitBootstrap !== null) {
+            const gitCounts = _lastBrainFromGitCounts;
+            sendFunnelEvent('brain_from_git', { ...telemetryExtra, ...(gitCounts ?? {}) });
+            sendFunnelEvent('recall_best_solution', telemetryExtra);
+            // Append bootstrap summary to the session_start briefing.
+            // brainResult is always a string here (handleBrainTool returns string for session_start).
+            const bootstrapText = String(gitBootstrap);
+            if (bootstrapText) {
+              return String(brainResult) + '\n---\n' + bootstrapText;
             }
-            // Fire-and-forget — never block the session_start response
-            void handleFedbrainTool('brain_from_git', {
-              instance_id: instanceId,
-              repo_path: workspacePath,
-              limit: 50,
-            }, getConnection, apiFetch).then(async (gitBootstrap) => {
-              if (gitBootstrap !== null) {
-                sendFunnelEvent('brain_from_git', telemetryExtra);
-                sendFunnelEvent('recall_best_solution', telemetryExtra);
-                // Store ingested count for the next session_start wow moment
-                try {
-                  const ingested = (gitBootstrap as string).match(/Ingested:\s*\*\*(\d+)\*/);
-                  if (ingested) {
-                    const r = await getConnection(instanceId);
-                    await r.set('cachly:brain_from_git:auto_bootstrap_result',
-                      JSON.stringify({ count: parseInt(ingested[1]!, 10), ts: new Date().toISOString() }),
-                      'EX', 7 * 86400);
-                  }
-                } catch { /* non-critical — must never break the session */ }
-              }
-            }).catch(() => { /* non-critical */ });
           }
         } catch { /* git bootstrap errors must never break session_start */ }
       }
@@ -755,7 +687,7 @@ async function handleTool(name: string, args: Record<string, unknown>): Promise<
       const srText = typeof brainResult === 'object' && brainResult !== null && 'content' in brainResult
         ? JSON.stringify(brainResult)
         : String(brainResult ?? '');
-      if (srText.length > 50 && !srText.includes('No lessons found') && !srText.includes('no lessons')) {
+      if (srText.length > 50 && !srText.includes('No lessons found') && !srText.includes('no lessons') && !srText.includes('No matches found')) {
         sendFunnelEvent('recall_best_solution', telemetryExtra);
       }
     }
@@ -765,9 +697,9 @@ async function handleTool(name: string, args: Record<string, unknown>): Promise<
   // Delegate context tools (remember/recall/list/forget)
   const contextResult = await handleContextTool(name, args, getConnection, apiFetch);
   if (contextResult !== null) {
-    if (!_firstCallSuccessSent && getJWT()) {
+    if (!_firstCallSuccessSent && JWT) {
       _firstCallSuccessSent = true;
-      sendFunnelEvent('first_call_success', { tool: name, instance_id: args.instance_id ?? getDefaultInstanceId() ?? '' });
+      sendFunnelEvent('first_call_success', { tool: name, instance_id: args.instance_id ?? _defaultInstanceId ?? '' });
     }
     return contextResult;
   }
@@ -793,8 +725,8 @@ async function handleTool(name: string, args: Record<string, unknown>): Promise<
   if (syndicateResult !== null) {
     // brain_predict is in syndicate handler — track telemetry here.
     if (name === 'brain_predict') {
-      const instanceId = (args.instance_id as string | undefined) ?? getDefaultInstanceId() ?? '';
-      const telemetryExtra = getJWT() ? { api_key: getJWT(), instance_id: instanceId } : { instance_id: instanceId };
+      const instanceId = (args.instance_id as string | undefined) ?? _defaultInstanceId ?? '';
+      const telemetryExtra = JWT ? { api_key: JWT, instance_id: instanceId } : { instance_id: instanceId };
       sendFunnelEvent('brain_predict', telemetryExtra);
     }
     return syndicateResult;
@@ -803,16 +735,21 @@ async function handleTool(name: string, args: Record<string, unknown>): Promise<
   const fedbrainResult = await handleFedbrainTool(name, args, getConnection, apiFetch);
   if (fedbrainResult !== null) {
     // brain_from_git and brain_predict_failures are in fedbrain handler.
-    const instanceId = (args.instance_id as string | undefined) ?? getDefaultInstanceId() ?? '';
-    const telemetryExtra = getJWT() ? { api_key: getJWT(), instance_id: instanceId } : { instance_id: instanceId };
+    const instanceId = (args.instance_id as string | undefined) ?? _defaultInstanceId ?? '';
+    const telemetryExtra = JWT ? { api_key: JWT, instance_id: instanceId } : { instance_id: instanceId };
     if (name === 'brain_from_git') {
-      sendFunnelEvent('brain_from_git', telemetryExtra);
+      const gitCounts = _lastBrainFromGitCounts;
+      sendFunnelEvent('brain_from_git', { ...telemetryExtra, ...(gitCounts ?? {}) });
     } else if (name === 'brain_predict_failures') {
       sendFunnelEvent('brain_predict_failures', telemetryExtra);
     }
     return fedbrainResult;
   }
 
+  // Delegate Travel Chaos Organizer tools (requires TCO_API_URL env var)
+  const tcoResult = await handleTcoTool(name, args, JWT ?? '');
+  if (tcoResult !== null) return tcoResult;
+
   switch (name) {
     // ── Instance management ──────────────────────────────────────────────
     case 'get_api_status': {
@@ -831,7 +768,7 @@ async function handleTool(name: string, args: Record<string, unknown>): Promise<
       }
 
       // Check JWT / auth
-      if (!getJWT()) {
+      if (!JWT) {
         return [
           `📡 **cachly API Status**`,
           ``,
@@ -844,38 +781,28 @@ async function handleTool(name: string, args: Record<string, unknown>): Promise<
       }
 
       // Decode JWT claims (inspection only, no verification)
-      const jwt = getJWT();
-      let authInfo: string;
-      // API keys (cky_live_... / cky_trial_...) are valid long-lived credentials.
-      // Only try to decode as JWT (3-part base64url) if it looks like one.
-      if (jwt.startsWith('cky_')) {
-        const keyType = jwt.startsWith('cky_trial_') ? 'Trial' : 'Live';
-        const keyId = jwt.slice(0, 20) + '…';
-        authInfo = `✅ API key (${keyType})\n  Key prefix: ${keyId}`;
-      } else {
-        authInfo = '❌ invalid credential format';
-        try {
-          const parts = jwt.split('.');
-          if (parts.length === 3) {
-            const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf-8')) as {
-              sub?: string; exp?: number; iss?: string;
-            };
-            const sub = payload.sub ?? '(unknown)';
-            const iss = payload.iss ?? '(unknown)';
-            const provider = iss.includes('keycloak') ? 'Keycloak' : 'OIDC';
-            const expTs = payload.exp ? new Date(payload.exp * 1000) : null;
-            const expired = expTs ? expTs < new Date() : false;
-            authInfo = [
-              `✅ JWT decoded`,
-              `  Sub (user ID): ${sub}`,
-              `  Provider:      ${provider}`,
-              `  Issuer:        ${iss}`,
-              `  Expires:       ${expTs ? expTs.toISOString() : 'never'} ${expired ? '⚠️  EXPIRED – get a new token!' : '✅'}`,
-            ].join('\n');
-          }
-        } catch {
-          authInfo = '❌ JWT decode failed – check CACHLY_JWT format';
+      let authInfo = '❌ invalid JWT format';
+      try {
+        const parts = JWT.split('.');
+        if (parts.length === 3) {
+          const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf-8')) as {
+            sub?: string; exp?: number; iss?: string;
+          };
+          const sub = payload.sub ?? '(unknown)';
+          const iss = payload.iss ?? '(unknown)';
+          const provider = iss.includes('keycloak') ? 'Keycloak' : 'OIDC';
+          const expTs = payload.exp ? new Date(payload.exp * 1000) : null;
+          const expired = expTs ? expTs < new Date() : false;
+          authInfo = [
+            `✅ JWT decoded`,
+            `  Sub (user ID): ${sub}`,
+            `  Provider:      ${provider}`,
+            `  Issuer:        ${iss}`,
+            `  Expires:       ${expTs ? expTs.toISOString() : 'never'} ${expired ? '⚠️  EXPIRED – get a new token!' : '✅'}`,
+          ].join('\n');
         }
+      } catch {
+        authInfo = '❌ JWT decode failed – check CACHLY_JWT format';
       }
 
       // List instances + connectivity
@@ -889,7 +816,7 @@ async function handleTool(name: string, args: Record<string, unknown>): Promise<
           const lines: string[] = ['\n\n🧠 **Brain Instances:**'];
           for (const inst of instances) {
             const badge = inst.status === 'running' ? '🟢' : inst.status === 'provisioning' ? '🟡' : '🔴';
-            const defaultMark = inst.id === getDefaultInstanceId() ? ' ← active' : '';
+            const defaultMark = inst.id === _defaultInstanceId ? ' ← active' : '';
             lines.push(`  ${badge} **${inst.name}** (\`${inst.id}\`) · ${inst.status}${defaultMark}`);
             if (inst.status === 'running' && inst.host) {
               // Try a quick ping on the cached connection
@@ -1017,14 +944,12 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       || _defaultInstanceId
       || process.env.CACHLY_BRAIN_INSTANCE_ID;
     if (instanceId) {
-      // Fire-and-forget — session management is non-critical and must never block tool calls.
-      // The session_start briefing (which includes brain_from_git) can take 30-120s on large
-      // repos; awaiting it here would freeze the user's first MCP tool call entirely.
-      void autoStartSession(instanceId);
+      await autoStartSession(instanceId).catch(() => undefined);
     }
+  } else if (_autoSessionStarting) {
+    // Another concurrent call is mid-start — wait for it before proceeding.
+    await _autoSessionStarting.catch(() => undefined);
   }
-  // Note: we intentionally do NOT await _autoSessionStarting for any call.
-  // The session tracker runs in background — tool calls must always proceed immediately.
   if (!sessionTools.has(name)) _autoSessionToolCount++;
 
   try {
@@ -1032,7 +957,9 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     return { content: [{ type: 'text', text }] };
   } catch (err) {
     if (err instanceof McpError) throw err;
-    throw new McpError(ErrorCode.InternalError, (err as Error).message);
+    const msg = (err as Error).message ?? String(err);
+    notify('cachly', 'tool_error', { tool: name, error: msg }).catch(() => undefined);
+    throw new McpError(ErrorCode.InternalError, msg);
   }
 });
 
@@ -1921,7 +1848,7 @@ if (!process.argv[2] && process.stdout.isTTY) {
   console.log('  \x1b[36m  npx @cachly-dev/mcp-server@latest upgrade\x1b[0m  ← Check for updates');
   console.log('');
   console.log('  \x1b[90mWorks with: Claude Code · Cursor · Windsurf · GitHub Copilot · Cline · Zed\x1b[0m');
-  console.log('  \x1b[90mFree forever · GDPR · German servers · 89 MCP tools\x1b[0m');
+  console.log('  \x1b[90mFree forever · GDPR · German servers · 95 MCP tools\x1b[0m');
   console.log('');
   process.exit(0);
 }
@@ -2094,7 +2021,7 @@ if (process.argv[2] === 'status') {
 if (process.argv[2] === 'health') {
   const { existsSync } = await import('node:fs');
   const { readFile } = await import('node:fs/promises');
-  const { resolve } = await import('node:path');
+  const { resolve, join: pJoin } = await import('node:path');
 
   const cwd = process.cwd();
   let passed = 0;
@@ -2111,9 +2038,6 @@ if (process.argv[2] === 'health') {
   const jwt = process.env.CACHLY_JWT ?? '';
   if (!jwt) {
     fail('CACHLY_JWT not set — run: npx @cachly-dev/mcp-server@latest setup');
-  } else if (jwt.startsWith('cky_')) {
-    // Opaque cachly API key — no JWT expiry to check, format is valid by prefix
-    ok('API key set (cky_*** opaque key)');
   } else {
     try {
       const parts = jwt.split('.');
@@ -2131,7 +2055,7 @@ if (process.argv[2] === 'health') {
         ok(`JWT valid${minsLeft !== null ? ` (expires in ${Math.floor(minsLeft / 60)}h ${minsLeft % 60}m)` : ''}`);
       }
     } catch {
-      fail('CACHLY_JWT format invalid (expected a cky_*** API key or a JWT with 3 parts)');
+      fail('CACHLY_JWT format invalid (expected JWT with 3 parts)');
     }
   }
 
@@ -2179,23 +2103,11 @@ if (process.argv[2] === 'health') {
                   signal: AbortSignal.timeout(5000),
                 });
                 if (connRes.ok) {
-                  const conn = await connRes.json() as { password?: string; connection_string?: string; tls_enabled?: boolean };
-                  // password may be a direct field, or embedded in connection_string as redis://:pass@host:port
-                  if (conn.password) {
-                    pingPassword = conn.password;
-                  } else if (conn.connection_string) {
-                    try {
-                      const u = new URL(conn.connection_string);
-                      if (u.password) pingPassword = decodeURIComponent(u.password);
-                    } catch { /* leave pingPassword undefined */ }
-                  }
-                  pingTls = conn.tls_enabled === true;
-                } else {
-                  warn(`Could not fetch Redis credentials (HTTP ${connRes.status}) — connectivity test may fail`);
+                  const conn = await connRes.json() as { password?: string; tls_enabled?: boolean };
+                  pingPassword = conn.password;
+                  pingTls = conn.tls_enabled !== false;
                 }
-              } catch (connErr) {
-                warn(`Could not fetch Redis credentials — ${(connErr as Error).message}`);
-              }
+              } catch { /* proceed without password */ }
               const pingClient = new Redis({
                 host: inst.host, port: inst.port,
                 password: pingPassword,
@@ -2323,6 +2235,7 @@ if (process.argv[2] === 'setup') {
     const CLIENT_ID = 'cachly-cli';
 
     console.log('Step 1: Sign in to cachly (free, no credit card)\n');
+    sendFunnelEvent('setup_auth_started');
 
     // Start device flow
     let deviceCode = '', userCode = '', verifyUri = '', pollInterval = 5000;
@@ -2346,6 +2259,7 @@ if (process.argv[2] === 'setup') {
       console.error('Falling back: sign in at https://cachly.dev/setup-ai and paste your API token.\n');
       token = await ask('   Paste API token (cky_live_...): ');
       if (!token) { console.error('\nToken is required. Aborting.\n'); rl.close(); process.exit(1); }
+      sendFunnelEvent('setup_auth_completed');
       console.log('');
       deviceCode = ''; // mark as fallback so we skip polling
     }
@@ -2379,6 +2293,7 @@ if (process.argv[2] === 'setup') {
           if (tokenData.access_token) {
             token = tokenData.access_token;
             console.log(' \x1b[32m✓ Authorized!\x1b[0m\n');
+            sendFunnelEvent('setup_auth_completed');
             break;
           }
           // authorization_pending = keep polling; slow_down = increase interval
@@ -2410,7 +2325,7 @@ if (process.argv[2] === 'setup') {
       if (!keyBody.key) throw new Error('no key in response');
       token = keyBody.key; // swap JWT → cky_live_...
       console.log(' ✓\n');
-    } catch {
+    } catch (e) {
       console.log(' (skipped)\n');
       // Non-fatal: fall back to using the Keycloak JWT directly.
       // It will expire but setup still works for now.
@@ -2459,9 +2374,10 @@ if (process.argv[2] === 'setup') {
         // Newly created — poll until running or give up after 30 s.
         const newId = autoBody.instance_id;
         console.log(` ✓ created (${newId.slice(0, 8)}…)\n`);
+        // 45 attempts × 3s = 135s — generous for free-tier in slow regions.
         process.stdout.write('⏳ Waiting for instance to start');
-        for (let attempt = 0; attempt < 15; attempt++) {
-          await new Promise(r => setTimeout(r, 2000));
+        for (let attempt = 0; attempt < 45; attempt++) {
+          await new Promise(r => setTimeout(r, 3000));
           process.stdout.write('.');
           try {
             const checkRes = await fetch(`${API_URL}/api/v1/instances/${newId}`, { headers: { Authorization: `Bearer ${token}` } });
@@ -2495,6 +2411,7 @@ if (process.argv[2] === 'setup') {
     console.log(`   (Run with --instance-id <id> to use a different one)\n`);
   }
   console.log(`✓  Instance: ${instance.name} (${instance.id.slice(0, 8)}…)\n`);
+  sendFunnelEvent('setup_instance_ready', { instance_id: instance.id });
 
   // ── Step 3: Detect editors ────────────────────────────────────────────────
   const cwd = process.cwd();
@@ -2667,8 +2584,6 @@ if (process.argv[2] === 'setup') {
   console.log(`   Dashboard: https://cachly.dev/instances/${instance.id}`);
   console.log(`\n   📛 Add a live badge to your README:`);
   console.log(`      npx @cachly-dev/mcp-server@latest badge\n`);
-  console.log(`   🤝 Invite a teammate — they'll arrive pre-briefed on your project:`);
-  console.log(`      npx @cachly-dev/mcp-server@latest invite\n`);
 
   // ── Step 7: Email opt-in (non-blocking — at the very end) ────────────────
   if (!nonInteractive) {
@@ -2742,7 +2657,7 @@ if (process.argv[2] === 'index') {
   const maxFiles   = parseInt(flag('max-files') ?? '500', 10);
   const namespace  = flag('namespace') ?? 'cachly:sem:code';
 
-  if (!instanceId || !getJWT()) {
+  if (!instanceId || !JWT) {
     console.error('\n❌  CACHLY_BRAIN_INSTANCE_ID and CACHLY_JWT must be set\n');
     console.error('   export CACHLY_BRAIN_INSTANCE_ID=<uuid>');
     console.error('   export CACHLY_JWT=<cky_live_...>');
@@ -2784,7 +2699,7 @@ if (process.argv[2] === 'learn-git') {
   const instanceId = flag('instance-id') ?? process.env.CACHLY_BRAIN_INSTANCE_ID;
   const maxCommits = parseInt(flag('max-commits') ?? '50', 10);
 
-  if (!instanceId || !getJWT()) {
+  if (!instanceId || !JWT) {
     console.error('\n❌  CACHLY_BRAIN_INSTANCE_ID and CACHLY_JWT must be set\n');
     console.error('   export CACHLY_BRAIN_INSTANCE_ID=<uuid>');
     console.error('   export CACHLY_JWT=<cky_live_...>');
@@ -2802,7 +2717,7 @@ if (process.argv[2] === 'learn-git') {
       limit: maxCommits,
     });
     console.log(result);
-    sendFunnelEvent('brain_from_git', { instance_id: instanceId });
+    sendFunnelEvent('brain_from_git', { api_key: JWT, instance_id: instanceId });
     console.log('\n✅  Brain learned from your commits.\n');
     // Let fire-and-forget telemetry flush before exit.
     await new Promise(r => setTimeout(r, 300));
@@ -2819,8 +2734,7 @@ if (process.argv[2] === 'learn-git') {
 // actionable message in their editor's MCP log instead of silent failures.
 // Skip for CLI commands that intentionally run without credentials.
 const _cliNoAuthCommands = ['demo', 'share', 'health', 'setup', 'init', 'digest', 'invite', 'badge', 'join', 'upgrade'];
-// In multi-tenant HTTP mode (PORT set) we never need a startup JWT — per-request auth.
-if (!JWT && !process.env.PORT && !_cliNoAuthCommands.includes(process.argv[2] ?? '') && !(!process.argv[2] && process.stdout.isTTY)) {
+if (!JWT && !_cliNoAuthCommands.includes(process.argv[2] ?? '') && !(!process.argv[2] && process.stdout.isTTY)) {
   // No args + no JWT in a non-TTY context = running as MCP server without credentials.
   // Print actionable setup banner to stdout so it's captured by callers/tests.
   const banner =
@@ -2893,76 +2807,12 @@ if (!process.env.CACHLY_NO_UPDATE_CHECK) {
 
 const httpPort = process.env.PORT ? parseInt(process.env.PORT, 10) : undefined;
 
-// ── Per-request MCP Server factory (HTTP / Smithery stateless mode) ──────────
-// SDK ≥1.9 forbids reusing a stateless transport across requests.
-// Solution: create a fresh Server+Transport per /mcp request.
-// The module-level `server` below is used for stdio mode only.
-function createHttpMcpServer(): Server {
-  const srv = new Server(
-    { name: 'cachly-mcp', version: CURRENT_VERSION },
-    { capabilities: { tools: {} } }
-  );
-  srv.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }));
-  srv.setRequestHandler(CallToolRequestSchema, async (request) => {
-    const { name, arguments: args } = request.params;
-    try {
-      const text = await handleTool(name, (args ?? {}) as Record<string, unknown>);
-      return { content: [{ type: 'text', text }] };
-    } catch (err) {
-      if (err instanceof McpError) throw err;
-      throw new McpError(ErrorCode.InternalError, (err as Error).message);
-    }
-  });
-  return srv;
-}
-
 if (httpPort) {
   // ── HTTP mode (Streamable HTTP transport) ───────────────────────────────
-  // Used for Smithery URL deployment: PORT=3000 node dist/index.js
-  // Multi-tenant: per-request JWT + instance ID resolved via:
-  //   1. Authorization: Bearer <jwt>  +  X-Cachly-Instance-Id: <uuid>
-  //   2. Smithery config: ?config=base64url({CACHLY_JWT, CACHLY_BRAIN_INSTANCE_ID, ...})
-  // Falls back to module-level env-derived values when neither is provided.
+  // Used for Smithery URL deployment: PORT=3000 node dist/src/index.js
   const { createServer } = await import('node:http');
-
-  function extractReqCtx(req: import('node:http').IncomingMessage, url: URL): ReqCtx {
-    let jwtVal = '';
-    let instId = '';
-    const auth = req.headers['authorization'];
-    if (typeof auth === 'string' && auth.trim()) {
-      const a = auth.trim();
-      jwtVal = a.toLowerCase().startsWith('bearer ') ? a.slice(7).trim() : a;
-    }
-    // Fallback: raw JWT in custom header (Smithery "header" transport without Bearer prefix)
-    if (!jwtVal) {
-      const rawJwt = req.headers['cachly_jwt'] ?? req.headers['cachly-jwt'] ?? req.headers['x-cachly-jwt'] ?? req.headers['x-api-key'];
-      if (typeof rawJwt === 'string') jwtVal = rawJwt.trim();
-    }
-    const hdrInst = req.headers['x-cachly-instance-id'];
-    if (typeof hdrInst === 'string') instId = hdrInst.trim();
-    // Smithery passes user config as a base64url-encoded JSON blob in ?config=
-    const cfgParam = url.searchParams.get('config');
-    if (cfgParam && (!jwtVal || !instId)) {
-      try {
-        const b64 = cfgParam.replace(/-/g, '+').replace(/_/g, '/');
-        const padded = b64 + '='.repeat((4 - b64.length % 4) % 4);
-        const json = JSON.parse(Buffer.from(padded, 'base64').toString('utf8'));
-        if (!jwtVal && typeof json.CACHLY_JWT === 'string') jwtVal = json.CACHLY_JWT;
-        if (!instId && typeof json.CACHLY_BRAIN_INSTANCE_ID === 'string') instId = json.CACHLY_BRAIN_INSTANCE_ID;
-      } catch { /* malformed config — ignore, fall back to globals */ }
-    }
-    // Direct query params (Smithery "query" transport, manual clients, etc.)
-    if (!jwtVal) {
-      const q = url.searchParams.get('CACHLY_JWT') ?? url.searchParams.get('cachly_jwt') ?? url.searchParams.get('api_key');
-      if (q) jwtVal = q.trim();
-    }
-    if (!instId) {
-      const q = url.searchParams.get('CACHLY_BRAIN_INSTANCE_ID') ?? url.searchParams.get('cachly_brain_instance_id') ?? url.searchParams.get('instance_id');
-      if (q) instId = q.trim();
-    }
-    return { jwt: jwtVal, instanceId: instId };
-  }
-
+  const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+  await server.connect(transport);
   const httpServer = createServer((req, res) => {
     const url = new URL(req.url ?? '/', `http://localhost:${httpPort}`);
     if (url.pathname === '/health') {
@@ -2970,8 +2820,6 @@ if (httpPort) {
       res.end(JSON.stringify({
         status: 'ok',
         version: CURRENT_VERSION,
-        transport: 'streamable-http',
-        multiTenant: true,
         zeroResults: {
           total: zeroResultsTotal,
           last10: ZERO_RESULTS_LOG.slice(-10).map(e => ({ query: e.query, ts: new Date(e.ts).toISOString() })),
@@ -2979,52 +2827,8 @@ if (httpPort) {
       }));
       return;
     }
-    // Static server card — lets Smithery skip live scanning (avoids auth complexity).
-    if (url.pathname === '/.well-known/mcp/server-card.json') {
-      const card = {
-        name: 'cachly AI Brain',
-        version: CURRENT_VERSION,
-        description: 'Persistent AI memory for Claude Code, Cursor, Copilot, Windsurf & friends. Remembers every lesson, fix, and architecture decision forever.',
-        transport: { type: 'streamable-http', url: 'https://mcp.cachly.dev/mcp' },
-        capabilities: { tools: {} },
-      };
-      res.writeHead(200, { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': '*' });
-      res.end(JSON.stringify(card));
-      return;
-    }
     if (url.pathname === '/mcp' || url.pathname === '/') {
-      // Handle CORS preflight
-      if (req.method === 'OPTIONS') {
-        res.writeHead(204, {
-          'Access-Control-Allow-Origin': '*',
-          'Access-Control-Allow-Methods': 'GET, POST, DELETE, OPTIONS',
-          'Access-Control-Allow-Headers': 'Authorization, Content-Type, Mcp-Session-Id, X-Cachly-Instance-Id, cachly_jwt, cachly-jwt, x-cachly-jwt, x-api-key',
-        });
-        res.end();
-        return;
-      }
-      const ctx = extractReqCtx(req, url);
-      // Create a fresh Server+Transport for each request (stateless multi-tenant mode).
-      // SDK ≥1.9 throws if a stateless transport is reused across requests.
-      const reqServer = createHttpMcpServer();
-      const reqTransport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
-      reqServer.connect(reqTransport).then(() => {
-        reqCtx.run(ctx, () => {
-          reqTransport.handleRequest(req, res).catch((err) => {
-            process.stderr.write(`cachly-mcp HTTP handler error: ${(err as Error).message}\n`);
-            if (!res.headersSent) {
-              res.writeHead(500, { 'Content-Type': 'application/json' });
-              res.end(JSON.stringify({ error: 'internal_error' }));
-            }
-          });
-        });
-      }).catch((err) => {
-        process.stderr.write(`cachly-mcp connect error: ${(err as Error).message}\n`);
-        if (!res.headersSent) {
-          res.writeHead(500, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify({ error: 'internal_error' }));
-        }
-      });
+      transport.handleRequest(req, res);
       return;
     }
     res.writeHead(404);
@@ -3039,3 +2843,5 @@ if (httpPort) {
   await server.connect(transport);
 }
 
+notify('cachly', 'startup', { version: CURRENT_VERSION, mode: process.env.MCP_HTTP_PORT ? 'http' : 'stdio' }).catch(() => undefined);
+