@cachly-dev/mcp-server 0.10.72 → 0.10.74

package/dist/src/index.js

@@ -2,7 +2,6 @@
 import { jwtExpiryMs, checkJwt, handleApiError, diagnoseAuth, planAuthHeal } from './auth.js';
 import { handleTcoTool } from './handlers/tco.js';
 import { notify } from './notifier.js';
-import { readFile } from 'node:fs/promises';
 import { fileURLToPath } from 'node:url';
 // True only when this file is the entry point (not imported by tests or other modules).
 const _isMain = process.argv[1] != null &&
@@ -64,7 +63,7 @@ import { Redis } from 'ioredis';
 const API_URL = process.env.CACHLY_API_URL ?? 'https://api.cachly.dev';
 let JWT = process.env.CACHLY_JWT ?? '';
 const _EMBED_MODEL = process.env.CACHLY_EMBED_MODEL ?? '';
-const CURRENT_VERSION = '0.10.72';
+const CURRENT_VERSION = '0.10.74';
 // Max time to wait for a freshly-provisioned instance to become "running" before
 // giving up. Free-tier provisioning in high-latency regions can take 45–90s, so the
 // old hard-coded 25s caused spurious "instance_not_reachable" on first run.
@@ -210,13 +209,34 @@ async function selfHealAuth() {
 }
 let _deviceFlow = null;
 async function startDeviceFlow() {
-    const AUTH_BASE = 'https://auth.cachly.dev/realms/cachly/protocol/openid-connect';
-    const CLIENT_ID = 'cachly-cli';
+    // Try the API proxy first (more reliable than direct Keycloak endpoint)
     try {
+        const res = await fetch(`${API_URL}/api/v1/auth/device/code`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ client_id: 'cachly-mcp-cli' }),
+            signal: AbortSignal.timeout(8000),
+        });
+        if (res.ok) {
+            const data = await res.json();
+            return {
+                deviceCode: data.device_code,
+                userCode: data.user_code,
+                verifyUrl: data.verification_uri,
+                pollInterval: (data.interval ?? 5) * 1000,
+                deadline: Date.now() + 10 * 60 * 1000,
+                polling: false,
+            };
+        }
+    }
+    catch { /* fall through to Keycloak */ }
+    // Fallback: direct Keycloak endpoint
+    try {
+        const AUTH_BASE = 'https://auth.cachly.dev/realms/cachly/protocol/openid-connect';
         const res = await fetch(`${AUTH_BASE}/auth/device`, {
             method: 'POST',
             headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: `client_id=${CLIENT_ID}&scope=openid`,
+            body: `client_id=cachly-cli&scope=openid`,
             signal: AbortSignal.timeout(8000),
         });
         if (!res.ok)
@@ -227,7 +247,7 @@ async function startDeviceFlow() {
             userCode: data.user_code,
             verifyUrl: data.verification_uri_complete,
             pollInterval: (data.interval ?? 5) * 1000,
-            deadline: Date.now() + 10 * 60 * 1000, // 10 min
+            deadline: Date.now() + 10 * 60 * 1000,
             polling: false,
         };
     }
@@ -238,16 +258,34 @@ async function startDeviceFlow() {
 async function pollDeviceFlow(flow) {
     if (Date.now() > flow.deadline)
         return 'expired';
-    const AUTH_BASE = 'https://auth.cachly.dev/realms/cachly/protocol/openid-connect';
-    const CLIENT_ID = 'cachly-cli';
-    try {
+    // Try API proxy first, then direct Keycloak as fallback
+    const tryProxy = async () => {
+        const res = await fetch(`${API_URL}/api/v1/auth/device/token`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ device_code: flow.deviceCode, client_id: 'cachly-mcp-cli' }),
+            signal: AbortSignal.timeout(8000),
+        });
+        if (!res.ok)
+            return null;
+        return res.json();
+    };
+    const tryKeycloak = async () => {
+        const AUTH_BASE = 'https://auth.cachly.dev/realms/cachly/protocol/openid-connect';
         const res = await fetch(`${AUTH_BASE}/token`, {
             method: 'POST',
             headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: `client_id=${CLIENT_ID}&grant_type=urn:ietf:params:oauth:grant-type:device_code&device_code=${flow.deviceCode}`,
+            body: `client_id=cachly-cli&grant_type=urn:ietf:params:oauth:grant-type:device_code&device_code=${flow.deviceCode}`,
             signal: AbortSignal.timeout(8000),
         });
-        const data = await res.json();
+        return res.json();
+    };
+    try {
+        let data = await tryProxy().catch(() => null);
+        if (!data)
+            data = await tryKeycloak().catch(() => null);
+        if (!data)
+            return 'pending';
         if (data.access_token) {
             // Exchange Keycloak JWT → long-lived API key
             let apiKey = data.access_token;
@@ -666,7 +704,7 @@ async function handleTool(name, args) {
                 '',
                 'After sign-in: call **any tool again** — your Brain activates instantly.',
                 '',
-                '✨ Free forever · No credit card · 105 MCP tools · GDPR · EU servers',
+                '✨ Free forever · No credit card · 107 MCP tools · GDPR · EU servers',
             ].join('\n');
         }
         // Device flow unavailable (network issue) — fall back to manual setup
@@ -1869,24 +1907,45 @@ if (!process.argv[2] && process.stdout.isTTY) {
     console.log('  \x1b[36m  npx @cachly-dev/mcp-server@latest upgrade\x1b[0m  ← Check for updates');
     console.log('');
     console.log('  \x1b[90mWorks with: Claude Code · Cursor · Windsurf · GitHub Copilot · Cline · Zed\x1b[0m');
-    console.log('  \x1b[90mFree forever · GDPR · German servers · 105 MCP tools\x1b[0m');
+    console.log('  \x1b[90mFree forever · GDPR · German servers · 107 MCP tools\x1b[0m');
     console.log('');
     process.exit(0);
 }
 // ── CLI: cachly init ──────────────────────────────────────────────────────────
 // Usage: npx @cachly-dev/mcp-server init --instance-id <id> --api-key <key> [--editor claude|cursor|windsurf|copilot|continue] [--project-dir /path]
 if (process.argv[2] === 'init') {
-    const { writeFile, mkdir } = await import('node:fs/promises');
+    const initStart = Date.now();
+    const { writeFile, mkdir, readFile } = await import('node:fs/promises');
     const { resolve, dirname } = await import('node:path');
     const argv = process.argv.slice(3);
     const flag = (name) => { const i = argv.indexOf(`--${name}`); return i !== -1 ? argv[i + 1] : undefined; };
-    const instanceId = flag('instance-id') ?? process.env.CACHLY_BRAIN_INSTANCE_ID;
-    const apiKey = flag('api-key') ?? process.env.CACHLY_JWT;
+    let instanceId = flag('instance-id') ?? process.env.CACHLY_BRAIN_INSTANCE_ID;
+    let apiKey = flag('api-key') ?? process.env.CACHLY_JWT;
     const editor = (flag('editor') ?? 'claude').toLowerCase();
     const projectDir = resolve(flag('project-dir') ?? '.');
+    // Zero-arg path: fall back to credentials saved by a previous `setup`
+    // (~/.claude/mcp.json). Makes `init` a fast, idempotent re-configuration command
+    // you can run in any project without copy-pasting tokens.
+    if (!instanceId || !apiKey) {
+        try {
+            const { existsSync } = await import('node:fs');
+            const home = process.env.HOME ?? process.env.USERPROFILE ?? '';
+            const savedPath = home ? resolve(home, '.claude', 'mcp.json') : '';
+            if (savedPath && existsSync(savedPath)) {
+                const saved = JSON.parse(await readFile(savedPath, 'utf-8'));
+                const env = saved.mcpServers?.['cachly']?.env ?? {};
+                apiKey ??= env['CACHLY_JWT'];
+                instanceId ??= env['CACHLY_BRAIN_INSTANCE_ID'];
+                if (apiKey && instanceId) {
+                    console.log('✓  Reusing credentials from ~/.claude/mcp.json (saved by a prior setup)');
+                }
+            }
+        }
+        catch { /* fall through to the usage error below */ }
+    }
     if (!instanceId || !apiKey) {
         console.error('\nUsage: npx @cachly-dev/mcp-server@latest init --instance-id <uuid> --api-key <cky_live_...> [--editor claude|cursor|windsurf|copilot|continue] [--project-dir /path]\n');
-        console.error('Or run interactively (no flags needed): npx @cachly-dev/mcp-server@latest setup\n');
+        console.error('First time? Run the zero-config wizard (signs you in, auto-provisions): npx @cachly-dev/mcp-server@latest setup\n');
         console.error('Get your credentials from: https://cachly.dev/setup-ai\n');
         process.exit(1);
     }
@@ -1894,9 +1953,17 @@ if (process.argv[2] === 'init') {
     const configPath = resolve(projectDir, configFile);
     await mkdir(dirname(configPath), { recursive: true });
     const { existsSync: exInit } = await import('node:fs');
+    const configExisted = exInit(configPath);
+    const prevConfig = configExisted ? await readFile(configPath, 'utf-8').catch(() => '') : '';
     const merged = await mergeMcpConfig(configPath, apiKey, instanceId, editor, { readFile, existsSync: exInit });
-    await writeFile(configPath, merged, 'utf-8');
-    console.log(`\n✅ ${exInit(configPath) ? 'Updated' : 'Written'}: ${configFile}`);
+    // Idempotent: only write when the content actually changes.
+    if (merged !== prevConfig) {
+        await writeFile(configPath, merged, 'utf-8');
+        console.log(`\n✅ ${configExisted ? 'Updated' : 'Written'}: ${configFile}`);
+    }
+    else {
+        console.log(`\n✓  Already configured: ${configFile} (no change)`);
+    }
     // Always write CLAUDE.md (idempotent — safe to run multiple times)
     const result = await writeClaudeMd(projectDir, instanceId);
     const action = result === 'updated' ? '✅ Updated' : result === 'appended' ? '✅ Appended to' : '✅ Written';
@@ -1942,8 +2009,10 @@ if (process.argv[2] === 'init') {
         }
     }
     catch { /* non-critical — git hook is a best-effort feature */ }
-    console.log(`\n🧠 Cachly AI Brain configured for ${editor === 'claude' ? 'Claude Code' : editor}!`);
+    const initSecs = ((Date.now() - initStart) / 1000).toFixed(1);
+    console.log(`\n🧠 Cachly AI Brain configured for ${editor === 'claude' ? 'Claude Code' : editor}! (${initSecs}s)`);
     console.log(`   Restart your editor — the \`cachly\` MCP tools will appear.`);
+    console.log(`   Re-run \`init\` anytime — it's idempotent (only writes what changed).`);
     console.log(`\n   📛 Add a live badge to your README:`);
     console.log(`      npx @cachly-dev/mcp-server@latest badge\n`);
     process.exit(0);
@@ -2244,41 +2313,52 @@ if (process.argv[2] === 'setup') {
         console.log('✓  Using token from CACHLY_JWT env var\n');
     }
     else {
-        const AUTH_BASE = 'https://auth.cachly.dev/realms/cachly/protocol/openid-connect';
-        const CLIENT_ID = 'cachly-cli';
         console.log('Step 1: Sign in to cachly (free, no credit card)\n');
         sendFunnelEvent('setup_auth_started');
-        // Start device flow
+        // Start device flow — try API proxy first, fall back to direct Keycloak
         let deviceCode = '', userCode = '', verifyUri = '', pollInterval = 5000;
+        let deviceFlowOk = false;
+        // Attempt 1: API proxy (recommended path)
         try {
-            const deviceRes = await fetch(`${AUTH_BASE}/auth/device`, {
+            const deviceRes = await fetch(`${API_URL}/api/v1/auth/device/code`, {
                 method: 'POST',
-                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-                body: `client_id=${CLIENT_ID}&scope=openid`,
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ client_id: 'cachly-mcp-cli' }),
+                signal: AbortSignal.timeout(8000),
             });
-            if (!deviceRes.ok)
-                throw new Error(`Device flow error: HTTP ${deviceRes.status}`);
-            const data = await deviceRes.json();
-            deviceCode = data.device_code;
-            userCode = data.user_code;
-            verifyUri = data.verification_uri_complete;
-            pollInterval = (data.interval ?? 5) * 1000;
+            if (deviceRes.ok) {
+                const data = await deviceRes.json();
+                deviceCode = data.device_code;
+                userCode = data.user_code;
+                verifyUri = data.verification_uri;
+                pollInterval = (data.interval ?? 5) * 1000;
+                deviceFlowOk = true;
+            }
         }
-        catch (e) {
-            console.error(`\nFailed to start device flow: ${e.message}`);
-            console.error('Falling back: sign in at https://cachly.dev/setup-ai and paste your API token.\n');
-            token = await ask('   Paste API token (cky_live_...): ');
-            if (!token) {
-                console.error('\nToken is required. Aborting.\n');
-                rl.close();
-                process.exit(1);
+        catch { /* fall through */ }
+        // Attempt 2: Direct Keycloak device flow
+        if (!deviceFlowOk) {
+            try {
+                const AUTH_BASE = 'https://auth.cachly.dev/realms/cachly/protocol/openid-connect';
+                const deviceRes = await fetch(`${AUTH_BASE}/auth/device`, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                    body: `client_id=cachly-cli&scope=openid`,
+                    signal: AbortSignal.timeout(8000),
+                });
+                if (deviceRes.ok) {
+                    const data = await deviceRes.json();
+                    deviceCode = data.device_code;
+                    userCode = data.user_code;
+                    verifyUri = data.verification_uri_complete;
+                    pollInterval = (data.interval ?? 5) * 1000;
+                    deviceFlowOk = true;
+                }
             }
-            sendFunnelEvent('setup_auth_completed');
-            console.log('');
-            deviceCode = ''; // mark as fallback so we skip polling
+            catch { /* fall through */ }
         }
-        if (deviceCode) {
-            // Open browser
+        if (deviceFlowOk && deviceCode) {
+            // Open browser and show code
             console.log(`   Code: \x1b[1;33m${userCode}\x1b[0m`);
             console.log(`   URL:  ${verifyUri}\n`);
             try {
@@ -2290,29 +2370,49 @@ if (process.argv[2] === 'setup') {
             catch {
                 console.log('   👉  Open the URL above in your browser and enter the code.\n');
             }
-            // Poll for token
+            // Poll for token with proper timeouts
             process.stdout.write('   Waiting for authorization');
-            const deadline = Date.now() + 10 * 60 * 1000; // 10 min
+            const deadline = Date.now() + 10 * 60 * 1000;
             while (Date.now() < deadline) {
                 await new Promise(r => setTimeout(r, pollInterval));
                 process.stdout.write('.');
                 try {
-                    const tokenRes = await fetch(`${AUTH_BASE}/token`, {
-                        method: 'POST',
-                        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-                        body: `client_id=${CLIENT_ID}&grant_type=urn:ietf:params:oauth:grant-type:device_code&device_code=${deviceCode}`,
-                    });
-                    const tokenData = await tokenRes.json();
-                    if (tokenData.access_token) {
+                    let tokenData = null;
+                    try {
+                        const proxyRes = await fetch(`${API_URL}/api/v1/auth/device/token`, {
+                            method: 'POST',
+                            headers: { 'Content-Type': 'application/json' },
+                            body: JSON.stringify({ device_code: deviceCode, client_id: 'cachly-mcp-cli' }),
+                            signal: AbortSignal.timeout(8000),
+                        });
+                        if (proxyRes.ok)
+                            tokenData = await proxyRes.json();
+                    }
+                    catch { /* try Keycloak */ }
+                    if (!tokenData) {
+                        const AUTH_BASE = 'https://auth.cachly.dev/realms/cachly/protocol/openid-connect';
+                        try {
+                            const kcRes = await fetch(`${AUTH_BASE}/token`, {
+                                method: 'POST',
+                                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                                body: `client_id=cachly-cli&grant_type=urn:ietf:params:oauth:grant-type:device_code&device_code=${deviceCode}`,
+                                signal: AbortSignal.timeout(8000),
+                            });
+                            tokenData = await kcRes.json();
+                        }
+                        catch { /* network hiccup */ }
+                    }
+                    if (tokenData?.access_token) {
                         token = tokenData.access_token;
                         console.log(' \x1b[32m✓ Authorized!\x1b[0m\n');
                         sendFunnelEvent('setup_auth_completed');
+                        sendFunnelEvent('device_flow_completed');
                         break;
                     }
-                    // authorization_pending = keep polling; slow_down = increase interval
-                    if (tokenData.error === 'slow_down')
+                    if (tokenData?.error === 'slow_down')
                         pollInterval = Math.min(pollInterval + 2000, 15000);
-                    else if (tokenData.error && tokenData.error !== 'authorization_pending') {
+                    else if (tokenData?.error && tokenData.error !== 'authorization_pending') {
+                        sendFunnelEvent('device_flow_failed', { reason: tokenData.error });
                         console.error(`\nAuth error: ${tokenData.error}. Aborting.\n`);
                         rl.close();
                         process.exit(1);
@@ -2321,12 +2421,37 @@ if (process.argv[2] === 'setup') {
                 catch { /* network hiccup — keep polling */ }
             }
             if (!token) {
+                sendFunnelEvent('device_flow_failed', { reason: 'timeout' });
                 console.error('\nTimed out waiting for authorization. Aborting.\n');
                 rl.close();
                 process.exit(1);
             }
             console.log('');
         }
+        else {
+            // Device flow unavailable — web fallback with automatic browser open
+            sendFunnelEvent('device_flow_failed', { reason: 'device_flow_unavailable' });
+            const signupUrl = 'https://cachly.dev/setup-ai';
+            console.log('   ⚠️  Could not start automatic sign-in. Opening browser for web sign-in...\n');
+            console.log(`   URL: \x1b[36m${signupUrl}\x1b[0m`);
+            console.log('   1. Sign up / log in at the URL above');
+            console.log('   2. Go to Settings → API Keys → Create new key');
+            console.log('   3. Copy the key (starts with cky_live_...)\n');
+            try {
+                const { execSync } = await import('node:child_process');
+                const openCmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start' : 'xdg-open';
+                execSync(`${openCmd} "${signupUrl}"`, { stdio: 'ignore' });
+            }
+            catch { /* can't open browser — instructions shown above */ }
+            token = await ask('   Paste API key (cky_live_...): ');
+            if (!token) {
+                console.error('\nAPI key is required. Aborting.\n');
+                rl.close();
+                process.exit(1);
+            }
+            sendFunnelEvent('setup_auth_completed');
+            console.log('');
+        }
     }
     // ── Step 1b: Exchange Keycloak JWT → long-lived cky_live_ API key ──────────
     // Only do this when the token looks like a Keycloak JWT (starts with "eyJ"),