@cachly-dev/mcp-server 0.9.4 → 0.9.6

package/dist/index.js

@@ -45,9 +45,9 @@ import { CallToolRequestSchema, ErrorCode, ListToolsRequestSchema, McpError, } f
 import { Redis } from 'ioredis';
 // ── Config ────────────────────────────────────────────────────────────────────
 const API_URL = process.env.CACHLY_API_URL ?? 'https://api.cachly.dev';
-const JWT = process.env.CACHLY_JWT ?? '';
+let JWT = process.env.CACHLY_JWT ?? '';
 const EMBED_MODEL = process.env.CACHLY_EMBED_MODEL ?? '';
-const CURRENT_VERSION = '0.9.4';
+const CURRENT_VERSION = '0.9.6';
 // ── Default Instance Resolution (for Smithery & single-credential setups) ────
 // When CACHLY_BRAIN_INSTANCE_ID is set, tools can omit the instance_id parameter.
 // When neither is set, we auto-fetch the first running instance once per process.
@@ -78,6 +78,95 @@ async function resolveDefaultInstanceId() {
     catch { /* non-fatal — caller will surface missing instance_id error */ }
     return '';
 }
+let _deviceFlow = null;
+async function startDeviceFlow() {
+    const AUTH_BASE = 'https://auth.cachly.dev/realms/cachly/protocol/openid-connect';
+    const CLIENT_ID = 'cachly-cli';
+    try {
+        const res = await fetch(`${AUTH_BASE}/auth/device`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: `client_id=${CLIENT_ID}&scope=openid`,
+            signal: AbortSignal.timeout(8000),
+        });
+        if (!res.ok)
+            return null;
+        const data = await res.json();
+        return {
+            deviceCode: data.device_code,
+            userCode: data.user_code,
+            verifyUrl: data.verification_uri_complete,
+            pollInterval: (data.interval ?? 5) * 1000,
+            deadline: Date.now() + 10 * 60 * 1000, // 10 min
+            polling: false,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+async function pollDeviceFlow(flow) {
+    if (Date.now() > flow.deadline)
+        return 'expired';
+    const AUTH_BASE = 'https://auth.cachly.dev/realms/cachly/protocol/openid-connect';
+    const CLIENT_ID = 'cachly-cli';
+    try {
+        const res = await fetch(`${AUTH_BASE}/token`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: `client_id=${CLIENT_ID}&grant_type=urn:ietf:params:oauth:grant-type:device_code&device_code=${flow.deviceCode}`,
+            signal: AbortSignal.timeout(8000),
+        });
+        const data = await res.json();
+        if (data.access_token) {
+            // Exchange Keycloak JWT → long-lived API key
+            let apiKey = data.access_token;
+            try {
+                const keyRes = await fetch(`${API_URL}/api/v1/api-keys`, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${apiKey}` },
+                    body: JSON.stringify({ name: 'cachly-mcp-smithery', scope: 'read_write' }),
+                    signal: AbortSignal.timeout(8000),
+                });
+                if (keyRes.ok) {
+                    const keyBody = await keyRes.json();
+                    if (keyBody.key)
+                        apiKey = keyBody.key;
+                }
+            }
+            catch { /* use raw JWT as fallback */ }
+            JWT = apiKey;
+            _deviceFlow = null;
+            // Auto-provision instance
+            _defaultInstanceFetched = false;
+            await resolveDefaultInstanceId();
+            if (!_defaultInstanceId) {
+                // Try auto-provision
+                try {
+                    const autoRes = await fetch(`${API_URL}/api/v1/instances/auto`, {
+                        method: 'POST',
+                        headers: { Authorization: `Bearer ${JWT}`, 'Content-Type': 'application/json' },
+                        signal: AbortSignal.timeout(10000),
+                    });
+                    if (autoRes.ok) {
+                        const body = await autoRes.json();
+                        const id = body.instance?.id ?? body.instance_id;
+                        if (id)
+                            _defaultInstanceId = id;
+                    }
+                }
+                catch { /* non-fatal */ }
+            }
+            return 'done';
+        }
+        if (data.error === 'slow_down')
+            flow.pollInterval = Math.min(flow.pollInterval + 2000, 15000);
+        return 'pending';
+    }
+    catch {
+        return 'pending';
+    }
+}
 /**
  * ┌──────────────────────────────────────────────────────────────────────┐
  * │  EMBEDDING PROVIDER — pluggable, client-side first                  │
@@ -3766,21 +3855,57 @@ async function handleTool(name, args) {
     // Guard: if no JWT, return actionable onboarding message instead of HTTP 401
     if (!JWT) {
         void sendAnonymousTelemetry(name);
+        // ── Zero-credential device flow ─────────────────────────────────────
+        // 1st call: start device flow, return code + URL
+        // 2nd+ calls: poll for token; once authenticated, proceed transparently
+        if (_deviceFlow) {
+            const result = await pollDeviceFlow(_deviceFlow);
+            if (result === 'done') {
+                // Auth complete — re-enter handleTool with now-valid JWT
+                return handleTool(name, args);
+            }
+            if (result === 'expired') {
+                _deviceFlow = null;
+                return '⌛ **Authentication timed out.** Please call any tool again to restart the sign-in flow.';
+            }
+            // Still pending
+            return [
+                '⏳ **Waiting for authentication...**',
+                '',
+                `Sign in at: **${_deviceFlow.verifyUrl}**`,
+                `Enter code: **${_deviceFlow.userCode}**`,
+                '',
+                'Once you complete sign-in in your browser, call this tool again and it will proceed automatically.',
+            ].join('\n');
+        }
+        // No pending flow — start a new one
+        const flow = await startDeviceFlow();
+        if (flow) {
+            _deviceFlow = flow;
+            return [
+                '🧠 **cachly AI Brain — One-click sign in**',
+                '',
+                '1. Open this URL in your browser (it may open automatically):',
+                `   **${flow.verifyUrl}**`,
+                '',
+                `2. Enter this code if prompted: **${flow.userCode}**`,
+                '',
+                '3. After sign-in, call this tool again — it will proceed automatically.',
+                '',
+                '✨ Free tier includes: 1 Brain instance, persistent memory, 63 MCP tools.',
+                '   No credit card required.',
+            ].join('\n');
+        }
+        // Device flow unavailable (network issue) — fall back to manual setup
         return [
             '🧠 **cachly AI Brain — Setup required**',
             '',
-            'You have no API credentials configured. Get started in 30 seconds:',
-            '',
-            '**Step 1:** Register for free (no credit card):',
-            '   👉 https://cachly.dev/setup-ai',
-            '',
-            '**Step 2:** Run the setup wizard in your terminal:',
+            'Run the setup wizard once in your terminal:',
             '   ```',
             '   npx @cachly-dev/mcp-server@latest setup',
             '   ```',
             '',
-            'The wizard auto-detects your editor (Claude Code, Cursor, Copilot, Windsurf)',
-            'and writes the config file with your credentials.',
+            'Or get your API key at: https://cachly.dev/setup-ai',
             '',
             '✨ Free tier includes: 1 Brain instance, persistent memory, semantic search.',
         ].join('\n');