@carrierllc/mcp 0.13.33 → 0.13.35

package/dist/cli.js

@@ -44,7 +44,7 @@ import {
   verifyStorefront,
   walletScreen,
   which
-} from "./chunk-QLLHVD63.js";
+} from "./chunk-EH3ZRLVZ.js";
 import {
   copyTree,
   exists,
@@ -1127,7 +1127,7 @@ function oauthFirstUseNote() {
 }
 function formatStatusBlock(st) {
   const yn = (ok2, yes = "yes", no = "no") => ok2 ? pc.green(yes) : pc.yellow(no);
-  const authLabel = st.authMode === "oauth" ? pc.green("OAuth session ready for CLI / Ask the fleet") : st.authMode === "oauth-first-use" ? pc.cyan("OAuth on first use (no token needed)") : st.authMode === "api-key" ? pc.green("org API key in env (CARRIER_API_KEY)") : st.authMode === "ocs-token" ? pc.green("OCS token in env") : pc.yellow("not ready \u2014 install MCP or open sign-up");
+  const authLabel = st.authMode === "oauth" ? pc.green("OAuth session ready for CLI / Ask the fleet") : st.authMode === "oauth-first-use" ? pc.cyan("OAuth on first use (no token needed)") : st.authMode === "api-key" ? pc.green("org API key in env (CARRIER_API_KEY)") : st.authMode === "ocs-token" ? pc.green("OCS token in env (read-only, ?TOKEN= path; for writes set CARRIER_API_KEY, or unset ESIMVAULT_API_TOKEN/CARRIER_OCS_API_TOKEN and carrier login)") : pc.yellow("not ready \u2014 install MCP or open sign-up");
   return [
     `Claude Code:   ${yn(st.claudeFound, "found", "not on PATH")}`,
     `Plugin:        ${st.pluginInstalled ? pc.green(`installed v${st.pluginVersion ?? "?"}`) : pc.yellow("not installed")}`,
@@ -1511,6 +1511,10 @@ function facts(value) {
 }
 
 // src/cli/lib/ask.ts
+var OCS_TOKEN_AUTH_HINTS = [
+  "Confirm ESIMVAULT_API_TOKEN / CARRIER_OCS_API_TOKEN is a valid eSIMVault reseller token",
+  "An OCS token is read-only on Carrier MCP. For writes: export CARRIER_API_KEY=ak_\u2026 (it outranks the OCS token), or unset ESIMVAULT_API_TOKEN and CARRIER_OCS_API_TOKEN, then carrier login"
+];
 var DEFAULT_ERROR_HINTS = [
   "Re-check the arguments: carrier <domain> <command> --help",
   "Or open Claude and ask there with full tool routing"
@@ -1542,8 +1546,9 @@ function parseRpcBody(raw) {
   return JSON.parse(dataLine.slice(5).trim());
 }
 async function callMcpTool(tool, args, opts = {}) {
-  const token = (resolveExplicitCredential({ allowOcs: true }) ?? await resolveCredential({ allowOcs: true }))?.token;
-  if (!token) {
+  const credential = resolveExplicitCredential({ allowOcs: true }) ?? await resolveCredential({ allowOcs: true });
+  const token = credential?.token;
+  if (!credential || !token) {
     return {
       ok: false,
       text: withNextStep("Not signed in.", [
@@ -1553,8 +1558,10 @@ async function callMcpTool(tool, args, opts = {}) {
       ])
     };
   }
+  const isOcsToken = credential.kind === "ocs-token";
+  const mcpUrl = isOcsToken ? `${MCP_URL}?TOKEN=${encodeURIComponent(token)}` : MCP_URL;
   const headers = {
-    Authorization: `Bearer ${token}`,
+    ...isOcsToken ? {} : { Authorization: `Bearer ${token}` },
     "Content-Type": "application/json",
     Accept: "application/json, text/event-stream"
   };
@@ -1571,7 +1578,7 @@ async function callMcpTool(tool, args, opts = {}) {
   try {
     const result = await Promise.race([
       (async () => {
-        const initRes = await fetch(MCP_URL, {
+        const initRes = await fetch(mcpUrl, {
           method: "POST",
           headers,
           signal,
@@ -1589,13 +1596,29 @@ async function callMcpTool(tool, args, opts = {}) {
         if (initRes.status === 401 || initRes.status === 403) {
           return {
             ok: false,
-            text: withNextStep(`MCP returned ${initRes.status} (auth rejected).`, [
+            text: withNextStep(`MCP returned ${initRes.status} (auth rejected).`, isOcsToken ? OCS_TOKEN_AUTH_HINTS : [
               "Confirm CARRIER_API_KEY is a valid org key (ak_\u2026) from app.carrier.llc",
               "Or complete OCS onboarding: https://app.carrier.llc/onboarding",
               "Interactive: use Claude + OAuth instead of a headless key"
             ])
           };
         }
+        if (!initRes.ok) {
+          const body = (await initRes.text().catch(() => "")).trim();
+          let reason = body.slice(0, 240);
+          try {
+            const parsed = JSON.parse(body);
+            reason = parsed.error_description ?? parsed.error ?? reason;
+          } catch {
+          }
+          return {
+            ok: false,
+            text: withNextStep(
+              initRes.status === 429 ? `MCP rate limit reached (429): ${reason}` : `MCP initialize failed (${initRes.status}). ${reason}`,
+              initRes.status === 429 ? ["Wait a few minutes and retry, or spread calls out over time"] : ["Retry later, or use Claude with the registered MCP (OAuth path)"]
+            )
+          };
+        }
         const sessionId = initRes.headers.get("mcp-session-id") ?? initRes.headers.get("Mcp-Session-Id");
         await initRes.arrayBuffer().catch(() => void 0);
         if (!sessionId) {
@@ -1608,13 +1631,13 @@ async function callMcpTool(tool, args, opts = {}) {
           };
         }
         const sessionHeaders = { ...headers, "Mcp-Session-Id": sessionId };
-        await fetch(MCP_URL, {
+        await fetch(mcpUrl, {
           method: "POST",
           headers: sessionHeaders,
           signal,
           body: JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" })
         }).catch(() => void 0);
-        const res = await fetch(MCP_URL, {
+        const res = await fetch(mcpUrl, {
           method: "POST",
           headers: sessionHeaders,
           signal,
@@ -1670,7 +1693,9 @@ async function callMcpTool(tool, args, opts = {}) {
         )
       };
     }
-    const msg = redact((e instanceof Error ? e.message : String(e)).split(token).join("***"));
+    const msg = redact(
+      (e instanceof Error ? e.message : String(e)).split(token).join("***").split(encodeURIComponent(token)).join("***")
+    );
     return {
       ok: false,
       text: withNextStep(`Could not reach MCP: ${msg}`, [