@cloudgrid-io/mcp 0.20.30 → 0.20.32

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudgrid-io/mcp",
-  "version": "0.20.30",
+  "version": "0.20.32",
   "description": "MCP access to CloudGrid — the live runtime environment where the user's apps run WITH the infrastructure they need out of the box: managed MongoDB, Redis (cache/queues/pub-sub), a pgvector store, persistent disk, and built-in AI with no API keys, in any language or stack, no Docker or Kubernetes to manage. Brainstorm, build, plug, and improve apps, games, dashboards, and tools; instant single-page publishes and full runtime-app deploys with a live URL — for developers and non-technical users. Three editions: local stdio (full toolset), hosted web (light, CLI-free), and a public docs-search server.",
   "type": "module",
   "bin": {
@@ -54,13 +54,14 @@
     "test:set-sharing": "node test/set-sharing.test.mjs",
     "test:check-deploy": "node test/check-deploy.test.mjs",
     "test:staleness": "node test/staleness.test.mjs",
-    "test:proxy": "node test/proxy.test.mjs"
+    "test:proxy": "node test/proxy.test.mjs",
+    "test:system-ca": "node test/system-ca.test.mjs"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
     "express": "^4.22.2",
     "fflate": "^0.8.3",
-    "undici": "^8.7.0",
+    "undici": "^6.27.0",
     "zod": "^3.23.0"
   },
   "license": "Apache-2.0",

package/src/auth.js

@@ -13,6 +13,7 @@ import { randomUUID } from "node:crypto";
 import { mkdir, writeFile, chmod, readFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { isCertError } from "./system-ca.js";
 
 // Base for server-to-API calls. On a hosted deployment this is the in-cluster
 // service address (CLOUDGRID_API_URL), which is fast but NOT reachable by a browser.
@@ -41,6 +42,33 @@ export function buildLoginUrl(code) {
   return `${PUBLIC_API_BASE}/auth/login?code=${encodeURIComponent(code)}`;
 }
 
+const CERT_ERROR_GUIDANCE =
+  "TLS certificate validation failed. This machine has a TLS-inspecting " +
+  "proxy or a custom root CA that is not in the OS trust store. The MCP " +
+  "trusts the system certificate store automatically, so if you still see " +
+  "this error the intercepting CA's root certificate is not installed in " +
+  "your OS trust store.\n\n" +
+  "To resolve this:\n" +
+  "- Install the root CA into your OS trust store (macOS Keychain, Windows " +
+  "Certificate Manager, or /usr/local/share/ca-certificates on Linux), or\n" +
+  "- Set NODE_EXTRA_CA_CERTS=/path/to/root-ca.pem before launching the MCP, or\n" +
+  "- Use the hosted MCP connector: https://mcp-connected.cloudgrid.io/mcp";
+
+function throwCertError() {
+  const err = new Error(CERT_ERROR_GUIDANCE);
+  err.certError = true;
+  throw err;
+}
+
+export async function checkApiConnectivity() {
+  try {
+    await fetch(`${API_BASE}/auth/status?code=connectivity-probe`);
+  } catch (err) {
+    if (isCertError(err)) throwCertError();
+    throw err;
+  }
+}
+
 // One poll. Returns { status: 'not_started' | 'pending' | 'authenticated' | 'expired', jwt? }.
 // A 404 means the session for this code does not exist yet — the user has not
 // opened the sign-in URL — so it is reported as 'not_started', not an error.
@@ -49,6 +77,7 @@ export async function pollStatusOnce(code) {
   try {
     res = await fetch(`${API_BASE}/auth/status?code=${encodeURIComponent(code)}`);
   } catch (err) {
+    if (isCertError(err)) throwCertError();
     const cause = err?.cause?.code || err?.cause?.message || err?.cause || err.message;
     throw new Error(
       `Can't reach api.cloudgrid.io (${cause}). ` +

package/src/corpus/workflows/ai-app.md

@@ -41,9 +41,17 @@ Persistent apps are owned entities.
 
 ## 3. Scaffold
 
-`grid_create_project` an app `<name>`. It scaffolds the project folder and writes a `cloudgrid.yaml` with an EMPTY
-`services: {}`. No server entity exists yet — the first `grid plug` auto-creates
-it from the manifest (honoring its `name:`) and writes `.cloudgrid/link.json`.
+`grid_create_project` an app `<name>`. It scaffolds the project folder, a
+`cloudgrid.yaml`, and a starter `web` service. No server entity exists yet — the
+first `grid plug` auto-creates it from the manifest (honoring its `name:`) and
+writes `.cloudgrid/link.json`.
+
+The starter files are throwaway — the `ai-app` template (step 4) is the source
+of truth. **The template is plain JavaScript.** The `nextjs` scaffold, on the
+other hand, writes a TypeScript starter (`tsconfig.json`, `app/layout.tsx`,
+`app/page.tsx`). Before applying the template, delete the scaffolded
+`tsconfig.json` and `app/*.tsx`, then write the template's `.js` files. Never
+leave both `.tsx` and `.js` for the same route — that breaks `next build`.
 
 You then do two things: (a) write the app under **`services/web/`**, and (b) fill
 in `cloudgrid.yaml` to the shape below (`services.web` type `nextjs` + `needs: {

package/src/index.js

@@ -5,8 +5,8 @@
 // Desktop). Full toolset, including the CLI-wrapping tools. Identity comes from
 // the shared ~/.cloudgrid/credentials file, so it interoperates with the CLI.
 
-import { installProxy } from "./proxy.js";
-installProxy();
+import { installTrustStore } from "./system-ca.js";
+installTrustStore();
 
 import { readFileSync } from "node:fs";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

package/src/system-ca.js

@@ -0,0 +1,129 @@
+// System CA trust for Node's global fetch.
+//
+// Node's built-in fetch uses Node's bundled Mozilla CA list and ignores the OS
+// trust store. On machines with a TLS-inspecting proxy or a custom/corporate
+// root CA (installed in the OS keychain but not in Node's bundle), every HTTPS
+// call fails with UNABLE_TO_GET_ISSUER_CERT_LOCALLY. This module builds a
+// unified CA bundle (Node defaults + OS store + NODE_EXTRA_CA_CERTS) and
+// installs it process-wide via tls.setDefaultCACertificates (Node >=22.15).
+//
+// On older Node (< 22.15) it is a graceful no-op — NODE_EXTRA_CA_CERTS is
+// still honored natively when set at launch, and the login preflight surfaces
+// the hosted-connector fallback on cert errors.
+//
+// Fully guarded: on any failure this is a silent no-op. Never throws at startup.
+
+import tls from "node:tls";
+import { readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { resolveProxy } from "./proxy.js";
+
+const CERT_ERROR_CODES = new Set([
+  "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+  "SELF_SIGNED_CERT_IN_CHAIN",
+  "DEPTH_ZERO_SELF_SIGNED_CERT",
+  "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+  "CERT_HAS_EXPIRED",
+  "ERR_TLS_CERT_ALTNAME_INVALID",
+  "CERT_UNTRUSTED",
+]);
+
+export function isCertError(err) {
+  if (!err) return false;
+  if (typeof err.code === "string" && CERT_ERROR_CODES.has(err.code)) return true;
+  if (err.cause) return isCertError(err.cause);
+  return false;
+}
+
+function parsePemFile(path) {
+  try {
+    const raw = readFileSync(path, "utf8");
+    const certs = [];
+    const re = /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g;
+    let m;
+    while ((m = re.exec(raw)) !== null) certs.push(m[0]);
+    return certs;
+  } catch {
+    return [];
+  }
+}
+
+export function buildCaBundle() {
+  const seen = new Set();
+  const certs = [];
+
+  function add(list) {
+    if (!Array.isArray(list)) return;
+    for (const c of list) {
+      if (c && !seen.has(c)) {
+        seen.add(c);
+        certs.push(c);
+      }
+    }
+  }
+
+  try {
+    if (typeof tls.getCACertificates === "function") {
+      add(tls.getCACertificates("default"));
+    } else {
+      add(tls.rootCertificates);
+    }
+  } catch { /* guard */ }
+
+  try {
+    if (typeof tls.getCACertificates === "function") {
+      add(tls.getCACertificates("system"));
+    }
+  } catch { /* guard */ }
+
+  try {
+    if (typeof tls.getCACertificates === "function") {
+      add(tls.getCACertificates("extra"));
+    }
+  } catch { /* guard */ }
+
+  try {
+    if (process.env.NODE_EXTRA_CA_CERTS) {
+      add(parsePemFile(process.env.NODE_EXTRA_CA_CERTS));
+    }
+  } catch { /* guard */ }
+
+  return certs.length > 0 ? certs : null;
+}
+
+export function installTrustStore() {
+  try {
+    const ca = buildCaBundle();
+
+    // Primary mechanism (Node >=22.15): set the process-wide default CA list.
+    // This covers Node's built-in fetch and all TLS connections — no userland
+    // undici dispatcher needed for the non-proxy case.
+    if (ca && typeof tls.setDefaultCACertificates === "function") {
+      tls.setDefaultCACertificates(ca);
+    }
+
+    // Proxy composition: Node's built-in fetch ignores HTTPS_PROXY, so when a
+    // proxy is configured we still need undici's ProxyAgent as the global
+    // dispatcher. The ProxyAgent carries the CA bundle in its TLS options.
+    // Guarded: if undici fails to load (unexpected, since we pin a compatible
+    // version, but guard anyway), proxy is a silent no-op.
+    const cfg = resolveProxy();
+    if (cfg) {
+      try {
+        const require = createRequire(import.meta.url);
+        const { setGlobalDispatcher, ProxyAgent } = require("undici");
+        setGlobalDispatcher(
+          new ProxyAgent({
+            uri: cfg.proxyUrl,
+            noProxy: cfg.noProxy.join(","),
+            ...(ca ? { requestTls: { ca }, proxyTls: { ca } } : {}),
+          }),
+        );
+      } catch {
+        // undici unavailable or API mismatch — proxy degrades silently.
+      }
+    }
+  } catch {
+    // Never break startup.
+  }
+}

package/src/tools/register.js

@@ -3,7 +3,7 @@
 // Extracted verbatim from src/tools.js (refactor: split tools.js into modules).
 
 import { z } from "zod";
-import { newLoginCode, buildLoginUrl, pollStatusOnce } from "../auth.js";
+import { newLoginCode, buildLoginUrl, pollStatusOnce, checkApiConnectivity } from "../auth.js";
 import { PLAYBOOK, fetchCorpus, listWorkflows } from "../playbook.js";
 import {
   APPS_WIDGETS_ENABLED,
@@ -557,6 +557,11 @@ export function registerTools(server, ctx) {
       annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
     },
     async () => {
+      try {
+        await checkApiConnectivity();
+      } catch (err) {
+        if (err.certError) return fail(err.message);
+      }
       const code = newLoginCode();
       ctx.state.pendingLoginCode = code;
       const url = buildLoginUrl(code);
@@ -934,7 +939,7 @@ export function registerTools(server, ctx) {
 
   regTool(
     "grid_create_project",
-    "Scaffold a new CloudGrid app or agent folder (cloudgrid.yaml + a web service), optionally pre-declaring resources. Wraps `grid new` (scaffolds locally; no server entity until you grid_deploy).",
+    "Scaffold a new CloudGrid app or agent folder (cloudgrid.yaml + a web service), optionally pre-declaring resources. Wraps `grid new` (scaffolds locally; no server entity until you grid_deploy). Language note: the nextjs starter is TypeScript (writes tsconfig.json + app/*.tsx), but CloudGrid templates are plain JavaScript. When you fill a template, treat the template's files as the source of truth — delete the scaffolded tsconfig.json and app/*.tsx, then write the template's .js files. Never leave both .tsx and .js for the same route.",
     {
       kind: z.enum(["app", "agent"]).describe("Entity kind. 'agent' scaffolds an agent: block."),
       name: z.string().describe("Slug: 3-40 lowercase alphanumerics and hyphens."),