@corenel/sidecar 0.8.0 → 0.8.2

package/dist/cli.js

@@ -25280,9 +25280,10 @@ function oauthConfigFromEnv(env = process.env) {
   return { issuer, clientId };
 }
 function openBrowser(url) {
-  const cmd = process.platform === "win32" ? "cmd" : process.platform === "darwin" ? "open" : "xdg-open";
-  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  const [cmd, args] = process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : process.platform === "darwin" ? ["open", [url]] : ["xdg-open", [url]];
   const child = spawn6(cmd, args, { detached: true, stdio: "ignore" });
+  child.on("error", () => {
+  });
   child.unref();
 }
 async function exchangeCode2(p2) {
@@ -46192,7 +46193,7 @@ var FLAG_TO_KEY = {
   "--default-model": "defaultModel",
   "--name": "name"
 };
-var DEFAULT_GUEST_IMAGE2 = "prompd/corenel-sandbox:0.7.0";
+var DEFAULT_GUEST_IMAGE2 = "prompd/corenel-sandbox:0.8.2";
 function parseArgsWithProvenance(argv) {
   const explicit = /* @__PURE__ */ new Set();
   for (const a2 of argv) {
@@ -46880,6 +46881,49 @@ async function readMcpCredential(stateDir, server) {
   const cred = section[server];
   return isUsableCredential(cred) ? cred : null;
 }
+function isUsableClient(v2) {
+  if (typeof v2 !== "object" || v2 === null) return false;
+  const r2 = v2;
+  return typeof r2.clientId === "string" && r2.clientId.length > 0 && typeof r2.authServer === "string" && r2.authServer.length > 0 && (r2.clientSecret === void 0 || typeof r2.clientSecret === "string") && (r2.redirectPort === void 0 || typeof r2.redirectPort === "number" && Number.isInteger(r2.redirectPort) && r2.redirectPort > 0 && r2.redirectPort < 65536);
+}
+async function readMcpClient(stateDir, server) {
+  const doc = await readAuthJson(stateDir);
+  const section = doc.mcpClients;
+  if (typeof section !== "object" || section === null || Array.isArray(section)) return null;
+  const rec5 = section[server];
+  return isUsableClient(rec5) ? rec5 : null;
+}
+async function writeMcpClient(stateDir, server, client) {
+  const doc = await readAuthJson(stateDir);
+  const prev = doc.mcpClients;
+  const section = typeof prev === "object" && prev !== null && !Array.isArray(prev) ? { ...prev } : {};
+  section[server] = client;
+  const next = { ...doc, mcpClients: section };
+  const path = credentialFilePath(stateDir);
+  await mkdir4(credentialDir(stateDir), { recursive: true });
+  await writeFile2(path, `${JSON.stringify(next, null, 2)}
+`, { mode: 384 });
+  try {
+    await chmod(path, 384);
+  } catch {
+  }
+}
+async function clearMcpClient(stateDir, server) {
+  const doc = await readAuthJson(stateDir);
+  const prev = doc.mcpClients;
+  if (typeof prev !== "object" || prev === null || Array.isArray(prev)) return;
+  const section = { ...prev };
+  if (!(server in section)) return;
+  delete section[server];
+  const path = credentialFilePath(stateDir);
+  await mkdir4(credentialDir(stateDir), { recursive: true });
+  await writeFile2(path, `${JSON.stringify({ ...doc, mcpClients: section }, null, 2)}
+`, { mode: 384 });
+  try {
+    await chmod(path, 384);
+  } catch {
+  }
+}
 async function writeMcpCredential(stateDir, server, cred) {
   const doc = await readAuthJson(stateDir);
   const section = isMcpAuthSection(doc.mcp) ? { ...doc.mcp } : {};
@@ -46921,6 +46965,15 @@ function firstAuthServer(doc) {
   const first = list[0];
   return typeof first === "string" && first.length > 0 ? first : null;
 }
+function scopesFrom(doc) {
+  const list = doc.scopes_supported;
+  if (!Array.isArray(list) || list.length === 0) return void 0;
+  return list.every((s2) => typeof s2 === "string") ? list : void 0;
+}
+function resourceResult(doc, authServer, mcpUrl) {
+  const scopes = scopesFrom(doc);
+  return { authServer, resource: resourceFor(doc, mcpUrl), ...scopes ? { scopes } : {} };
+}
 function resourceMetadataUrlFromHeader(headerValue) {
   if (!headerValue) return null;
   const match = /resource_metadata="([^"]+)"/.exec(headerValue);
@@ -46934,9 +46987,22 @@ async function discoverAuthServer(mcpUrl, fetchImpl = fetch) {
   const wellKnownUrl = new URL(PROTECTED_RESOURCE_PATH, origin).toString();
   const direct = await tryFetchJson(wellKnownUrl, fetchImpl);
   if (direct) {
-    const authServer2 = firstAuthServer(direct);
-    if (authServer2) return { authServer: authServer2, resource: resourceFor(direct, mcpUrl) };
+    const authServer = firstAuthServer(direct);
+    if (authServer) return resourceResult(direct, authServer, mcpUrl);
   }
+  const viaHint = await hintedResource(mcpUrl, fetchImpl);
+  if (viaHint) {
+    const authServer = firstAuthServer(viaHint);
+    if (authServer) return resourceResult(viaHint, authServer, mcpUrl);
+  }
+  const own = await tryFetchJson(authServerMetadataUrl(origin), fetchImpl);
+  if (own && typeof own.authorization_endpoint === "string" && own.authorization_endpoint.length > 0) {
+    const issuer = typeof own.issuer === "string" && own.issuer.length > 0 ? own.issuer : origin;
+    return resourceResult(own, issuer, mcpUrl);
+  }
+  return null;
+}
+async function hintedResource(mcpUrl, fetchImpl) {
   let probe;
   try {
     probe = await fetchImpl(mcpUrl);
@@ -46946,10 +47012,7 @@ async function discoverAuthServer(mcpUrl, fetchImpl = fetch) {
   if (probe.status !== 401) return null;
   const hinted = resourceMetadataUrlFromHeader(probe.headers.get("www-authenticate"));
   if (!hinted) return null;
-  const viaHint = await tryFetchJson(hinted, fetchImpl);
-  if (!viaHint) return null;
-  const authServer = firstAuthServer(viaHint);
-  return authServer ? { authServer, resource: resourceFor(viaHint, mcpUrl) } : null;
+  return tryFetchJson(hinted, fetchImpl);
 }
 function authServerMetadataUrl(authServer) {
   const u2 = new URL(authServer);
@@ -47208,23 +47271,32 @@ async function loginToMcpServer(stateDir, server, deps = {}) {
         message: `"${server.name}" does not advertise an OAuth authorization server. If it takes a static token instead, store that as a header.`
       };
     }
-    const meta = await discoverAuthMetadata(
+    const asMeta = await discoverAuthMetadata(
       discovered.authServer,
       fetchImpl
     );
-    const port = await getFreePort();
+    const meta = discovered.scopes ? { ...asMeta, scopesSupported: discovered.scopes } : asMeta;
+    const cached = await readMcpClient(stateDir, server.name);
+    const port = cached?.redirectPort ?? await getFreePort();
     const redirectUri = `http://localhost:${port}/callback`;
-    const registered2 = await registerClient(
+    const registered2 = cached && cached.authServer === discovered.authServer ? { clientId: cached.clientId, ...cached.clientSecret ? { clientSecret: cached.clientSecret } : {} } : await registerClient(
       meta,
       redirectUri,
       fetchImpl
     );
+    if (registered2 && !cached) {
+      await writeMcpClient(stateDir, server.name, {
+        clientId: registered2.clientId,
+        ...registered2.clientSecret ? { clientSecret: registered2.clientSecret } : {},
+        authServer: discovered.authServer
+      });
+    }
     if (!registered2) {
       return {
         ok: false,
         reason: "no-dcr",
         authServer: discovered.authServer,
-        message: `"${server.name}"'s authorization server (${discovered.authServer}) does not support dynamic client registration, and there is no configured client id to fall back to. Store a static token as a header instead, if the server offers one.`
+        message: `"${server.name}"'s authorization server (${discovered.authServer}) supports OAuth but not dynamic client registration, so no client can be created on demand. Store a static token as a header instead -- a server in this position normally issues one from its own settings.`
       };
     }
     const pkce = makePkce();
@@ -47259,12 +47331,17 @@ async function loginToMcpServer(stateDir, server, deps = {}) {
     await writeMcpCredential(stateDir, server.name, cred);
     return { ok: true };
   } catch (e2) {
-    return { ok: false, reason: "failed", message: e2 instanceof Error ? e2.message : String(e2) };
+    const message = e2 instanceof Error ? e2.message : String(e2);
+    if (/invalid_client|unauthorized_client|client.{0,20}not.{0,10}found/i.test(message)) {
+      await clearMcpClient(stateDir, server.name).catch(() => {
+      });
+    }
+    return { ok: false, reason: "failed", message };
   }
 }
 
 // src/config/mcpCmd.ts
-var USAGE2 = "Use: corenel mcp add <name> <url> [--hosted] | remove <name> | list | set-header <name> <header> <value> | login <name> | refresh <name>";
+var USAGE2 = "Use: corenel mcp add <name> <url> [--hosted] | remove <name> | list | set-header <name> <header> <value> | set-client <name> <client-id> [<client-secret>] --auth-server <url> [--redirect-port <port>] | login <name> | refresh <name>";
 function isHttpUrl(url) {
   try {
     const parsed = new URL(url);
@@ -47277,7 +47354,7 @@ async function runMcp(raw, io, deps = {}) {
   const argv = stripStateDir(raw);
   const sub = argv[0];
   const { corrupt } = await readDaemonConfig(io.stateDir);
-  const isWrite = sub === "add" || sub === "remove" || sub === "set-header" || sub === "login";
+  const isWrite = sub === "add" || sub === "remove" || sub === "set-header" || sub === "set-client" || sub === "login";
   if (corrupt && isWrite) {
     io.err(`daemon.json in ${io.stateDir} is not valid JSON; fix or delete it before writing.`);
     return 2;
@@ -47332,6 +47409,51 @@ async function runMcp(raw, io, deps = {}) {
     if (corrupt) io.err(`daemon.json in ${io.stateDir} is not valid JSON; these are the defaults, not what the file says.`);
     return 0;
   }
+  if (sub === "set-client") {
+    const flagAt = argv.indexOf("--auth-server");
+    const authServer = flagAt === -1 ? void 0 : argv[flagAt + 1];
+    const portAt = argv.indexOf("--redirect-port");
+    const portRaw = portAt === -1 ? void 0 : argv[portAt + 1];
+    const consumed = /* @__PURE__ */ new Set([0, flagAt, flagAt + 1, portAt, portAt + 1]);
+    const positional = argv.filter((a2, i2) => !consumed.has(i2));
+    const name = positional[0];
+    const clientId = positional[1];
+    const clientSecret = positional[2];
+    if (!name || !clientId) {
+      io.err(`corenel mcp set-client needs a name and a client id. ${USAGE2}`);
+      return 2;
+    }
+    if (!authServer || !isHttpUrl(authServer)) {
+      io.err(`corenel mcp set-client needs --auth-server <url> -- the authorization server the client was registered with, copied from the service's own app settings. ${USAGE2}`);
+      return 2;
+    }
+    let redirectPort;
+    if (portRaw !== void 0) {
+      const parsed = Number(portRaw);
+      if (!Number.isInteger(parsed) || parsed <= 0 || parsed >= 65536) {
+        io.err(`"${portRaw}" is not a usable port for --redirect-port. ${USAGE2}`);
+        return 2;
+      }
+      redirectPort = parsed;
+    }
+    const servers = await readMcpServers(io.stateDir);
+    if (!servers.some((s2) => s2.name === name)) {
+      io.err(`"${name}" is not a configured MCP server. Add it first: corenel mcp add ${name} <url>`);
+      return 2;
+    }
+    await writeMcpClient(io.stateDir, name, {
+      clientId,
+      ...clientSecret ? { clientSecret } : {},
+      authServer,
+      ...redirectPort ? { redirectPort } : {}
+    });
+    io.out(`Stored an OAuth client for "${name}" (client id ${clientId}${clientSecret ? ", with a secret" : ""}).`);
+    if (redirectPort !== void 0) {
+      io.out(`Register this redirect URL with the service: http://localhost:${redirectPort}/callback`);
+    }
+    io.out(`Run: corenel mcp login ${name}`);
+    return 0;
+  }
   if (sub === "set-header") {
     const name = argv[1];
     const header = argv[2];
@@ -47385,7 +47507,7 @@ async function runMcp(raw, io, deps = {}) {
         return 2;
       }
       if (outcome.reason === "no-dcr") {
-        io.err(`"${name}"'s authorization server (${outcome.authServer}) does not support dynamic client registration, and corenel mcp login has no configured client id to fall back to. Use: corenel mcp set-header ${name} <header> <value> instead, if the server also offers a static token.`);
+        io.err(`"${name}"'s authorization server (${outcome.authServer}) supports OAuth but not dynamic client registration, so no client can be created on demand. Use: corenel mcp set-header ${name} <header> <value> with a token from the service's own settings.`);
         return 2;
       }
       io.err(`Sign-in for "${name}" failed: ${outcome.message}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corenel/sidecar",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "type": "module",
   "license": "Elastic-2.0",
   "description": "Prompd sidecar — a local capability server. Run it next to Prompd (prompd.app) so the browser app can reach your machine: local LLMs (Ollama/LM Studio/vLLM) without CORS, your filesystem, and (opt-in) shell.",
@@ -38,8 +38,8 @@
     "typescript": "^5.9.3",
     "@corenel/harness": "0.7.0",
     "@corenel/protocol": "0.7.0",
-    "@corenel/tools-node": "0.3.2",
-    "@corenel/crew": "0.0.0"
+    "@corenel/crew": "0.0.0",
+    "@corenel/tools-node": "0.3.2"
   },
   "repository": {
     "type": "git",