@corenel/sidecar 0.8.1 → 0.8.2

package/dist/cli.js

@@ -46193,7 +46193,7 @@ var FLAG_TO_KEY = {
   "--default-model": "defaultModel",
   "--name": "name"
 };
-var DEFAULT_GUEST_IMAGE2 = "prompd/corenel-sandbox:0.8.1";
+var DEFAULT_GUEST_IMAGE2 = "prompd/corenel-sandbox:0.8.2";
 function parseArgsWithProvenance(argv) {
   const explicit = /* @__PURE__ */ new Set();
   for (const a2 of argv) {
@@ -46884,7 +46884,7 @@ async function readMcpCredential(stateDir, server) {
 function isUsableClient(v2) {
   if (typeof v2 !== "object" || v2 === null) return false;
   const r2 = v2;
-  return typeof r2.clientId === "string" && r2.clientId.length > 0 && typeof r2.authServer === "string" && r2.authServer.length > 0 && (r2.clientSecret === void 0 || typeof r2.clientSecret === "string");
+  return typeof r2.clientId === "string" && r2.clientId.length > 0 && typeof r2.authServer === "string" && r2.authServer.length > 0 && (r2.clientSecret === void 0 || typeof r2.clientSecret === "string") && (r2.redirectPort === void 0 || typeof r2.redirectPort === "number" && Number.isInteger(r2.redirectPort) && r2.redirectPort > 0 && r2.redirectPort < 65536);
 }
 async function readMcpClient(stateDir, server) {
   const doc = await readAuthJson(stateDir);
@@ -46965,6 +46965,15 @@ function firstAuthServer(doc) {
   const first = list[0];
   return typeof first === "string" && first.length > 0 ? first : null;
 }
+function scopesFrom(doc) {
+  const list = doc.scopes_supported;
+  if (!Array.isArray(list) || list.length === 0) return void 0;
+  return list.every((s2) => typeof s2 === "string") ? list : void 0;
+}
+function resourceResult(doc, authServer, mcpUrl) {
+  const scopes = scopesFrom(doc);
+  return { authServer, resource: resourceFor(doc, mcpUrl), ...scopes ? { scopes } : {} };
+}
 function resourceMetadataUrlFromHeader(headerValue) {
   if (!headerValue) return null;
   const match = /resource_metadata="([^"]+)"/.exec(headerValue);
@@ -46978,9 +46987,22 @@ async function discoverAuthServer(mcpUrl, fetchImpl = fetch) {
   const wellKnownUrl = new URL(PROTECTED_RESOURCE_PATH, origin).toString();
   const direct = await tryFetchJson(wellKnownUrl, fetchImpl);
   if (direct) {
-    const authServer2 = firstAuthServer(direct);
-    if (authServer2) return { authServer: authServer2, resource: resourceFor(direct, mcpUrl) };
+    const authServer = firstAuthServer(direct);
+    if (authServer) return resourceResult(direct, authServer, mcpUrl);
+  }
+  const viaHint = await hintedResource(mcpUrl, fetchImpl);
+  if (viaHint) {
+    const authServer = firstAuthServer(viaHint);
+    if (authServer) return resourceResult(viaHint, authServer, mcpUrl);
   }
+  const own = await tryFetchJson(authServerMetadataUrl(origin), fetchImpl);
+  if (own && typeof own.authorization_endpoint === "string" && own.authorization_endpoint.length > 0) {
+    const issuer = typeof own.issuer === "string" && own.issuer.length > 0 ? own.issuer : origin;
+    return resourceResult(own, issuer, mcpUrl);
+  }
+  return null;
+}
+async function hintedResource(mcpUrl, fetchImpl) {
   let probe;
   try {
     probe = await fetchImpl(mcpUrl);
@@ -46990,10 +47012,7 @@ async function discoverAuthServer(mcpUrl, fetchImpl = fetch) {
   if (probe.status !== 401) return null;
   const hinted = resourceMetadataUrlFromHeader(probe.headers.get("www-authenticate"));
   if (!hinted) return null;
-  const viaHint = await tryFetchJson(hinted, fetchImpl);
-  if (!viaHint) return null;
-  const authServer = firstAuthServer(viaHint);
-  return authServer ? { authServer, resource: resourceFor(viaHint, mcpUrl) } : null;
+  return tryFetchJson(hinted, fetchImpl);
 }
 function authServerMetadataUrl(authServer) {
   const u2 = new URL(authServer);
@@ -47252,13 +47271,14 @@ async function loginToMcpServer(stateDir, server, deps = {}) {
         message: `"${server.name}" does not advertise an OAuth authorization server. If it takes a static token instead, store that as a header.`
       };
     }
-    const meta = await discoverAuthMetadata(
+    const asMeta = await discoverAuthMetadata(
       discovered.authServer,
       fetchImpl
     );
-    const port = await getFreePort();
-    const redirectUri = `http://localhost:${port}/callback`;
+    const meta = discovered.scopes ? { ...asMeta, scopesSupported: discovered.scopes } : asMeta;
     const cached = await readMcpClient(stateDir, server.name);
+    const port = cached?.redirectPort ?? await getFreePort();
+    const redirectUri = `http://localhost:${port}/callback`;
     const registered2 = cached && cached.authServer === discovered.authServer ? { clientId: cached.clientId, ...cached.clientSecret ? { clientSecret: cached.clientSecret } : {} } : await registerClient(
       meta,
       redirectUri,
@@ -47276,7 +47296,7 @@ async function loginToMcpServer(stateDir, server, deps = {}) {
         ok: false,
         reason: "no-dcr",
         authServer: discovered.authServer,
-        message: `"${server.name}"'s authorization server (${discovered.authServer}) does not support dynamic client registration, and there is no configured client id to fall back to. Store a static token as a header instead, if the server offers one.`
+        message: `"${server.name}"'s authorization server (${discovered.authServer}) supports OAuth but not dynamic client registration, so no client can be created on demand. Store a static token as a header instead -- a server in this position normally issues one from its own settings.`
       };
     }
     const pkce = makePkce();
@@ -47321,7 +47341,7 @@ async function loginToMcpServer(stateDir, server, deps = {}) {
 }
 
 // src/config/mcpCmd.ts
-var USAGE2 = "Use: corenel mcp add <name> <url> [--hosted] | remove <name> | list | set-header <name> <header> <value> | login <name> | refresh <name>";
+var USAGE2 = "Use: corenel mcp add <name> <url> [--hosted] | remove <name> | list | set-header <name> <header> <value> | set-client <name> <client-id> [<client-secret>] --auth-server <url> [--redirect-port <port>] | login <name> | refresh <name>";
 function isHttpUrl(url) {
   try {
     const parsed = new URL(url);
@@ -47334,7 +47354,7 @@ async function runMcp(raw, io, deps = {}) {
   const argv = stripStateDir(raw);
   const sub = argv[0];
   const { corrupt } = await readDaemonConfig(io.stateDir);
-  const isWrite = sub === "add" || sub === "remove" || sub === "set-header" || sub === "login";
+  const isWrite = sub === "add" || sub === "remove" || sub === "set-header" || sub === "set-client" || sub === "login";
   if (corrupt && isWrite) {
     io.err(`daemon.json in ${io.stateDir} is not valid JSON; fix or delete it before writing.`);
     return 2;
@@ -47389,6 +47409,51 @@ async function runMcp(raw, io, deps = {}) {
     if (corrupt) io.err(`daemon.json in ${io.stateDir} is not valid JSON; these are the defaults, not what the file says.`);
     return 0;
   }
+  if (sub === "set-client") {
+    const flagAt = argv.indexOf("--auth-server");
+    const authServer = flagAt === -1 ? void 0 : argv[flagAt + 1];
+    const portAt = argv.indexOf("--redirect-port");
+    const portRaw = portAt === -1 ? void 0 : argv[portAt + 1];
+    const consumed = /* @__PURE__ */ new Set([0, flagAt, flagAt + 1, portAt, portAt + 1]);
+    const positional = argv.filter((a2, i2) => !consumed.has(i2));
+    const name = positional[0];
+    const clientId = positional[1];
+    const clientSecret = positional[2];
+    if (!name || !clientId) {
+      io.err(`corenel mcp set-client needs a name and a client id. ${USAGE2}`);
+      return 2;
+    }
+    if (!authServer || !isHttpUrl(authServer)) {
+      io.err(`corenel mcp set-client needs --auth-server <url> -- the authorization server the client was registered with, copied from the service's own app settings. ${USAGE2}`);
+      return 2;
+    }
+    let redirectPort;
+    if (portRaw !== void 0) {
+      const parsed = Number(portRaw);
+      if (!Number.isInteger(parsed) || parsed <= 0 || parsed >= 65536) {
+        io.err(`"${portRaw}" is not a usable port for --redirect-port. ${USAGE2}`);
+        return 2;
+      }
+      redirectPort = parsed;
+    }
+    const servers = await readMcpServers(io.stateDir);
+    if (!servers.some((s2) => s2.name === name)) {
+      io.err(`"${name}" is not a configured MCP server. Add it first: corenel mcp add ${name} <url>`);
+      return 2;
+    }
+    await writeMcpClient(io.stateDir, name, {
+      clientId,
+      ...clientSecret ? { clientSecret } : {},
+      authServer,
+      ...redirectPort ? { redirectPort } : {}
+    });
+    io.out(`Stored an OAuth client for "${name}" (client id ${clientId}${clientSecret ? ", with a secret" : ""}).`);
+    if (redirectPort !== void 0) {
+      io.out(`Register this redirect URL with the service: http://localhost:${redirectPort}/callback`);
+    }
+    io.out(`Run: corenel mcp login ${name}`);
+    return 0;
+  }
   if (sub === "set-header") {
     const name = argv[1];
     const header = argv[2];
@@ -47442,7 +47507,7 @@ async function runMcp(raw, io, deps = {}) {
         return 2;
       }
       if (outcome.reason === "no-dcr") {
-        io.err(`"${name}"'s authorization server (${outcome.authServer}) does not support dynamic client registration, and corenel mcp login has no configured client id to fall back to. Use: corenel mcp set-header ${name} <header> <value> instead, if the server also offers a static token.`);
+        io.err(`"${name}"'s authorization server (${outcome.authServer}) supports OAuth but not dynamic client registration, so no client can be created on demand. Use: corenel mcp set-header ${name} <header> <value> with a token from the service's own settings.`);
         return 2;
       }
       io.err(`Sign-in for "${name}" failed: ${outcome.message}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corenel/sidecar",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "type": "module",
   "license": "Elastic-2.0",
   "description": "Prompd sidecar — a local capability server. Run it next to Prompd (prompd.app) so the browser app can reach your machine: local LLMs (Ollama/LM Studio/vLLM) without CORS, your filesystem, and (opt-in) shell.",
@@ -36,10 +36,10 @@
     "esbuild": "^0.21.5",
     "tsx": "^4.19.2",
     "typescript": "^5.9.3",
-    "@corenel/protocol": "0.7.0",
-    "@corenel/tools-node": "0.3.2",
     "@corenel/harness": "0.7.0",
-    "@corenel/crew": "0.0.0"
+    "@corenel/protocol": "0.7.0",
+    "@corenel/crew": "0.0.0",
+    "@corenel/tools-node": "0.3.2"
   },
   "repository": {
     "type": "git",