@drop2run/mcp 0.3.0 → 0.4.0

package/README.md

@@ -33,32 +33,31 @@ Nothing is installed globally either way — `npx` fetches the package when the
 
 ## Sign in
 
-The server has no browser and no dashboard session, so it authenticates with a personal access token.
-Two ways to give it one.
+Ask for a publish. If there is no token yet, Claude calls the `login` tool, a browser tab opens, you
+approve the sign-in, and the publish carries on. Nothing to install, nothing to paste.
 
-Through the CLI, which stores it in `~/.config/drop2run/config.json` with mode `0600`:
+The token lands in `~/.config/drop2run/config.json` with mode `0600` — the same file the `drop2run`
+CLI uses, so signing in once covers both. It is read on every call rather than at startup, so it takes
+effect without restarting the client.
 
-```bash
-npx drop2run login
-```
-
-Or create a token at <https://dropto.run/account/tokens> and set it in the environment:
+**No browser on this machine?** In a container, over SSH, on a remote host, `login_code` gives a short
+code to enter at <https://dropto.run/device> from any other device.
 
-```
-DROP2RUN_TOKEN=d2r_...
-```
+**Or set a token yourself.** Create one at <https://dropto.run/account/tokens> and either put it in
+`~/.config/drop2run/config.json` as `{"token": "d2r_..."}`, which needs no restart, or set
+`DROP2RUN_TOKEN` in the environment the client starts the server in. The environment takes precedence
+over the file — and because it is read once at startup, setting it in a shell afterwards changes
+nothing until the client restarts the server.
 
 A token is shown once and stored as a hash, so it cannot be read back later — create a new one if you
-lose it. The environment takes precedence over the file, and the file is the one the `drop2run` CLI
-reads, so signing in once covers both.
-
-The token is read on every call rather than at startup, so one added while the client is running takes
-effect without a restart.
+lose it.
 
 ## The tools
 
 | Tool | What it does |
 |---|---|
+| `login` | Signs in through a browser on this machine and stores the token |
+| `login_code` | Signs in with a short code approved elsewhere, where no browser can be opened |
 | `publish_files` | Publishes files Claude wrote — a page, a markdown note, several files together |
 | `publish_dir` | Publishes a folder, given its absolute path |
 | `list_sites` | Lists the sites on the account |
@@ -66,6 +65,10 @@ effect without a restart.
 Both publish tools take an optional `site` — a subdomain or site id to publish over. Leave it out and a
 new site is created.
 
+Both sign-in tools answer "not approved yet" rather than failing while they wait, and calling them
+again keeps waiting on the same sign-in. Neither replaces a token that is already stored unless asked
+to with `replace`.
+
 ## Behaviour worth knowing
 
 **Publishing without a `site` creates a new one.** It never replaces your most recent site by default:
@@ -96,8 +99,17 @@ needs no credential from us, and none is sent there.
 
 ## If something is wrong
 
-**"No Drop2Run access token."** — the server is running but has no token. Run `npx drop2run login`, or
-set `DROP2RUN_TOKEN`. No restart needed.
+**"No Drop2Run access token."** — the server is running but has no token. Ask Claude to sign in, which
+calls `login`; or run `npx drop2run login` yourself. Either writes the same file, and no restart is
+needed.
+
+**The browser never opened.** `login` says so and returns the URL instead — open it anywhere on this
+machine, then ask Claude to call `login` again. The URL stays valid. On a machine with no browser at
+all, use `login_code`.
+
+**You signed in but publishing is still refused.** Check for `DROP2RUN_TOKEN` in the environment the
+client started the server in: it outranks the file that was just written. `login` says so when it finds
+one.
 
 **Claude Desktop cannot start it** — Desktop does not inherit your shell's `PATH`. Use the absolute path
 to `npx` (`which npx`) as `command`.

package/dist/index.js

@@ -1,7 +1,10 @@
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join, relative, sep } from "node:path";
+import { readFileSync, mkdirSync, writeFileSync, chmodSync, renameSync } from "node:fs";
+import { homedir, hostname } from "node:os";
+import { join, dirname, relative, sep } from "node:path";
+import { spawn } from "node:child_process";
+import { randomBytes, createHash } from "node:crypto";
+import { createServer as createServer$1 } from "node:http";
 import { realpath, readdir, stat, readFile } from "node:fs/promises";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
@@ -50,20 +53,199 @@ function loadCredentials(env = process.env, read = (path) => readFileSync(path,
     apiBaseUrl: env.DROP2RUN_API_URL?.trim() || stored.apiBaseUrl?.trim() || DEFAULT_API_BASE_URL
   };
 }
-function missingCredentialsMessage() {
-  return [
-    "No Drop2Run access token.",
-    "",
-    "Run `drop2run login` to sign in through a browser, which stores one for you.",
+function resolveApiBaseUrl(env = process.env, read = (path) => readFileSync(path, "utf8")) {
+  let stored = {};
+  try {
+    stored = JSON.parse(read(configPath()));
+  } catch {
+  }
+  const url = env.DROP2RUN_API_URL?.trim() || stored.apiBaseUrl?.trim() || DEFAULT_API_BASE_URL;
+  return url.replace(/\/+$/, "");
+}
+function dashboardUrlFor(apiBaseUrl) {
+  return apiBaseUrl.replace(/\/+$/, "").replace(/\/api$/, "");
+}
+function saveToken(token, path = configPath()) {
+  let existing = {};
+  try {
+    existing = JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+  }
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  const temporary = `${path}.tmp`;
+  writeFileSync(temporary, `${JSON.stringify({ ...existing, token }, null, "	")}
+`, {
+    mode: 384
+  });
+  chmodSync(temporary, 384);
+  renameSync(temporary, path);
+  return path;
+}
+function missingCredentialsMessage(surface = "cli") {
+  const signIn = surface === "mcp" ? [
+    "Call the `login` tool to sign in through a browser, which stores a token.",
     "",
+    "Where no browser can be opened on this machine — a container, a remote host — call",
+    "`login_code` instead and pass on the short code it gives you."
+  ] : ["Run `drop2run login` to sign in through a browser, which stores one for you."];
+  const byHand = surface === "mcp" ? [
+    "To set one without signing in here, create a token at",
+    "https://dropto.run/account/tokens and either:",
+    `  - put it in ${configPath()} as {"token": "d2r_..."}, which this`,
+    "    server reads on every call and needs no restart, or",
+    `  - set ${TOKEN_VARIABLE} in the environment and restart this server, since it reads`,
+    "    the environment it was started in."
+  ] : [
     "For CI, or where no browser can be opened, create a token at",
     "https://dropto.run/account/tokens and either:",
     `  - set ${TOKEN_VARIABLE} in the environment, or`,
-    `  - put it in ${configPath()} as {"token": "d2r_..."}`,
+    `  - put it in ${configPath()} as {"token": "d2r_..."}`
+  ];
+  return [
+    "No Drop2Run access token.",
+    "",
+    ...signIn,
+    "",
+    ...byHand,
     "",
     "The token is shown once when it is created and cannot be recovered afterwards."
   ].join("\n");
 }
+function newAttempt() {
+  const verifier = randomBytes(32).toString("base64url");
+  return {
+    verifier,
+    challenge: createHash("sha256").update(verifier).digest("base64url"),
+    state: randomBytes(16).toString("base64url")
+  };
+}
+function clientName(surface) {
+  const clean2 = (value) => value.trim().replace(/[^A-Za-z0-9._-]/g, "-");
+  const label = `-${clean2(surface).slice(0, 16)}`;
+  const raw = clean2(hostname()).slice(0, 64 - label.length);
+  return `${raw === "" ? "drop2run" : raw}${label}`;
+}
+function openBrowser(url) {
+  const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  try {
+    const child = spawn(command, [...args], { stdio: "ignore", detached: true });
+    child.unref();
+    child.on("error", () => {
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function listen(state) {
+  return new Promise((resolveListener, rejectListener) => {
+    let settle = null;
+    let fail = null;
+    const received = new Promise((resolveCode, rejectCode) => {
+      settle = resolveCode;
+      fail = rejectCode;
+    });
+    const server = createServer$1((request2, response) => {
+      const url = new URL(request2.url ?? "/", "http://127.0.0.1");
+      if (url.pathname !== "/cb") {
+        response.writeHead(404, { "Content-Type": "text/plain" });
+        response.end("Not found.\n");
+        return;
+      }
+      const code = url.searchParams.get("code") ?? "";
+      const returned = url.searchParams.get("state") ?? "";
+      if (returned !== state || code === "") {
+        respond(
+          response,
+          400,
+          "Sign-in could not be completed",
+          "This did not come from the sign-in that was started here. Nothing has been changed."
+        );
+        fail?.(new Error("The browser returned a response that did not match this sign-in."));
+        return;
+      }
+      respond(response, 200, "Signed in", "You can close this tab now.");
+      settle?.({ code });
+    });
+    server.on("error", (error) => {
+      rejectListener(error);
+      fail?.(error instanceof Error ? error : new Error(String(error)));
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      if (address === null) {
+        rejectListener(new Error("Could not open a local port to receive the sign-in."));
+        return;
+      }
+      resolveListener({
+        port: address.port,
+        received,
+        close: () => server.close()
+      });
+    });
+  });
+}
+function respond(response, status, title, detail) {
+  response.writeHead(status, { "Content-Type": "text/html; charset=utf-8" });
+  response.end(
+    `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>${title} — drop2run</title><style>body{font:16px/1.6 system-ui,sans-serif;margin:20vh auto;max-width:28rem;padding:0 1.5rem;color:#12211f}h1{font-size:1.4rem;margin:0 0 .5rem}p{margin:0;color:#64706e}@media(prefers-color-scheme:dark){body{background:#0d1413;color:#e8efee}p{color:#9aa8a6}}</style></head><body><h1>${title}</h1><p>${detail}</p></body></html>
+`
+  );
+}
+function consentUrl(dashboardUrl, attempt2, port, name) {
+  const url = new URL("/cli-auth", dashboardUrl);
+  url.searchParams.set("challenge", attempt2.challenge);
+  url.searchParams.set("state", attempt2.state);
+  url.searchParams.set("port", String(port));
+  url.searchParams.set("name", name);
+  return url.toString();
+}
+async function startDevice(apiBaseUrl, clientName2) {
+  const response = await fetch(`${apiBaseUrl}/auth/cli/device`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ clientName: clientName2 })
+  });
+  if (!response.ok) throw new Error(await problemDetail(response));
+  return await response.json();
+}
+async function pollDevice(apiBaseUrl, deviceCode) {
+  let response;
+  try {
+    response = await fetch(`${apiBaseUrl}/auth/cli/device/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ deviceCode })
+    });
+  } catch {
+    return { state: "pending" };
+  }
+  if (response.ok) {
+    const body = await response.json();
+    return { state: "granted", token: { token: body.token, name: body.name, email: body.email } };
+  }
+  const problem = await response.json().catch(() => null);
+  if (problem?.type === "authorization_pending") return { state: "pending" };
+  if (problem?.type === "slow_down") return { state: "slow_down" };
+  return {
+    state: "dead",
+    message: problem?.detail ?? `The API answered ${response.status}.`
+  };
+}
+async function problemDetail(response) {
+  const problem = await response.json().catch(() => null);
+  return problem?.detail ?? `The API answered ${response.status}.`;
+}
+async function exchange(apiBaseUrl, code, verifier) {
+  const response = await fetch(`${apiBaseUrl}/auth/cli/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ code, verifier })
+  });
+  if (!response.ok) throw new Error(await problemDetail(response));
+  const body = await response.json();
+  return { token: body.token, name: body.name, email: body.email };
+}
 class DeployError extends Error {
   /**
    * @param code Stable code, either an API error type (`quota_exceeded`, `unsafe_path`, …) or one of
@@ -446,10 +628,10 @@ async function uploadAll(targets, uploadUrl, files, onProgress, signal, deps = {
 }
 async function uploadOne(target, file, context) {
   let lastError;
-  for (let attempt = 0; attempt <= context.retries; attempt++) {
+  for (let attempt2 = 0; attempt2 <= context.retries; attempt2++) {
     context.signal?.throwIfAborted();
-    if (attempt > 0) {
-      await context.delay(BACKOFF_MS[attempt - 1] ?? BACKOFF_MS.at(-1) ?? 1e3);
+    if (attempt2 > 0) {
+      await context.delay(BACKOFF_MS[attempt2 - 1] ?? BACKOFF_MS.at(-1) ?? 1e3);
       context.signal?.throwIfAborted();
     }
     try {
@@ -669,15 +851,194 @@ async function publishFiles(credentials, files, site) {
   }
   return publish(credentials, async () => collected, site);
 }
-const SERVER_VERSION = "0.3.0";
+const DEFAULT_WAIT_SECONDS = 120;
+const MAX_WAIT_SECONDS = 240;
+const ATTEMPT_LIFETIME_MS = 15 * 60 * 1e3;
+const MAX_POLL_MS = 30 * 1e3;
+let pendingBrowser = null;
+let pendingDevice = null;
+function dropPendingBrowser() {
+  pendingBrowser?.listener.close();
+  pendingBrowser = null;
+}
+function waitSecondsFor(requested) {
+  if (requested === void 0) return DEFAULT_WAIT_SECONDS;
+  return Math.min(MAX_WAIT_SECONDS, Math.max(1, Math.floor(requested)));
+}
+function alreadySignedIn() {
+  const credentials = loadCredentials();
+  if (credentials === null) return null;
+  return [
+    "Already signed in — a token is stored, so publishing should work.",
+    "",
+    `API: ${credentials.apiBaseUrl}`,
+    "",
+    "If publishing is refused as unauthorized, or this is the wrong account, call this tool again",
+    "with replace set to true to sign in over it."
+  ].join("\n");
+}
+function environmentOverrideNote() {
+  if (!process.env[TOKEN_VARIABLE]?.trim()) return "";
+  return [
+    "",
+    `Note: ${TOKEN_VARIABLE} is set in this server's environment and outranks the stored file, so`,
+    "that token is still the one in force. Unset it and restart this server to use the new one."
+  ].join("\n");
+}
+function signedIn(email, name, path) {
+  return [
+    `Signed in${email === null ? "" : ` as ${email}`}.`,
+    "",
+    `Token "${name}" saved to ${path}. Publishing works from the next call — nothing needs`,
+    "restarting.",
+    environmentOverrideNote()
+  ].join("\n");
+}
+async function signInWithBrowser(waitSeconds, replace = false, open = openBrowser) {
+  if (!replace) {
+    const already = alreadySignedIn();
+    if (already !== null) return already;
+  }
+  if (pendingBrowser !== null && pendingBrowser.expiresAt <= Date.now()) dropPendingBrowser();
+  let current;
+  let resumed;
+  if (pendingBrowser === null) {
+    resumed = false;
+    const apiBaseUrl = resolveApiBaseUrl();
+    const attempt2 = newAttempt();
+    let listener;
+    try {
+      listener = await listen(attempt2.state);
+    } catch (error) {
+      throw new Error(
+        `Could not open a local port to receive the sign-in: ${error instanceof Error ? error.message : String(error)}. Call login_code instead, which needs no port.`
+      );
+    }
+    current = {
+      attempt: attempt2,
+      listener,
+      url: consentUrl(dashboardUrlFor(apiBaseUrl), attempt2, listener.port, clientName("mcp")),
+      apiBaseUrl,
+      expiresAt: Date.now() + ATTEMPT_LIFETIME_MS
+    };
+    pendingBrowser = current;
+    current.listener.received.catch(() => {
+    });
+    if (!open(current.url)) {
+      return [
+        "Could not open a browser here. Ask the person to open this URL and approve the sign-in:",
+        "",
+        current.url,
+        "",
+        "Then call this tool again to collect the token. The URL stays valid until then."
+      ].join("\n");
+    }
+  } else {
+    resumed = true;
+    current = pendingBrowser;
+  }
+  try {
+    const waited = await waitOrTimeOut(
+      current.listener.received,
+      waitSecondsFor(waitSeconds) * 1e3
+    );
+    if (waited === null) {
+      return [
+        resumed ? "Still not approved." : "A browser has been opened for the sign-in. Not approved yet.",
+        "",
+        current.url,
+        "",
+        "Call this tool again to keep waiting. Nothing has been changed yet."
+      ].join("\n");
+    }
+    const issued = await exchange(current.apiBaseUrl, waited.code, current.attempt.verifier);
+    const path = saveToken(issued.token);
+    dropPendingBrowser();
+    return signedIn(issued.email, issued.name, path);
+  } catch (error) {
+    dropPendingBrowser();
+    throw error instanceof Error ? error : new Error(String(error));
+  }
+}
+async function waitOrTimeOut(received, timeoutMs) {
+  let timer;
+  try {
+    return await Promise.race([
+      received,
+      new Promise((resolve) => {
+        timer = setTimeout(() => resolve(null), timeoutMs);
+      })
+    ]);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+  }
+}
+async function signInWithCode(waitSeconds, replace = false) {
+  if (!replace) {
+    const already = alreadySignedIn();
+    if (already !== null) return already;
+  }
+  if (pendingDevice !== null && pendingDevice.expiresAt <= Date.now()) pendingDevice = null;
+  if (pendingDevice === null) {
+    const apiBaseUrl = resolveApiBaseUrl();
+    const request2 = await startDevice(apiBaseUrl, clientName("mcp"));
+    pendingDevice = {
+      deviceCode: request2.deviceCode,
+      userCode: request2.userCode,
+      verificationUri: request2.verificationUri,
+      verificationUriComplete: request2.verificationUriComplete,
+      apiBaseUrl,
+      expiresAt: Date.now() + ATTEMPT_LIFETIME_MS,
+      waitMs: Math.max(1, request2.intervalSeconds) * 1e3
+    };
+    return [
+      `Ask the person to open ${request2.verificationUri} and enter this code:`,
+      "",
+      `    ${request2.userCode}`,
+      "",
+      `Or send them this link, which has the code in it: ${request2.verificationUriComplete}`,
+      "",
+      "Then call this tool again to wait for the approval and collect the token."
+    ].join("\n");
+  }
+  const pending = pendingDevice;
+  const deadline = Date.now() + waitSecondsFor(waitSeconds) * 1e3;
+  while (Date.now() < deadline) {
+    await new Promise((done) => {
+      setTimeout(done, pending.waitMs);
+    });
+    const poll = await pollDevice(pending.apiBaseUrl, pending.deviceCode);
+    if (poll.state === "granted") {
+      const path = saveToken(poll.token.token);
+      pendingDevice = null;
+      return signedIn(poll.token.email, poll.token.name, path);
+    }
+    if (poll.state === "dead") {
+      pendingDevice = null;
+      throw new Error(poll.message);
+    }
+    if (poll.state === "slow_down") pending.waitMs = Math.min(pending.waitMs * 2, MAX_POLL_MS);
+  }
+  return [
+    "Not approved yet.",
+    "",
+    `Code ${pending.userCode}, at ${pending.verificationUri}.`,
+    "",
+    "Call this tool again to keep waiting. Nothing has been changed yet."
+  ].join("\n");
+}
+const SERVER_VERSION = "0.4.0";
 function say(text, isError = false) {
   return { content: [{ type: "text", text }], ...isError ? { isError: true } : {} };
 }
 async function withCredentials(work) {
   const credentials = loadCredentials();
-  if (credentials === null) return say(missingCredentialsMessage(), true);
+  if (credentials === null) return say(missingCredentialsMessage("mcp"), true);
+  return attempt(() => work(credentials));
+}
+async function attempt(work) {
   try {
-    return say(await work(credentials));
+    return say(await work());
   } catch (error) {
     return say(error instanceof Error ? error.message : String(error), true);
   }
@@ -708,11 +1069,41 @@ function createServer() {
         "which publishes as a documents site and is read through a viewer. So one page goes at",
         "index.html, and a single note is a whole publish that needs no wrapping in HTML.",
         "",
+        "Publishing needs an access token. If there is none, call login — it opens a browser and",
+        "stores one, and no command line or manual token is involved. Where no browser can be",
+        "opened, login_code gives a short code to approve from another machine.",
+        "",
         "Publishing over an existing site replaces what it serves, so ask before doing that to a",
         "site the person did not name."
       ].join("\n")
     }
   );
+  server.registerTool(
+    "login",
+    {
+      title: "Sign in to Drop2Run",
+      description: "Signs in through a browser on this machine and stores an access token, which every other tool then uses. Opens the browser here and waits for the person to approve. If it answers that nothing has been approved yet, call it again to keep waiting — that is not a failure. Needs no command line and no token pasted by hand.",
+      inputSchema: {
+        waitSeconds: z.number().int().min(5).max(MAX_WAIT_SECONDS).optional().describe("How long this call waits for the approval before answering. Default 120."),
+        replace: z.boolean().optional().describe(
+          "Sign in even though a token is already stored. Use when switching accounts, or when the stored token is being refused."
+        )
+      }
+    },
+    ({ waitSeconds, replace }) => attempt(() => signInWithBrowser(waitSeconds, replace))
+  );
+  server.registerTool(
+    "login_code",
+    {
+      title: "Sign in with a code",
+      description: "Signs in where no browser can be opened on this machine — a container, a remote host. The first call returns a short code and a URL to enter it at, which the person opens anywhere; call it again to wait for the approval and store the token.",
+      inputSchema: {
+        waitSeconds: z.number().int().min(5).max(MAX_WAIT_SECONDS).optional().describe("How long a waiting call polls before answering. Default 120."),
+        replace: z.boolean().optional().describe("Sign in even though a token is already stored.")
+      }
+    },
+    ({ waitSeconds, replace }) => attempt(() => signInWithCode(waitSeconds, replace))
+  );
   server.registerTool(
     "publish_files",
     {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@drop2run/mcp",
-	"version": "0.3.0",
+	"version": "0.4.0",
 	"description": "MCP server that publishes a folder or an HTML page to Drop2Run and returns a live URL.",
 	"license": "MIT",
 	"type": "module",