@finchagentic/mcp 4.6.1 → 4.6.2

package/dist/clink-input.js

@@ -1,15 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.dedupClinkInput = dedupClinkInput;
-// Deduplicates doubled input from a known Clink v1.7.6 terminal bug (garbled/
-// doubled keystrokes, e.g. "finch_sk_xxfinch_sk_xx" -> "finch_sk_xx"). Used by
-// every raw-input prompt in cli.ts (login, setup wizard provider/URL prompts)
-// before validating what the user typed.
-function dedupClinkInput(s) {
-    if (s.length > 0 && s.length % 2 === 0) {
-        const half = s.length / 2;
-        if (s.slice(0, half) === s.slice(half))
-            return s.slice(0, half);
-    }
-    return s;
-}

package/dist/config.js

@@ -1,132 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.env = env;
-exports.readConfig = readConfig;
-exports.writeConfig = writeConfig;
-exports.getSavedToken = getSavedToken;
-exports.isApiKey = isApiKey;
-exports.hydrateEnvFromConfig = hydrateEnvFromConfig;
-const fs = __importStar(require("fs"));
-const os = __importStar(require("os"));
-const path = __importStar(require("path"));
-const CONFIG_DIR = path.join(os.homedir(), ".finch");
-const LEGACY_DIR = path.join(os.homedir(), ".finch");
-const CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
-const LEGACY_FILE = path.join(LEGACY_DIR, "config.json");
-/** Prefer FINCH_* env, fall back to legacy FINCH_* during rebrand. */
-function env(name, legacy) {
-    const primary = process.env[name];
-    if (primary !== undefined && primary !== "")
-        return primary;
-    if (legacy) {
-        const v = process.env[legacy];
-        if (v !== undefined && v !== "")
-            return v;
-    }
-    // Auto-map FINCH_X → FINCH_X when legacy not passed
-    if (name.startsWith("FINCH_")) {
-        const auto = "FINCH_" + name.slice("FINCH_".length);
-        const v = process.env[auto];
-        if (v !== undefined && v !== "")
-            return v;
-    }
-    return undefined;
-}
-function readConfig() {
-    try {
-        if (fs.existsSync(CONFIG_FILE)) {
-            return JSON.parse(fs.readFileSync(CONFIG_FILE, "utf8"));
-        }
-        // migrate-read: still pick up old ~/.finch/config.json
-        if (fs.existsSync(LEGACY_FILE)) {
-            return JSON.parse(fs.readFileSync(LEGACY_FILE, "utf8"));
-        }
-    }
-    catch {
-        // Missing/corrupt config file - treat as no saved config.
-    }
-    return {};
-}
-function writeConfig(patch) {
-    const current = readConfig();
-    const updated = { ...current, ...patch };
-    if (!fs.existsSync(CONFIG_DIR))
-        fs.mkdirSync(CONFIG_DIR, { recursive: true });
-    fs.writeFileSync(CONFIG_FILE, JSON.stringify(updated, null, 2), { mode: 0o600 });
-}
-function getSavedToken() {
-    // env var always wins over saved config
-    return env("FINCH_SESSION_TOKEN", "FINCH_SESSION_TOKEN") ?? readConfig().sessionToken;
-}
-/** Accept finch_sk_* (new) and noel_sk_* (backend still issues these). */
-function isApiKey(value) {
-    if (!value)
-        return false;
-    return value.startsWith("finch_sk_") || value.startsWith("noel_sk_");
-}
-// Injects provider keys saved via `finch setup` into process.env, so both
-// the interactive CLI and the MCP server process (spawned fresh by Claude
-// Desktop/Cursor/etc, which never sees ~/.finch/config.json otherwise)
-// pick them up the same way. An env var already set by the parent process
-// always wins - this only fills gaps, never overrides.
-function hydrateEnvFromConfig() {
-    const cfg = readConfig();
-    if (!process.env.BANKR_API_KEY && cfg.bankrApiKey)
-        process.env.BANKR_API_KEY = cfg.bankrApiKey;
-    if (!process.env.ANTHROPIC_API_KEY && cfg.anthropicApiKey)
-        process.env.ANTHROPIC_API_KEY = cfg.anthropicApiKey;
-    if (!process.env.OPENAI_API_KEY && cfg.openaiApiKey)
-        process.env.OPENAI_API_KEY = cfg.openaiApiKey;
-    if (!process.env.OPENAI_BASE_URL && cfg.openaiBaseUrl)
-        process.env.OPENAI_BASE_URL = cfg.openaiBaseUrl;
-    // Bridge legacy env into FINCH_* so the rest of the codebase can read one name.
-    const bridges = [
-        ["FINCH_SESSION_TOKEN", "FINCH_SESSION_TOKEN"],
-        ["FINCH_API_KEY", "FINCH_API_KEY"],
-        ["FINCH_CONVEX_URL", "FINCH_CONVEX_URL"],
-        ["FINCH_TOOLS", "FINCH_TOOLS"],
-        ["FINCH_PROVIDER", "FINCH_PROVIDER"],
-        ["FINCH_MODEL", "FINCH_MODEL"],
-        ["FINCH_RPC_URL", "FINCH_RPC_URL"],
-        ["FINCH_BROADCAST_RPC", "FINCH_BROADCAST_RPC"],
-        ["FINCH_WALLET_PASSPHRASE", "FINCH_WALLET_PASSPHRASE"],
-        ["FINCH_PAYMENT_HEADER", "FINCH_PAYMENT_HEADER"],
-    ];
-    for (const [fin, leg] of bridges) {
-        if (!process.env[fin] && process.env[leg])
-            process.env[fin] = process.env[leg];
-    }
-}

package/dist/convex.js

@@ -1,175 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PaymentRequiredError = exports.CONVEX_SITE = void 0;
-exports.buildPaymentHeader = buildPaymentHeader;
-exports.callConvex = callConvex;
-exports.callConvexRaw = callConvexRaw;
-const wallet_js_1 = require("./wallet.js");
-const config_js_1 = require("./config.js");
-exports.CONVEX_SITE = process.env.FINCH_CONVEX_URL ?? "https://befitting-porcupine-276.convex.site";
-const RETRY_STATUSES = new Set([429, 500, 502, 503, 504]);
-const RETRY_DELAYS = [500, 1000, 2000];
-class PaymentRequiredError extends Error {
-    constructor(details) {
-        super("Payment required");
-        this.name = "PaymentRequiredError";
-        this.details = details;
-    }
-}
-exports.PaymentRequiredError = PaymentRequiredError;
-function buildPaymentHeader(txHash, requestId) {
-    return Buffer.from(`${txHash}:${requestId}`).toString("base64");
-}
-async function attemptConvex(url, method, headers, body, timeoutMs = 30000) {
-    return fetch(url, {
-        method,
-        headers,
-        body: body ? JSON.stringify(body) : undefined,
-        signal: AbortSignal.timeout(timeoutMs),
-    });
-}
-async function callConvex(path, method, body, toolName = "unknown", timeoutMs = 30000, 
-// Fund-moving mutations (stake, unstake, claim rewards, a real - non-
-// dryRun - automation trigger) are NOT idempotent server-side: there is
-// no request-id dedup on the backend, so silently retrying a POST whose
-// response was merely lost (a network blip or client-side timeout AFTER
-// the server already processed it) can double-execute a real transfer.
-// Pass true here for any such call - it trades the convenience of an
-// automatic retry for never risking a duplicate execution; the caller
-// sees a clear "may have already gone through" error instead and can
-// check status before deciding to retry by hand.
-noRetry = false) {
-    const url = `${exports.CONVEX_SITE}${path}`;
-    const headers = { "Content-Type": "application/json" };
-    const apiKey = process.env.FINCH_API_KEY;
-    const sessionToken = (0, config_js_1.getSavedToken)(); // env var → saved config fallback
-    // Prefer session token (resolved by backend) over API key for Convex API calls
-    const authHeader = sessionToken
-        ? `Bearer ${sessionToken}`
-        : apiKey
-            ? `Bearer ${apiKey}`
-            : null;
-    if (authHeader) {
-        headers["Authorization"] = authHeader;
-    }
-    else {
-        try {
-            const { address, signature, timestamp } = await (0, wallet_js_1.signRequest)(toolName);
-            headers["X-Wallet-Address"] = address;
-            headers["X-Wallet-Signature"] = signature;
-            headers["X-Wallet-Timestamp"] = timestamp;
-        }
-        catch {
-            // continue without wallet headers - server will respond with 401/402
-        }
-    }
-    const paymentHeader = process.env.FINCH_PAYMENT_HEADER;
-    if (paymentHeader)
-        headers["X-Payment"] = paymentHeader;
-    // BYOK headers - user pays for their own AI/service costs
-    if (process.env.ANTHROPIC_API_KEY)
-        headers["X-User-Anthropic-Key"] = process.env.ANTHROPIC_API_KEY;
-    if (process.env.OPENAI_API_KEY)
-        headers["X-User-OpenAI-Key"] = process.env.OPENAI_API_KEY;
-    if (process.env.GROK_API_KEY)
-        headers["X-User-Grok-Key"] = process.env.GROK_API_KEY;
-    if (process.env.BANKR_API_KEY)
-        headers["X-User-Bankr-Key"] = process.env.BANKR_API_KEY;
-    let lastError = null;
-    const attempts = noRetry ? 1 : RETRY_DELAYS.length;
-    for (let attempt = 0; attempt < attempts; attempt++) {
-        if (attempt > 0) {
-            await new Promise((r) => setTimeout(r, RETRY_DELAYS[attempt - 1]));
-        }
-        let res;
-        try {
-            res = await attemptConvex(url, method, headers, body, timeoutMs);
-        }
-        catch (err) {
-            // Ambiguous: the request may never have reached the server, or it may
-            // have been received and even processed before the connection died -
-            // there's no way to tell from here. Safe to retry for read-only/
-            // idempotent calls; for a fund-moving one, retrying risks resending a
-            // mutation that already landed.
-            lastError = noRetry
-                ? new Error(`${err?.message ?? err} - request may or may not have completed (no response received). Check status before retrying manually.`)
-                : err;
-            continue;
-        }
-        if (res.status === 402) {
-            const b = await res.json().catch(() => ({}));
-            throw new PaymentRequiredError(b);
-        }
-        if (res.status === 401) {
-            const b = await res.json().catch(() => ({}));
-            throw new Error(`🔑 ${b.message || "Authentication required"}\n\n` +
-                `→ Sign in at: ${b.url || "https://finchagentic.com"}\n\n` +
-                `Hint: ${b.hint || 'Add FINCH_SESSION_TOKEN=… to the env block in your MCP config'}\n\n` +
-                `${b.alternative ? `Alternative: ${b.alternative}` : ""}`);
-        }
-        if (RETRY_STATUSES.has(res.status) && attempt < attempts - 1) {
-            // Capture the actual body so a deterministic error (e.g. "unknown
-            // token") that happens to come back on a 500 still surfaces its real
-            // message if retries exhaust - previously this discarded the body
-            // entirely and threw a bare "Finch API error: 500", hiding exactly the
-            // information the caller needed to fix the request.
-            const bodyText = await res.text().catch(() => "");
-            lastError = new Error(`Finch API error ${res.status}: ${bodyText.slice(0, 300) || "(no body)"}`);
-            continue;
-        }
-        // noRetry + a retryable status on the one and only attempt: the server
-        // definitely received this one (unlike the network-exception case
-        // above), so it may have partially or fully processed it before
-        // erroring - same "check before retrying" caution, worded for the case
-        // where we know a response did come back.
-        if (RETRY_STATUSES.has(res.status) && noRetry) {
-            const bodyText = await res.text().catch(() => "");
-            throw new Error(`Finch API error ${res.status}: ${bodyText.slice(0, 300) || "(no body)"} - the server received this request and may have processed it before erroring. Check status before retrying manually.`);
-        }
-        if (!res.ok)
-            throw new Error(`Finch API error: ${res.status} ${await res.text()}`);
-        return res.json();
-    }
-    throw lastError ?? new Error("Request failed after retries");
-}
-// Variant that returns the response body as raw text. Used for endpoints
-// that stream non-JSON content like /vault/blob (large vault entries that
-// were offloaded to Convex File Storage).
-async function callConvexRaw(path, toolName = "unknown", timeoutMs = 60000) {
-    const url = `${exports.CONVEX_SITE}${path}`;
-    const headers = {};
-    const apiKey = process.env.FINCH_API_KEY;
-    const sessionToken = (0, config_js_1.getSavedToken)();
-    // Same precedence as callConvex() above - prefer session token over API
-    // key. These two functions previously disagreed (this one checked apiKey
-    // first), so the same env/config could pick a different credential
-    // depending on which helper a tool happened to call.
-    const authHeader = sessionToken
-        ? `Bearer ${sessionToken}`
-        : apiKey
-            ? `Bearer ${apiKey}`
-            : null;
-    if (authHeader) {
-        headers["Authorization"] = authHeader;
-    }
-    else {
-        try {
-            const { address, signature, timestamp } = await (0, wallet_js_1.signRequest)(toolName);
-            headers["X-Wallet-Address"] = address;
-            headers["X-Wallet-Signature"] = signature;
-            headers["X-Wallet-Timestamp"] = timestamp;
-        }
-        catch {
-            // No local wallet available to sign with - continue without wallet
-            // headers, server will respond with 401/402 if auth was required.
-        }
-    }
-    const res = await fetch(url, {
-        method: "GET",
-        headers,
-        signal: AbortSignal.timeout(timeoutMs),
-    });
-    if (!res.ok)
-        throw new Error(`Finch API error: ${res.status}`);
-    return res.text();
-}

package/dist/dex-pair.js

@@ -1,54 +0,0 @@
-"use strict";
-/**
- * Pick the DexScreener pair whose numbers actually describe the token asked for.
- *
- * `priceUsd`, `marketCap`, `fdv`, `priceChange` and `txns` on a pair all describe
- * the BASE token. Taking the deepest pair regardless of side therefore reports a
- * different token entirely, and does it convincingly — the caller's own contract
- * address is still printed alongside. Two real cases:
- *
- *   - Canonical USDC on Base. Its deepest pair is `AERO/USDC`, so asking for
- *     USDC returned Aerodrome at $0.4332 with an $840M FDV.
- *   - NVDA on Robinhood Chain. Its deepest pair is `AI/NVDA`, so it reported AI
- *     at $0.0063 as though that were NVDA at $205 — and that price fed the
- *     take-profit and stop-loss triggers.
- *
- * Base-side pairs are preferred by depth. When a token only ever appears as the
- * quote, its price is still derivable as `basePriceUsd / basePriceInOurToken`,
- * so the pair is rebuilt with the sides swapped and the fields that describe the
- * other token's flow dropped rather than passed off as ours.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.pickTokenPair = pickTokenPair;
-const depth = (p) => p.liquidity?.usd ?? 0;
-function pickTokenPair(pairs, tokenAddress) {
-    const want = tokenAddress.toLowerCase();
-    const all = pairs ?? [];
-    const baseSide = all
-        .filter((p) => p.baseToken?.address?.toLowerCase() === want)
-        .sort((a, b) => depth(b) - depth(a));
-    if (baseSide.length)
-        return baseSide[0];
-    const q = all
-        .filter((p) => p.quoteToken?.address?.toLowerCase() === want)
-        .sort((a, b) => depth(b) - depth(a))[0];
-    if (!q)
-        return null;
-    const baseUsd = Number(q.priceUsd);
-    const baseInOurs = Number(q.priceNative);
-    if (!isFinite(baseUsd) || !isFinite(baseInOurs) || baseInOurs <= 0)
-        return null;
-    return {
-        ...q,
-        baseToken: q.quoteToken,
-        quoteToken: q.baseToken,
-        priceUsd: String(baseUsd / baseInOurs),
-        priceNative: undefined,
-        // Supply-based and direction-based figures belong to the other token.
-        marketCap: undefined,
-        fdv: undefined,
-        txns: undefined,
-        priceChange: undefined,
-        derivedFromQuoteSide: true,
-    };
-}