@floomhq/floom-mcp-sync 1.0.12 → 1.0.13

package/dist/auto-sync.js

@@ -1,7 +1,7 @@
 import { constants } from "node:fs";
 import { lstat, mkdir, open } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { apiUrlFromConfig, readConfig } from "./lib/config.js";
+import { apiUrlFromConfig, readConfig, refreshConfig } from "./lib/config.js";
 import { getJsonWithEtag, FloomApiError } from "./lib/api.js";
 import { sha256 } from "./lib/hash.js";
 import { assertValidSlug } from "./lib/slug.js";
@@ -254,21 +254,29 @@ export async function autoSync(log = (message) => process.stderr.write(`${messag
     return await withSyncLock(async () => {
         const manifest = await readSyncManifest();
         const root = skillsDir();
-        const apiUrl = apiUrlFromConfig(cfg);
+        let activeCfg = cfg;
+        const apiUrl = apiUrlFromConfig(activeCfg);
         let response;
         try {
-            response = await getJsonWithEtag(`${apiUrl}/api/v1/me/skills`, cfg.accessToken, cachedEtag, signal);
+            response = await getJsonWithEtag(`${apiUrl}/api/v1/me/skills`, activeCfg.accessToken, cachedEtag, signal);
         }
         catch (err) {
             if (err instanceof FloomApiError && err.status === 401) {
-                maybeAuthWarning(log, "[floom] sign-in expired; skipping sync (run `npx -y @floomhq/floom login` again)");
-                return { synced: 0, unchanged: 0, updated: 0, conflicts: 0 };
+                const refreshed = await refreshConfig(activeCfg);
+                if (!refreshed) {
+                    maybeAuthWarning(log, "[floom] sign-in expired; skipping sync (run `npx -y @floomhq/floom login` again)");
+                    return { synced: 0, unchanged: 0, updated: 0, conflicts: 0 };
+                }
+                activeCfg = refreshed;
+                response = await getJsonWithEtag(`${apiUrl}/api/v1/me/skills`, activeCfg.accessToken, cachedEtag, signal);
+            }
+            else {
+                throw err;
             }
-            throw err;
         }
         if (response.status === 304) {
             if (await manifestHasMissingTrackedFile(manifest, root)) {
-                response = await getJsonWithEtag(`${apiUrl}/api/v1/me/skills`, cfg.accessToken, null, signal);
+                response = await getJsonWithEtag(`${apiUrl}/api/v1/me/skills`, activeCfg.accessToken, null, signal);
             }
             else {
                 maybeHeartbeat(log);
@@ -428,7 +436,7 @@ export async function autoSync(log = (message) => process.stderr.write(`${messag
             if (updated > 0) {
                 // Activation telemetry counts syncs that write new content. Best-effort;
                 // never blocks or throws.
-                void emitSyncCompleted(apiUrl, cfg.accessToken, { total, updated, unchanged }, signal).catch(() => { });
+                void emitSyncCompleted(apiUrl, activeCfg.accessToken, { total, updated, unchanged }, signal).catch(() => { });
             }
         }
         else if (conflicts > 0) {

package/dist/lib/api.js

@@ -6,6 +6,53 @@ export class FloomApiError extends Error {
         this.name = "FloomApiError";
     }
 }
+export const DEFAULT_TIMEOUT_MS = 15_000;
+function withTimeout(signal) {
+    const controller = new AbortController();
+    const timeoutMs = requestTimeoutMs();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    const abort = () => controller.abort();
+    signal?.addEventListener("abort", abort, { once: true });
+    if (signal?.aborted)
+        controller.abort();
+    const aborted = new Promise((_, reject) => {
+        controller.signal.addEventListener("abort", () => {
+            reject(new FloomApiError(408, "Request timed out while contacting Floom."));
+        }, { once: true });
+    });
+    return {
+        signal: controller.signal,
+        aborted,
+        cleanup: () => {
+            clearTimeout(timer);
+            signal?.removeEventListener("abort", abort);
+        },
+    };
+}
+function requestTimeoutMs() {
+    const fromEnv = Number(process.env.FLOOM_REQUEST_TIMEOUT_MS);
+    if (Number.isFinite(fromEnv) && fromEnv > 0)
+        return fromEnv;
+    return DEFAULT_TIMEOUT_MS;
+}
+async function fetchWithTimeout(url, init, signal) {
+    const timeout = withTimeout(signal);
+    try {
+        return await Promise.race([
+            fetch(url, { ...init, signal: timeout.signal }),
+            timeout.aborted,
+        ]);
+    }
+    catch (err) {
+        if (err.name === "AbortError") {
+            throw new FloomApiError(408, "Request timed out while contacting Floom.");
+        }
+        throw err;
+    }
+    finally {
+        timeout.cleanup();
+    }
+}
 async function readError(res) {
     const text = await res.text();
     if (!text)
@@ -24,10 +71,7 @@ export async function getJson(url, token, signal) {
     const headers = {};
     if (token)
         headers.authorization = `Bearer ${token}`;
-    const init = { headers };
-    if (signal)
-        init.signal = signal;
-    const res = await fetch(url, init);
+    const res = await fetchWithTimeout(url, { headers }, signal);
     if (!res.ok)
         throw new FloomApiError(res.status, await readError(res));
     return (await res.json());
@@ -40,10 +84,7 @@ export async function getJsonWithEtag(url, token, etag, signal) {
     const headers = { authorization: `Bearer ${token}` };
     if (etag)
         headers["if-none-match"] = etag;
-    const init = { headers };
-    if (signal)
-        init.signal = signal;
-    const res = await fetch(url, init);
+    const res = await fetchWithTimeout(url, { headers }, signal);
     const responseEtag = res.headers.get("etag");
     if (res.status === 304) {
         return { status: 304, body: null, etag: responseEtag ?? etag };
@@ -54,10 +95,7 @@ export async function getJsonWithEtag(url, token, etag, signal) {
     return { status: res.status, body, etag: responseEtag };
 }
 export async function getText(url, signal) {
-    const init = {};
-    if (signal)
-        init.signal = signal;
-    const res = await fetch(url, init);
+    const res = await fetchWithTimeout(url, {}, signal);
     if (!res.ok)
         throw new FloomApiError(res.status, await readError(res));
     return res.text();
@@ -71,9 +109,7 @@ export async function postJson(url, token, body, signal) {
         },
         body: JSON.stringify(body),
     };
-    if (signal)
-        init.signal = signal;
-    const res = await fetch(url, init);
+    const res = await fetchWithTimeout(url, init, signal);
     if (!res.ok)
         throw new FloomApiError(res.status, await readError(res));
     return (await res.json());
@@ -87,9 +123,7 @@ export async function putJson(url, token, body, signal) {
         },
         body: JSON.stringify(body),
     };
-    if (signal)
-        init.signal = signal;
-    const res = await fetch(url, init);
+    const res = await fetchWithTimeout(url, init, signal);
     if (!res.ok)
         throw new FloomApiError(res.status, await readError(res));
     return (await res.json());
@@ -99,9 +133,7 @@ export async function deleteRequest(url, token, signal) {
         method: "DELETE",
         headers: { authorization: `Bearer ${token}` },
     };
-    if (signal)
-        init.signal = signal;
-    const res = await fetch(url, init);
+    const res = await fetchWithTimeout(url, init, signal);
     if (!res.ok)
         throw new FloomApiError(res.status, await readError(res));
     return (await res.json());

package/dist/lib/config.js

@@ -1,8 +1,10 @@
-import { readFile } from "node:fs/promises";
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
 import { configPath } from "./paths.js";
 export const DEFAULT_API_URL = "https://floom.dev";
+const REFRESH_SKEW_SECONDS = 5 * 60;
 export function apiUrlFromConfig(cfg) {
-    return (cfg.apiUrl ?? process.env.FLOOM_API_URL ?? DEFAULT_API_URL).replace(/\/$/, "");
+    return (process.env.FLOOM_API_URL ?? cfg.apiUrl ?? DEFAULT_API_URL).replace(/\/$/, "");
 }
 export async function readConfig() {
     try {
@@ -10,13 +12,16 @@ export async function readConfig() {
         const parsed = JSON.parse(raw);
         if (typeof parsed.accessToken !== "string" || parsed.accessToken.length === 0)
             return null;
-        return {
+        const cfg = {
             accessToken: parsed.accessToken,
             ...(typeof parsed.apiUrl === "string" ? { apiUrl: parsed.apiUrl } : {}),
             ...(typeof parsed.refreshToken === "string" ? { refreshToken: parsed.refreshToken } : {}),
             ...(typeof parsed.expiresAt === "number" ? { expiresAt: parsed.expiresAt } : {}),
             ...(typeof parsed.email === "string" || parsed.email === null ? { email: parsed.email } : {}),
         };
+        if (needsRefresh(cfg))
+            return refreshConfig(cfg);
+        return cfg;
     }
     catch (err) {
         if (err.code === "ENOENT")
@@ -24,3 +29,53 @@ export async function readConfig() {
         throw err;
     }
 }
+export function needsRefresh(cfg) {
+    if (!cfg.refreshToken)
+        return false;
+    return !Number.isFinite(cfg.expiresAt) || Number(cfg.expiresAt) <= Math.floor(Date.now() / 1000) + REFRESH_SKEW_SECONDS;
+}
+export async function refreshConfig(cfg) {
+    if (!cfg.refreshToken)
+        return cfg;
+    const apiUrl = apiUrlFromConfig(cfg);
+    let res;
+    try {
+        res = await fetch(`${apiUrl}/api/v1/auth/refresh`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ refresh_token: cfg.refreshToken }),
+        });
+    }
+    catch {
+        return null;
+    }
+    if (!res.ok)
+        return null;
+    let data;
+    try {
+        data = await res.json();
+    }
+    catch {
+        return null;
+    }
+    if (typeof data.access_token !== "string" || typeof data.refresh_token !== "string")
+        return null;
+    const expiresAt = typeof data.expires_at === "number" && Number.isFinite(data.expires_at)
+        ? data.expires_at
+        : Math.floor(Date.now() / 1000) + (typeof data.expires_in === "number" && Number.isFinite(data.expires_in) ? data.expires_in : 3600);
+    const refreshed = {
+        apiUrl,
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token,
+        expiresAt,
+        email: typeof data.email === "string" || data.email === null ? data.email : cfg.email ?? null,
+    };
+    await writeConfig(refreshed);
+    return refreshed;
+}
+async function writeConfig(cfg) {
+    const target = configPath();
+    await mkdir(dirname(target), { recursive: true, mode: 0o700 });
+    await writeFile(target, JSON.stringify(cfg, null, 2), { mode: 0o600 });
+    await chmod(target, 0o600);
+}

package/dist/server.js

@@ -5,7 +5,7 @@ import { autoSync } from "./auto-sync.js";
 import { getSkill } from "./tools/get.js";
 import { searchSkills } from "./tools/search.js";
 import { syncStatus } from "./tools/status.js";
-const SERVER_VERSION = "1.0.12";
+const SERVER_VERSION = "1.0.13";
 const DEFAULT_INTERVAL_MS = 60_000;
 const MIN_INTERVAL_MS = 10_000;
 const SEARCH_TYPES = new Set(["knowledge", "instruction", "workflow", "skill"]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floomhq/floom-mcp-sync",
-  "version": "1.0.12",
+  "version": "1.0.13",
   "description": "Lightweight Floom MCP server for search, on-demand skill fetch, status, and sync.",
   "license": "MIT",
   "type": "module",