@kaneo/mcp 0.1.4 → 0.1.5

package/README.md

@@ -2,7 +2,7 @@
 
 `@kaneo/mcp` is a local MCP server for Kaneo.
 
-It runs over stdio, signs in with Kaneo's device flow, and then calls the Kaneo API with a bearer token. The package lives in `apps/mcp` in this monorepo and exposes the `kaneo-mcp` CLI.
+It runs over stdio, signs in with Kaneo's device flow, and then calls the Kaneo API with a bearer token. The package lives in `packages/mcp` in this monorepo and exposes the `kaneo-mcp` CLI.
 
 ## Prerequisites
 
@@ -69,7 +69,7 @@ See all options:
 kaneo-mcp install --help
 ```
 
-If you are currently inside the local `apps/mcp` package directory, npm may resolve the local workspace package instead of the published one and fail to expose the bin. In that case, either run `npx` from outside `apps/mcp`, or use a local build:
+If you are currently inside the local `packages/mcp` package directory, npm may resolve the local workspace package instead of the published one and fail to expose the bin. In that case, either run `npx` from outside `packages/mcp`, or use a local build:
 
 ```bash
 node dist/index.js
@@ -91,7 +91,7 @@ pnpm --filter @kaneo/mcp run test
 Or run it from the package directory:
 
 ```bash
-pnpm -C apps/mcp run build
+pnpm -C packages/mcp run build
 ```
 
 The CLI entry points to `./dist/index.js`. Use `npx @kaneo/mcp` or `kaneo-mcp` after a global install so your IDE config points at the resolved path.

package/dist/auth/auth-service.js

@@ -4,6 +4,7 @@ import { clearCredentials, loadCredentials, saveCredentials, } from "./token-sto
 export class AuthService {
     baseUrl;
     clientId;
+    activeGetAccessTokenPromise;
     constructor(options) {
         this.baseUrl = options.baseUrl;
         this.clientId = options.clientId;
@@ -13,8 +14,10 @@ export class AuthService {
     }
     async validateAccessToken(token) {
         try {
+            const signal = AbortSignal.timeout(10_000);
             const res = await fetch(`${this.baseUrl}/api/auth/get-session`, {
                 headers: { Authorization: `Bearer ${token}` },
+                signal,
             });
             if (res.status === 401) {
                 return "invalid";
@@ -36,38 +39,49 @@ export class AuthService {
      * Returns a valid access token, running the device authorization flow if needed.
      */
     async getAccessToken() {
-        const cached = await loadCredentials();
-        if (cached &&
-            cached.baseUrl === this.baseUrl &&
-            cached.clientId === this.clientId &&
-            cached.accessToken) {
-            const validation = await this.validateAccessToken(cached.accessToken);
-            // Fail-open for "unknown": validateAccessToken returns "unknown" on transient HTTP/network
-            // errors or ambiguous responses. Treating "unknown" like "valid" avoids clearToken() and a full
-            // device re-auth so flaky connectivity does not wipe cached.accessToken; only "invalid" forces
-            // a fresh login. Tests should cover both unknown and invalid paths.
-            if (validation === "valid" || validation === "unknown") {
-                return cached.accessToken;
-            }
-            await this.clearToken();
+        if (this.activeGetAccessTokenPromise) {
+            return await this.activeGetAccessTokenPromise;
         }
-        const code = await requestDeviceCode(this.baseUrl, this.clientId);
-        const verifyUrl = code.verification_uri_complete || code.verification_uri;
-        this.log(`Open ${verifyUrl} and approve this device. User code: ${code.user_code}`);
+        this.activeGetAccessTokenPromise = (async () => {
+            const cached = await loadCredentials();
+            if (cached &&
+                cached.baseUrl === this.baseUrl &&
+                cached.clientId === this.clientId &&
+                cached.accessToken) {
+                const validation = await this.validateAccessToken(cached.accessToken);
+                // Fail-open for "unknown": validateAccessToken returns "unknown" on transient HTTP/network
+                // errors or ambiguous responses. Treating "unknown" like "valid" avoids clearToken() and a full
+                // device re-auth so flaky connectivity does not wipe cached.accessToken; only "invalid" forces
+                // a fresh login. Tests should cover both unknown and invalid paths.
+                if (validation === "valid" || validation === "unknown") {
+                    return cached.accessToken;
+                }
+                await this.clearToken();
+            }
+            const code = await requestDeviceCode(this.baseUrl, this.clientId);
+            const verifyUrl = code.verification_uri_complete || code.verification_uri;
+            this.log(`Open ${verifyUrl} and approve this device. User code: ${code.user_code}`);
+            try {
+                await open(verifyUrl);
+            }
+            catch {
+                this.log("Could not open a browser automatically; use the URL above.");
+            }
+            const accessToken = await pollDeviceAccessToken(this.baseUrl, this.clientId, code.device_code, code.interval, { log: (m) => this.log(m) });
+            const toStore = {
+                version: 1,
+                baseUrl: this.baseUrl,
+                clientId: this.clientId,
+                accessToken,
+            };
+            await saveCredentials(toStore);
+            return accessToken;
+        })();
         try {
-            await open(verifyUrl);
+            return await this.activeGetAccessTokenPromise;
         }
-        catch {
-            this.log("Could not open a browser automatically; use the URL above.");
+        finally {
+            this.activeGetAccessTokenPromise = undefined;
         }
-        const accessToken = await pollDeviceAccessToken(this.baseUrl, this.clientId, code.device_code, code.interval, { log: (m) => this.log(m) });
-        const toStore = {
-            version: 1,
-            baseUrl: this.baseUrl,
-            clientId: this.clientId,
-            accessToken,
-        };
-        await saveCredentials(toStore);
-        return accessToken;
     }
 }

package/dist/auth/device-flow.js

@@ -1,17 +1,49 @@
+const REQUEST_TIMEOUT_MS = 10_000;
 function sleep(ms) {
     return new Promise((r) => setTimeout(r, ms));
 }
+function isAbortError(err) {
+    return err instanceof DOMException
+        ? err.name === "AbortError"
+        : err instanceof Error && err.name === "AbortError";
+}
+function isObjectRecord(value) {
+    return value !== null && typeof value === "object";
+}
+async function fetchWithTimeout(input, init, timeoutMs = REQUEST_TIMEOUT_MS) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        return await fetch(input, { ...init, signal: controller.signal });
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
 export async function requestDeviceCode(baseUrl, clientId) {
-    const res = await fetch(`${baseUrl}/api/auth/device/code`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ client_id: clientId }),
-    });
-    const body = (await res.json().catch(() => ({})));
+    let res;
+    try {
+        res = await fetchWithTimeout(`${baseUrl}/api/auth/device/code`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ client_id: clientId }),
+        });
+    }
+    catch (err) {
+        if (isAbortError(err)) {
+            throw new Error("device/code request timed out after 10s.");
+        }
+        throw err;
+    }
+    const parsedBody = await res.json().catch(() => ({}));
+    if (!isObjectRecord(parsedBody)) {
+        throw new Error(`device/code: unexpected response ${JSON.stringify(parsedBody)}`);
+    }
+    const body = parsedBody;
     if (!res.ok) {
         throw new Error(`device/code failed (${res.status}): ${JSON.stringify(body)}`);
     }
-    if (!("device_code" in body) || typeof body.device_code !== "string") {
+    if (typeof body.device_code !== "string") {
         throw new Error(`device/code: unexpected response ${JSON.stringify(body)}`);
     }
     if (typeof body.user_code !== "string" ||
@@ -53,24 +85,41 @@ export async function pollDeviceAccessToken(baseUrl, clientId, deviceCode, initi
     for (let attempt = 0; Date.now() - started < maxWait; attempt++) {
         if (attempt > 0) {
             await sleep(intervalMs);
+            if (Date.now() - started >= maxWait) {
+                break;
+            }
         }
-        const res = await fetch(`${baseUrl}/api/auth/device/token`, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({
-                grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-                device_code: deviceCode,
-                client_id: clientId,
-            }),
-        });
-        if (Date.now() - started > maxWait) {
+        let res;
+        try {
+            res = await fetchWithTimeout(`${baseUrl}/api/auth/device/token`, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({
+                    grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                    device_code: deviceCode,
+                    client_id: clientId,
+                }),
+            });
+        }
+        catch (err) {
+            if (isAbortError(err)) {
+                log("Device token poll request timed out; retrying.");
+                continue;
+            }
+            throw err;
+        }
+        if (Date.now() - started >= maxWait) {
             throw new Error("Device authorization timed out waiting for approval.");
         }
-        const body = (await res.json().catch(() => ({})));
+        const parsedBody = await res.json().catch(() => ({}));
+        if (!isObjectRecord(parsedBody)) {
+            throw new Error(`device/token failed (${res.status}): ${JSON.stringify(parsedBody)}`);
+        }
+        const body = parsedBody;
         if (res.ok && typeof body.access_token === "string") {
             return body.access_token;
         }
-        const err = body.error;
+        const err = typeof body.error === "string" ? body.error : undefined;
         if (err === "authorization_pending") {
             log("Waiting for device approval…");
             continue;

package/dist/install/index.js

@@ -1,4 +1,4 @@
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname } from "node:path";
 import { stdin as input, stdout as output } from "node:process";
 import { mergeMcpServerEntry } from "./merge-config.js";
@@ -254,6 +254,12 @@ export async function runInstall(argv) {
     for (const w of mergedWrites) {
         await mkdir(dirname(w.configPath), { recursive: true });
         await writeFile(w.configPath, w.merged, { encoding: "utf8", mode: 0o600 });
+        try {
+            await chmod(w.configPath, 0o600);
+        }
+        catch {
+            /* ignore chmod failures on some FS */
+        }
         writtenPaths.push(w.configPath);
     }
     if (writtenPaths.length === 0) {

package/dist/kaneo/client.js

@@ -13,7 +13,11 @@ export class KaneoClient {
             headers.set("Content-Type", "application/json");
         }
         const url = `${this.baseUrl}${path.startsWith("/") ? path : `/${path}`}`;
-        const res = await fetch(url, { ...init, headers });
+        const timeoutSignal = AbortSignal.timeout(10_000);
+        const signal = init?.signal
+            ? AbortSignal.any([init.signal, timeoutSignal])
+            : timeoutSignal;
+        const res = await fetch(url, { ...init, headers, signal });
         if (res.status === 401 && !didRetry) {
             await this.auth.clearToken();
             return this.authorizedFetch(path, init, true);

package/dist/tools/register.js

@@ -93,9 +93,9 @@ export function registerTools(server, ctx) {
             }
             const icon = patch.icon !== undefined
                 ? patch.icon
-                : existing.icon != null
-                    ? String(existing.icon)
-                    : "";
+                : typeof existing.icon === "string"
+                    ? existing.icon
+                    : "Layout";
             const slug = patch.slug ??
                 (typeof existing.slug === "string" ? existing.slug : "");
             if (!slug) {
@@ -108,16 +108,13 @@ export function registerTools(server, ctx) {
                     : "";
             const isPublic = patch.isPublic !== undefined
                 ? patch.isPublic
-                : Boolean(existing.isPublic);
+                : typeof existing.isPublic === "boolean"
+                    ? existing.isPublic
+                    : false;
+            const body = { name, icon, slug, description, isPublic };
             return client.json(`/api/project/${encodeURIComponent(id)}`, {
                 method: "PUT",
-                body: JSON.stringify({
-                    name,
-                    icon,
-                    slug,
-                    description,
-                    isPublic,
-                }),
+                body: JSON.stringify(body),
             });
         });
     });

package/package.json

@@ -1,12 +1,13 @@
 {
 	"name": "@kaneo/mcp",
-	"version": "0.1.4",
+	"version": "0.1.5",
 	"description": "Model Context Protocol (stdio) server for Kaneo — tasks, projects, labels, and device authorization",
 	"license": "MIT",
 	"homepage": "https://github.com/usekaneo/kaneo/",
 	"repository": {
 		"type": "git",
-		"url": "https://github.com/usekaneo/kaneo/"
+		"url": "https://github.com/usekaneo/kaneo/",
+		"directory": "packages/mcp"
 	},
 	"type": "module",
 	"bin": {