npm - @kolbo/mcp - Versions diffs - 1.19.1 → 1.20.0 - Mend

@kolbo/mcp 1.19.1 → 1.20.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@kolbo/mcp",
-  "version": "1.19.1",
+  "version": "1.20.0",
   "description": "Kolbo AI MCP Server - Generate images, videos, music, speech, and sound effects from Claude Code",
   "main": "src/index.js",
   "bin": {

package/src/auth.js ADDED Viewed

@@ -0,0 +1,155 @@
+/**
+ * Keyless browser login for the LOCAL (stdio) Kolbo MCP server.
+ *
+ * When the server runs on the user's machine with no KOLBO_API_KEY and no
+ * stored credential, the first tool call triggers this: we open the browser to
+ * Kolbo's OAuth login (the same server that powers the remote connector), the
+ * user clicks Allow, and we capture a token via a loopback redirect — no API
+ * key to create or paste. The token is cached so every later run is silent.
+ *
+ * Standard "native app" OAuth: authorization-code + PKCE with a
+ * http://localhost:<port>/callback redirect (already allow-listed by the Kolbo
+ * OAuth server). This path is NOT used by the remote connector (it always
+ * injects the caller's key, and passes allowBrowserLogin:false).
+ */
+const http = require('http');
+const crypto = require('crypto');
+const { exec } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+function b64url(buf) {
+  return Buffer.from(buf).toString('base64url');
+}
+function openBrowser(url) {
+  const cmd =
+    process.platform === 'win32' ? `start "" "${url}"`
+    : process.platform === 'darwin' ? `open "${url}"`
+    : `xdg-open "${url}"`;
+  try { exec(cmd, () => {}); } catch (_) { /* best effort */ }
+}
+// Where we cache the token — same location + shape that client.js reads back
+// (`<xdg-data>/kolbo/auth.json` → { "kolbo@<host>": { type: 'api', key } }).
+function authStorePath() {
+  const dataDir =
+    process.env.XDG_DATA_HOME ||
+    (process.platform === 'win32'
+      ? (process.env.LOCALAPPDATA || path.join(os.homedir(), '.local', 'share'))
+      : process.platform === 'darwin'
+        ? path.join(os.homedir(), 'Library', 'Application Support')
+        : path.join(os.homedir(), '.local', 'share'));
+  return path.join(dataDir, 'kolbo', 'auth.json');
+}
+function storeKey(apiHost, key) {
+  try {
+    const file = authStorePath();
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    let store = {};
+    try { store = JSON.parse(fs.readFileSync(file, 'utf8')); } catch (_) {}
+    store[`kolbo@${apiHost}`] = { type: 'api', key, savedAt: new Date().toISOString() };
+    fs.writeFileSync(file, JSON.stringify(store, null, 2), { mode: 0o600 });
+  } catch (_) { /* non-fatal — the key still works for this process */ }
+}
+function donePage(ok) {
+  const title = ok ? 'Connected to Kolbo' : 'Connection cancelled';
+  const sub = ok ? 'You can close this tab and return to your app.' : 'You can close this tab.';
+  const mark = ok ? '✓' : '✕';
+  return `<!doctype html><meta charset="utf-8"><title>${title}</title>` +
+    `<body style="margin:0;font-family:Inter,system-ui,sans-serif;background:#05050f;color:#fff;` +
+    `display:flex;align-items:center;justify-content:center;height:100vh">` +
+    `<div style="text-align:center"><div style="font-size:42px;color:#8B5CF6;margin-bottom:8px">${mark}</div>` +
+    `<h2 style="margin:0 0 6px">${title}</h2><p style="opacity:.55;font-size:14px">${sub}</p></div></body>`;
+}
+/**
+ * Run the interactive browser login. Resolves with the kolbo_live_ key.
+ * @param {object} opts
+ * @param {string} opts.apiBase  e.g. https://api.kolbo.ai/api
+ */
+async function browserLogin({ apiBase }) {
+  // The OAuth endpoints live at the host root, not under /api.
+  const oauthBase = apiBase.replace(/\/api\/?$/, '');
+  let apiHost = 'api.kolbo.ai';
+  try { apiHost = new URL(apiBase).host; } catch (_) {}
+  const verifier = b64url(crypto.randomBytes(32));
+  const challenge = b64url(crypto.createHash('sha256').update(verifier).digest());
+  const state = b64url(crypto.randomBytes(16));
+  // Loopback callback server on a random free port.
+  const server = http.createServer();
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const port = server.address().port;
+  const redirectUri = `http://localhost:${port}/callback`;
+  try {
+    // 1. Dynamic client registration (public + PKCE).
+    const regRes = await fetch(`${oauthBase}/oauth/register`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ client_name: 'Kolbo MCP (local)', redirect_uris: [redirectUri] }),
+    });
+    if (!regRes.ok) throw new Error(`client registration failed (${regRes.status})`);
+    const { client_id } = await regRes.json();
+    // 2. Wait for the browser redirect to hit our loopback server.
+    const codePromise = new Promise((resolve, reject) => {
+      const timer = setTimeout(() => reject(new Error('login timed out (5 min)')), 5 * 60 * 1000);
+      server.on('request', (req, resp) => {
+        let u;
+        try { u = new URL(req.url, redirectUri); } catch (_) { resp.writeHead(400); resp.end(); return; }
+        if (u.pathname !== '/callback') { resp.writeHead(404); resp.end(); return; }
+        clearTimeout(timer);
+        const code = u.searchParams.get('code');
+        const st = u.searchParams.get('state');
+        const err = u.searchParams.get('error');
+        resp.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+        resp.end(donePage(!err && !!code));
+        if (err) return reject(new Error(`login denied: ${err}`));
+        if (!code || st !== state) return reject(new Error('login: invalid callback'));
+        resolve(code);
+      });
+    });
+    // 3. Open the consent/login page.
+    const authUrl =
+      `${oauthBase}/oauth/authorize?response_type=code&client_id=${encodeURIComponent(client_id)}` +
+      `&redirect_uri=${encodeURIComponent(redirectUri)}&code_challenge=${challenge}` +
+      `&code_challenge_method=S256&state=${state}&scope=kolbo`;
+    openBrowser(authUrl);
+    process.stderr.write(
+      `\n[kolbo] Connect your Kolbo account in the browser. If it didn't open, visit:\n${authUrl}\n\n`
+    );
+    const code = await codePromise;
+    // 4. Exchange the code (with the PKCE verifier) for the token.
+    const tokRes = await fetch(`${oauthBase}/oauth/token`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        grant_type: 'authorization_code',
+        code,
+        code_verifier: verifier,
+        redirect_uri: redirectUri,
+        client_id,
+      }),
+    });
+    if (!tokRes.ok) throw new Error(`token exchange failed (${tokRes.status})`);
+    const tok = await tokRes.json();
+    if (!tok.access_token) throw new Error('login: no access_token returned');
+    storeKey(apiHost, tok.access_token);
+    return tok.access_token;
+  } finally {
+    try { server.close(); } catch (_) {}
+  }
+}
+module.exports = { browserLogin };

package/src/client.js CHANGED Viewed

@@ -158,17 +158,45 @@ class KolboClient {
     this._explicitKey = opts.apiKey || null;
     this._envKey = process.env.KOLBO_API_KEY || null;
     this._authStoreKey = null; // lazy-loaded
+    // Local stdio servers (raw `npx @kolbo/mcp` in Claude Desktop / Code / Cursor)
+    // may start with no key and log in via the browser on first use. Disabled when:
+    //   - the host opts out (remote HTTP connector passes allowBrowserLogin:false —
+    //     it always injects the caller's key, and opening a browser on a server is
+    //     nonsensical), or
+    //   - we're spawned by Kolbo Code (it sets KOLBO_CALLER_SESSION_ID and runs its
+    //     OWN in-app sign-in off the [KOLBO_AUTH_MISSING] error — don't double up).
+    this._allowBrowserLogin =
+      opts.allowBrowserLogin !== undefined
+        ? opts.allowBrowserLogin
+        : !process.env.KOLBO_CALLER_SESSION_ID;
+    this._loginPromise = null;
     this.apiKey = this._explicitKey || this._envKey || this._readAuthStore();
-    if (!this.apiKey) {
-      // No key in env OR auth store. The Kolbo Code parent process should
-      // never spawn us in this state (it injects the key into env after the
-      // user signs in). If this fires, the parent will catch it via the
-      // [KOLBO_AUTH_MISSING] tag and surface the in-app sign-in flow.
+    if (!this.apiKey && !this._allowBrowserLogin) {
       throw new Error(
         'Kolbo API key not found. Sign in to Kolbo to continue. [KOLBO_AUTH_MISSING]'
       );
     }
+    // When allowBrowserLogin is on and there's no key yet, we DON'T throw —
+    // the first request triggers an interactive browser login (see _ensureLogin).
+  }
+  /**
+   * Ensure we have a key before a request. If none, run the one-time browser
+   * login (single-flight so concurrent first calls share one login window).
+   */
+  async _ensureLogin() {
+    if (this.apiKey) return;
+    if (!this._allowBrowserLogin) {
+      throw new Error('Kolbo API key not found. Sign in to Kolbo to continue. [KOLBO_AUTH_MISSING]');
+    }
+    if (!this._loginPromise) {
+      const { browserLogin } = require('./auth');
+      this._loginPromise = browserLogin({ apiBase: this.baseUrl })
+        .then((key) => { this.apiKey = key; this._explicitKey = key; return key; })
+        .catch((err) => { this._loginPromise = null; throw err; });
+    }
+    await this._loginPromise;
   }
   _readAuthStore() {
@@ -202,6 +230,7 @@ class KolboClient {
   }
   async request(method, reqPath, body = null) {
+    if (!this.apiKey) await this._ensureLogin();
     const result = await this._doRequest(method, reqPath, body);
     // On 401, try re-reading auth store and retry once
@@ -291,6 +320,7 @@ class KolboClient {
   }
   async postMultipart(reqPath, formData) {
+    if (!this.apiKey) await this._ensureLogin();
     const result = await this._doMultipart(reqPath, formData);
     if (result._status === 401 && this._tryRefreshKey()) {
       return this._doMultipart(reqPath, formData);

package/src/tools/_shared.js CHANGED Viewed

@@ -106,11 +106,11 @@ function assertSafeUrl(rawUrl) {
   return u;
 }
-async function safeFetch(rawUrl) {
+async function safeFetch(rawUrl, opts = {}) {
   let current = rawUrl;
   for (let i = 0; i <= MAX_REDIRECTS; i++) {
     assertSafeUrl(current);
-    const res = await fetch(current, { redirect: 'manual' });
+    const res = await fetch(current, { redirect: 'manual', signal: opts.signal });
     if (res.status >= 300 && res.status < 400 && res.headers.get('location')) {
       const next = new URL(res.headers.get('location'), current).toString();
       current = next;
@@ -251,20 +251,28 @@ const projectIdField = z.string().optional().describe(
 //     can never be base64-embedded even if mistakenly passed in;
 //   - any fetch/decoding failure silently falls back to URL-only.
 const INLINE_IMG_MAX_COUNT = 4;
-const INLINE_IMG_MAX_BYTES = 8 * 1024 * 1024; // 8 MB per image
+// Cap kept conservative on purpose: a base64 image rides inside the JSON-RPC
+// tool result, and chat clients (claude.ai etc.) drop the WHOLE result if it's
+// too large — which looks like "no image at all". Anything over the cap is left
+// to the URL in the text payload (clients render a "Show Image" affordance from
+// it), so a big image degrades to a click instead of vanishing.
+const INLINE_IMG_MAX_BYTES = 1.5 * 1024 * 1024; // 1.5 MB per image
+const INLINE_IMG_FETCH_TIMEOUT_MS = 8000; // never hang the tool response on a slow CDN
 async function inlineImageBlocks(urls, opts = {}) {
   if (!opts || !opts.enabled) return [];
   if (!Array.isArray(urls) || urls.length === 0) return [];
   // Fetch the (≤4) images in parallel — they're independent, the cap already
   // bounds concurrency, and this sits on the connector response path right
-  // after generation. Order is preserved by map-then-filter; any failure falls
-  // back to URL-only for that image.
+  // after generation. Order is preserved by map-then-filter; any failure (size,
+  // type, timeout, network) returns null and falls back to URL-only.
   const blocks = await Promise.all(
     urls.slice(0, INLINE_IMG_MAX_COUNT).map(async (url) => {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), INLINE_IMG_FETCH_TIMEOUT_MS);
       try {
         if (typeof url !== 'string' || !isHttpUrl(url)) return null;
-        const res = await safeFetch(url);
+        const res = await safeFetch(url, { signal: controller.signal });
         if (!res.ok) return null;
         const contentType = (res.headers.get('content-type') || '').split(';')[0].trim().toLowerCase();
         if (!contentType.startsWith('image/')) return null; // never embed non-images
@@ -275,6 +283,8 @@ async function inlineImageBlocks(urls, opts = {}) {
         return { type: 'image', data: Buffer.from(ab).toString('base64'), mimeType: contentType };
       } catch (_) {
         return null;
+      } finally {
+        clearTimeout(timer);
       }
     })
   );