npm - @kolbo/mcp - Versions diffs - 1.19.2 → 1.20.0 - Mend

@kolbo/mcp 1.19.2 → 1.20.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@kolbo/mcp",
-  "version": "1.19.2",
+  "version": "1.20.0",
   "description": "Kolbo AI MCP Server - Generate images, videos, music, speech, and sound effects from Claude Code",
   "main": "src/index.js",
   "bin": {

package/src/auth.js ADDED Viewed

@@ -0,0 +1,155 @@
+/**
+ * Keyless browser login for the LOCAL (stdio) Kolbo MCP server.
+ *
+ * When the server runs on the user's machine with no KOLBO_API_KEY and no
+ * stored credential, the first tool call triggers this: we open the browser to
+ * Kolbo's OAuth login (the same server that powers the remote connector), the
+ * user clicks Allow, and we capture a token via a loopback redirect — no API
+ * key to create or paste. The token is cached so every later run is silent.
+ *
+ * Standard "native app" OAuth: authorization-code + PKCE with a
+ * http://localhost:<port>/callback redirect (already allow-listed by the Kolbo
+ * OAuth server). This path is NOT used by the remote connector (it always
+ * injects the caller's key, and passes allowBrowserLogin:false).
+ */
+const http = require('http');
+const crypto = require('crypto');
+const { exec } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+function b64url(buf) {
+  return Buffer.from(buf).toString('base64url');
+}
+function openBrowser(url) {
+  const cmd =
+    process.platform === 'win32' ? `start "" "${url}"`
+    : process.platform === 'darwin' ? `open "${url}"`
+    : `xdg-open "${url}"`;
+  try { exec(cmd, () => {}); } catch (_) { /* best effort */ }
+}
+// Where we cache the token — same location + shape that client.js reads back
+// (`<xdg-data>/kolbo/auth.json` → { "kolbo@<host>": { type: 'api', key } }).
+function authStorePath() {
+  const dataDir =
+    process.env.XDG_DATA_HOME ||
+    (process.platform === 'win32'
+      ? (process.env.LOCALAPPDATA || path.join(os.homedir(), '.local', 'share'))
+      : process.platform === 'darwin'
+        ? path.join(os.homedir(), 'Library', 'Application Support')
+        : path.join(os.homedir(), '.local', 'share'));
+  return path.join(dataDir, 'kolbo', 'auth.json');
+}
+function storeKey(apiHost, key) {
+  try {
+    const file = authStorePath();
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    let store = {};
+    try { store = JSON.parse(fs.readFileSync(file, 'utf8')); } catch (_) {}
+    store[`kolbo@${apiHost}`] = { type: 'api', key, savedAt: new Date().toISOString() };
+    fs.writeFileSync(file, JSON.stringify(store, null, 2), { mode: 0o600 });
+  } catch (_) { /* non-fatal — the key still works for this process */ }
+}
+function donePage(ok) {
+  const title = ok ? 'Connected to Kolbo' : 'Connection cancelled';
+  const sub = ok ? 'You can close this tab and return to your app.' : 'You can close this tab.';
+  const mark = ok ? '✓' : '✕';
+  return `<!doctype html><meta charset="utf-8"><title>${title}</title>` +
+    `<body style="margin:0;font-family:Inter,system-ui,sans-serif;background:#05050f;color:#fff;` +
+    `display:flex;align-items:center;justify-content:center;height:100vh">` +
+    `<div style="text-align:center"><div style="font-size:42px;color:#8B5CF6;margin-bottom:8px">${mark}</div>` +
+    `<h2 style="margin:0 0 6px">${title}</h2><p style="opacity:.55;font-size:14px">${sub}</p></div></body>`;
+}
+/**
+ * Run the interactive browser login. Resolves with the kolbo_live_ key.
+ * @param {object} opts
+ * @param {string} opts.apiBase  e.g. https://api.kolbo.ai/api
+ */
+async function browserLogin({ apiBase }) {
+  // The OAuth endpoints live at the host root, not under /api.
+  const oauthBase = apiBase.replace(/\/api\/?$/, '');
+  let apiHost = 'api.kolbo.ai';
+  try { apiHost = new URL(apiBase).host; } catch (_) {}
+  const verifier = b64url(crypto.randomBytes(32));
+  const challenge = b64url(crypto.createHash('sha256').update(verifier).digest());
+  const state = b64url(crypto.randomBytes(16));
+  // Loopback callback server on a random free port.
+  const server = http.createServer();
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const port = server.address().port;
+  const redirectUri = `http://localhost:${port}/callback`;
+  try {
+    // 1. Dynamic client registration (public + PKCE).
+    const regRes = await fetch(`${oauthBase}/oauth/register`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ client_name: 'Kolbo MCP (local)', redirect_uris: [redirectUri] }),
+    });
+    if (!regRes.ok) throw new Error(`client registration failed (${regRes.status})`);
+    const { client_id } = await regRes.json();
+    // 2. Wait for the browser redirect to hit our loopback server.
+    const codePromise = new Promise((resolve, reject) => {
+      const timer = setTimeout(() => reject(new Error('login timed out (5 min)')), 5 * 60 * 1000);
+      server.on('request', (req, resp) => {
+        let u;
+        try { u = new URL(req.url, redirectUri); } catch (_) { resp.writeHead(400); resp.end(); return; }
+        if (u.pathname !== '/callback') { resp.writeHead(404); resp.end(); return; }
+        clearTimeout(timer);
+        const code = u.searchParams.get('code');
+        const st = u.searchParams.get('state');
+        const err = u.searchParams.get('error');
+        resp.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+        resp.end(donePage(!err && !!code));
+        if (err) return reject(new Error(`login denied: ${err}`));
+        if (!code || st !== state) return reject(new Error('login: invalid callback'));
+        resolve(code);
+      });
+    });
+    // 3. Open the consent/login page.
+    const authUrl =
+      `${oauthBase}/oauth/authorize?response_type=code&client_id=${encodeURIComponent(client_id)}` +
+      `&redirect_uri=${encodeURIComponent(redirectUri)}&code_challenge=${challenge}` +
+      `&code_challenge_method=S256&state=${state}&scope=kolbo`;
+    openBrowser(authUrl);
+    process.stderr.write(
+      `\n[kolbo] Connect your Kolbo account in the browser. If it didn't open, visit:\n${authUrl}\n\n`
+    );
+    const code = await codePromise;
+    // 4. Exchange the code (with the PKCE verifier) for the token.
+    const tokRes = await fetch(`${oauthBase}/oauth/token`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        grant_type: 'authorization_code',
+        code,
+        code_verifier: verifier,
+        redirect_uri: redirectUri,
+        client_id,
+      }),
+    });
+    if (!tokRes.ok) throw new Error(`token exchange failed (${tokRes.status})`);
+    const tok = await tokRes.json();
+    if (!tok.access_token) throw new Error('login: no access_token returned');
+    storeKey(apiHost, tok.access_token);
+    return tok.access_token;
+  } finally {
+    try { server.close(); } catch (_) {}
+  }
+}
+module.exports = { browserLogin };

package/src/client.js CHANGED Viewed

@@ -158,17 +158,45 @@ class KolboClient {
     this._explicitKey = opts.apiKey || null;
     this._envKey = process.env.KOLBO_API_KEY || null;
     this._authStoreKey = null; // lazy-loaded
+    // Local stdio servers (raw `npx @kolbo/mcp` in Claude Desktop / Code / Cursor)
+    // may start with no key and log in via the browser on first use. Disabled when:
+    //   - the host opts out (remote HTTP connector passes allowBrowserLogin:false —
+    //     it always injects the caller's key, and opening a browser on a server is
+    //     nonsensical), or
+    //   - we're spawned by Kolbo Code (it sets KOLBO_CALLER_SESSION_ID and runs its
+    //     OWN in-app sign-in off the [KOLBO_AUTH_MISSING] error — don't double up).
+    this._allowBrowserLogin =
+      opts.allowBrowserLogin !== undefined
+        ? opts.allowBrowserLogin
+        : !process.env.KOLBO_CALLER_SESSION_ID;
+    this._loginPromise = null;
     this.apiKey = this._explicitKey || this._envKey || this._readAuthStore();
-    if (!this.apiKey) {
-      // No key in env OR auth store. The Kolbo Code parent process should
-      // never spawn us in this state (it injects the key into env after the
-      // user signs in). If this fires, the parent will catch it via the
-      // [KOLBO_AUTH_MISSING] tag and surface the in-app sign-in flow.
+    if (!this.apiKey && !this._allowBrowserLogin) {
       throw new Error(
         'Kolbo API key not found. Sign in to Kolbo to continue. [KOLBO_AUTH_MISSING]'
       );
     }
+    // When allowBrowserLogin is on and there's no key yet, we DON'T throw —
+    // the first request triggers an interactive browser login (see _ensureLogin).
+  }
+  /**
+   * Ensure we have a key before a request. If none, run the one-time browser
+   * login (single-flight so concurrent first calls share one login window).
+   */
+  async _ensureLogin() {
+    if (this.apiKey) return;
+    if (!this._allowBrowserLogin) {
+      throw new Error('Kolbo API key not found. Sign in to Kolbo to continue. [KOLBO_AUTH_MISSING]');
+    }
+    if (!this._loginPromise) {
+      const { browserLogin } = require('./auth');
+      this._loginPromise = browserLogin({ apiBase: this.baseUrl })
+        .then((key) => { this.apiKey = key; this._explicitKey = key; return key; })
+        .catch((err) => { this._loginPromise = null; throw err; });
+    }
+    await this._loginPromise;
   }
   _readAuthStore() {
@@ -202,6 +230,7 @@ class KolboClient {
   }
   async request(method, reqPath, body = null) {
+    if (!this.apiKey) await this._ensureLogin();
     const result = await this._doRequest(method, reqPath, body);
     // On 401, try re-reading auth store and retry once
@@ -291,6 +320,7 @@ class KolboClient {
   }
   async postMultipart(reqPath, formData) {
+    if (!this.apiKey) await this._ensureLogin();
     const result = await this._doMultipart(reqPath, formData);
     if (result._status === 401 && this._tryRefreshKey()) {
       return this._doMultipart(reqPath, formData);