@kylewadegrove/cutline-mcp-cli 0.2.0 → 0.3.0

package/dist/commands/login.d.ts

@@ -1,4 +1,5 @@
 export declare function loginCommand(options: {
     staging?: boolean;
     signup?: boolean;
+    email?: string;
 }): Promise<void>;

package/dist/commands/login.js

@@ -41,15 +41,25 @@ async function loginCommand(options) {
     if (options.staging) {
         console.log(chalk_1.default.yellow('  ⚠️  Using STAGING environment\n'));
     }
-    if (!config.FIREBASE_API_KEY) {
-        console.error(chalk_1.default.red(`Error: FIREBASE_API_KEY or NEXT_PUBLIC_FIREBASE_API_KEY environment variable is required.`));
-        console.error(chalk_1.default.gray('Please set it before running this command:'));
-        console.error(chalk_1.default.cyan(`  export FIREBASE_API_KEY=AIzaSy...`));
-        console.error(chalk_1.default.gray('  (or use NEXT_PUBLIC_FIREBASE_API_KEY for consistency with web app config)'));
-        process.exit(1);
+    if (options.email) {
+        console.log(chalk_1.default.gray(`  Requesting sign-in as: ${options.email}\n`));
     }
     const spinner = (0, ora_1.default)('Starting authentication flow...').start();
     try {
+        // Fetch Firebase API key from web app endpoint
+        spinner.text = 'Fetching configuration...';
+        let firebaseApiKey;
+        try {
+            firebaseApiKey = await (0, config_js_1.fetchFirebaseApiKey)(options);
+        }
+        catch (error) {
+            spinner.fail(chalk_1.default.red('Failed to fetch Firebase configuration'));
+            if (error instanceof Error) {
+                console.error(chalk_1.default.red(`  ${error.message}`));
+            }
+            console.error(chalk_1.default.gray('\n  You can also set the FIREBASE_API_KEY environment variable manually.\n'));
+            process.exit(1);
+        }
         // Start callback server
         spinner.text = 'Waiting for authentication...';
         const serverPromise = (0, callback_js_1.startCallbackServer)();
@@ -58,6 +68,9 @@ async function loginCommand(options) {
         if (options.signup) {
             authUrl += '&mode=signup';
         }
+        if (options.email) {
+            authUrl += `&email=${encodeURIComponent(options.email)}`;
+        }
         await (0, open_1.default)(authUrl);
         spinner.text = options.signup
             ? 'Browser opened - please create your account'
@@ -66,7 +79,7 @@ async function loginCommand(options) {
         const result = await serverPromise;
         // Exchange custom token for refresh token
         spinner.text = 'Exchanging token...';
-        const { refreshToken, email } = await exchangeCustomToken(result.token, config.FIREBASE_API_KEY);
+        const { refreshToken, email } = await exchangeCustomToken(result.token, firebaseApiKey);
         // Store refresh token
         try {
             await (0, keychain_js_1.storeRefreshToken)(refreshToken);
@@ -74,12 +87,11 @@ async function loginCommand(options) {
         catch (error) {
             console.warn(chalk_1.default.yellow('  ⚠️  Could not save to Keychain (skipping)'));
         }
-        // Always save to file config (cross-platform)
+        // Save to file config (cross-platform) - don't store API key anymore
         try {
             (0, config_store_js_1.saveConfig)({
                 refreshToken,
                 environment: options.staging ? 'staging' : 'production',
-                firebaseApiKey: config.FIREBASE_API_KEY
             });
         }
         catch (error) {

package/dist/commands/status.js

@@ -44,16 +44,20 @@ async function statusCommand(options) {
             console.log(chalk_1.default.gray('  Run'), chalk_1.default.cyan('cutline-mcp login'), chalk_1.default.gray('to authenticate\n'));
             return;
         }
-        // Get config for API key
-        const config = (0, config_js_1.getConfig)(options);
-        if (!config.FIREBASE_API_KEY) {
+        // Get Firebase API key
+        spinner.text = 'Fetching configuration...';
+        let firebaseApiKey;
+        try {
+            firebaseApiKey = await (0, config_js_1.fetchFirebaseApiKey)(options);
+        }
+        catch (error) {
             spinner.fail(chalk_1.default.red('Configuration error'));
-            console.error(chalk_1.default.red(`  FIREBASE_API_KEY or NEXT_PUBLIC_FIREBASE_API_KEY environment variable is required.`));
+            console.error(chalk_1.default.red(`  ${error instanceof Error ? error.message : 'Failed to get Firebase API key'}`));
             process.exit(1);
         }
         // Exchange refresh token for ID token
         spinner.text = 'Verifying credentials...';
-        const idToken = await exchangeRefreshToken(refreshToken, config.FIREBASE_API_KEY);
+        const idToken = await exchangeRefreshToken(refreshToken, firebaseApiKey);
         // Initialize Firebase Admin with correct project ID
         if (firebase_admin_1.default.apps.length === 0) {
             const projectId = options.staging ? 'cutline-staging' : 'cutline-prod';

package/dist/commands/upgrade.js

@@ -36,8 +36,13 @@ async function upgradeCommand(options) {
     if (options.staging) {
         console.log(chalk_1.default.yellow('  ⚠️  Using STAGING environment\n'));
     }
-    if (!config.FIREBASE_API_KEY) {
-        console.error(chalk_1.default.red(`Error: FIREBASE_API_KEY environment variable is required.`));
+    // Fetch Firebase API key
+    let firebaseApiKey;
+    try {
+        firebaseApiKey = await (0, config_js_1.fetchFirebaseApiKey)(options);
+    }
+    catch (error) {
+        console.error(chalk_1.default.red(`Error: ${error instanceof Error ? error.message : 'Failed to get Firebase API key'}`));
         process.exit(1);
     }
     // Determine upgrade URL based on environment
@@ -59,7 +64,7 @@ async function upgradeCommand(options) {
         const result = await serverPromise;
         // Exchange custom token for refresh token
         spinner.text = 'Refreshing your session...';
-        const { refreshToken, email } = await exchangeCustomToken(result.token, config.FIREBASE_API_KEY);
+        const { refreshToken, email } = await exchangeCustomToken(result.token, firebaseApiKey);
         // Store refresh token
         try {
             await (0, keychain_js_1.storeRefreshToken)(refreshToken);
@@ -67,12 +72,11 @@ async function upgradeCommand(options) {
         catch (error) {
             console.warn(chalk_1.default.yellow('  ⚠️  Could not save to Keychain (skipping)'));
         }
-        // Save to file config
+        // Save to file config (API key is fetched at runtime, not stored)
         try {
             (0, config_store_js_1.saveConfig)({
                 refreshToken,
                 environment: options.staging ? 'staging' : 'production',
-                firebaseApiKey: config.FIREBASE_API_KEY
             });
         }
         catch (error) {

package/dist/index.js

@@ -16,6 +16,7 @@ program
     .description('Authenticate with Cutline and store credentials')
     .option('--staging', 'Use staging environment')
     .option('--signup', 'Open sign-up page instead of sign-in')
+    .option('--email <address>', 'Request sign-in with specific email address')
     .action(login_js_1.loginCommand);
 program
     .command('logout')

package/dist/utils/config-store.d.ts

@@ -1,7 +1,6 @@
 export interface McpConfig {
     refreshToken?: string;
     environment?: 'production' | 'staging';
-    firebaseApiKey?: string;
 }
 export declare function saveConfig(config: McpConfig): void;
 export declare function loadConfig(): McpConfig;

package/dist/utils/config.d.ts

@@ -1,8 +1,22 @@
 export interface Config {
     AUTH_URL: string;
     CALLBACK_URL: string;
+    BASE_URL: string;
+}
+export interface ConfigWithApiKey extends Config {
     FIREBASE_API_KEY: string;
 }
+/**
+ * Get static config (URLs only, no API key)
+ */
 export declare function getConfig(options?: {
     staging?: boolean;
 }): Config;
+/**
+ * Fetch Firebase API key from the web app's public endpoint.
+ * This avoids hardcoding API keys in source code.
+ * Falls back to environment variables if fetch fails.
+ */
+export declare function fetchFirebaseApiKey(options?: {
+    staging?: boolean;
+}): Promise<string>;

package/dist/utils/config.js

@@ -1,21 +1,52 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getConfig = getConfig;
+exports.fetchFirebaseApiKey = fetchFirebaseApiKey;
+/**
+ * Get static config (URLs only, no API key)
+ */
 function getConfig(options = {}) {
     if (options.staging) {
         return {
             AUTH_URL: process.env.CUTLINE_AUTH_URL || 'https://cutline-staging.web.app/mcp-auth',
             CALLBACK_URL: 'http://localhost:8765',
-            // For environment-scoped secrets, use FIREBASE_API_KEY (GitHub Actions will scope it to staging environment)
-            // Also support NEXT_PUBLIC_FIREBASE_API_KEY for consistency with web app config
-            FIREBASE_API_KEY: process.env.FIREBASE_API_KEY || process.env.NEXT_PUBLIC_FIREBASE_API_KEY || 'AIzaSyAAqU_euGAMtJoXp0sECblAIndifCp0pmE',
+            BASE_URL: 'https://cutline-staging.web.app',
         };
     }
     return {
         AUTH_URL: process.env.CUTLINE_AUTH_URL || 'https://thecutline.ai/mcp-auth',
         CALLBACK_URL: 'http://localhost:8765',
-        // For environment-scoped secrets, use FIREBASE_API_KEY (GitHub Actions will scope it to production environment)
-        // Also support NEXT_PUBLIC_FIREBASE_API_KEY for consistency with web app config
-        FIREBASE_API_KEY: process.env.FIREBASE_API_KEY || process.env.NEXT_PUBLIC_FIREBASE_API_KEY || 'AIzaSyAYBQt7A-a_mxn5SuXPHUpyIlm0eCn42N8',
+        BASE_URL: 'https://thecutline.ai',
     };
 }
+/**
+ * Fetch Firebase API key from the web app's public endpoint.
+ * This avoids hardcoding API keys in source code.
+ * Falls back to environment variables if fetch fails.
+ */
+async function fetchFirebaseApiKey(options = {}) {
+    // First check environment variables
+    const envKey = process.env.FIREBASE_API_KEY || process.env.NEXT_PUBLIC_FIREBASE_API_KEY;
+    if (envKey) {
+        return envKey;
+    }
+    // Fetch from web app endpoint
+    const config = getConfig(options);
+    try {
+        const response = await fetch(`${config.BASE_URL}/api/firebase-config`, {
+            headers: { 'Accept': 'application/json' },
+        });
+        if (!response.ok) {
+            throw new Error(`HTTP ${response.status}`);
+        }
+        const data = await response.json();
+        if (!data.apiKey) {
+            throw new Error('No apiKey in response');
+        }
+        return data.apiKey;
+    }
+    catch (error) {
+        throw new Error(`Failed to fetch Firebase config from ${config.BASE_URL}/api/firebase-config. ` +
+            `Please set FIREBASE_API_KEY environment variable or ensure network connectivity.`);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@kylewadegrove/cutline-mcp-cli",
-    "version": "0.2.0",
+    "version": "0.3.0",
     "description": "CLI tool for authenticating with Cutline MCP servers",
     "main": "dist/index.js",
     "bin": {

package/src/commands/login.ts

@@ -4,7 +4,7 @@ import ora from 'ora';
 import { startCallbackServer } from '../auth/callback.js';
 import { storeRefreshToken } from '../auth/keychain.js';
 import { saveConfig } from '../utils/config-store.js';
-import { getConfig } from '../utils/config.js';
+import { getConfig, fetchFirebaseApiKey } from '../utils/config.js';
 
 async function exchangeCustomToken(customToken: string, apiKey: string): Promise<{ refreshToken: string; email?: string }> {
     const response = await fetch(
@@ -31,7 +31,7 @@ async function exchangeCustomToken(customToken: string, apiKey: string): Promise
     };
 }
 
-export async function loginCommand(options: { staging?: boolean; signup?: boolean }) {
+export async function loginCommand(options: { staging?: boolean; signup?: boolean; email?: string }) {
     const config = getConfig(options);
     
     if (options.signup) {
@@ -44,17 +44,28 @@ export async function loginCommand(options: { staging?: boolean; signup?: boolea
         console.log(chalk.yellow('  ⚠️  Using STAGING environment\n'));
     }
 
-    if (!config.FIREBASE_API_KEY) {
-        console.error(chalk.red(`Error: FIREBASE_API_KEY or NEXT_PUBLIC_FIREBASE_API_KEY environment variable is required.`));
-        console.error(chalk.gray('Please set it before running this command:'));
-        console.error(chalk.cyan(`  export FIREBASE_API_KEY=AIzaSy...`));
-        console.error(chalk.gray('  (or use NEXT_PUBLIC_FIREBASE_API_KEY for consistency with web app config)'));
-        process.exit(1);
+    if (options.email) {
+        console.log(chalk.gray(`  Requesting sign-in as: ${options.email}\n`));
     }
 
+
     const spinner = ora('Starting authentication flow...').start();
 
     try {
+        // Fetch Firebase API key from web app endpoint
+        spinner.text = 'Fetching configuration...';
+        let firebaseApiKey: string;
+        try {
+            firebaseApiKey = await fetchFirebaseApiKey(options);
+        } catch (error) {
+            spinner.fail(chalk.red('Failed to fetch Firebase configuration'));
+            if (error instanceof Error) {
+                console.error(chalk.red(`  ${error.message}`));
+            }
+            console.error(chalk.gray('\n  You can also set the FIREBASE_API_KEY environment variable manually.\n'));
+            process.exit(1);
+        }
+
         // Start callback server
         spinner.text = 'Waiting for authentication...';
         const serverPromise = startCallbackServer();
@@ -64,6 +75,9 @@ export async function loginCommand(options: { staging?: boolean; signup?: boolea
         if (options.signup) {
             authUrl += '&mode=signup';
         }
+        if (options.email) {
+            authUrl += `&email=${encodeURIComponent(options.email)}`;
+        }
         await open(authUrl);
         spinner.text = options.signup 
             ? 'Browser opened - please create your account' 
@@ -74,7 +88,7 @@ export async function loginCommand(options: { staging?: boolean; signup?: boolea
 
         // Exchange custom token for refresh token
         spinner.text = 'Exchanging token...';
-        const { refreshToken, email } = await exchangeCustomToken(result.token, config.FIREBASE_API_KEY);
+        const { refreshToken, email } = await exchangeCustomToken(result.token, firebaseApiKey);
 
         // Store refresh token
         try {
@@ -83,12 +97,11 @@ export async function loginCommand(options: { staging?: boolean; signup?: boolea
             console.warn(chalk.yellow('  ⚠️  Could not save to Keychain (skipping)'));
         }
 
-        // Always save to file config (cross-platform)
+        // Save to file config (cross-platform) - don't store API key anymore
         try {
             saveConfig({ 
                 refreshToken,
                 environment: options.staging ? 'staging' : 'production',
-                firebaseApiKey: config.FIREBASE_API_KEY
             });
         } catch (error) {
             console.error(chalk.red('  ✗ Failed to save config file:'), error);

package/src/commands/status.ts

@@ -2,7 +2,7 @@ import chalk from 'chalk';
 import ora from 'ora';
 import admin from 'firebase-admin';
 import { getRefreshToken } from '../auth/keychain.js';
-import { getConfig } from '../utils/config.js';
+import { fetchFirebaseApiKey } from '../utils/config.js';
 
 async function exchangeRefreshToken(refreshToken: string, apiKey: string): Promise<string> {
     const response = await fetch(
@@ -48,18 +48,20 @@ export async function statusCommand(options: { staging?: boolean }) {
             return;
         }
 
-        // Get config for API key
-        const config = getConfig(options);
-
-        if (!config.FIREBASE_API_KEY) {
+        // Get Firebase API key
+        spinner.text = 'Fetching configuration...';
+        let firebaseApiKey: string;
+        try {
+            firebaseApiKey = await fetchFirebaseApiKey(options);
+        } catch (error) {
             spinner.fail(chalk.red('Configuration error'));
-            console.error(chalk.red(`  FIREBASE_API_KEY or NEXT_PUBLIC_FIREBASE_API_KEY environment variable is required.`));
+            console.error(chalk.red(`  ${error instanceof Error ? error.message : 'Failed to get Firebase API key'}`));
             process.exit(1);
         }
 
         // Exchange refresh token for ID token
         spinner.text = 'Verifying credentials...';
-        const idToken = await exchangeRefreshToken(refreshToken, config.FIREBASE_API_KEY);
+        const idToken = await exchangeRefreshToken(refreshToken, firebaseApiKey);
 
         // Initialize Firebase Admin with correct project ID
         if (admin.apps.length === 0) {

package/src/commands/upgrade.ts

@@ -4,7 +4,7 @@ import ora from 'ora';
 import { startCallbackServer } from '../auth/callback.js';
 import { storeRefreshToken } from '../auth/keychain.js';
 import { saveConfig } from '../utils/config-store.js';
-import { getConfig } from '../utils/config.js';
+import { getConfig, fetchFirebaseApiKey } from '../utils/config.js';
 
 async function exchangeCustomToken(customToken: string, apiKey: string): Promise<{ refreshToken: string; email?: string }> {
     const response = await fetch(
@@ -40,8 +40,12 @@ export async function upgradeCommand(options: { staging?: boolean }) {
         console.log(chalk.yellow('  ⚠️  Using STAGING environment\n'));
     }
 
-    if (!config.FIREBASE_API_KEY) {
-        console.error(chalk.red(`Error: FIREBASE_API_KEY environment variable is required.`));
+    // Fetch Firebase API key
+    let firebaseApiKey: string;
+    try {
+        firebaseApiKey = await fetchFirebaseApiKey(options);
+    } catch (error) {
+        console.error(chalk.red(`Error: ${error instanceof Error ? error.message : 'Failed to get Firebase API key'}`));
         process.exit(1);
     }
 
@@ -71,7 +75,7 @@ export async function upgradeCommand(options: { staging?: boolean }) {
 
         // Exchange custom token for refresh token
         spinner.text = 'Refreshing your session...';
-        const { refreshToken, email } = await exchangeCustomToken(result.token, config.FIREBASE_API_KEY);
+        const { refreshToken, email } = await exchangeCustomToken(result.token, firebaseApiKey);
 
         // Store refresh token
         try {
@@ -80,12 +84,11 @@ export async function upgradeCommand(options: { staging?: boolean }) {
             console.warn(chalk.yellow('  ⚠️  Could not save to Keychain (skipping)'));
         }
 
-        // Save to file config
+        // Save to file config (API key is fetched at runtime, not stored)
         try {
             saveConfig({ 
                 refreshToken,
                 environment: options.staging ? 'staging' : 'production',
-                firebaseApiKey: config.FIREBASE_API_KEY
             });
         } catch (error) {
             console.error(chalk.red('  ✗ Failed to save config file:'), error);

package/src/index.ts

@@ -17,6 +17,7 @@ program
     .description('Authenticate with Cutline and store credentials')
     .option('--staging', 'Use staging environment')
     .option('--signup', 'Open sign-up page instead of sign-in')
+    .option('--email <address>', 'Request sign-in with specific email address')
     .action(loginCommand);
 
 program

package/src/utils/config-store.ts

@@ -9,7 +9,7 @@ const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
 export interface McpConfig {
     refreshToken?: string;
     environment?: 'production' | 'staging';
-    firebaseApiKey?: string; // Store the API key used during login for reference
+    // Note: firebaseApiKey is no longer stored - it's fetched from the web app at runtime
 }
 
 function ensureConfigDir() {

package/src/utils/config.ts

@@ -1,25 +1,65 @@
 export interface Config {
     AUTH_URL: string;
     CALLBACK_URL: string;
+    BASE_URL: string;
+}
+
+export interface ConfigWithApiKey extends Config {
     FIREBASE_API_KEY: string;
 }
 
+/**
+ * Get static config (URLs only, no API key)
+ */
 export function getConfig(options: { staging?: boolean } = {}): Config {
     if (options.staging) {
         return {
             AUTH_URL: process.env.CUTLINE_AUTH_URL || 'https://cutline-staging.web.app/mcp-auth',
             CALLBACK_URL: 'http://localhost:8765',
-            // For environment-scoped secrets, use FIREBASE_API_KEY (GitHub Actions will scope it to staging environment)
-            // Also support NEXT_PUBLIC_FIREBASE_API_KEY for consistency with web app config
-            FIREBASE_API_KEY: process.env.FIREBASE_API_KEY || process.env.NEXT_PUBLIC_FIREBASE_API_KEY || 'AIzaSyAAqU_euGAMtJoXp0sECblAIndifCp0pmE',
+            BASE_URL: 'https://cutline-staging.web.app',
         };
     }
 
     return {
         AUTH_URL: process.env.CUTLINE_AUTH_URL || 'https://thecutline.ai/mcp-auth',
         CALLBACK_URL: 'http://localhost:8765',
-        // For environment-scoped secrets, use FIREBASE_API_KEY (GitHub Actions will scope it to production environment)
-        // Also support NEXT_PUBLIC_FIREBASE_API_KEY for consistency with web app config
-        FIREBASE_API_KEY: process.env.FIREBASE_API_KEY || process.env.NEXT_PUBLIC_FIREBASE_API_KEY || 'AIzaSyAYBQt7A-a_mxn5SuXPHUpyIlm0eCn42N8',
+        BASE_URL: 'https://thecutline.ai',
     };
 }
+
+/**
+ * Fetch Firebase API key from the web app's public endpoint.
+ * This avoids hardcoding API keys in source code.
+ * Falls back to environment variables if fetch fails.
+ */
+export async function fetchFirebaseApiKey(options: { staging?: boolean } = {}): Promise<string> {
+    // First check environment variables
+    const envKey = process.env.FIREBASE_API_KEY || process.env.NEXT_PUBLIC_FIREBASE_API_KEY;
+    if (envKey) {
+        return envKey;
+    }
+
+    // Fetch from web app endpoint
+    const config = getConfig(options);
+    try {
+        const response = await fetch(`${config.BASE_URL}/api/firebase-config`, {
+            headers: { 'Accept': 'application/json' },
+        });
+        
+        if (!response.ok) {
+            throw new Error(`HTTP ${response.status}`);
+        }
+        
+        const data = await response.json();
+        if (!data.apiKey) {
+            throw new Error('No apiKey in response');
+        }
+        
+        return data.apiKey;
+    } catch (error) {
+        throw new Error(
+            `Failed to fetch Firebase config from ${config.BASE_URL}/api/firebase-config. ` +
+            `Please set FIREBASE_API_KEY environment variable or ensure network connectivity.`
+        );
+    }
+}