@lanonasis/cli 3.1.13 → 3.2.14

package/dist/utils/config.d.ts

@@ -4,12 +4,44 @@ interface UserProfile {
     role: string;
     plan: string;
 }
+interface CLIConfigData {
+    version?: string;
+    apiUrl?: string;
+    token?: string | undefined;
+    user?: UserProfile | undefined;
+    lastUpdated?: string;
+    mcpServerPath?: string;
+    mcpServerUrl?: string;
+    mcpUseRemote?: boolean;
+    mcpPreference?: 'local' | 'remote' | 'auto';
+    discoveredServices?: {
+        auth_base: string;
+        memory_base: string;
+        mcp_base?: string;
+        mcp_ws_base: string;
+        mcp_sse_base?: string;
+        project_scope: string;
+    };
+    lastServiceDiscovery?: string;
+    manualEndpointOverrides?: boolean;
+    lastManualEndpointUpdate?: string;
+    vendorKey?: string | undefined;
+    authMethod?: 'jwt' | 'vendor_key' | 'oauth' | undefined;
+    tokenExpiry?: number | undefined;
+    lastValidated?: string | undefined;
+    deviceId?: string;
+    authFailureCount?: number;
+    lastAuthFailure?: string | undefined;
+    [key: string]: unknown;
+}
 export declare class CLIConfig {
     private configDir;
     private configPath;
     private config;
     private lockFile;
     private static readonly CONFIG_VERSION;
+    private authCheckCache;
+    private readonly AUTH_CACHE_TTL;
     constructor();
     init(): Promise<void>;
     load(): Promise<void>;
@@ -20,9 +52,15 @@ export declare class CLIConfig {
     private acquireLock;
     private releaseLock;
     getApiUrl(): string;
-    discoverServices(): Promise<void>;
+    discoverServices(verbose?: boolean): Promise<void>;
+    private handleServiceDiscoveryFailure;
+    private categorizeServiceDiscoveryError;
+    setManualEndpoints(endpoints: Partial<CLIConfigData['discoveredServices']>): Promise<void>;
+    hasManualEndpointOverrides(): boolean;
+    clearManualEndpointOverrides(): Promise<void>;
     getDiscoveredApiUrl(): string;
     setVendorKey(vendorKey: string): Promise<void>;
+    validateVendorKeyFormat(vendorKey: string): string | boolean;
     private validateVendorKeyWithServer;
     getVendorKey(): string | undefined;
     hasVendorKey(): boolean;
@@ -44,6 +82,7 @@ export declare class CLIConfig {
     getLastAuthFailure(): string | undefined;
     shouldDelayAuth(): boolean;
     getAuthDelayMs(): number;
+    getDeviceId(): Promise<string>;
     get<T = unknown>(key: string): T;
     set(key: string, value: unknown): void;
     setAndSave(key: string, value: unknown): Promise<void>;

package/dist/utils/config.js

@@ -9,6 +9,8 @@ export class CLIConfig {
     config = {};
     lockFile;
     static CONFIG_VERSION = '1.0.0';
+    authCheckCache = null;
+    AUTH_CACHE_TTL = 5 * 60 * 1000; // 5 minutes
     constructor() {
         this.configDir = path.join(os.homedir(), '.maas');
         this.configPath = path.join(this.configDir, 'config.json');
@@ -151,13 +153,21 @@ export class CLIConfig {
             this.config.apiUrl ||
             'https://api.lanonasis.com/api/v1';
     }
-    // Service Discovery Integration
-    async discoverServices() {
+    // Enhanced Service Discovery Integration
+    async discoverServices(verbose = false) {
+        const discoveryUrl = 'https://mcp.lanonasis.com/.well-known/onasis.json';
         try {
             // Use axios instead of fetch for consistency
             const axios = (await import('axios')).default;
-            const discoveryUrl = 'https://mcp.lanonasis.com/.well-known/onasis.json';
-            const response = await axios.get(discoveryUrl);
+            if (verbose) {
+                console.log(`🔍 Discovering services from ${discoveryUrl}...`);
+            }
+            const response = await axios.get(discoveryUrl, {
+                timeout: 10000,
+                headers: {
+                    'User-Agent': 'Lanonasis-CLI/3.0.13'
+                }
+            });
             // Map discovery response to our config format
             const discovered = response.data;
             this.config.discoveredServices = {
@@ -168,34 +178,134 @@ export class CLIConfig {
                 mcp_sse_base: discovered.endpoints?.sse || 'https://mcp.lanonasis.com/api/v1/events',
                 project_scope: 'lanonasis-maas'
             };
+            // Mark discovery as successful
+            this.config.lastServiceDiscovery = new Date().toISOString();
             await this.save();
+            if (verbose) {
+                console.log('✓ Service discovery completed successfully');
+                console.log(`  Auth: ${this.config.discoveredServices.auth_base}`);
+                console.log(`  MCP: ${this.config.discoveredServices.mcp_base}`);
+                console.log(`  WebSocket: ${this.config.discoveredServices.mcp_ws_base}`);
+            }
         }
-        catch {
-            // Service discovery failed, use fallback defaults
-            if (process.env.CLI_VERBOSE === 'true') {
-                console.log('Service discovery failed, using fallback defaults');
+        catch (error) {
+            // Enhanced error handling with user-visible messages
+            await this.handleServiceDiscoveryFailure(error, verbose);
+        }
+    }
+    async handleServiceDiscoveryFailure(error, verbose) {
+        const errorType = this.categorizeServiceDiscoveryError(error);
+        if (verbose || process.env.CLI_VERBOSE === 'true') {
+            console.log('⚠️  Service discovery failed, using cached/fallback endpoints');
+            switch (errorType) {
+                case 'network_error':
+                    console.log('   Reason: Network connection failed');
+                    console.log('   This is normal when offline or behind restrictive firewalls');
+                    break;
+                case 'timeout':
+                    console.log('   Reason: Request timed out');
+                    console.log('   The discovery service may be temporarily slow');
+                    break;
+                case 'server_error':
+                    console.log('   Reason: Discovery service returned an error');
+                    console.log('   The service may be temporarily unavailable');
+                    break;
+                case 'invalid_response':
+                    console.log('   Reason: Invalid response format from discovery service');
+                    console.log('   Using known working endpoints instead');
+                    break;
+                default:
+                    console.log(`   Reason: ${error.message || 'Unknown error'}`);
+            }
+        }
+        // Use cached endpoints if available and recent (within 24 hours)
+        if (this.config.discoveredServices && this.config.lastServiceDiscovery) {
+            const lastDiscovery = new Date(this.config.lastServiceDiscovery);
+            const hoursSinceDiscovery = (Date.now() - lastDiscovery.getTime()) / (1000 * 60 * 60);
+            if (hoursSinceDiscovery < 24) {
+                if (verbose) {
+                    console.log('✓ Using cached service endpoints (less than 24 hours old)');
+                }
+                return;
+            }
+        }
+        // Set fallback service endpoints
+        this.config.discoveredServices = {
+            auth_base: 'https://api.lanonasis.com', // CLI auth goes to central auth system
+            memory_base: 'https://api.lanonasis.com/api/v1', // Memory via onasis-core
+            mcp_base: 'https://mcp.lanonasis.com/api/v1', // MCP HTTP/REST
+            mcp_ws_base: 'wss://mcp.lanonasis.com/ws', // MCP WebSocket
+            mcp_sse_base: 'https://mcp.lanonasis.com/api/v1/events', // MCP SSE
+            project_scope: 'lanonasis-maas' // Correct project scope
+        };
+        // Mark as fallback (don't set lastServiceDiscovery)
+        await this.save();
+        if (verbose) {
+            console.log('✓ Using fallback service endpoints');
+            console.log('   These are the standard production endpoints');
+        }
+    }
+    categorizeServiceDiscoveryError(error) {
+        if (error.code) {
+            switch (error.code) {
+                case 'ECONNREFUSED':
+                case 'ENOTFOUND':
+                case 'ECONNRESET':
+                case 'ENETUNREACH':
+                    return 'network_error';
+                case 'ETIMEDOUT':
+                    return 'timeout';
             }
-            // Set fallback service endpoints to prevent double slash issues
-            // Use mcp.lanonasis.com for MCP services (proxied to port 3001)
-            this.config.discoveredServices = {
-                auth_base: 'https://api.lanonasis.com', // CLI auth goes to central auth system
-                memory_base: 'https://api.lanonasis.com/api/v1', // Memory via onasis-core
-                mcp_base: 'https://mcp.lanonasis.com/api/v1', // MCP HTTP/REST
-                mcp_ws_base: 'wss://mcp.lanonasis.com/ws', // MCP WebSocket
-                mcp_sse_base: 'https://mcp.lanonasis.com/api/v1/events', // MCP SSE
-                project_scope: 'lanonasis-maas' // Correct project scope
-            };
-            await this.save();
         }
+        if (error.response?.status >= 500) {
+            return 'server_error';
+        }
+        if (error.response?.status === 404) {
+            return 'invalid_response';
+        }
+        const message = error.message?.toLowerCase() || '';
+        if (message.includes('timeout')) {
+            return 'timeout';
+        }
+        if (message.includes('network') || message.includes('connection')) {
+            return 'network_error';
+        }
+        return 'unknown';
+    }
+    // Manual endpoint override functionality
+    async setManualEndpoints(endpoints) {
+        if (!this.config.discoveredServices) {
+            // Initialize with defaults first
+            await this.discoverServices();
+        }
+        // Merge manual overrides with existing endpoints
+        this.config.discoveredServices = {
+            ...this.config.discoveredServices,
+            ...endpoints
+        };
+        // Mark as manually configured
+        this.config.manualEndpointOverrides = true;
+        this.config.lastManualEndpointUpdate = new Date().toISOString();
+        await this.save();
+    }
+    hasManualEndpointOverrides() {
+        return !!this.config.manualEndpointOverrides;
+    }
+    async clearManualEndpointOverrides() {
+        this.config.manualEndpointOverrides = undefined;
+        this.config.lastManualEndpointUpdate = undefined;
+        // Rediscover services
+        await this.discoverServices();
     }
     getDiscoveredApiUrl() {
         return this.config.discoveredServices?.auth_base || this.getApiUrl();
     }
     // Enhanced authentication support
     async setVendorKey(vendorKey) {
-        // Validate vendor key format (pk_*.sk_*)
-        if (!vendorKey.match(/^pk_[a-zA-Z0-9]+\.sk_[a-zA-Z0-9]+$/)) {
-            throw new Error('Invalid vendor key format. Expected: pk_xxx.sk_xxx');
+        // Enhanced format validation with detailed error messages
+        const formatValidation = this.validateVendorKeyFormat(vendorKey);
+        if (formatValidation !== true) {
+            throw new Error(typeof formatValidation === 'string' ? formatValidation : 'Invalid vendor key format');
         }
         // Server-side validation
         await this.validateVendorKeyWithServer(vendorKey);
@@ -205,6 +315,44 @@ export class CLIConfig {
         await this.resetFailureCount(); // Reset failure count on successful auth
         await this.save();
     }
+    validateVendorKeyFormat(vendorKey) {
+        if (!vendorKey || vendorKey.trim().length === 0) {
+            return 'Vendor key is required';
+        }
+        const trimmed = vendorKey.trim();
+        // Check basic format
+        if (!trimmed.includes('.')) {
+            return 'Invalid vendor key format: Must contain a dot (.) separator. Expected format: pk_xxx.sk_xxx';
+        }
+        const parts = trimmed.split('.');
+        if (parts.length !== 2) {
+            return 'Invalid vendor key format: Must have exactly two parts separated by a dot. Expected format: pk_xxx.sk_xxx';
+        }
+        const [publicPart, secretPart] = parts;
+        // Validate public key part
+        if (!publicPart.startsWith('pk_')) {
+            return 'Invalid vendor key format: First part must start with "pk_". Expected format: pk_xxx.sk_xxx';
+        }
+        if (publicPart.length < 11) { // pk_ + minimum 8 chars
+            return 'Invalid vendor key format: Public key part is too short. Expected format: pk_xxx.sk_xxx (minimum 8 characters after "pk_")';
+        }
+        const publicKeyContent = publicPart.substring(3); // Remove 'pk_'
+        if (!/^[a-zA-Z0-9]+$/.test(publicKeyContent)) {
+            return 'Invalid vendor key format: Public key part contains invalid characters. Only letters and numbers are allowed after "pk_"';
+        }
+        // Validate secret key part
+        if (!secretPart.startsWith('sk_')) {
+            return 'Invalid vendor key format: Second part must start with "sk_". Expected format: pk_xxx.sk_xxx';
+        }
+        if (secretPart.length < 19) { // sk_ + minimum 16 chars
+            return 'Invalid vendor key format: Secret key part is too short. Expected format: pk_xxx.sk_xxx (minimum 16 characters after "sk_")';
+        }
+        const secretKeyContent = secretPart.substring(3); // Remove 'sk_'
+        if (!/^[a-zA-Z0-9]+$/.test(secretKeyContent)) {
+            return 'Invalid vendor key format: Secret key part contains invalid characters. Only letters and numbers are allowed after "sk_"';
+        }
+        return true;
+    }
     async validateVendorKeyWithServer(vendorKey) {
         try {
             // Import axios dynamically to avoid circular dependency
@@ -223,14 +371,45 @@ export class CLIConfig {
             });
         }
         catch (error) {
-            if (error.response?.status === 401 || error.response?.status === 403) {
-                throw new Error('Invalid vendor key: Authentication failed with server');
+            // Provide specific error messages based on response
+            if (error.response?.status === 401) {
+                const errorData = error.response.data;
+                if (errorData?.error?.includes('expired') || errorData?.message?.includes('expired')) {
+                    throw new Error('Vendor key has expired. Please generate a new key from your dashboard.');
+                }
+                else if (errorData?.error?.includes('revoked') || errorData?.message?.includes('revoked')) {
+                    throw new Error('Vendor key has been revoked. Please generate a new key from your dashboard.');
+                }
+                else if (errorData?.error?.includes('invalid') || errorData?.message?.includes('invalid')) {
+                    throw new Error('Vendor key is invalid. Please check the key format and ensure it was copied correctly.');
+                }
+                else {
+                    throw new Error('Vendor key authentication failed. The key may be invalid, expired, or revoked.');
+                }
+            }
+            else if (error.response?.status === 403) {
+                throw new Error('Vendor key access denied. The key may not have sufficient permissions for this operation.');
             }
-            else if (error.code === 'ECONNREFUSED' || error.code === 'ENOTFOUND') {
-                throw new Error('Cannot validate vendor key: Server unreachable');
+            else if (error.response?.status === 429) {
+                throw new Error('Too many validation attempts. Please wait a moment before trying again.');
+            }
+            else if (error.response?.status >= 500) {
+                throw new Error('Server error during validation. Please try again in a few moments.');
+            }
+            else if (error.code === 'ECONNREFUSED') {
+                throw new Error('Cannot connect to authentication server. Please check your internet connection and try again.');
+            }
+            else if (error.code === 'ENOTFOUND') {
+                throw new Error('Authentication server not found. Please check your internet connection.');
+            }
+            else if (error.code === 'ETIMEDOUT') {
+                throw new Error('Validation request timed out. Please check your internet connection and try again.');
+            }
+            else if (error.code === 'ECONNRESET') {
+                throw new Error('Connection was reset during validation. Please try again.');
             }
             else {
-                throw new Error(`Vendor key validation failed: ${error.message}`);
+                throw new Error(`Vendor key validation failed: ${error.message || 'Unknown error'}`);
             }
         }
     }
@@ -280,6 +459,12 @@ export class CLIConfig {
         const token = this.getToken();
         if (!token)
             return false;
+        // Check cache first
+        if (this.authCheckCache && (Date.now() - this.authCheckCache.timestamp) < this.AUTH_CACHE_TTL) {
+            return this.authCheckCache.isValid;
+        }
+        // Local expiry check first (fast)
+        let locallyValid = false;
         // Handle simple CLI tokens (format: cli_xxx_timestamp)
         if (token.startsWith('cli_')) {
             // Extract timestamp from CLI token
@@ -290,21 +475,44 @@ export class CLIConfig {
                 if (!isNaN(timestamp)) {
                     // CLI tokens are valid for 30 days
                     const thirtyDaysInMs = 30 * 24 * 60 * 60 * 1000;
-                    return (Date.now() - timestamp) < thirtyDaysInMs;
+                    locallyValid = (Date.now() - timestamp) < thirtyDaysInMs;
                 }
             }
-            // If we can't parse timestamp, assume valid (fallback)
-            return true;
+            else {
+                locallyValid = true; // Fallback for old format
+            }
         }
-        // Handle JWT tokens
-        try {
-            const decoded = jwtDecode(token);
-            const now = Date.now() / 1000;
-            return typeof decoded.exp === 'number' && decoded.exp > now;
+        else {
+            // Handle JWT tokens
+            try {
+                const decoded = jwtDecode(token);
+                const now = Date.now() / 1000;
+                locallyValid = typeof decoded.exp === 'number' && decoded.exp > now;
+            }
+            catch {
+                locallyValid = false;
+            }
         }
-        catch {
+        // If expired locally, no need to check server
+        if (!locallyValid) {
+            this.authCheckCache = { isValid: false, timestamp: Date.now() };
             return false;
         }
+        // Verify with server (security check)
+        try {
+            const axios = (await import('axios')).default;
+            const response = await axios.post('https://api.lanonasis.com/auth/verify', { token }, { timeout: 5000 });
+            const isValid = response.data.valid === true;
+            this.authCheckCache = { isValid, timestamp: Date.now() };
+            return isValid;
+        }
+        catch (error) {
+            // If server check fails, fall back to local validation
+            // This allows offline usage but is less secure
+            console.warn('⚠️  Unable to verify token with server, using local validation');
+            this.authCheckCache = { isValid: locallyValid, timestamp: Date.now() };
+            return locallyValid;
+        }
     }
     async logout() {
         this.config.token = undefined;
@@ -447,6 +655,14 @@ export class CLIConfig {
         const delay = Math.min(baseDelay * Math.pow(2, failureCount - 3), maxDelay);
         return delay;
     }
+    async getDeviceId() {
+        if (!this.config.deviceId) {
+            // Generate a new device ID
+            this.config.deviceId = randomUUID();
+            await this.save();
+        }
+        return this.config.deviceId;
+    }
     // Generic get/set methods for MCP and other dynamic config
     get(key) {
         return this.config[key];

package/dist/utils/mcp-client.d.ts

@@ -49,15 +49,64 @@ export declare class MCPClient {
     private isConnected;
     private sseConnection;
     private wsConnection;
+    private retryAttempts;
+    private maxRetries;
+    private healthCheckInterval;
+    private connectionStartTime;
+    private lastHealthCheck;
     constructor();
     /**
      * Initialize the MCP client configuration
      */
     init(): Promise<void>;
     /**
-     * Connect to MCP server (local or remote)
+     * Connect to MCP server with retry logic
      */
     connect(options?: MCPConnectionOptions): Promise<boolean>;
+    /**
+     * Connect to MCP server with retry logic and exponential backoff
+     */
+    private connectWithRetry;
+    /**
+     * Handle connection failures with retry logic and specific error messages
+     */
+    private handleConnectionFailure;
+    /**
+     * Check if error is authentication-related
+     */
+    private isAuthenticationError;
+    /**
+     * Provide authentication-specific guidance
+     */
+    private provideAuthenticationGuidance;
+    /**
+     * Provide network troubleshooting guidance
+     */
+    private provideNetworkTroubleshootingGuidance;
+    /**
+     * Calculate exponential backoff delay with jitter
+     */
+    private exponentialBackoff;
+    /**
+     * Validate authentication credentials before attempting MCP connection
+     */
+    private validateAuthBeforeConnect;
+    /**
+     * Validate vendor key format
+     */
+    private validateVendorKeyFormat;
+    /**
+     * Validate and refresh token if needed
+     */
+    private validateAndRefreshToken;
+    /**
+     * Refresh token if needed
+     */
+    private refreshTokenIfNeeded;
+    /**
+     * Validate token with server
+     */
+    private validateTokenWithServer;
     /**
      * Initialize SSE connection for real-time updates
      */
@@ -70,6 +119,34 @@ export declare class MCPClient {
      * Send a message over the WebSocket connection
      */
     private sendWebSocketMessage;
+    /**
+     * Start health monitoring for the connection
+     */
+    private startHealthMonitoring;
+    /**
+     * Stop health monitoring
+     */
+    private stopHealthMonitoring;
+    /**
+     * Perform a health check on the current connection
+     */
+    private performHealthCheck;
+    /**
+     * Check WebSocket connection health
+     */
+    private checkWebSocketHealth;
+    /**
+     * Check remote connection health
+     */
+    private checkRemoteHealth;
+    /**
+     * Check local connection health
+     */
+    private checkLocalHealth;
+    /**
+     * Handle health check failure by attempting reconnection
+     */
+    private handleHealthCheckFailure;
     /**
      * Disconnect from MCP server
      */
@@ -94,12 +171,16 @@ export declare class MCPClient {
      */
     isConnectedToServer(): boolean;
     /**
-     * Get connection status details
+     * Get connection status details with health information
      */
     getConnectionStatus(): {
         connected: boolean;
         mode: string;
         server?: string;
+        latency?: number;
+        lastHealthCheck?: Date;
+        connectionUptime?: number;
+        failureCount: number;
     };
 }
 export declare function getMCPClient(): MCPClient;