@mandujs/mcp 0.27.2 → 0.28.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mandujs/mcp",
-  "version": "0.27.2",
+  "version": "0.28.1",
   "description": "Mandu MCP Server - Agent-native interface for Mandu framework operations",
   "type": "module",
   "main": "./src/index.ts",
@@ -34,7 +34,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@mandujs/core": "^0.41.0",
+    "@mandujs/core": "^0.41.1",
     "@mandujs/ate": "^0.24.0",
     "@mandujs/skills": "^0.18.0",
     "@modelcontextprotocol/sdk": "^1.25.3"

package/src/tools/brain.ts

@@ -157,6 +157,56 @@ export const brainToolDefinitions: Tool[] = [
       required: [],
     },
   },
+  {
+    name: "mandu.brain.status",
+    description:
+      "Check which LLM adapter is active for brain (openai / anthropic / ollama / template) and whether auth tokens are present. Read-only — does not call an LLM or spawn subprocesses.",
+    annotations: { readOnlyHint: true },
+    inputSchema: {
+      type: "object",
+      properties: {},
+      required: [],
+    },
+  },
+  {
+    name: "mandu.brain.login",
+    description:
+      "Authenticate the brain to an LLM provider. For openai, spawns `npx @openai/codex login` which opens the user's default browser to the OpenAI OAuth page; on approval, the token lands in ~/.codex/auth.json and this tool returns. Anthropic path uses the Mandu OAuth flow with a local loopback listener.",
+    annotations: { readOnlyHint: false },
+    inputSchema: {
+      type: "object",
+      properties: {
+        provider: {
+          type: "string",
+          enum: ["openai", "anthropic"],
+          description: "Which provider to sign into. Default: openai.",
+        },
+        waitMs: {
+          type: "number",
+          description:
+            "How long to wait for auth.json to appear after spawning the OAuth flow. Default 180000 (3 min). Increase if the user takes longer to approve in the browser.",
+        },
+      },
+      required: [],
+    },
+  },
+  {
+    name: "mandu.brain.logout",
+    description:
+      "Delete stored brain credentials for a provider. For openai, deletes the keychain-stored enterprise token only — the ~/.codex/auth.json owned by the Codex CLI is intentionally left in place (run `npx @openai/codex logout` to revoke that).",
+    annotations: { readOnlyHint: false },
+    inputSchema: {
+      type: "object",
+      properties: {
+        provider: {
+          type: "string",
+          enum: ["openai", "anthropic", "all"],
+          description: "Which provider to log out of. Default: all.",
+        },
+      },
+      required: [],
+    },
+  },
 ];
 
 /** Module-level unsubscribe handle for MCP warning notifications */
@@ -547,6 +597,241 @@ export function brainTools(projectRoot: string, server?: Server, monitor?: Activ
     },
   };
 
+  // #235 followup — brain auth tools (status / login / logout).
+  handlers["mandu.brain.status"] = async () => {
+    const core = await import("@mandujs/core");
+    const store = core.getCredentialStore();
+    const resolution = await core.resolveBrainAdapter({
+      adapter: "auto",
+      credentialStore: store,
+      projectRoot,
+    });
+
+    // Check ChatGPT session token (managed by @openai/codex, not the keychain).
+    const chatgpt = new core.ChatGPTAuth();
+    const chatgptFile = chatgpt.locateAuthFile();
+
+    const providers: Record<string, unknown> = {};
+    for (const provider of ["openai", "anthropic"] as const) {
+      const token = await store.load(provider);
+      providers[provider] = token
+        ? {
+            logged_in: true,
+            source: "keychain",
+            model: token.default_model ?? null,
+            expires_at: token.expires_at
+              ? new Date(token.expires_at * 1000).toISOString()
+              : null,
+            last_used_at: token.last_used_at ?? null,
+          }
+        : provider === "openai" && chatgptFile
+          ? {
+              logged_in: true,
+              source: "chatgpt_session",
+              auth_file: chatgptFile,
+              note: "Managed by `@openai/codex` CLI. Mandu reads + auto-refreshes.",
+            }
+          : { logged_in: false };
+    }
+
+    return {
+      content: [
+        {
+          type: "text",
+          text: JSON.stringify(
+            {
+              active_tier: resolution.resolved,
+              reason: resolution.reason,
+              backend: store.backendName,
+              providers,
+            },
+            null,
+            2,
+          ),
+        },
+      ],
+    };
+  };
+
+  handlers["mandu.brain.login"] = async (args) => {
+    const { provider = "openai", waitMs = 180000 } = args as {
+      provider?: "openai" | "anthropic";
+      waitMs?: number;
+    };
+
+    if (provider === "openai") {
+      const core = await import("@mandujs/core");
+      const auth = new core.ChatGPTAuth();
+      const existing = auth.locateAuthFile();
+      if (existing) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(
+                {
+                  ok: true,
+                  provider: "openai",
+                  already_authenticated: true,
+                  auth_file: existing,
+                  note:
+                    "ChatGPT session already present. Call mandu.brain.logout + mandu.brain.login again to re-authenticate.",
+                },
+                null,
+                2,
+              ),
+            },
+          ],
+        };
+      }
+
+      // Spawn `npx @openai/codex login` detached from the MCP process.
+      // Codex itself opens the user's default browser (`start` on
+      // Windows, `open` on macOS, `xdg-open` on Linux) — no TTY needed
+      // on our side. We poll for ~/.codex/auth.json to appear and
+      // return once it does.
+      const { spawn } = await import("node:child_process");
+      const child = spawn("npx", ["-y", "@openai/codex", "login"], {
+        cwd: projectRoot,
+        detached: false,
+        stdio: ["ignore", "pipe", "pipe"],
+        shell: process.platform === "win32",
+      });
+
+      let stdoutBuffer = "";
+      let stderrBuffer = "";
+      child.stdout?.on("data", (d) => {
+        stdoutBuffer += d.toString();
+      });
+      child.stderr?.on("data", (d) => {
+        stderrBuffer += d.toString();
+      });
+
+      const deadline = Date.now() + Math.max(15_000, Math.min(waitMs, 600_000));
+      let file: string | null = null;
+      while (Date.now() < deadline) {
+        file = auth.locateAuthFile();
+        if (file) break;
+        await new Promise((r) => setTimeout(r, 1000));
+      }
+
+      // Kill the codex process if it's still running (normally it exits
+      // on its own once auth.json is written).
+      if (!child.killed) {
+        try { child.kill(); } catch { /* ignore */ }
+      }
+
+      const urlMatch = stdoutBuffer.match(
+        /https:\/\/auth\.openai\.com\/oauth\/authorize\?[^\s]+/,
+      );
+
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify(
+              {
+                ok: Boolean(file),
+                provider: "openai",
+                auth_file: file,
+                oauth_url: urlMatch ? urlMatch[0] : undefined,
+                stdout_tail: stdoutBuffer.slice(-500),
+                stderr_tail: stderrBuffer.slice(-500),
+                note: file
+                  ? "auth.json written; Mandu brain will now use the OpenAI tier."
+                  : "No auth.json detected before waitMs expired. If the OAuth URL is present above, open it in a browser; otherwise rerun with a larger waitMs or run `npx @openai/codex login` in your own terminal.",
+              },
+              null,
+              2,
+            ),
+          },
+        ],
+      };
+    }
+
+    // Anthropic — Mandu-managed OAuth loopback flow.
+    const core = await import("@mandujs/core");
+    try {
+      const adapter = new core.AnthropicOAuthAdapter({
+        credentialStore: core.getCredentialStore(),
+        projectRoot,
+        strict: true,
+        skipConsent: true,
+      });
+      const token = await adapter.login({});
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify(
+              {
+                ok: true,
+                provider: "anthropic",
+                model: token.default_model ?? null,
+                expires_at: token.expires_at
+                  ? new Date(token.expires_at * 1000).toISOString()
+                  : null,
+              },
+              null,
+              2,
+            ),
+          },
+        ],
+      };
+    } catch (err) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify(
+              {
+                ok: false,
+                provider: "anthropic",
+                error: err instanceof Error ? err.message : String(err),
+              },
+              null,
+              2,
+            ),
+          },
+        ],
+      };
+    }
+  };
+
+  handlers["mandu.brain.logout"] = async (args) => {
+    const { provider = "all" } = args as {
+      provider?: "openai" | "anthropic" | "all";
+    };
+    const core = await import("@mandujs/core");
+    const store = core.getCredentialStore();
+    const targets =
+      provider === "all"
+        ? (["openai", "anthropic"] as const)
+        : ([provider] as const);
+    for (const p of targets) {
+      await store.delete(p);
+      await core.revokeConsent(p, projectRoot);
+    }
+    return {
+      content: [
+        {
+          type: "text",
+          text: JSON.stringify(
+            {
+              ok: true,
+              logged_out: targets,
+              note: targets.includes("openai")
+                ? "Keychain-stored openai token cleared. To revoke the Codex CLI session (~/.codex/auth.json), run `npx @openai/codex logout`."
+                : undefined,
+            },
+            null,
+            2,
+          ),
+        },
+      ],
+    };
+  };
+
   // Backward-compatible aliases (deprecated)
   handlers["mandu_doctor"] = handlers["mandu.brain.doctor"];
   handlers["mandu_watch_start"] = handlers["mandu.watch.start"];