@paradigma-inc/flywheel 0.1.0 → 0.1.4

package/src/mcp-writer.mjs

@@ -1,5 +1,6 @@
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { access, mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
+import { load as loadYaml, dump as dumpYaml } from "js-yaml";
 
 function stripJsonComments(text) {
   let result = "";
@@ -8,32 +9,40 @@ function stripJsonComments(text) {
     if (text[i] === '"') {
       const start = i++;
       while (i < text.length && text[i] !== '"') {
-        if (text[i] === "\\") i++;
-        i++;
+        if (text[i] === "\\") i += 1;
+        i += 1;
       }
       result += text.slice(start, ++i);
     } else if (text[i] === "/" && text[i + 1] === "/") {
       i += 2;
-      while (i < text.length && text[i] !== "\n") i++;
+      while (i < text.length && text[i] !== "\n") i += 1;
     } else if (text[i] === "/" && text[i + 1] === "*") {
       i += 2;
-      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/")) i++;
+      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/"))
+        i += 1;
       i += 2;
     } else {
-      result += text[i++];
+      result += text[i];
+      i += 1;
     }
   }
   return result;
 }
 
+function normalizeLineEndings(text) {
+  return text.replace(/\r\n/g, "\n");
+}
+
 export async function readJsonConfig(filePath) {
+  let raw;
   try {
-    const raw = (await readFile(filePath, "utf8")).trim();
-    if (!raw) return {};
-    return JSON.parse(stripJsonComments(raw));
+    raw = await readFile(filePath, "utf8");
   } catch {
     return {};
   }
+  const trimmed = raw.trim();
+  if (!trimmed) return {};
+  return JSON.parse(stripJsonComments(trimmed));
 }
 
 export async function writeJsonConfig(filePath, config) {
@@ -44,79 +53,190 @@ export async function writeJsonConfig(filePath, config) {
   });
 }
 
-function stableJson(value) {
-  return JSON.stringify(value, Object.keys(value || {}).sort());
+export async function readYamlConfig(filePath) {
+  let raw;
+  try {
+    raw = await readFile(filePath, "utf8");
+  } catch {
+    return {};
+  }
+  const trimmed = raw.trim();
+  if (!trimmed) return {};
+
+  try {
+    const parsed = loadYaml(trimmed);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed;
+    }
+    return {};
+  } catch {
+    return {};
+  }
 }
 
-export function upsertJsonServerEntry({ config, configKey, serverName, entry }) {
-  const section =
-    config && typeof config[configKey] === "object" && config[configKey] !== null
-      ? { ...config[configKey] }
+export async function writeYamlConfig(filePath, config) {
+  await mkdir(path.dirname(filePath), { recursive: true });
+  await writeFile(filePath, dumpYaml(config, { noRefs: true }), {
+    encoding: "utf8",
+    mode: 0o600,
+  });
+}
+
+export async function resolveMcpPath(candidates) {
+  for (const candidate of candidates) {
+    try {
+      // eslint-disable-next-line no-await-in-loop
+      await access(candidate);
+      return candidate;
+    } catch {
+      // keep searching
+    }
+  }
+  return candidates[0];
+}
+
+function keyPath(configKey) {
+  return Array.isArray(configKey) ? configKey : [configKey];
+}
+
+function readConfigSection(config, configKey) {
+  const pathParts = keyPath(configKey);
+  let current = config && typeof config === "object" ? config : {};
+  for (const part of pathParts) {
+    if (
+      !current ||
+      typeof current !== "object" ||
+      Array.isArray(current) ||
+      !(part in current)
+    ) {
+      return {};
+    }
+    const next = current[part];
+    if (!next || typeof next !== "object" || Array.isArray(next)) {
+      return {};
+    }
+    current = next;
+  }
+  return current;
+}
+
+function writeConfigSection(config, configKey, section) {
+  const pathParts = keyPath(configKey);
+  if (pathParts.length === 0) return config || {};
+
+  const root =
+    config && typeof config === "object" && !Array.isArray(config)
+      ? { ...config }
       : {};
-  const previous = section[serverName] ?? null;
-  section[serverName] = entry;
-  const nextConfig = {
-    ...(config || {}),
-    [configKey]: section,
-  };
+  let cursor = root;
+
+  for (let index = 0; index < pathParts.length - 1; index += 1) {
+    const part = pathParts[index];
+    const existing = cursor[part];
+    cursor[part] =
+      existing && typeof existing === "object" && !Array.isArray(existing)
+        ? { ...existing }
+        : {};
+    cursor = cursor[part];
+  }
+  cursor[pathParts[pathParts.length - 1]] = section;
+  return root;
+}
+
+export function mergeServerEntry(existing, configKey, serverName, entry) {
+  const section = readConfigSection(existing, configKey);
+
+  if (serverName in section) {
+    return { config: existing, alreadyExists: true };
+  }
 
-  const changed = stableJson(previous) !== stableJson(entry);
   return {
-    config: nextConfig,
-    changed,
-    hadExisting: previous !== null,
+    config: writeConfigSection(existing, configKey, {
+      ...section,
+      [serverName]: entry,
+    }),
+    alreadyExists: false,
   };
 }
 
 export function removeJsonServerEntry({ config, configKey, serverName }) {
-  const section =
-    config && typeof config[configKey] === "object" && config[configKey] !== null
-      ? { ...config[configKey] }
-      : {};
+  const section = { ...readConfigSection(config, configKey) };
+
   if (!(serverName in section)) {
-    return {
-      config: config || {},
-      changed: false,
-    };
+    return { config: config || {}, changed: false };
   }
+
   delete section[serverName];
-  const nextConfig = {
-    ...(config || {}),
-    [configKey]: section,
-  };
   return {
-    config: nextConfig,
+    config: writeConfigSection(config, configKey, section),
     changed: true,
   };
 }
 
-function normalizeLineEndings(text) {
-  return text.replace(/\r\n/g, "\n");
+export async function readTomlServerExists(filePath, serverName) {
+  try {
+    const raw = await readFile(filePath, "utf8");
+    return raw.includes(`[mcp_servers.${serverName}]`);
+  } catch {
+    return false;
+  }
 }
 
-export function buildCodexTomlServerBlock({ serverName, entry }) {
+export function buildTomlServerBlock(serverName, entry) {
   const lines = [`[mcp_servers.${serverName}]`];
-  lines.push(`type = ${JSON.stringify(entry.type)}`);
-  lines.push(`url = ${JSON.stringify(entry.url)}`);
+  const headers =
+    entry && typeof entry.headers === "object" && entry.headers !== null
+      ? entry.headers
+      : null;
+
+  for (const [key, value] of Object.entries(entry || {})) {
+    if (key === "headers") continue;
+    lines.push(`${key} = ${JSON.stringify(value)}`);
+  }
 
-  const headers = entry.headers && typeof entry.headers === "object" ? entry.headers : {};
-  const headerEntries = Object.entries(headers);
-  if (headerEntries.length > 0) {
+  if (headers && Object.keys(headers).length > 0) {
     lines.push("");
     lines.push(`[mcp_servers.${serverName}.http_headers]`);
-    for (const [key, value] of headerEntries) {
-      lines.push(`${key} = ${JSON.stringify(String(value))}`);
+    for (const [headerKey, headerValue] of Object.entries(headers)) {
+      lines.push(`${headerKey} = ${JSON.stringify(String(headerValue))}`);
     }
   }
 
   return `${lines.join("\n")}\n`;
 }
 
+export async function appendTomlServer(filePath, serverName, entry) {
+  if (await readTomlServerExists(filePath, serverName)) {
+    return { alreadyExists: true };
+  }
+
+  const block = buildTomlServerBlock(serverName, entry);
+
+  let existing = "";
+  try {
+    existing = await readFile(filePath, "utf8");
+  } catch {
+    existing = "";
+  }
+
+  const separator =
+    existing.length > 0 && !existing.endsWith("\n")
+      ? "\n\n"
+      : existing.length > 0
+        ? "\n"
+        : "";
+  await mkdir(path.dirname(filePath), { recursive: true });
+  await writeFile(filePath, `${existing}${separator}${block}`, {
+    encoding: "utf8",
+    mode: 0o600,
+  });
+  return { alreadyExists: false };
+}
+
 function stripCodexTomlServerBlock({ tomlText, serverName }) {
   const normalized = normalizeLineEndings(tomlText || "");
   const lines = normalized.split("\n");
   const output = [];
-
   let skipping = false;
   let removed = false;
 
@@ -146,37 +266,10 @@ function stripCodexTomlServerBlock({ tomlText, serverName }) {
 
   let stripped = output.join("\n");
   stripped = stripped.replace(/\n{3,}/g, "\n\n").trimEnd();
-  if (stripped.length > 0) {
-    stripped += "\n";
-  }
+  if (stripped.length > 0) stripped += "\n";
   return { stripped, removed };
 }
 
-export async function upsertCodexTomlServer({ filePath, serverName, entry }) {
-  let existing = "";
-  try {
-    existing = await readFile(filePath, "utf8");
-  } catch {
-    existing = "";
-  }
-
-  const { stripped, removed } = stripCodexTomlServerBlock({
-    tomlText: existing,
-    serverName,
-  });
-  const block = buildCodexTomlServerBlock({ serverName, entry });
-  const separator = stripped.length > 0 ? "\n" : "";
-  const next = `${stripped}${separator}${block}`;
-
-  await mkdir(path.dirname(filePath), { recursive: true });
-  await writeFile(filePath, next, { encoding: "utf8", mode: 0o600 });
-
-  return {
-    changed: normalizeLineEndings(existing) !== normalizeLineEndings(next),
-    hadExisting: removed,
-  };
-}
-
 export async function removeCodexTomlServer({ filePath, serverName }) {
   let existing = "";
   try {
@@ -189,9 +282,7 @@ export async function removeCodexTomlServer({ filePath, serverName }) {
     tomlText: existing,
     serverName,
   });
-  if (!removed) {
-    return { changed: false };
-  }
+  if (!removed) return { changed: false };
 
   await mkdir(path.dirname(filePath), { recursive: true });
   await writeFile(filePath, stripped, { encoding: "utf8", mode: 0o600 });

package/src/setup-auth.mjs

@@ -32,10 +32,67 @@ function renderCallbackPage({ ok, message }) {
 </html>`;
 }
 
+async function redeemSetupExchangeToken({
+  baseUrl,
+  exchangeToken,
+  state,
+  redirectUri,
+}) {
+  const redeemUrl = new URL(
+    "/api/auth/mcp-api-keys/setup-exchange/redeem",
+    baseUrl,
+  );
+  const response = await fetch(redeemUrl, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      "Idempotency-Key": `setup-redeem:${state}`,
+    },
+    body: JSON.stringify({
+      exchange_token: exchangeToken,
+      state,
+      redirect_uri: redirectUri,
+    }),
+  });
+  let payload = {};
+  try {
+    payload = await response.json();
+  } catch {
+    payload = {};
+  }
+  if (!response.ok) {
+    const detail = resolveRedeemErrorMessage(payload);
+    throw new Error(detail);
+  }
+  const key = (payload?.key || "").trim();
+  if (!key) {
+    throw new Error("Setup exchange response missing API key.");
+  }
+  return { apiKey: key };
+}
+
+function resolveRedeemErrorMessage(payload) {
+  if (!payload || typeof payload !== "object") {
+    return "Setup exchange redemption failed.";
+  }
+  const detail = payload.detail;
+  if (typeof detail === "string" && detail.trim()) {
+    return detail.trim();
+  }
+  if (detail && typeof detail === "object") {
+    const message = detail.message;
+    if (typeof message === "string" && message.trim()) {
+      return message.trim();
+    }
+  }
+  return "Setup exchange redemption failed.";
+}
+
 export async function acquireApiKeyViaBrowserBridge({
   baseUrl,
   keyName,
   timeoutMs = DEFAULT_AUTH_TIMEOUT_MS,
+  openUrl = openUrlInBrowser,
 }) {
   const state = crypto.randomUUID();
 
@@ -43,6 +100,7 @@ export async function acquireApiKeyViaBrowserBridge({
     let settled = false;
     let timeout = null;
     let server = null;
+    let callbackUrl = "";
 
     const cleanup = () => {
       if (timeout) {
@@ -51,6 +109,8 @@ export async function acquireApiKeyViaBrowserBridge({
       }
       if (server) {
         server.close();
+        server.closeAllConnections?.();
+        server.closeIdleConnections?.();
         server = null;
       }
     };
@@ -69,7 +129,7 @@ export async function acquireApiKeyViaBrowserBridge({
       resolve(result);
     };
 
-    server = http.createServer((req, res) => {
+    server = http.createServer(async (req, res) => {
       const reqUrl = new URL(req.url || "/", "http://127.0.0.1");
       if (reqUrl.pathname !== "/callback") {
         res.writeHead(404, { "Content-Type": "text/plain" });
@@ -78,7 +138,9 @@ export async function acquireApiKeyViaBrowserBridge({
       }
 
       const callbackState = (reqUrl.searchParams.get("state") || "").trim();
-      const key = (reqUrl.searchParams.get("key") || "").trim();
+      const exchangeToken = (
+        reqUrl.searchParams.get("exchange_token") || ""
+      ).trim();
       const error = (reqUrl.searchParams.get("error") || "").trim();
 
       if (callbackState !== state) {
@@ -100,15 +162,32 @@ export async function acquireApiKeyViaBrowserBridge({
         return;
       }
 
-      if (!key) {
+      if (!exchangeToken) {
         res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
         res.end(
           renderCallbackPage({
             ok: false,
-            message: "No API key was returned.",
+            message: "No setup exchange token was returned.",
           }),
         );
-        fail(new Error("Setup callback missing API key."));
+        fail(new Error("Setup callback missing exchange token."));
+        return;
+      }
+
+      let redeemed;
+      try {
+        redeemed = await redeemSetupExchangeToken({
+          baseUrl,
+          exchangeToken,
+          state,
+          redirectUri: callbackUrl,
+        });
+      } catch (err) {
+        const message =
+          err instanceof Error ? err.message : "Failed to redeem setup exchange.";
+        res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(renderCallbackPage({ ok: false, message }));
+        fail(new Error(message));
         return;
       }
 
@@ -119,7 +198,7 @@ export async function acquireApiKeyViaBrowserBridge({
           message: "Flywheel MCP was authorized successfully.",
         }),
       );
-      succeed({ apiKey: key });
+      succeed({ apiKey: redeemed.apiKey });
     });
 
     server.once("error", (error) => {
@@ -133,7 +212,7 @@ export async function acquireApiKeyViaBrowserBridge({
         return;
       }
 
-      const callbackUrl = `http://127.0.0.1:${address.port}/callback`;
+      callbackUrl = `http://127.0.0.1:${address.port}/callback`;
       const setupUrl = new URL("/auth/mcp/setup", baseUrl);
       setupUrl.searchParams.set("state", state);
       setupUrl.searchParams.set("redirect_uri", callbackUrl);
@@ -143,8 +222,10 @@ export async function acquireApiKeyViaBrowserBridge({
       console.log(`If it does not open, use this URL:\n${setupUrl.toString()}\n`);
 
       try {
-        const child = openUrlInBrowser(setupUrl.toString());
-        child.unref();
+        const child = openUrl(setupUrl.toString());
+        if (child && typeof child.unref === "function") {
+          child.unref();
+        }
       } catch {
         // User can still open URL manually.
       }

package/tests/mcp-writer.test.mjs

@@ -1,117 +0,0 @@
-import { mkdtemp, readFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import assert from "node:assert/strict";
-import test from "node:test";
-
-import {
-  removeCodexTomlServer,
-  removeJsonServerEntry,
-  upsertCodexTomlServer,
-  upsertJsonServerEntry,
-  writeJsonConfig,
-  readJsonConfig,
-} from "../src/mcp-writer.mjs";
-
-test("upsertJsonServerEntry installs and removes server entries", async () => {
-  const initial = {
-    mcpServers: {
-      other: {
-        url: "http://localhost/other",
-      },
-    },
-  };
-
-  const inserted = upsertJsonServerEntry({
-    config: initial,
-    configKey: "mcpServers",
-    serverName: "flywheel",
-    entry: {
-      type: "http",
-      url: "https://flywheel.paradigma.inc/mcp-server",
-    },
-  });
-
-  assert.equal(inserted.changed, true);
-  assert.equal(inserted.hadExisting, false);
-  assert.equal(inserted.config.mcpServers.flywheel.type, "http");
-
-  const removed = removeJsonServerEntry({
-    config: inserted.config,
-    configKey: "mcpServers",
-    serverName: "flywheel",
-  });
-  assert.equal(removed.changed, true);
-  assert.equal("flywheel" in removed.config.mcpServers, false);
-  assert.equal("other" in removed.config.mcpServers, true);
-});
-
-test("codex toml writer replaces flywheel block idempotently", async () => {
-  const tempDir = await mkdtemp(path.join(os.tmpdir(), "flywheel-mcp-writer-"));
-  const filePath = path.join(tempDir, "config.toml");
-
-  const first = await upsertCodexTomlServer({
-    filePath,
-    serverName: "flywheel",
-    entry: {
-      type: "http",
-      url: "https://flywheel.paradigma.inc/mcp-server",
-      headers: {
-        Authorization: "Bearer one",
-      },
-    },
-  });
-  assert.equal(first.changed, true);
-
-  const second = await upsertCodexTomlServer({
-    filePath,
-    serverName: "flywheel",
-    entry: {
-      type: "http",
-      url: "https://flywheel.paradigma.inc/mcp-server",
-      headers: {
-        Authorization: "Bearer two",
-      },
-    },
-  });
-  assert.equal(second.changed, true);
-  assert.equal(second.hadExisting, true);
-
-  const text = await readFile(filePath, "utf8");
-  assert.equal(
-    text.includes("Authorization = \"Bearer two\""),
-    true,
-    "updated token should be present",
-  );
-  assert.equal(
-    text.includes("Authorization = \"Bearer one\""),
-    false,
-    "old token should not survive repeated setup",
-  );
-
-  const removed = await removeCodexTomlServer({
-    filePath,
-    serverName: "flywheel",
-  });
-  assert.equal(removed.changed, true);
-  const afterRemove = await readFile(filePath, "utf8");
-  assert.equal(afterRemove.includes("[mcp_servers.flywheel]"), false);
-});
-
-test("readJsonConfig/writeJsonConfig round-trip", async () => {
-  const tempDir = await mkdtemp(path.join(os.tmpdir(), "flywheel-mcp-json-"));
-  const filePath = path.join(tempDir, "mcp.json");
-
-  const config = {
-    mcpServers: {
-      flywheel: {
-        type: "http",
-        url: "https://flywheel.paradigma.inc/mcp-server",
-      },
-    },
-  };
-
-  await writeJsonConfig(filePath, config);
-  const loaded = await readJsonConfig(filePath);
-  assert.deepEqual(loaded, config);
-});