@paradigma-inc/flywheel 0.1.4 → 0.1.9

package/src/mcp-writer.mjs

@@ -33,6 +33,77 @@ function normalizeLineEndings(text) {
   return text.replace(/\r\n/g, "\n");
 }
 
+function stripTomlInlineComment(valueText) {
+  let inSingleQuotedString = false;
+  let inDoubleQuotedString = false;
+  let escapeNextChar = false;
+
+  for (let index = 0; index < valueText.length; index += 1) {
+    const char = valueText[index];
+
+    if (escapeNextChar) {
+      escapeNextChar = false;
+      continue;
+    }
+
+    if (inDoubleQuotedString && char === "\\") {
+      escapeNextChar = true;
+      continue;
+    }
+
+    if (!inDoubleQuotedString && char === "'") {
+      inSingleQuotedString = !inSingleQuotedString;
+      continue;
+    }
+
+    if (!inSingleQuotedString && char === '"') {
+      inDoubleQuotedString = !inDoubleQuotedString;
+      continue;
+    }
+
+    if (!inSingleQuotedString && !inDoubleQuotedString && char === "#") {
+      return valueText.slice(0, index).trim();
+    }
+  }
+
+  return valueText.trim();
+}
+
+function parseTomlStringValue(valueText) {
+  const stripped = stripTomlInlineComment(valueText);
+  if (!stripped) {
+    return null;
+  }
+
+  if (stripped.startsWith('"""') && stripped.endsWith('"""') && stripped.length >= 6) {
+    return stripped.slice(3, -3);
+  }
+
+  if (stripped.startsWith("'''") && stripped.endsWith("'''") && stripped.length >= 6) {
+    return stripped.slice(3, -3);
+  }
+
+  if (stripped.startsWith('"') && stripped.endsWith('"')) {
+    try {
+      return JSON.parse(stripped);
+    } catch {
+      return stripped.slice(1, -1);
+    }
+  }
+
+  if (stripped.startsWith("'") && stripped.endsWith("'")) {
+    return stripped.slice(1, -1);
+  }
+
+  return stripped;
+}
+
+function parseTomlSectionName(lineText) {
+  const withoutComment = stripTomlInlineComment(String(lineText || "").trim());
+  const sectionMatch = withoutComment.match(/^\[(.+)\]$/);
+  return sectionMatch ? sectionMatch[1] : null;
+}
+
 export async function readJsonConfig(filePath) {
   let raw;
   try {
@@ -120,6 +191,15 @@ function readConfigSection(config, configKey) {
   return current;
 }
 
+export function readNamedConfigEntry(config, configKey, serverName) {
+  const section = readConfigSection(config, configKey);
+  const entry = section[serverName];
+  if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+    return null;
+  }
+  return entry;
+}
+
 function writeConfigSection(config, configKey, section) {
   const pathParts = keyPath(configKey);
   if (pathParts.length === 0) return config || {};
@@ -182,6 +262,52 @@ export async function readTomlServerExists(filePath, serverName) {
   }
 }
 
+export async function readTomlServerEntry(filePath, serverName) {
+  let raw = "";
+  try {
+    raw = await readFile(filePath, "utf8");
+  } catch {
+    return { exists: false, url: null };
+  }
+
+  const normalized = normalizeLineEndings(raw);
+  const lines = normalized.split("\n");
+  const targetSection = `mcp_servers.${serverName}`;
+  let inTargetSection = false;
+  let exists = false;
+  let url = null;
+
+  for (const line of lines) {
+    const trimmed = line.trim();
+    const sectionName = parseTomlSectionName(trimmed);
+
+    if (sectionName) {
+      if (sectionName === targetSection) {
+        exists = true;
+        inTargetSection = true;
+        continue;
+      }
+
+      if (exists && !sectionName.startsWith(`${targetSection}.`)) {
+        break;
+      }
+
+      inTargetSection = false;
+      continue;
+    }
+
+    if (!inTargetSection) continue;
+
+    const withoutComment = stripTomlInlineComment(trimmed);
+    const urlMatch = withoutComment.match(/^url\s*=\s*(.+)$/);
+    if (!urlMatch) continue;
+
+    url = parseTomlStringValue(urlMatch[1]);
+  }
+
+  return { exists, url };
+}
+
 export function buildTomlServerBlock(serverName, entry) {
   const lines = [`[mcp_servers.${serverName}]`];
   const headers =
@@ -242,10 +368,9 @@ function stripCodexTomlServerBlock({ tomlText, serverName }) {
 
   for (const line of lines) {
     const trimmed = line.trim();
-    const sectionMatch = trimmed.match(/^\[(.+)\]$/);
+    const sectionName = parseTomlSectionName(trimmed);
 
-    if (sectionMatch) {
-      const sectionName = sectionMatch[1];
+    if (sectionName) {
       const isTargetSection =
         sectionName === `mcp_servers.${serverName}` ||
         sectionName.startsWith(`mcp_servers.${serverName}.`);

package/src/setup-auth.mjs

@@ -3,6 +3,8 @@ import http from "node:http";
 import { spawn } from "node:child_process";
 
 const DEFAULT_AUTH_TIMEOUT_MS = 5 * 60 * 1000;
+const MIN_POLL_DELAY_MS = 1000;
+const MAX_POLL_DELAY_MS = 10_000;
 
 function openUrlInBrowser(url) {
   const platform = process.platform;
@@ -32,6 +34,39 @@ function renderCallbackPage({ ok, message }) {
 </html>`;
 }
 
+function resolveErrorMessage(payload, fallback) {
+  if (!payload || typeof payload !== "object") {
+    return fallback;
+  }
+  const detail = payload.detail;
+  if (typeof detail === "string" && detail.trim()) {
+    return detail.trim();
+  }
+  if (detail && typeof detail === "object") {
+    const message = detail.message;
+    if (typeof message === "string" && message.trim()) {
+      return message.trim();
+    }
+  }
+  return fallback;
+}
+
+async function parseJsonResponse(response) {
+  let payload = {};
+  try {
+    payload = await response.json();
+  } catch {
+    payload = {};
+  }
+  return payload;
+}
+
+function nonEmptyString(value) {
+  if (typeof value !== "string") return null;
+  const candidate = value.trim();
+  return candidate ? candidate : null;
+}
+
 async function redeemSetupExchangeToken({
   baseUrl,
   exchangeToken,
@@ -54,38 +89,163 @@ async function redeemSetupExchangeToken({
       redirect_uri: redirectUri,
     }),
   });
-  let payload = {};
-  try {
-    payload = await response.json();
-  } catch {
-    payload = {};
-  }
+  const payload = await parseJsonResponse(response);
   if (!response.ok) {
-    const detail = resolveRedeemErrorMessage(payload);
+    const detail = resolveErrorMessage(payload, "Setup exchange redemption failed.");
     throw new Error(detail);
   }
-  const key = (payload?.key || "").trim();
+  const key = nonEmptyString(payload?.key);
   if (!key) {
     throw new Error("Setup exchange response missing API key.");
   }
   return { apiKey: key };
 }
 
-function resolveRedeemErrorMessage(payload) {
-  if (!payload || typeof payload !== "object") {
-    return "Setup exchange redemption failed.";
+async function startSetupDeviceSession({
+  baseUrl,
+  keyName,
+  verificationBaseUrl,
+}) {
+  const startUrl = new URL("/api/auth/mcp-api-keys/setup-device/start", baseUrl);
+  const response = await fetch(startUrl, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      "Idempotency-Key": `setup-device-start:${crypto.randomUUID()}`,
+    },
+    body: JSON.stringify({
+      name: keyName,
+      verification_base_url: verificationBaseUrl,
+    }),
+  });
+  const payload = await parseJsonResponse(response);
+  if (!response.ok) {
+    const detail = resolveErrorMessage(payload, "Failed to start setup device flow.");
+    throw new Error(detail);
   }
-  const detail = payload.detail;
-  if (typeof detail === "string" && detail.trim()) {
-    return detail.trim();
+
+  const deviceCode = nonEmptyString(payload.device_code);
+  const userCode = nonEmptyString(payload.user_code);
+  const verificationUri = nonEmptyString(payload.verification_uri);
+  const verificationUriComplete = nonEmptyString(payload.verification_uri_complete);
+  const pollIntervalSeconds = Number(payload.poll_interval_seconds);
+  const expiresInSeconds = Number(payload.expires_in_seconds);
+
+  if (!deviceCode || !userCode || !verificationUri || !verificationUriComplete) {
+    throw new Error("Setup device session response missing required fields.");
   }
-  if (detail && typeof detail === "object") {
-    const message = detail.message;
-    if (typeof message === "string" && message.trim()) {
-      return message.trim();
+  if (
+    !Number.isFinite(pollIntervalSeconds) ||
+    pollIntervalSeconds <= 0 ||
+    !Number.isFinite(expiresInSeconds) ||
+    expiresInSeconds <= 0
+  ) {
+    throw new Error("Setup device session response contained invalid timing values.");
+  }
+
+  return {
+    deviceCode,
+    userCode,
+    verificationUri,
+    verificationUriComplete,
+    pollIntervalSeconds: Math.floor(pollIntervalSeconds),
+    expiresInSeconds: Math.floor(expiresInSeconds),
+  };
+}
+
+async function pollSetupDeviceSession({ baseUrl, userCode, deviceCode }) {
+  const pollUrl = new URL("/api/auth/mcp-api-keys/setup-device/poll", baseUrl);
+  const response = await fetch(pollUrl, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      "Idempotency-Key": `setup-device-poll:${deviceCode}:${Date.now()}`,
+    },
+    body: JSON.stringify({
+      user_code: userCode,
+      device_code: deviceCode,
+    }),
+  });
+  if (response.status === 404) {
+    return { status: "expired", pollIntervalSeconds: 0 };
+  }
+  const payload = await parseJsonResponse(response);
+  if (!response.ok) {
+    const detail = resolveErrorMessage(payload, "Setup device polling failed.");
+    throw new Error(detail);
+  }
+
+  const status = nonEmptyString(payload.status);
+  const pollIntervalSeconds = Number(payload.poll_interval_seconds);
+  if (!status || !Number.isFinite(pollIntervalSeconds) || pollIntervalSeconds <= 0) {
+    throw new Error("Setup device poll response missing required status fields.");
+  }
+  if (status === "pending") {
+    return {
+      status,
+      pollIntervalSeconds: Math.floor(pollIntervalSeconds),
+    };
+  }
+  if (status === "approved") {
+    const key = nonEmptyString(payload.key);
+    if (!key) {
+      throw new Error("Setup device poll response missing API key.");
+    }
+    return {
+      status,
+      pollIntervalSeconds: Math.floor(pollIntervalSeconds),
+      apiKey: key,
+    };
+  }
+  throw new Error(`Unsupported setup device session status: ${status}`);
+}
+
+function pollDelayMs({ pollIntervalSeconds, attempt }) {
+  const baseMs = Math.max(
+    MIN_POLL_DELAY_MS,
+    Math.floor(pollIntervalSeconds * 1000),
+  );
+  const rampMs = Math.min(5000, attempt * 250);
+  const jitterMs = Math.floor(Math.random() * 250);
+  return Math.min(MAX_POLL_DELAY_MS, baseMs + rampMs + jitterMs);
+}
+
+function defaultSleep(ms) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+
+function launchBrowser(openUrl, url) {
+  try {
+    const child = openUrl(url);
+    if (child && typeof child.once === "function") {
+      child.once("error", () => {
+        // URL is printed to stdout; opener failures should not abort setup.
+      });
+    }
+    if (child && typeof child.unref === "function") {
+      child.unref();
     }
+  } catch {
+    // User can still open URL manually.
   }
-  return "Setup exchange redemption failed.";
+}
+
+export function resolveSetupAuthMode({ requestedMode, env = process.env }) {
+  const normalizedRequested = String(requestedMode || "auto")
+    .trim()
+    .toLowerCase();
+
+  if (normalizedRequested === "device" || normalizedRequested === "loopback") {
+    return normalizedRequested;
+  }
+
+  const isRemoteShell =
+    nonEmptyString(env.SSH_CONNECTION) ||
+    nonEmptyString(env.SSH_CLIENT) ||
+    nonEmptyString(env.SSH_TTY);
+  return isRemoteShell ? "device" : "loopback";
 }
 
 export async function acquireApiKeyViaBrowserBridge({
@@ -221,14 +381,7 @@ export async function acquireApiKeyViaBrowserBridge({
       console.log("Opening browser for Flywheel login and key creation...");
       console.log(`If it does not open, use this URL:\n${setupUrl.toString()}\n`);
 
-      try {
-        const child = openUrl(setupUrl.toString());
-        if (child && typeof child.unref === "function") {
-          child.unref();
-        }
-      } catch {
-        // User can still open URL manually.
-      }
+      launchBrowser(openUrl, setupUrl.toString());
     });
 
     timeout = setTimeout(() => {
@@ -236,3 +389,54 @@ export async function acquireApiKeyViaBrowserBridge({
     }, timeoutMs);
   });
 }
+
+export async function acquireApiKeyViaDeviceFlow({
+  baseUrl,
+  keyName,
+  verificationBaseUrl = baseUrl,
+  timeoutMs = DEFAULT_AUTH_TIMEOUT_MS,
+  openUrl = openUrlInBrowser,
+  sleep = defaultSleep,
+}) {
+  const startedAt = Date.now();
+  const session = await startSetupDeviceSession({
+    baseUrl,
+    keyName,
+    verificationBaseUrl,
+  });
+
+  console.log("Opening browser for Flywheel device authorization...");
+  console.log(`Approval URL:\n${session.verificationUriComplete}\n`);
+  console.log(`Code: ${session.userCode}`);
+  console.log(
+    "If the page does not open automatically, open the URL above and approve this code.\n",
+  );
+
+  launchBrowser(openUrl, session.verificationUriComplete);
+
+  let attempt = 0;
+  while (Date.now() - startedAt < timeoutMs) {
+    // eslint-disable-next-line no-await-in-loop
+    const pollResult = await pollSetupDeviceSession({
+      baseUrl,
+      userCode: session.userCode,
+      deviceCode: session.deviceCode,
+    });
+    if (pollResult.status === "approved") {
+      return { apiKey: pollResult.apiKey };
+    }
+    if (pollResult.status === "expired") {
+      throw new Error("Setup device session expired. Please rerun setup.");
+    }
+
+    attempt += 1;
+    const delayMs = pollDelayMs({
+      pollIntervalSeconds: pollResult.pollIntervalSeconds,
+      attempt,
+    });
+    // eslint-disable-next-line no-await-in-loop
+    await sleep(delayMs);
+  }
+
+  throw new Error("Timed out waiting for device authorization.");
+}