@pauhu/mcp 3.0.6 → 3.0.7

package/README.md

@@ -14,7 +14,7 @@ Connect any MCP client to Pauhu. Every answer carries its source.
 }
 ```
 
-On first use Pauhu prints a sign-in link; open it in your browser (new users create an account there). Or set `PAUHU_TOKEN` to a key you already hold.
+No key needed to start: without one the daily try applies. When it is used, the reply says how to continue (a prepaid balance token in `PAUHU_TOKEN`, with the endpoint it names in `PAUHU_MCP_URL`). Set `PAUHU_TOKEN` to a key you already hold to use it from the start. If the service asks for an account, Pauhu prints a sign-in link to open in your browser.
 
 Prices per delivered result: https://api.pauhu.ai/v1/lds/outputs
 

package/bridge.mjs

@@ -5,11 +5,13 @@
  * forwarded over StreamableHTTP to the Pauhu MCP service at PAUHU_MCP_URL, which runs them; what
  * the service lists appears here at once, with no bundle rebuild.
  *
- * Auth: PAUHU_TOKEN, else PAUHU_REFRESH_TOKEN exchanged at auth.pauhu.ai, else OAuth Device Flow.
- * Sign-in is lazy: the stdio server answers initialize at once, and the first request starts the
- * sign-in, waits a bounded time, and otherwise returns the sign-in link as the error so the host
- * can show it. Every credential the bridge holds is redacted from any text it writes and from
- * every result it passes on; sign-in links must be on the auth origin.
+ * Auth: PAUHU_TOKEN, else PAUHU_REFRESH_TOKEN exchanged at auth.pauhu.ai; with neither, the bridge
+ * connects with no key and the service's daily try applies. OAuth Device Flow starts only after the
+ * service answers 401. That sign-in waits a bounded time and otherwise returns the sign-in link as
+ * the error so the host can show it. When the daily try is used (HTTP 429, JSON-RPC -32029, nothing
+ * run or billed) the service's own next steps are passed on, never retried. Every credential the
+ * bridge holds is redacted from any text it writes and from every result it passes on; sign-in
+ * links must be on the auth origin.
  *
  * Retry: list/read/get requests are read-only and are retried once after any failure. tools/call
  * is retried once only when the service cannot have run it: the connect step failed, or the service
@@ -31,7 +33,7 @@ const MCP_URL   = process.env.PAUHU_MCP_URL   ?? "https://api.pauhu.ai/mcp";
 const CALL_MS   = Number(process.env.PAUHU_CALL_TIMEOUT_MS ?? 120_000);
 const AUTH_MS   = 15_000;                            // one token or device-code HTTP call
 const WAIT_MS   = 45_000;                            // how long one request waits for a browser sign-in in progress
-const VERSION   = "3.0.6";
+const VERSION   = "3.0.7";
 
 // An omitted optional user_config can arrive as the literal "${user_config.x}"; that is no value.
 const given = (v) => (v && !v.startsWith("${") ? v : null);
@@ -148,15 +150,17 @@ async function ensureToken() {
     " and then try again");                          // built at the deadline, once the device flow has set the URL
 }
 
+let signInAsked = false;                             // set once the service answered 401; until then no key is sent
+
 let conn = null;                                     // promise of the one upstream client; shared by concurrent requests
 function client() {
   if (conn) return conn;
   const mine = (async () => {
-    const bearer = await ensureToken();
+    const bearer = token || refreshToken || signInAsked ? await ensureToken() : null;
     const c = new Client({ name: "pauhu", version: VERSION }, { capabilities: {} });
     try {
       await withTimeout(c.connect(new StreamableHTTPClientTransport(new URL(MCP_URL), {
-        requestInit: { headers: { Authorization: `Bearer ${bearer}` } },
+        requestInit: { headers: bearer ? { Authorization: `Bearer ${bearer}` } : {} },
       })), 60_000, "Pauhu service did not answer in time");
     } catch (e) {
       try { await c.close(); } catch { /* not open */ }
@@ -183,9 +187,22 @@ async function on(c, fn) {                           // run one request on clien
 
 const status = (e) => (e instanceof UnauthorizedError ? 401 : e instanceof StreamableHTTPError && e.code > 0 ? e.code : null);
 
+// The service's daily-try refusal: HTTP 429 carrying JSON-RPC -32029 and its next steps; nothing was run or billed.
+function tryUsed(e) {
+  if (status(e) !== 429) return null;
+  const at = e.message.indexOf("{");
+  let b = null;
+  try { b = JSON.parse(e.message.slice(at)); } catch { /* not the JSON-RPC body */ }
+  return at >= 0 && b?.error?.code === -32029 && typeof b.error.message === "string" ? b.error : null;
+}
+const BRIDGE_HINT = " With this bridge, put the token in PAUHU_TOKEN and the endpoint in PAUHU_MCP_URL.";
+
 function publicMessage(e) {
   if (e instanceof BridgeError) return e.message;
+  const used = tryUsed(e);
+  if (used) return scrub(used.message).slice(0, 600) + BRIDGE_HINT;   // scrub, not redact: its "Bearer <token>" is a placeholder
   const s = status(e);
+  if (s === 429) return "Pauhu service is busy (HTTP 429); nothing was retried, try again later";
   if (s === 401 || s === 403) return "Pauhu sign-in expired or not permitted; restart the Pauhu extension to sign in again";
   if (s) return `Pauhu service error (HTTP ${s})`;
   if (e instanceof McpError) return redact(e.message);   // the Pauhu server's own JSON-RPC error, e.g. an unknown tool
@@ -205,8 +222,9 @@ async function forward(fn, readOnly) {
   const s = status(first);
   const lost = [ErrorCode.ConnectionClosed, ErrorCode.RequestTimeout];   // no answer arrived: a transport fault
   const answered = first instanceof McpError && !lost.includes(first.code);
-  const safe = !(first instanceof BridgeError) && !answered && (readOnly || first.connectPhase || s === 401 || s === 404);
-  if (!safe) throw first;
+  const safe = !(first instanceof BridgeError) && !answered && s !== 429 && (readOnly || first.connectPhase || s === 401 || s === 404);
+  if (!safe) throw first;                            // a 429 is a stop: the daily try is used or the service is busy
+  if (s === 401) signInAsked = true;                 // the service wants an account: the retry signs in
   if (s === 401 && (first.bearer ?? bearer) === token) {   // refused the current token: refresh once (a refused refresh
     token = null;                                    // token is dropped, so the retry goes to browser sign-in)
     await refresh();
@@ -242,7 +260,9 @@ server.setRequestHandler(CallToolRequestSchema, async (req) => {
   try {
     return scrub(await forward((c) => withTimeout(c.callTool(req.params), CALL_MS, "Pauhu tool call timed out"), false));
   } catch (e) {
-    return { content: [{ type: "text", text: JSON.stringify({ error: publicMessage(e) }) }], isError: true };
+    const steps = tryUsed(e)?.data?.next_steps;      // machine-readable continuation from the service, passed on as is
+    const out = Array.isArray(steps) ? { error: publicMessage(e), next_steps: scrub(steps) } : { error: publicMessage(e) };
+    return { content: [{ type: "text", text: JSON.stringify(out) }], isError: true };
   }
 });
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@pauhu/mcp",
-  "version": "3.0.6",
-  "description": "Pauhu: sourced answers over MCP. Every answer carries its source.",
+  "version": "3.0.7",
+  "description": "Pauhu: sourced answers over MCP. Try with no key (daily try); every answer carries its source.",
   "type": "module",
   "license": "Apache-2.0",
   "author": "Pauhu AI Ltd (https://pauhu.ai)",