@showly/mcp-server 0.4.3 → 0.4.4

package/dist/cli.d.ts

@@ -142,6 +142,17 @@ export declare function buildCodexAuthSnippet(opts: {
 /** Secrets used by the two remote-agent targets the Hero prompt exercises. */
 export declare const OPENCLAW_TOKEN_ENV_VAR = "SHOWLY_MCP_TOKEN";
 export declare const HERMES_TOKEN_ENV_VAR = "MCP_SHOWLY_API_KEY";
+/**
+ * Give every OpenClaw credential its own environment variable name.
+ *
+ * A managed Gateway can keep the old process environment alive while its
+ * user config is reloaded. With one fixed SHOWLY_MCP_TOKEN name, that stale
+ * process value wins over the freshly-written env.vars value and a successful
+ * re-login immediately fails with token_revoked until the whole instance is
+ * restarted. The token fingerprint is not a credential, but makes the new
+ * config reference a name the old process cannot already contain.
+ */
+export declare function openClawTokenEnvVar(token: string): string;
 /**
  * Merge Showly into OpenClaw's user config without disturbing other Gateway
  * settings. The token lives in the Gateway-owned env.vars store; the MCP entry

package/dist/cli.js

@@ -34,6 +34,7 @@ import { readFileSync, readdirSync, mkdirSync, rmSync, writeFileSync, existsSync
 import { dirname, join } from "node:path";
 import { homedir } from "node:os";
 import { pathToFileURL } from "node:url";
+import { createHash } from "node:crypto";
 import { parseDocument } from "yaml";
 import { loadManifest } from "./index.js";
 import { SHOWLY_HOSTING_SKILL_DIRECTORY, SHOWLY_HOSTING_SKILL_NAME, SHOWLY_LEGACY_SKILL_NAME, } from "./showly-hosting-skill.js";
@@ -99,7 +100,7 @@ function usage() {
         "host, pass --agent <cursor|openclaw|hermes|cline> so My Agents can name it.",
         "",
         "Environment overrides:",
-        "  SHOWLY_MCP_URL    full URL to your MCP endpoint (default https://mcp.showly.ai)",
+        "  SHOWLY_MCP_URL    full URL to your MCP endpoint (default https://mcp.showly.ai/mcp)",
         "  SHOWLY_API_URL    full URL to your API (default https://api.showly.ai)",
         "",
         "--with-skill installs a reusable showly-hosting skill for Claude Code or Codex.",
@@ -490,6 +491,24 @@ export function buildCodexAuthSnippet(opts) {
 /** Secrets used by the two remote-agent targets the Hero prompt exercises. */
 export const OPENCLAW_TOKEN_ENV_VAR = "SHOWLY_MCP_TOKEN";
 export const HERMES_TOKEN_ENV_VAR = "MCP_SHOWLY_API_KEY";
+/**
+ * Give every OpenClaw credential its own environment variable name.
+ *
+ * A managed Gateway can keep the old process environment alive while its
+ * user config is reloaded. With one fixed SHOWLY_MCP_TOKEN name, that stale
+ * process value wins over the freshly-written env.vars value and a successful
+ * re-login immediately fails with token_revoked until the whole instance is
+ * restarted. The token fingerprint is not a credential, but makes the new
+ * config reference a name the old process cannot already contain.
+ */
+export function openClawTokenEnvVar(token) {
+    const fingerprint = createHash("sha256")
+        .update(token)
+        .digest("hex")
+        .slice(0, 12)
+        .toUpperCase();
+    return `${OPENCLAW_TOKEN_ENV_VAR}_${fingerprint}`;
+}
 function asRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value)
         ? value
@@ -509,11 +528,14 @@ export function buildOpenClawAuthConfig(opts) {
     const currentShowly = asRecord(servers.showly);
     const currentHeaders = asRecord(currentShowly.headers);
     const { auth: _nativeOauth, ...showlyWithoutOauth } = currentShowly;
+    const tokenEnvVar = openClawTokenEnvVar(opts.token);
+    const varsWithoutOldShowlyTokens = Object.fromEntries(Object.entries(vars).filter(([name]) => name !== OPENCLAW_TOKEN_ENV_VAR &&
+        !name.startsWith(`${OPENCLAW_TOKEN_ENV_VAR}_`)));
     return {
         ...opts.existing,
         env: {
             ...env,
-            vars: { ...vars, [OPENCLAW_TOKEN_ENV_VAR]: opts.token },
+            vars: { ...varsWithoutOldShowlyTokens, [tokenEnvVar]: opts.token },
         },
         mcp: {
             ...mcp,
@@ -525,7 +547,7 @@ export function buildOpenClawAuthConfig(opts) {
                     transport: "streamable-http",
                     headers: {
                         ...currentHeaders,
-                        Authorization: `Bearer \${${OPENCLAW_TOKEN_ENV_VAR}}`,
+                        Authorization: `Bearer \${${tokenEnvVar}}`,
                     },
                 },
             },
@@ -1102,7 +1124,15 @@ export function buildLoginOutput(result, opts = {}) {
         });
         lines.push({ stream: "out", line: result.snippet });
     }
-    for (const name of envVarsReferencedBy(result.snippet)) {
+    // OpenClaw and Hermes have already received the value in their protected
+    // user-level credential store. Printing an export for them is both false
+    // (the variable is set) and needlessly exposes the token in terminal/chat
+    // logs. Codex and stdout are the two handoff targets whose config really
+    // does depend on the human setting the referenced environment variable.
+    const handoffEnvVars = result.target === "codex" || result.target === "stdout"
+        ? envVarsReferencedBy(result.snippet)
+        : [];
+    for (const name of handoffEnvVars) {
         lines.push({
             stream: "err",
             line: `That config reads the token from ${name}, and nothing sets it yet. Put this in the environment your agent starts in:`,

package/manifest.json

@@ -2,7 +2,7 @@
   "$schema": "https://showly.ai/schemas/skill-manifest-v1.json",
   "name": "showly",
   "displayName": "Showly",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "description": "Deploy and manage Showly sites from inside Claude Code / Codex.",
   "homepage": "https://showly.ai/docs/mcp/overview",
   "publisher": "Showly",
@@ -26,7 +26,7 @@
     },
     "endpoints": {
       "url_env": "SHOWLY_MCP_URL",
-      "default_url": "https://mcp.showly.ai",
+      "default_url": "https://mcp.showly.ai/mcp",
       "api_url_env": "SHOWLY_API_URL"
     }
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@showly/mcp-server",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "description": "Connect Claude Code / Codex to the Showly MCP server — preview and deploy sites from your agent.",
   "license": "UNLICENSED",
   "type": "module",
@@ -52,11 +52,11 @@
   },
   "claude-code-skill": {
     "name": "showly",
-    "version": "0.4.3",
+    "version": "0.4.4",
     "description": "Deploy and manage Showly sites from inside Claude Code.",
     "mcp-server": {
       "url-env": "SHOWLY_MCP_URL",
-      "default-url": "https://mcp.showly.ai",
+      "default-url": "https://mcp.showly.ai/mcp",
       "auth": "oauth",
       "api-url-env": "SHOWLY_API_URL"
     },
@@ -65,7 +65,7 @@
   },
   "codex-plugin": {
     "name": "showly",
-    "version": "0.4.3",
+    "version": "0.4.4",
     "type": "mcp-server",
     "manifest": "manifest.json"
   },