@solarisdk/mcp 0.2.1 → 0.2.2

package/README.md

@@ -86,6 +86,7 @@ Chat, Code and Cowork alike.
 | `SOLARI_API_KEY` | ✅ | — | unified `slr_live_…` key (works on both gateways) |
 | `SOLARI_BASE_URL` | | `https://api.getsolari.com` | sandbox/desktop gateway |
 | `SOLARI_BROWSER_URL` | | `SOLARI_BASE_URL` → prod | cloud-browser gateway (differs from `SOLARI_BASE_URL` on staging) |
+| `SOLARI_BROWSER_API_KEY` | | `SOLARI_API_KEY` | separate key for the browser gateway, for environments where the browser and desktop key stores are split |
 
 ## Tools
 

package/dist/http.js

@@ -29,22 +29,35 @@ async function validateKey(key) {
     const until = keyOkUntil.get(h);
     if (until && until > Date.now())
         return true;
-    try {
-        const res = await fetch(`${BROWSER_URL}/profiles`, {
-            headers: { authorization: `Bearer ${key}` },
-            signal: AbortSignal.timeout(10_000),
-        });
-        if (res.ok) {
-            keyOkUntil.set(h, Date.now() + 60_000);
-            return true;
+    // Prod's browser and desktop gateways have separate key stores — a key is
+    // acceptable if EITHER accepts it (its tool calls on the other surface will
+    // fail with that gateway's own auth error).
+    const probes = [
+        `${BROWSER_URL}/profiles`,
+        `${process.env.SOLARI_BASE_URL ?? "https://api.getsolari.com"}/sandboxes?limit=1`,
+    ];
+    let sawDefinitiveReject = false;
+    for (const url of probes) {
+        try {
+            const res = await fetch(url, {
+                headers: { authorization: `Bearer ${key}` },
+                signal: AbortSignal.timeout(10_000),
+            });
+            if (res.ok) {
+                keyOkUntil.set(h, Date.now() + 60_000);
+                return true;
+            }
+            if (res.status === 401 || res.status === 403)
+                sawDefinitiveReject = true;
+            // Other statuses: inconclusive (gateway hiccup) — keep probing.
+        }
+        catch {
+            /* transient — inconclusive */
         }
-        // Gateway auth can negative-cache a freshly minted key for a few seconds;
-        // treat only a definitive 401/403 as invalid.
-        return res.status !== 401 && res.status !== 403;
-    }
-    catch {
-        return true; // don't lock customers out on our own transient errors
     }
+    // Reject only when at least one gateway definitively said no and none said
+    // yes; if everything was inconclusive, don't lock customers out on our blip.
+    return !sawDefinitiveReject;
 }
 function bearer(req) {
     const m = /^Bearer\s+(.+)$/i.exec(req.headers.authorization ?? "");

package/dist/server.js

@@ -212,8 +212,10 @@ export function buildServerParts(client, browserCfg) {
         });
     // The cloud-browser gateway is a separate service from the sandbox/desktop
     // gateway (same domain in prod, different domains on staging).
+    // Prod's browser + desktop gateways have separate key stores today; allow a
+    // browser-specific key (falls back to the shared one).
     const bCfg = browserCfg ?? {
-        apiKey,
+        apiKey: process.env.SOLARI_BROWSER_API_KEY ?? apiKey,
         baseUrl: process.env.SOLARI_BROWSER_URL ??
             process.env.SOLARI_BASE_URL ??
             "https://api.getsolari.com",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solarisdk/mcp",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Model Context Protocol server for the Solari cloud browser, sandboxes + desktops — drive them from Claude Desktop/Cowork, Claude Code, Cursor, etc.",
   "type": "module",
   "bin": {