npm - @spekoai/mcp-calls - Versions diffs - 0.2.1 → 0.3.0 - Mend

@spekoai/mcp-calls 0.2.1 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/README.md CHANGED Viewed

@@ -15,9 +15,12 @@ Desktop, and any MCP client. Powered by [Speko](https://speko.ai).
 npx @spekoai/mcp-calls@latest init
 ```
-The wizard opens the Speko dashboard for an API key, verifies it, writes the MCP into your
-client config (Claude Code or Claude Desktop), and installs a companion skill. Then just ask
-your agent to call a business.
+The wizard signs you in **with your browser** (OAuth — no key to copy or paste), fetches your
+key automatically, writes the MCP into your client config (Claude Code or Claude Desktop), and
+installs a companion skill. Then just ask your agent to call a business.
+Already have a key, or on a headless box? `--token sk_...` or `--paste` skips the browser.
+Re-authenticate anytime with `npx @spekoai/mcp-calls login`.
 It runs **single-process**: give it your `SPEKO_API_KEY` and it calls `api.speko.dev`
 directly — no separate server to run.

package/dist/index.js CHANGED Viewed

@@ -10,7 +10,7 @@ var __export = (target, all) => {
 };
 // ../server/dist/config.js
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import { existsSync as existsSync3 } from "fs";
 import { dirname as dirname3, resolve as resolve3 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
@@ -93,7 +93,7 @@ function loadConfig() {
   return cached;
 }
 function serverBearerHash(cfg) {
-  return createHash("sha256").update(cfg.speko.apiKey, "utf-8").digest("hex").slice(0, 16);
+  return createHash2("sha256").update(cfg.speko.apiKey, "utf-8").digest("hex").slice(0, 16);
 }
 var ConfigError, cached;
 var init_config = __esm({
@@ -842,9 +842,9 @@ var init_objective = __esm({
 });
 // ../server/dist/safety/prompt.js
-import { randomBytes } from "crypto";
+import { randomBytes as randomBytes2 } from "crypto";
 function delimitedBlock(label, content) {
-  const nonce = randomBytes(8).toString("hex");
+  const nonce = randomBytes2(8).toString("hex");
   return `${BLOCK_RULE} ${label} ${nonce} ${BLOCK_RULE}
 ${content}
 ${BLOCK_RULE} END ${label} ${nonce} ${BLOCK_RULE}`;
@@ -1374,13 +1374,191 @@ var init_core = __esm({
 import { MCPServer } from "mcp-framework";
 // src/cli/init.ts
-import { spawn, spawnSync } from "child_process";
+import { spawn as spawn2, spawnSync } from "child_process";
 import { createInterface } from "readline";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { homedir, platform } from "os";
+import { homedir, platform as platform2 } from "os";
 import { dirname, join, resolve } from "path";
 import { fileURLToPath } from "url";
+// src/cli/login.ts
+import { createServer } from "http";
+import { randomBytes, createHash } from "crypto";
+import { spawn } from "child_process";
+import { platform } from "os";
 var API_BASE = (process.env.SPEKOAI_API_URL || "https://api.speko.dev").replace(/\/+$/, "");
+var AUTH_DISCOVERY = process.env.SPEKO_OAUTH_DISCOVERY || "https://platform.speko.dev/.well-known/oauth-authorization-server/api/auth";
+var LOGIN_TIMEOUT_MS = 5 * 6e4;
+function b64url(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function escapeHtml(s) {
+  return s.replace(/[&<>"']/g, (ch) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[ch]);
+}
+function resultPage(title, body) {
+  return `<!doctype html><meta charset="utf-8"><title>${escapeHtml(title)}</title>
+<body style="font-family:system-ui,-apple-system,sans-serif;max-width:30rem;margin:18vh auto;text-align:center;color:#111">
+<div style="font-size:2.5rem">\u{1F4DE}</div>
+<h1 style="font-size:1.35rem;margin:.5rem 0">${escapeHtml(title)}</h1>
+<p style="color:#555;line-height:1.5">${escapeHtml(body)}</p></body>`;
+}
+function openBrowser(url) {
+  if (["1", "true", "yes"].includes((process.env.SPEKO_NO_BROWSER ?? "").toLowerCase())) return;
+  try {
+    const p = platform();
+    const cmd2 = p === "darwin" ? "open" : p === "win32" ? "cmd" : "xdg-open";
+    const args = p === "win32" ? ["/c", "start", "", url] : [url];
+    const child = spawn(cmd2, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+async function discover() {
+  const r = await fetch(AUTH_DISCOVERY, { signal: AbortSignal.timeout(15e3) });
+  if (!r.ok) throw new Error(`OAuth discovery failed (HTTP ${r.status}) at ${AUTH_DISCOVERY}`);
+  const d = await r.json();
+  if (!d.authorization_endpoint || !d.token_endpoint || !d.registration_endpoint || !d.issuer) {
+    throw new Error("OAuth discovery doc is missing required endpoints");
+  }
+  return d;
+}
+async function registerClient(registrationEndpoint, redirectUri) {
+  const r = await fetch(registrationEndpoint, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      client_name: "Speko Calls CLI",
+      redirect_uris: [redirectUri],
+      grant_types: ["authorization_code"],
+      response_types: ["code"],
+      token_endpoint_auth_method: "none",
+      type: "native",
+      scope: "openid profile email"
+    }),
+    signal: AbortSignal.timeout(15e3)
+  });
+  if (!r.ok) throw new Error(`client registration failed (HTTP ${r.status})`);
+  const j = await r.json();
+  if (!j.client_id) throw new Error("client registration returned no client_id");
+  return j.client_id;
+}
+async function fetchOrgKey(bearer2) {
+  const r = await fetch(`${API_BASE}/v1/api-keys/organization-credentials`, {
+    headers: { authorization: `Bearer ${bearer2}` },
+    signal: AbortSignal.timeout(15e3)
+  });
+  if (r.status === 403) {
+    throw new Error("your account has no organization yet \u2014 finish signup at platform.speko.dev, then retry");
+  }
+  if (!r.ok) {
+    const body = await r.text().catch(() => "");
+    throw new Error(`couldn't fetch your API key (HTTP ${r.status})${body ? `: ${body.slice(0, 160)}` : ""}`);
+  }
+  const j = await r.json();
+  const key = j.mcpApiKey?.key;
+  if (!key) throw new Error("API-key response was missing mcpApiKey.key");
+  return key;
+}
+function startLoopback(expectedState) {
+  return new Promise((resolve4, reject) => {
+    let resolveCode;
+    let rejectCode;
+    const waitForCode = new Promise((res, rej) => {
+      resolveCode = res;
+      rejectCode = rej;
+    });
+    const timeout = setTimeout(
+      () => rejectCode(new Error("login timed out (5 min) \u2014 no redirect received")),
+      LOGIN_TIMEOUT_MS
+    );
+    if (typeof timeout.unref === "function") timeout.unref();
+    const server2 = createServer((req, res) => {
+      const u = new URL(req.url ?? "/", "http://127.0.0.1");
+      if (u.pathname !== "/callback") {
+        res.writeHead(404);
+        res.end();
+        return;
+      }
+      const send = (status, title, body) => {
+        res.writeHead(status, { "content-type": "text/html; charset=utf-8" });
+        res.end(resultPage(title, body));
+      };
+      const err = u.searchParams.get("error");
+      const code = u.searchParams.get("code");
+      const state = u.searchParams.get("state");
+      clearTimeout(timeout);
+      if (err) {
+        send(400, "Sign-in failed", `Authorization was denied (${err}). You can close this tab and try again.`);
+        rejectCode(new Error(`authorization denied: ${err}`));
+        return;
+      }
+      if (!code || state !== expectedState) {
+        send(400, "Sign-in failed", "The response was invalid or didn't match. Close this tab and re-run the login.");
+        rejectCode(new Error("state mismatch or missing authorization code"));
+        return;
+      }
+      send(200, "You're connected \u2713", "Speko Calls is signed in. You can close this tab and return to your terminal.");
+      resolveCode(code);
+    });
+    server2.on("error", reject);
+    server2.listen(0, "127.0.0.1", () => {
+      const port = server2.address().port;
+      resolve4({ server: server2, redirectUri: `http://127.0.0.1:${port}/callback`, waitForCode });
+    });
+  });
+}
+async function browserLogin(log = () => {
+}) {
+  const disc = await discover();
+  const verifier = b64url(randomBytes(32));
+  const challenge = b64url(createHash("sha256").update(verifier).digest());
+  const state = b64url(randomBytes(16));
+  const { server: server2, redirectUri, waitForCode } = await startLoopback(state);
+  try {
+    const clientId = await registerClient(disc.registration_endpoint, redirectUri);
+    const authUrl = new URL(disc.authorization_endpoint);
+    authUrl.searchParams.set("response_type", "code");
+    authUrl.searchParams.set("client_id", clientId);
+    authUrl.searchParams.set("redirect_uri", redirectUri);
+    authUrl.searchParams.set("scope", "openid profile email");
+    authUrl.searchParams.set("state", state);
+    authUrl.searchParams.set("code_challenge", challenge);
+    authUrl.searchParams.set("code_challenge_method", "S256");
+    log("Opening your browser to sign in to Speko\u2026");
+    log(`If it doesn't open, paste this URL into your browser:
+    ${authUrl.toString()}`);
+    openBrowser(authUrl.toString());
+    log("Waiting for you to finish signing in\u2026");
+    const code = await waitForCode;
+    const tok = await fetch(disc.token_endpoint, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: redirectUri,
+        client_id: clientId,
+        code_verifier: verifier
+      }),
+      signal: AbortSignal.timeout(2e4)
+    });
+    if (!tok.ok) {
+      const body = await tok.text().catch(() => "");
+      throw new Error(`token exchange failed (HTTP ${tok.status})${body ? `: ${body.slice(0, 200)}` : ""}`);
+    }
+    const tj = await tok.json();
+    const bearer2 = tj.id_token ?? tj.access_token;
+    if (!bearer2) throw new Error("token endpoint returned neither an id_token nor an access_token");
+    return await fetchOrgKey(bearer2);
+  } finally {
+    server2.close();
+  }
+}
+// src/cli/init.ts
+var API_BASE2 = (process.env.SPEKOAI_API_URL || "https://api.speko.dev").replace(/\/+$/, "");
 var DASHBOARD = "https://platform.speko.dev";
 var PKG = "@spekoai/mcp-calls";
 var SERVER_NAME = "speko-calls";
@@ -1393,7 +1571,7 @@ var c = {
   cyan: (s) => `\x1B[36m${s}\x1B[0m`
 };
 function parseFlags(argv) {
-  const f = { scope: "user", yes: false, printConfig: false };
+  const f = { scope: "user", yes: false, printConfig: false, paste: false };
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
     if (a === "--token") f.token = argv[++i];
@@ -1401,6 +1579,7 @@ function parseFlags(argv) {
     else if (a === "--scope") f.scope = argv[++i] ?? "user";
     else if (a === "--yes" || a === "-y") f.yes = true;
     else if (a === "--print-config") f.printConfig = true;
+    else if (a === "--paste" || a === "--manual") f.paste = true;
   }
   return f;
 }
@@ -1451,12 +1630,12 @@ function askSecret(query) {
     stdin.on("data", onData);
   });
 }
-function openBrowser(url) {
+function openBrowser2(url) {
   try {
-    const p = platform();
+    const p = platform2();
     const cmd2 = p === "darwin" ? "open" : p === "win32" ? "cmd" : "xdg-open";
     const args = p === "win32" ? ["/c", "start", "", url] : [url];
-    const child = spawn(cmd2, args, { stdio: "ignore", detached: true });
+    const child = spawn2(cmd2, args, { stdio: "ignore", detached: true });
     child.on("error", () => {
     });
     child.unref();
@@ -1465,7 +1644,7 @@ function openBrowser(url) {
 }
 async function verifyKey(key) {
   try {
-    const r = await fetch(`${API_BASE}/v1/organization`, {
+    const r = await fetch(`${API_BASE2}/v1/organization`, {
       headers: { authorization: `Bearer ${key}` },
       signal: AbortSignal.timeout(15e3)
     });
@@ -1485,8 +1664,8 @@ function claudeCliPresent() {
 }
 function desktopConfigPath() {
   const home = homedir();
-  if (platform() === "darwin") return join(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
-  if (platform() === "win32") return join(process.env.APPDATA ?? join(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
+  if (platform2() === "darwin") return join(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
+  if (platform2() === "win32") return join(process.env.APPDATA ?? join(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
   return join(home, ".config", "Claude", "claude_desktop_config.json");
 }
 function configureClaudeCode(key, scope, extraEnv = {}) {
@@ -1544,8 +1723,11 @@ function configureClaudeDesktop(key, extraEnv = {}) {
 function installSkill() {
   try {
     const here = dirname(fileURLToPath(import.meta.url));
-    const src = resolve(here, "..", "..", "skills", SERVER_NAME, "SKILL.md");
-    if (!existsSync(src)) {
+    const src = [
+      resolve(here, "..", "skills", SERVER_NAME, "SKILL.md"),
+      resolve(here, "..", "..", "skills", SERVER_NAME, "SKILL.md")
+    ].find((p) => existsSync(p));
+    if (!src) {
       console.log(c.yellow("  \u2022 Bundled skill not found in package; skipping skill install."));
       return false;
     }
@@ -1563,27 +1745,33 @@ function installSkill() {
     return false;
   }
 }
-async function runInit(argv) {
+async function runInit(argv, mode = "init") {
   const f = parseFlags(argv);
-  console.log(c.bold("\n  Speko Calls \u2014 setup\n"));
-  console.log("  This MCP places " + c.bold("real, disclosed") + " outbound phone calls to " + c.bold("businesses") + ",");
-  console.log("  straight from your coding agent. Every call opens with an AI disclosure;");
-  console.log("  business lines only; quiet hours 08:00\u201321:00 in the destination's local time.\n");
-  if (!f.yes) {
-    const ok = (await ask("  Continue? [Y/n] ")).toLowerCase();
-    if (ok === "n" || ok === "no") {
-      console.log("  Aborted.");
-      return;
-    }
+  const quick = mode === "login";
+  console.log(c.bold(quick ? "\n  Speko Calls \u2014 sign in\n" : "\n  Speko Calls \u2014 setup\n"));
+  if (!quick) {
+    console.log("  This MCP places " + c.bold("real, disclosed") + " outbound phone calls to " + c.bold("businesses") + ",");
+    console.log("  straight from your coding agent. Every call opens with an AI disclosure;");
+    console.log("  business lines only; quiet hours 08:00\u201321:00 in the destination's local time.\n");
   }
   let key = (f.token ?? process.env.SPEKO_API_KEY ?? "").trim();
+  if (!key && !f.paste) {
+    console.log("\n  Sign in to connect \u2014 this opens your browser. " + c.dim("No key to copy or paste."));
+    try {
+      key = await browserLogin((m) => console.log(c.dim("  " + m)));
+      console.log(c.green("  \u2713 Signed in \u2014 fetched your API key automatically."));
+    } catch (e) {
+      console.log(c.yellow(`  \u2022 Browser sign-in didn't complete (${e.message}).`));
+      console.log("  Falling back to manual key entry. " + c.dim("(Use --paste to skip the browser next time.)"));
+    }
+  }
   if (!key) {
     console.log(`
   Opening ${c.cyan(DASHBOARD)} \u2014 sign in and create an API key (starts with "sk_").`);
     console.log(c.dim(`  (If it doesn't open: visit ${DASHBOARD} and copy your key.)
 `));
     if (!f.yes) await ask("  Press Enter to open your browser\u2026 ");
-    openBrowser(DASHBOARD);
+    openBrowser2(DASHBOARD);
     key = await askSecret("  Paste your Speko API key: ");
   }
   if (!key) {
@@ -1609,16 +1797,9 @@ async function runInit(argv) {
     console.log("    " + c.cyan(JSON.stringify({ [SERVER_NAME]: { command: "npx", args: ["-y", PKG], env: { SPEKO_API_KEY: key } } })));
     return;
   }
-  let target = (f.client ?? "").toLowerCase();
-  if (!target) {
-    const hasCode = claudeCliPresent();
-    const def = hasCode ? "code" : "desktop";
-    const ans = (await ask(`
-  Configure which client? [code/desktop/both] (${def}) `)).toLowerCase();
-    target = ans || def;
-  }
+  const target = (f.client || "both").toLowerCase();
   const extraEnv = {};
-  if (!f.yes) {
+  if (!quick && !f.yes) {
     const demo = (await ask('\n  Set up a quick DEMO so "call <a business>" works right away \u2014 rings a number you control? [y/N] ')).toLowerCase();
     if (demo === "y" || demo === "yes") {
       const num = (await ask("  Number to ring, E.164 (e.g. +15551234567): ")).replace(/\s/g, "");
@@ -1705,7 +1886,7 @@ import { MCPTool as MCPTool2 } from "mcp-framework";
 import { z as z2 } from "zod";
 // src/http/serverClient.ts
-import { randomBytes as randomBytes2 } from "crypto";
+import { randomBytes as randomBytes3 } from "crypto";
 var DemoServerError = class extends Error {
   name = "DemoServerError";
 };
@@ -1728,7 +1909,7 @@ var InProcessBackend = class {
     if (!this.ready) {
       this.ready = (async () => {
         if (!(process.env.SPEKO_DIAL_TOKEN_SECRET ?? "").trim()) {
-          process.env.SPEKO_DIAL_TOKEN_SECRET = randomBytes2(32).toString("hex");
+          process.env.SPEKO_DIAL_TOKEN_SECRET = randomBytes3(32).toString("hex");
         }
         const core = await Promise.resolve().then(() => (init_core(), core_exports));
         const cfg = core.loadConfig();
@@ -1865,9 +2046,9 @@ function getServerClient() {
 // src/tools/CallNumberTool.ts
 var schema2 = z2.object({
   phone_number: z2.string().describe("Number to call, E.164 (e.g. +77011234567). A real number the user has consent to call."),
-  objective: z2.string().describe("What to say / accomplish, e.g. 'Tell Karim that Amirlan says happy birthday and misses him.'"),
+  objective: z2.string().describe("What to say / accomplish, e.g. 'Tell Sam that John says happy birthday and misses him.'"),
   caller_name: z2.string().describe("Name of the human the call is on behalf of (1-80 chars); spoken in the AI-disclosure opening."),
-  recipient_name: z2.string().optional().describe("Who you're calling, used in the greeting (e.g. 'Karim')."),
+  recipient_name: z2.string().optional().describe("Who you're calling, used in the greeting (e.g. 'Sam')."),
   context: z2.string().optional().describe("Optional extra context for the message."),
   utc_offset_minutes: z2.number().int().optional().describe("Callee UTC offset in minutes for quiet hours (e.g. 300 = UTC+5). Auto-derived from the number; pass it only if a call is blocked for unknown timezone."),
   max_duration_seconds: z2.number().int().optional().describe("Max seconds to wait for the call to finish; clamped 30-300.")
@@ -2095,13 +2276,13 @@ var MakeCallTool = class extends MCPTool6 {
 // src/index.ts
 var cmd = process.argv[2];
 if (cmd === "init" || cmd === "setup" || cmd === "login") {
-  await runInit(process.argv.slice(3));
+  await runInit(process.argv.slice(3), cmd);
   process.exit(0);
 }
 loadEnv();
 var server = new MCPServer({
   name: "speko-calls",
-  version: "0.2.1",
+  version: "0.3.0",
   transport: { type: "stdio" }
 });
 server.addTool(LookupBusinessTool);