@togglhq/mcp 1.6.10 → 1.6.11

package/build/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as runMcpCli } from "./src-BHKKOqzB.js";
+import { n as runMcpCli } from "./src-DHcD1uso.js";
 //#region src/cli.ts
 runMcpCli();
 //#endregion

package/build/index.js

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-import { n as runMcpCli, t as bootstrapServer } from "./src-BHKKOqzB.js";
+import { n as runMcpCli, t as bootstrapServer } from "./src-DHcD1uso.js";
 export { bootstrapServer, runMcpCli };

package/build/{src-BHKKOqzB.js → src-DHcD1uso.js}

@@ -31852,6 +31852,10 @@ function openAuthBrowser(url) {
 	});
 }
 const TOGGL_OAUTH_CLIENT_ID = "000000";
+/** Production accounts-be client for hosted `/focus/cli/auth-code` redirects. */
+const TOGGL_OAUTH_MANUAL_CLIENT_ID = "2ca88f39-18c5-4686-9101-3d3b7bd24470";
+/** Staging accounts-be client for hosted `/focus/cli/auth-code` redirects. */
+const TOGGL_OAUTH_MANUAL_STAGING_CLIENT_ID = "88972024-c0b3-46d1-8191-e48fb876434c";
 const TOGGL_OAUTH_CALLBACK_PORT = 8716;
 const TOGGL_OAUTH_LOGIN_TIMEOUT_MS = 12e4;
 const TOGGL_OAUTH_MANUAL_CALLBACK_PATH = "/focus/cli/auth-code";
@@ -31865,6 +31869,16 @@ function togglOAuthRedirectUri(port = TOGGL_OAUTH_CALLBACK_PORT) {
 function togglOAuthManualRedirectUri(accountsApiUrl) {
 	return `${accountsApiUrl.replace(/\/$/, "")}${TOGGL_OAUTH_MANUAL_CALLBACK_PATH}`;
 }
+/**
+* Localhost CLI login keeps the test client (`000000`, domain `http://localhost`).
+* Manual/headless login uses dedicated first-party clients whose domain prefixes
+* match the hosted auth-code page. Do not send `000000` with a hosted redirect.
+*/
+function resolveTogglOAuthClientId(flowMode, accountsApiUrl) {
+	if (flowMode !== "manual") return TOGGL_OAUTH_CLIENT_ID;
+	if (accountsApiUrl.replace(/\/$/, "") === "https://accounts.toggl.space") return TOGGL_OAUTH_MANUAL_STAGING_CLIENT_ID;
+	return TOGGL_OAUTH_MANUAL_CLIENT_ID;
+}
 const BACKGROUND_DARK_SVG = `<svg width="1440" height="900" viewBox="0 0 1440 900" fill="none" xmlns="http://www.w3.org/2000/svg">
 <g clip-path="url(#clip0_11555_363)">
 <g clip-path="url(#clip1_11555_363)">
@@ -32213,12 +32227,12 @@ function waitForOAuthCallback(port = TOGGL_OAUTH_CALLBACK_PORT, timeoutMs = TOGG
 		});
 	});
 }
-async function exchangeAuthorizationCode(accountsApiUrl, code, verifier, redirectUri = togglOAuthRedirectUri()) {
+async function exchangeAuthorizationCode(accountsApiUrl, code, verifier, redirectUri = togglOAuthRedirectUri(), clientId = TOGGL_OAUTH_CLIENT_ID) {
 	const params = new URLSearchParams({
 		grant_type: "authorization_code",
 		code,
 		code_verifier: verifier,
-		client_id: TOGGL_OAUTH_CLIENT_ID,
+		client_id: clientId,
 		redirect_uri: redirectUri
 	});
 	const response = await fetch(`${accountsApiUrl}/api/oauth/token?${params}`, { method: "POST" });
@@ -32255,7 +32269,7 @@ function resolveTogglOAuthFlowMode(options) {
 }
 function buildTogglOAuthAuthorizationUrl(options) {
 	return `${options.accountsApiUrl.replace(/\/$/, "")}/focus/login/?${new URLSearchParams({
-		client_id: TOGGL_OAUTH_CLIENT_ID,
+		client_id: resolveTogglOAuthClientId(options.flowMode, options.accountsApiUrl),
 		code_challenge: options.codeChallenge,
 		code_challenge_method: "S256",
 		redirect_uri: options.redirectUri,
@@ -32271,6 +32285,7 @@ async function obtainTogglOAuthAuthorizationCode(options) {
 		authorizationCode: options.authorizationCode
 	});
 	const redirectUri = resolveTogglOAuthRedirectUri(options.accountsApiUrl, flowMode);
+	const clientId = resolveTogglOAuthClientId(flowMode, options.accountsApiUrl);
 	const { verifier, challenge } = generateOAuthPKCE();
 	const authUrl = buildTogglOAuthAuthorizationUrl({
 		accountsApiUrl: options.accountsApiUrl,
@@ -32308,6 +32323,7 @@ async function obtainTogglOAuthAuthorizationCode(options) {
 		code,
 		verifier,
 		redirectUri,
+		clientId,
 		flowMode
 	};
 }
@@ -32374,11 +32390,11 @@ const PUBLIC_MCP_PACKAGE_NAME = "@togglhq/mcp";
 function npxMcpAuthCommand() {
 	return `npx ${PUBLIC_MCP_PACKAGE_NAME} auth`;
 }
-async function refreshTokens(accountsApiUrl, refreshToken) {
+async function refreshTokens(accountsApiUrl, refreshToken, clientId = TOGGL_OAUTH_CLIENT_ID) {
 	const params = new URLSearchParams({
 		grant_type: "refresh_token",
 		refresh_token: refreshToken,
-		client_id: TOGGL_OAUTH_CLIENT_ID
+		client_id: clientId
 	});
 	const response = await fetch(`${accountsApiUrl}/api/oauth/token?${params}`, { method: "POST" });
 	if (!response.ok) {
@@ -32392,7 +32408,7 @@ async function getValidToken$1(scope = "cli", profile) {
 	if (!authConfig) throw new Error(scope === "cli" ? "Not authenticated. Run `toggl auth` to sign in." : `Not authenticated. Run \`${npxMcpAuthCommand()}\` to sign in.`);
 	const now = Date.now() / 1e3;
 	if (authConfig.expires_at > now + 60) return authConfig.access_token;
-	const tokens = await refreshTokens(authConfig.accounts_api_url, authConfig.refresh_token);
+	const tokens = await refreshTokens(authConfig.accounts_api_url, authConfig.refresh_token, authConfig.oauth_client_id ?? "000000");
 	authConfig.access_token = tokens.access_token;
 	authConfig.refresh_token = tokens.refresh_token;
 	authConfig.expires_at = now + tokens.expires_in;
@@ -32485,7 +32501,7 @@ async function runAuthFlow(accountsApiUrl = "https://accounts.toggl.com", focusA
 		log("Continuing MCP authentication with existing session...\n");
 	} else {
 		log("Toggl 2.0 MCP — Authentication\n");
-		const { code, verifier, redirectUri } = await obtainTogglOAuthAuthorizationCode({
+		const { code, verifier, redirectUri, clientId } = await obtainTogglOAuthAuthorizationCode({
 			accountsApiUrl,
 			flowMode: options.oauthFlowMode ?? (options.manualPrompt ? "manual" : "local"),
 			authorizationCode: options.authorizationCode,
@@ -32493,7 +32509,7 @@ async function runAuthFlow(accountsApiUrl = "https://accounts.toggl.com", focusA
 			log
 		});
 		log("Exchanging authorization code...");
-		const tokens = await exchangeAuthorizationCode(accountsApiUrl, code, verifier, redirectUri);
+		const tokens = await exchangeAuthorizationCode(accountsApiUrl, code, verifier, redirectUri, clientId);
 		log("Fetching account info...");
 		const user = await fetchAccountsApiMe(accountsApiUrl, tokens.access_token);
 		if (!user.user_account_id) throw new Error("Could not determine user ID from API response.");
@@ -32506,6 +32522,7 @@ async function runAuthFlow(accountsApiUrl = "https://accounts.toggl.com", focusA
 			accounts_api_url: accountsApiUrl,
 			focus_api_url: focusApiUrl,
 			authenticated_at: (/* @__PURE__ */ new Date()).toISOString(),
+			oauth_client_id: clientId,
 			workspaces,
 			default_workspace_id: user.default_workspace_id
 		};
@@ -32534,6 +32551,7 @@ async function runAuthFlow(accountsApiUrl = "https://accounts.toggl.com", focusA
 		focus_api_url: pendingContext.focus_api_url,
 		accounts_api_url: pendingContext.accounts_api_url,
 		authenticated_at: pendingContext.authenticated_at,
+		oauth_client_id: pendingContext.oauth_client_id,
 		workspaces
 	};
 	saveConfig(config);
@@ -44939,7 +44957,7 @@ import_main.default.config({
 	quiet: true,
 	ignore: ["MISSING_ENV_FILE"]
 });
-const packageVersion = "1.6.10";
+const packageVersion = "1.6.11";
 function resolvePublicUrls() {
 	return {
 		focusApiUrl: process.env.TOGGL_FOCUS_API_URL ?? "https://focus.toggl.com",
@@ -45004,4 +45022,4 @@ function bootstrapServer(options = {}) {
 //#endregion
 export { runMcpCli as n, bootstrapServer as t };
 
-//# sourceMappingURL=src-BHKKOqzB.js.map
+//# sourceMappingURL=src-DHcD1uso.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@togglhq/mcp",
-  "version": "1.6.10",
+  "version": "1.6.11",
   "description": "Toggl 2.0 MCP server for Claude Code, Claude Desktop, and other MCP clients.",
   "license": "UNLICENSED",
   "type": "module",