@vibetocloud/mcp 1.0.0 → 1.0.2

package/dist/index.js

@@ -57455,25 +57455,24 @@ var ValidateRequestGuard = class {
   }
   async canActivate(context) {
     const req = context.switchToHttp().getRequest();
+    const authHeader = req.headers.authorization;
+    if (authHeader?.startsWith("Bearer ")) {
+      const token = authHeader.slice(7);
+      try {
+        const publicKey = await this.publicKeyCache.get();
+        const payload = import_jsonwebtoken.default.verify(token, publicKey, { algorithms: ["RS256"] });
+        req.auth = { kind: "user", payload };
+        return true;
+      } catch {
+      }
+    }
     const internalServiceKey = process.env["INTERNAL_SERVICE_KEY"];
     const sentKey = req.headers["x-internal-secret"] ?? req.headers["x-service-key"];
     if (internalServiceKey && sentKey === internalServiceKey) {
       req.auth = { kind: "internal" };
       return true;
     }
-    const authHeader = req.headers.authorization;
-    if (!authHeader?.startsWith("Bearer ")) {
-      throw new import_common3.UnauthorizedException("Missing or invalid Authorization header");
-    }
-    const token = authHeader.slice(7);
-    try {
-      const publicKey = await this.publicKeyCache.get();
-      const payload = import_jsonwebtoken.default.verify(token, publicKey, { algorithms: ["RS256"] });
-      req.auth = { kind: "user", payload };
-      return true;
-    } catch {
-      throw new import_common3.UnauthorizedException("Invalid or expired token");
-    }
+    throw new import_common3.UnauthorizedException("Missing or invalid Authorization header");
   }
 };
 ValidateRequestGuard = __decorateClass([
@@ -57626,6 +57625,7 @@ var DeployClient = class {
       return null;
     }
   }
+  /** First page only (default page size) — callers needing more should call the history endpoint directly with `take`/`cursor`. */
   async history(appId) {
     try {
       const res = await fetch(`${this.baseUrl}/deploy/history/${encodeURIComponent(appId)}`, {
@@ -57636,7 +57636,7 @@ var DeployClient = class {
         return [];
       }
       const json = await res.json();
-      return json.data ?? [];
+      return json.data?.items ?? [];
     } catch {
       return [];
     }
@@ -57672,6 +57672,21 @@ var DeployClient = class {
       return null;
     }
   }
+  async cancel(options) {
+    try {
+      const res = await fetch(`${this.baseUrl}/deploy/cancel/${encodeURIComponent(options.buildId)}`, {
+        method: "POST",
+        headers: this.headers
+      });
+      if (!res.ok) {
+        return null;
+      }
+      const json = await res.json();
+      return json.data;
+    } catch {
+      return null;
+    }
+  }
   async restoreBackup(appId, backupId, environment) {
     try {
       const res = await fetch(`${this.baseUrl}/applications/${encodeURIComponent(appId)}/backups/${encodeURIComponent(backupId)}/restore`, {
@@ -57715,6 +57730,9 @@ var UserClient = class {
   getUser(id) {
     return this.request("GET", `/users/${id}`);
   }
+  getUserByEmail(email2) {
+    return this.request("GET", `/users?email=${encodeURIComponent(email2)}`);
+  }
   createUser(options) {
     return this.request("POST", "/users", options);
   }
@@ -57864,6 +57882,14 @@ var AccountClient = class {
     const env = environments.length ? `&environments=${encodeURIComponent(environments.join(","))}` : "";
     return this.request("GET", `/entitlements/active?orgId=${encodeURIComponent(orgId)}${env}`);
   }
+  /** Per-application capabilities (environments/backup tier scoped to one application). */
+  getAppActiveCapabilities(orgId, appId, environments = []) {
+    const env = environments.length ? `&environments=${encodeURIComponent(environments.join(","))}` : "";
+    return this.request(
+      "GET",
+      `/entitlements/app-active?orgId=${encodeURIComponent(orgId)}&appId=${encodeURIComponent(appId)}${env}`
+    );
+  }
   /** List purchasable environments (staging/production) with their Stripe prices. */
   listCatalogEnvironments() {
     return this.request("GET", "/catalog/environments").then((d) => d ?? []);
@@ -57894,6 +57920,16 @@ var AccountClient = class {
       delta
     }).then((d) => d !== null);
   }
+  /**
+   * Adjust the org's quantity-billed application-count item by ±1.
+   * Called by application-service on application create / delete (Pay-as-you-go only).
+   */
+  adjustApplicationQuantity(orgId, delta) {
+    return this.request("POST", "/entitlements/application-quantity", {
+      orgId,
+      delta
+    }).then((d) => d !== null);
+  }
 };
 
 // libs/shared/src/utils/validate-identifier.ts
@@ -57905,6 +57941,43 @@ var ENVIRONMENT_NAMES = ["dev", "staging", "production"];
 // libs/shared/src/utils/org-ownership.ts
 var import_common6 = __toESM(require_common2());
 
+// libs/shared/src/utils/jwt-lifetime.ts
+function decodeJwtLifetime(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3 || !parts[1]) {
+    return null;
+  }
+  try {
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    const { iat, exp } = payload;
+    if (typeof iat !== "number" || typeof exp !== "number") {
+      return null;
+    }
+    return { iat, exp };
+  } catch {
+    return null;
+  }
+}
+function isTokenDueForRefresh(token, nowMs = Date.now()) {
+  const lifetime = decodeJwtLifetime(token);
+  if (!lifetime) {
+    return false;
+  }
+  const nowSeconds = nowMs / 1e3;
+  const halfLife = lifetime.iat + (lifetime.exp - lifetime.iat) / 2;
+  return nowSeconds > halfLife && nowSeconds < lifetime.exp;
+}
+
+// apps/mcp-server/src/lib/token-refresh.ts
+var authClient = new AuthClient(config2.services.authServiceUrl);
+async function maybeRefreshToken(token) {
+  if (!isTokenDueForRefresh(token)) {
+    return null;
+  }
+  const result = await authClient.refresh({ token });
+  return result?.token ?? null;
+}
+
 // apps/mcp-server/src/tools/account.ts
 var client = new AccountClient(config2.services.accountServiceUrl);
 var orgRegisterTool = {
@@ -58092,7 +58165,7 @@ var tools2 = [
 ];
 
 // apps/mcp-server/src/tools/auth.ts
-var authClient = new AuthClient(config2.services.authServiceUrl);
+var authClient2 = new AuthClient(config2.services.authServiceUrl);
 var orgAuthenticateTool = {
   name: "org_authenticate",
   description: "Verify an existing session token. Returns the authenticated user and organisation. Use this to confirm a stored token is still valid before making other API calls.",
@@ -58112,7 +58185,7 @@ async function handleOrgAuthenticate(args) {
   if (!token) {
     return fail({ status: 401, message: "Please sign in first. Use org_request_otp and org_verify_otp to authenticate." });
   }
-  const result = await authClient.verify({ token });
+  const result = await authClient2.verify({ token });
   if (!result) {
     return fail({ status: 401, message: "Your session has expired or is invalid. Please sign in again with org_request_otp." });
   }
@@ -58422,9 +58495,43 @@ ${tail}`;
     }]
   };
 }
+var orgDeployCancelTool = {
+  name: "org_deploy_cancel",
+  description: 'Cancel a deployment that is currently running. Only works while the build is in the deploy phase; the build is marked failed with reason "Deployment cancelled by user".',
+  inputSchema: {
+    type: "object",
+    properties: {
+      token: { type: "string", description: "JWT session token from org_verify_otp" },
+      buildId: { type: "string", description: "Build ID returned by org_deploy" }
+    },
+    required: ["token", "buildId"]
+  }
+};
+async function handleOrgDeployCancel(args) {
+  const token = args["token"];
+  if (!token) {
+    return notAuthenticatedResult();
+  }
+  const client3 = new DeployClient(config2.services.deployServiceUrl, token);
+  const build = await client3.cancel({ buildId: args["buildId"] });
+  if (!build) {
+    return fail({ status: 404, message: "No cancellable deployment found for this build \u2014 it may have already finished, or not reached the deploy phase yet." });
+  }
+  return {
+    content: [{
+      type: "text",
+      text: JSON.stringify({
+        success: true,
+        data: { id: build.id, status: build.status, message: 'Cancellation requested. Poll org_deploy_status \u2014 the build will end as failed with reason "Deployment cancelled by user".' },
+        error: null
+      })
+    }]
+  };
+}
 var tools5 = [
   { definition: orgDeployTool, handle: handleOrgDeploy },
-  { definition: orgDeployStatusTool, handle: handleOrgDeployStatus }
+  { definition: orgDeployStatusTool, handle: handleOrgDeployStatus },
+  { definition: orgDeployCancelTool, handle: handleOrgDeployCancel }
 ];
 
 // apps/mcp-server/src/tools/dev-sync.ts
@@ -58556,37 +58663,35 @@ var orgSetupGitCredentialsTool = {
   inputSchema: {
     type: "object",
     properties: {
-      userId: {
-        type: "string",
-        description: "ID of the user to generate the credential for"
-      },
-      orgId: {
+      token: {
         type: "string",
-        description: "ID of the organisation"
+        description: "JWT session token from org_verify_otp"
       },
       label: {
         type: "string",
         description: 'Label to identify this credential, e.g. "laptop" or "work" (default: "default")'
       }
     },
-    required: ["userId", "orgId"]
+    required: ["token"]
   }
 };
 async function handleOrgSetupGitCredentials(args) {
-  const userId = args["userId"];
-  const orgId = args["orgId"];
+  const sessionToken = args["token"];
+  if (!sessionToken) {
+    return notAuthenticatedResult();
+  }
   const label = args["label"] ?? "default";
   try {
     const response = await fetch(`${config2.services.userServiceUrl}/git-credentials`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ userId, orgId, label })
+      headers: authHeaders(sessionToken),
+      body: JSON.stringify({ label })
     });
     if (!response.ok) {
       return fail({ status: response.status, message: "Failed to create git credential" });
     }
     const json = await response.json();
-    const { token } = json.data;
+    const credentialToken = json.data.token;
     const gitHost = config2.services.applicationServiceUrl.replace(/^https?:\/\//, "");
     const instructions = [
       `Git credentials created (label: "${label}").`,
@@ -58594,7 +58699,7 @@ async function handleOrgSetupGitCredentials(args) {
       `Run these commands to configure git:`,
       ``,
       `  git config --global credential.helper store`,
-      `  echo "https://user:${token}@${gitHost}" >> ~/.git-credentials`,
+      `  echo "https://user:${credentialToken}@${gitHost}" >> ~/.git-credentials`,
       ``,
       `After that, clone a repository with:`,
       ``,
@@ -58603,7 +58708,7 @@ async function handleOrgSetupGitCredentials(args) {
       `The token is shown only once. Store it securely. To revoke it, call org_revoke_git_credentials.`
     ].join("\n");
     return {
-      content: [{ type: "text", text: JSON.stringify({ success: true, data: { token, instructions }, error: null }) }]
+      content: [{ type: "text", text: JSON.stringify({ success: true, data: { token: credentialToken, instructions }, error: null }) }]
     };
   } catch {
     return fail({ code: "UPSTREAM_ERROR", message: "Failed to connect to user service", hint: "The user service is unreachable. Retry shortly." });
@@ -58615,25 +58720,28 @@ var orgRevokeGitCredentialsTool = {
   inputSchema: {
     type: "object",
     properties: {
-      credentialId: {
+      token: {
         type: "string",
-        description: "ID of the credential to revoke"
+        description: "JWT session token from org_verify_otp"
       },
-      userId: {
+      credentialId: {
         type: "string",
-        description: "ID of the user who owns the credential"
+        description: "ID of the credential to revoke"
       }
     },
-    required: ["credentialId", "userId"]
+    required: ["token", "credentialId"]
   }
 };
 async function handleOrgRevokeGitCredentials(args) {
+  const sessionToken = args["token"];
+  if (!sessionToken) {
+    return notAuthenticatedResult();
+  }
   const credentialId = args["credentialId"];
-  const userId = args["userId"];
   try {
     const response = await fetch(
-      `${config2.services.userServiceUrl}/git-credentials/${credentialId}?userId=${encodeURIComponent(userId)}`,
-      { method: "DELETE" }
+      `${config2.services.userServiceUrl}/git-credentials/${credentialId}`,
+      { method: "DELETE", headers: authHeaders(sessionToken) }
     );
     if (!response.ok) {
       return fail({ status: response.status, message: "Failed to revoke credential" });
@@ -58647,23 +58755,27 @@ async function handleOrgRevokeGitCredentials(args) {
 }
 var orgListGitCredentialsTool = {
   name: "org_list_git_credentials",
-  description: "List all git credentials for a user",
+  description: "List all git credentials for the authenticated user",
   inputSchema: {
     type: "object",
     properties: {
-      userId: {
+      token: {
         type: "string",
-        description: "ID of the user"
+        description: "JWT session token from org_verify_otp"
       }
     },
-    required: ["userId"]
+    required: ["token"]
   }
 };
 async function handleOrgListGitCredentials(args) {
-  const userId = args["userId"];
+  const sessionToken = args["token"];
+  if (!sessionToken) {
+    return notAuthenticatedResult();
+  }
   try {
     const response = await fetch(
-      `${config2.services.userServiceUrl}/git-credentials?userId=${encodeURIComponent(userId)}`
+      `${config2.services.userServiceUrl}/git-credentials`,
+      { headers: authHeaders(sessionToken) }
     );
     if (!response.ok) {
       return fail({ status: response.status, message: "Failed to list credentials" });
@@ -58786,10 +58898,10 @@ var tools9 = [
 ];
 
 // apps/mcp-server/src/tools/refresh-token.ts
-var authClient2 = new AuthClient(config2.services.authServiceUrl);
+var authClient3 = new AuthClient(config2.services.authServiceUrl);
 var orgRefreshTokenTool = {
   name: "org_refresh_token",
-  description: "Refresh an existing session token to extend its validity for another 8 hours. Call this when the token has less than 1 hour remaining before expiry.",
+  description: "Refresh an existing session token, extending its validity for a full new lifetime (7 days by default). Rarely needed: tokens past half of their lifetime are refreshed automatically on any tool call. Use this only to force a refresh explicitly.",
   inputSchema: {
     type: "object",
     properties: {
@@ -58806,7 +58918,7 @@ async function handleOrgRefreshToken(args) {
   if (!token) {
     return fail({ status: 400, message: "token is required" });
   }
-  const result = await authClient2.refresh({ token });
+  const result = await authClient3.refresh({ token });
   if (!result) {
     return fail({ status: 401, message: "Token refresh failed. Please sign in again with org_request_otp." });
   }
@@ -59406,17 +59518,39 @@ function createServer() {
     ListToolsRequestSchema,
     () => Promise.resolve({ tools: allTools.map((t) => t.definition) })
   );
-  server.setRequestHandler(CallToolRequestSchema, (request) => {
-    const { name, arguments: args } = request.params;
+  server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    const { name, arguments: rawArgs } = request.params;
     const handler = toolMap.get(name);
     if (!handler) {
-      return Promise.resolve(fail({
+      return fail({
         code: "UNKNOWN_TOOL",
         message: `Unknown tool: ${name}`,
         hint: "This tool does not exist. List available tools and use one of them."
-      }));
+      });
+    }
+    const args = { ...rawArgs ?? {} };
+    let refreshedToken = null;
+    if (name !== "org_refresh_token" && typeof args["token"] === "string") {
+      refreshedToken = await maybeRefreshToken(args["token"]).catch(() => null);
+      if (refreshedToken) {
+        args["token"] = refreshedToken;
+      }
     }
-    return handler(args ?? {}).catch(fromCatch);
+    const result = await handler(args).catch(fromCatch);
+    if (refreshedToken) {
+      result.content = [
+        ...Array.isArray(result.content) ? result.content : [],
+        {
+          type: "text",
+          text: JSON.stringify({
+            tokenRefreshed: true,
+            token: refreshedToken,
+            note: "Your session token was refreshed automatically. Use this new token for all subsequent tool calls."
+          })
+        }
+      ];
+    }
+    return result;
   });
   return server;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibetocloud/mcp",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Claude Code MCP server and skills for deploying applications on vibetocloud",
   "bin": {
     "vibetocloud-mcp": "./dist/index.js"

package/skills/skills/vibetocloud-onboard/SKILL.md

@@ -415,3 +415,31 @@ git push --set-upstream <remote from config> <current branch>
 ```
 
 Tell the user: "✅ Your code is on vibetocloud. Run `/vibetocloud-deploy` to trigger your first deployment."
+
+---
+
+## Step 7 — Write CLAUDE.md
+
+Check whether `CLAUDE.md` exists in the project root using the Read tool.
+
+If it exists, read it and check whether it already contains a "VibeToCloud" section. If it does, skip this step.
+
+If it does not exist, or exists but has no VibeToCloud section, append the following block (create the file if needed):
+
+```markdown
+## VibeToCloud development
+
+This project is deployed on VibeToCloud. The `docker-compose.yml` defines how the application runs **in the cloud** — you do not need Docker locally and should never run `docker compose up`.
+
+Use the VibeToCloud MCP skills to work with the project:
+- Push code and deploy: `/vibe`
+- Debug running services: `/vibetocloud-debug`
+
+All interaction with running containers happens through the MCP tools, not locally.
+```
+
+Commit the CLAUDE.md if it was created or changed:
+```bash
+git add CLAUDE.md
+git diff --cached --quiet || git commit -m "chore: add VibeToCloud development instructions to CLAUDE.md"
+```