@yugabytedb/meko-mcp 2.3.0 → 2.5.1

package/lib/browser-login.mjs

@@ -0,0 +1,495 @@
+/**
+ * Browser sign-in for Cloud Meko: OAuth once, then trade the session for an
+ * API key.
+ *
+ * The flow is the MCP authorization spec, ported from
+ * yugabyte/meko-cli lib/oauth.mjs:
+ *
+ *   1. Probe the MCP endpoint unauthenticated and read WWW-Authenticate.
+ *   2. Discover protected-resource and authorization-server metadata.
+ *   3. Register a public client (DCR) with a loopback redirect_uri.
+ *   4. Open the browser on /authorize with PKCE (S256) and wait for the
+ *      callback on 127.0.0.1.
+ *   5. Exchange the code for an access token.
+ *   6. POST it to <server>/api-keys, which creates an `mko_tkn_` key for the
+ *      signed-in user.
+ *
+ * Only the API key leaves this module. The OAuth tokens are discarded: the
+ * client configs and capture hooks all authenticate with the key, so nothing
+ * here needs refreshing.
+ */
+
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import http from "node:http";
+import os from "node:os";
+import { spawn } from "node:child_process";
+
+import { MEKO_PRODUCTION_CONSOLE_URL } from "./clients/common.mjs";
+
+const PROTOCOL_VERSION = "2025-03-26";
+const USER_AGENT = "meko-installer/1.0 (+https://github.com/yugabyte/meko-mcp-server)";
+export const DEFAULT_LOGIN_TIMEOUT_MS = 5 * 60_000;
+const DEFAULT_REQUEST_TIMEOUT_MS = 30_000;
+const MAX_KEY_NAME_LEN = 100;
+
+export class BrowserLoginError extends Error {
+  constructor(message, { code = "login_failed", status = null } = {}) {
+    super(message);
+    this.name = "BrowserLoginError";
+    this.code = code;
+    this.status = status;
+  }
+}
+
+/**
+ * Sign in through the browser and return a freshly created API key.
+ *
+ * @param {object} params
+ * @param {string} params.url             MCP endpoint, e.g. https://mcp.mekodata.ai/mcp
+ * @param {string} [params.keyName]       Label for the new key (default: installer + hostname + time)
+ * @param {boolean} [params.noBrowser]    Print the URL instead of opening a browser
+ * @param {number} [params.loginTimeoutMs]
+ * @param {(msg: string) => void} [params.notify]
+ * @param {typeof fetch} [params.fetchImpl]
+ * @param {(url: string) => Promise<boolean>} [params.openBrowser]
+ * @returns {Promise<{apiKey: string, id: string|null, name: string, expiresAt: string|null}>}
+ */
+export async function loginAndCreateApiKey({
+  url,
+  keyName = defaultKeyName(),
+  noBrowser = false,
+  loginTimeoutMs = DEFAULT_LOGIN_TIMEOUT_MS,
+  notify = () => {},
+  fetchImpl = globalThis.fetch,
+  openBrowser = openDefaultBrowser,
+} = {}) {
+  const accessToken = await loginOAuth({
+    url,
+    noBrowser,
+    loginTimeoutMs,
+    notify,
+    fetchImpl,
+    openBrowser,
+  });
+  return createApiKey({ url, accessToken, keyName, fetchImpl });
+}
+
+export async function loginOAuth({
+  url,
+  noBrowser = false,
+  loginTimeoutMs = DEFAULT_LOGIN_TIMEOUT_MS,
+  notify = () => {},
+  fetchImpl = globalThis.fetch,
+  openBrowser = openDefaultBrowser,
+}) {
+  const callback = await createCallbackServer();
+  try {
+    const discovery = await discoverOAuth(url, fetchImpl);
+    const client = await registerClient(discovery, callback.redirectUri, fetchImpl);
+    const state = base64url(randomBytes(32));
+    const verifier = base64url(randomBytes(48));
+    const challenge = base64url(createHash("sha256").update(verifier).digest());
+    const authorizationUrl = buildAuthorizationUrl({
+      discovery,
+      client,
+      redirectUri: callback.redirectUri,
+      state,
+      challenge,
+    });
+
+    if (noBrowser) {
+      notify(`Open this URL in a browser to sign in:\n  ${authorizationUrl}`);
+    } else {
+      const opened = await openBrowser(authorizationUrl);
+      notify(
+        opened
+          ? `Opened your browser to sign in. If it didn't open, use this URL:\n  ${authorizationUrl}`
+          : `Could not open a browser. Open this URL to sign in:\n  ${authorizationUrl}`,
+      );
+    }
+
+    const returned = await callback.wait(loginTimeoutMs);
+    if (returned.error) {
+      throw new BrowserLoginError(
+        `Sign-in failed: ${returned.error_description ?? returned.error}`,
+        { code: "authorization_denied" },
+      );
+    }
+    if (!safeEqual(returned.state, state)) {
+      throw new BrowserLoginError("Sign-in callback state did not match. Run the installer again.");
+    }
+    if (!returned.code) {
+      throw new BrowserLoginError("Sign-in callback did not include an authorization code.");
+    }
+
+    const tokens = await exchangeAuthorizationCode({
+      discovery,
+      client,
+      redirectUri: callback.redirectUri,
+      code: returned.code,
+      verifier,
+      fetchImpl,
+    });
+    return tokens.access_token;
+  } finally {
+    await callback.close();
+  }
+}
+
+/**
+ * Trade an OAuth access token for an `mko_tkn_` key via POST <server>/api-keys.
+ */
+export async function createApiKey({ url, accessToken, keyName = defaultKeyName(), fetchImpl = globalThis.fetch }) {
+  const endpoint = apiKeysEndpoint(url);
+  const response = await timedFetch(fetchImpl, endpoint, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${accessToken}`,
+      "Content-Type": "application/json",
+      Accept: "application/json",
+      "User-Agent": USER_AGENT,
+    },
+    body: JSON.stringify({ name: keyName }),
+  });
+  const body = await response.json().catch(() => null);
+  const console = consoleUrlFor(url);
+
+  if (response.status === 404 || response.status === 405) {
+    throw new BrowserLoginError(
+      "This Meko server does not support browser sign-in yet. " +
+        `Create an API key at ${console} > Settings > API Keys, then rerun with --api-key.`,
+      { code: "unsupported", status: response.status },
+    );
+  }
+  if (response.status === 429) {
+    throw new BrowserLoginError(
+      "You already have the maximum number of active API keys. " +
+        `Revoke one at ${console} > Settings > API Keys, then run the installer again.`,
+      { code: "token_cap_reached", status: 429 },
+    );
+  }
+  if (response.status === 403 && body?.error?.code === "account_not_provisioned") {
+    // The browser signed in as a Cognito identity with no Meko account, e.g.
+    // Google in the browser but email and password in the console. The
+    // server refuses rather than minting a key for a new, empty account.
+    throw new BrowserLoginError(
+      `You signed in as a user that has no Meko account. Sign in at ${console} with the ` +
+        "method you normally use (for example Google, or email and password), then run the " +
+        "installer again and pick that same method. If the browser chose an account " +
+        `automatically, sign out at ${console} first. Or create a key at ${console} > ` +
+        "Settings > API Keys and rerun with --api-key.",
+      { code: "account_not_provisioned", status: 403 },
+    );
+  }
+  if (!response.ok || typeof body?.api_key !== "string" || !body.api_key.startsWith("mko_tkn_")) {
+    const detail = body?.error?.message ? `: ${body.error.message}` : "";
+    throw new BrowserLoginError(
+      `Could not create an API key (HTTP ${response.status})${detail}`,
+      { code: body?.error?.code ?? "create_failed", status: response.status },
+    );
+  }
+  return {
+    apiKey: body.api_key,
+    id: body.id ?? null,
+    name: body.name ?? keyName,
+    expiresAt: body.expires_at ?? null,
+  };
+}
+
+/** `https://mcp.mekodata.ai/mcp` → `https://mcp.mekodata.ai/api-keys`. */
+export function apiKeysEndpoint(mcpUrl) {
+  const parsed = new URL(mcpUrl);
+  const base = parsed.pathname.replace(/\/+$/, "").replace(/\/mcp$/, "");
+  return `${parsed.origin}${base}/api-keys`;
+}
+
+/** Console that issues keys for this MCP host. Dev keys only work on dev. */
+export function consoleUrlFor(mcpUrl) {
+  try {
+    const host = new URL(mcpUrl).hostname;
+    if (host === "mekodev.com" || host.endsWith(".mekodev.com")) return "https://app.mekodev.com";
+  } catch {
+    // fall through
+  }
+  return MEKO_PRODUCTION_CONSOLE_URL;
+}
+
+export function defaultKeyName({ hostname = os.hostname(), now = new Date() } = {}) {
+  const stamp = now.toISOString().replace(/\.\d{3}Z$/, "Z");
+  const host = String(hostname || "unknown-host").replace(/\.local$/, "");
+  const name = `Meko installer (${host}) ${stamp}`;
+  if (name.length <= MAX_KEY_NAME_LEN) return name;
+  const room = MAX_KEY_NAME_LEN - `Meko installer () ${stamp}`.length;
+  return `Meko installer (${host.slice(0, Math.max(room, 0))}) ${stamp}`;
+}
+
+// ---------------------------------------------------------------------------
+// OAuth plumbing
+// ---------------------------------------------------------------------------
+
+export async function discoverOAuth(serverUrl, fetchImpl = globalThis.fetch) {
+  const challenge = await probeChallenge(serverUrl, fetchImpl);
+  const resourceMetadata = await firstJson(
+    protectedResourceUrls(serverUrl, challenge.resourceMetadata),
+    fetchImpl,
+  );
+  const authorizationServer = resourceMetadata?.authorization_servers?.[0] ?? new URL(serverUrl).origin;
+  const metadata = await firstJson(authorizationMetadataUrls(authorizationServer, serverUrl), fetchImpl);
+  if (!metadata?.authorization_endpoint || !metadata?.token_endpoint) {
+    throw new BrowserLoginError(
+      "This Meko endpoint does not advertise OAuth sign-in. Use --api-key instead.",
+      { code: "unsupported" },
+    );
+  }
+  return {
+    authorization_endpoint: metadata.authorization_endpoint,
+    token_endpoint: metadata.token_endpoint,
+    registration_endpoint: metadata.registration_endpoint ?? new URL("/register", authorizationServer).toString(),
+    scope: challenge.scope
+      ?? resourceMetadata?.scopes_supported?.join(" ")
+      ?? metadata.scopes_supported?.join(" ")
+      ?? null,
+    resource: resourceMetadata?.resource ?? null,
+  };
+}
+
+async function probeChallenge(serverUrl, fetchImpl) {
+  const response = await timedFetch(fetchImpl, serverUrl, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Accept: "application/json, text/event-stream",
+      "MCP-Protocol-Version": PROTOCOL_VERSION,
+      "User-Agent": USER_AGENT,
+    },
+    body: JSON.stringify({
+      jsonrpc: "2.0",
+      id: "oauth-discovery",
+      method: "initialize",
+      params: {
+        protocolVersion: PROTOCOL_VERSION,
+        capabilities: {},
+        clientInfo: { name: "meko-installer", version: "1.0.0" },
+      },
+    }),
+  });
+  const header = response.headers.get("www-authenticate") ?? "";
+  return {
+    resourceMetadata: challengeField(header, "resource_metadata"),
+    scope: challengeField(header, "scope"),
+  };
+}
+
+async function registerClient(discovery, redirectUri, fetchImpl) {
+  const response = await timedFetch(fetchImpl, discovery.registration_endpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", "User-Agent": USER_AGENT },
+    body: JSON.stringify({
+      redirect_uris: [redirectUri],
+      token_endpoint_auth_method: "none",
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      client_name: "Meko installer",
+      software_id: "meko-installer",
+      software_version: "1.0.0",
+      ...(discovery.scope ? { scope: discovery.scope } : {}),
+    }),
+  });
+  const body = await response.json().catch(() => null);
+  if (!response.ok || !body?.client_id) {
+    throw new BrowserLoginError(
+      `OAuth client registration failed (HTTP ${response.status}). Use --api-key instead.`,
+      { code: "registration_failed", status: response.status },
+    );
+  }
+  return body;
+}
+
+function buildAuthorizationUrl({ discovery, client, redirectUri, state, challenge }) {
+  const url = new URL(discovery.authorization_endpoint);
+  url.search = new URLSearchParams({
+    response_type: "code",
+    client_id: client.client_id,
+    redirect_uri: redirectUri,
+    state,
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+    ...(discovery.scope ? { scope: discovery.scope } : {}),
+    ...(discovery.resource ? { resource: discovery.resource } : {}),
+  }).toString();
+  return url.toString();
+}
+
+async function exchangeAuthorizationCode({ discovery, client, redirectUri, code, verifier, fetchImpl }) {
+  const form = new URLSearchParams({
+    grant_type: "authorization_code",
+    code,
+    redirect_uri: redirectUri,
+    client_id: client.client_id,
+    code_verifier: verifier,
+    ...(discovery.resource ? { resource: discovery.resource } : {}),
+  });
+  const headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": USER_AGENT };
+  const method = client.token_endpoint_auth_method ?? "none";
+  if (method === "client_secret_basic") {
+    const id = encodeURIComponent(client.client_id);
+    const secret = encodeURIComponent(client.client_secret ?? "");
+    headers.Authorization = `Basic ${Buffer.from(`${id}:${secret}`).toString("base64")}`;
+  } else if (method === "client_secret_post" && client.client_secret) {
+    form.set("client_secret", client.client_secret);
+  }
+  const response = await timedFetch(fetchImpl, discovery.token_endpoint, { method: "POST", headers, body: form });
+  const body = await response.json().catch(() => null);
+  if (!response.ok || !body?.access_token) {
+    throw new BrowserLoginError(
+      `OAuth token exchange failed (HTTP ${response.status}). Run the installer again.`,
+      { code: "token_exchange_failed", status: response.status },
+    );
+  }
+  return body;
+}
+
+const CALLBACK_PAGE =
+  "<!doctype html><meta charset=utf-8><title>Meko sign-in</title>" +
+  "<body style=\"font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto\">" +
+  "<h1>Signed in to Meko</h1><p>You can close this window and return to the terminal.</p></body>";
+
+async function createCallbackServer() {
+  let settle;
+  let fail;
+  const result = new Promise((resolve, reject) => {
+    settle = resolve;
+    fail = reject;
+  });
+  const server = http.createServer((req, res) => {
+    const requestUrl = new URL(req.url, "http://localhost");
+    if (requestUrl.pathname !== "/callback") {
+      res.writeHead(404, { "Content-Type": "text/plain" });
+      res.end("Not found");
+      return;
+    }
+    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+    res.end(CALLBACK_PAGE);
+    settle(Object.fromEntries(requestUrl.searchParams));
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+  server.on("error", (err) => fail(err));
+  const { port } = server.address();
+  return {
+    redirectUri: `http://localhost:${port}/callback`,
+    wait: (timeoutMs) => {
+      const timer = setTimeout(
+        () =>
+          fail(
+            new BrowserLoginError(
+              `Timed out after ${Math.round(timeoutMs / 1000)}s waiting for browser sign-in. ` +
+                "Run the installer again, or use --api-key.",
+              { code: "timeout" },
+            ),
+          ),
+        timeoutMs,
+      );
+      timer.unref?.();
+      return result.finally(() => clearTimeout(timer));
+    },
+    close: () =>
+      new Promise((resolve) => {
+        server.closeAllConnections?.();
+        server.close(() => resolve());
+      }),
+  };
+}
+
+export async function openDefaultBrowser(url, { platform = process.platform, spawnImpl = spawn } = {}) {
+  const command = platform === "darwin" ? "open" : platform === "win32" ? "rundll32" : "xdg-open";
+  const args = platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
+  try {
+    const child = spawnImpl(command, args, { detached: true, stdio: "ignore" });
+    return await new Promise((resolve) => {
+      child.once("error", () => resolve(false));
+      child.once("spawn", () => {
+        child.unref();
+        resolve(true);
+      });
+    });
+  } catch {
+    return false;
+  }
+}
+
+function protectedResourceUrls(serverUrl, advertised) {
+  const parsed = new URL(serverUrl);
+  const urls = [];
+  if (advertised) urls.push(advertised);
+  if (parsed.pathname && parsed.pathname !== "/") {
+    urls.push(`${parsed.origin}/.well-known/oauth-protected-resource${parsed.pathname}`);
+  }
+  urls.push(`${parsed.origin}/.well-known/oauth-protected-resource`);
+  return [...new Set(urls)];
+}
+
+function authorizationMetadataUrls(authServer, serverUrl) {
+  const parsed = new URL(authServer || serverUrl);
+  if (parsed.pathname && parsed.pathname !== "/") {
+    const path = parsed.pathname.replace(/\/$/, "");
+    return [
+      `${parsed.origin}/.well-known/oauth-authorization-server${path}`,
+      `${parsed.origin}/.well-known/openid-configuration${path}`,
+      `${parsed.origin}${path}/.well-known/openid-configuration`,
+    ];
+  }
+  return [
+    `${parsed.origin}/.well-known/oauth-authorization-server`,
+    `${parsed.origin}/.well-known/openid-configuration`,
+  ];
+}
+
+async function firstJson(urls, fetchImpl) {
+  for (const url of urls) {
+    const response = await timedFetch(fetchImpl, url, {
+      headers: { "MCP-Protocol-Version": PROTOCOL_VERSION, "User-Agent": USER_AGENT },
+    });
+    if (!response.ok) continue;
+    try {
+      return await response.json();
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+
+async function timedFetch(fetchImpl, url, options) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), DEFAULT_REQUEST_TIMEOUT_MS);
+  timer.unref?.();
+  try {
+    return await fetchImpl(url, { ...options, signal: controller.signal });
+  } catch (err) {
+    if (err?.name === "AbortError") {
+      throw new BrowserLoginError(`Request timed out: ${url}`, { code: "network" });
+    }
+    throw new BrowserLoginError(`Request failed: ${err?.message ?? String(err)}`, { code: "network" });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+function challengeField(header, field) {
+  const match = new RegExp(`${field}=(?:"([^"]+)"|([^\\s,]+))`, "i").exec(header);
+  return match?.[1] ?? match?.[2] ?? null;
+}
+
+function safeEqual(left, right) {
+  if (typeof left !== "string" || typeof right !== "string") return false;
+  const a = Buffer.from(left);
+  const b = Buffer.from(right);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+
+function base64url(value) {
+  return Buffer.from(value).toString("base64url");
+}

package/lib/clients/codex.mjs

@@ -38,6 +38,7 @@ import {
 import {
   getInstallerVersion,
   installStableTree,
+  isLocalUrl,
   isPackagedInstall,
   isDanglingSymlink,
   markerIsStale,
@@ -909,30 +910,6 @@ function buildCliRegisterCommand(name, url, bearerEnv) {
   return cmd;
 }
 
-/**
- * True for localhost / loopback MCP URLs (no cloud WAF in front). Parses the
- * URL and compares the HOSTNAME exactly — a substring test would wrongly
- * classify `https://localhost.example.com` (a real remote host) as local and
- * skip the WAF User-Agent header. Unparseable input is treated as non-local
- * (cloud), i.e. we err toward setting the header.
- */
-function isLocalUrl(url) {
-  let host;
-  try {
-    host = new URL(String(url ?? "")).hostname;
-  } catch {
-    return false;
-  }
-  // `new URL` strips the brackets from IPv6 literals, so `[::1]` → `::1`.
-  host = host.replace(/^\[|\]$/g, "").toLowerCase();
-  return (
-    host === "localhost" ||
-    host === "::1" ||
-    // Entire 127.0.0.0/8 block is loopback, not just 127.0.0.1.
-    /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host)
-  );
-}
-
 const HTTP_HEADER_USER_AGENT_KEY = "User-Agent";
 
 // Matches one `KEY = "VALUE"` (or single-quoted) pair. KEY may be

package/lib/clients/common.mjs

@@ -114,6 +114,31 @@ export function run(cmd) {
   return execSync(cmd, { encoding: "utf8", stdio: "pipe" }).trim();
 }
 
+/**
+ * True for localhost / loopback MCP URLs (no cloud WAF in front, no browser
+ * sign-in). Parses the URL and compares the HOSTNAME exactly — a substring
+ * test would wrongly classify `https://localhost.example.com` (a real remote
+ * host) as local and `http://[::1]/mcp` as cloud. Unparseable input is
+ * treated as non-local (cloud): Codex errs toward setting the WAF User-Agent
+ * header, and the installer toward requiring an API key.
+ */
+export function isLocalUrl(url) {
+  let host;
+  try {
+    host = new URL(String(url ?? "")).hostname;
+  } catch {
+    return false;
+  }
+  // `new URL` strips the brackets from IPv6 literals, so `[::1]` → `::1`.
+  host = host.replace(/^\[|\]$/g, "").toLowerCase();
+  return (
+    host === "localhost" ||
+    host === "::1" ||
+    // Entire 127.0.0.0/8 block is loopback, not just 127.0.0.1.
+    /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host)
+  );
+}
+
 /**
  * @param {string|null|undefined} apiKey
  * @returns {string}

package/lib/clients/opencode.mjs

@@ -337,6 +337,7 @@ export function createOpenCodeAdapter(customPaths = {}) {
         };
       }
       let resolved;
+      log?.dim?.("  Reading OpenCode's resolved configuration. The first run after install can take a minute while OpenCode installs plugin dependencies.");
       try {
         resolved = await Promise.resolve(readResolvedConfig({
           bin: found.path || "opencode",
@@ -378,12 +379,16 @@ export function createOpenCodeAdapter(customPaths = {}) {
     },
   };
 }
+// The first OpenCode run after install writes package.json with
+// @opencode-ai/plugin and installs it before resolving config. That took 80 s
+// in one measured run; warm runs take under a second.
+const RESOLVED_CONFIG_TIMEOUT_MS = 120_000;
 function defaultReadResolvedConfig({ bin, cwd }) {
   const result = spawnSync(bin, ["debug", "config"], {
     cwd,
     encoding: "utf8",
     maxBuffer: 16 * 1024 * 1024,
-    timeout: 10_000,
+    timeout: RESOLVED_CONFIG_TIMEOUT_MS,
   });
   if (result.error) throw result.error;
   if (result.status !== 0) {