auchan-mcp 0.1.0 → 0.2.1

package/README.md

@@ -21,35 +21,18 @@ O `robots.txt` do Auchan pede que a pesquisa não seja usada de forma automátic
 
 ## Instalar
 
-Precisas do Node.js 20.18.1 ou mais recente. Na pasta `servers/auchan`:
-
-```
-npm install
-```
-
-Para o carrinho, instala também o browser que o login usa:
-
-```
-npx playwright install chromium
-```
-
-e cria `%USERPROFILE%\.auchan-mcp\credentials.env` (no macOS/Linux, `~/.auchan-mcp/credentials.env`) com o teu login do Auchan. A pesquisa funciona sem este ficheiro.
-
-```
-AUCHAN_EMAIL=tu@exemplo.pt
-AUCHAN_PASSWORD=a-tua-palavra-passe
-```
-
-Depois junta o servidor ao teu cliente MCP e reinicia-o:
+Precisas do Node.js 20.18.1 ou mais recente e de um cliente MCP, por exemplo o Claude Code. Junta o servidor e reinicia o cliente:
 
 ```json
 {
   "mcpServers": {
-    "auchan": { "command": "node", "args": ["C:/caminho/para/servers/auchan/src/index.js"] }
+    "auchan": { "command": "npx", "args": ["-y", "auchan-mcp"] }
   }
 }
 ```
 
+A pesquisa funciona logo, sem conta. Para o carrinho não crias nada: quando o assistente precisar dele, abre-se uma janela do Edge ou do Chrome na página de login do Auchan. Entras tu, a janela fecha e ficas ligado. A palavra-passe nunca passa pelo servidor nem fica guardada: só a sessão, no teu computador (`%USERPROFILE%\.auchan-mcp\cookies.json`). Se aparecer um CAPTCHA, resolves tu na janela.
+
 ## Usar
 
 Pede coisas como "procura leite meio-gordo no Auchan" ou "junta 2 pacotes ao carrinho do Auchan".
@@ -59,13 +42,12 @@ Pede coisas como "procura leite meio-gordo no Auchan" ou "junta 2 pacotes ao car
 | `search_products` | Pesquisar o catálogo (devolve JSON) |
 | `get_cart` | Ver o carrinho |
 | `add_to_cart` / `update_cart_item` | Juntar um produto / mudar a quantidade (0 tira-o) |
-| `close_session` | Fechar o browser |
-
-As ferramentas do carrinho só aparecem quando existe o ficheiro de credenciais.
+| `login` | Ligar a tua conta: abre a janela de login (as ferramentas do carrinho fazem-no sozinhas se for preciso) |
+| `logout` | Desligar a conta: apaga a sessão guardada neste computador |
+| `close_session` | Libertar recursos |
 
 ## Mais
 
-- **Definições:** caminhos e opções em [`.env.example`](.env.example).
 - **Problemas:** [docs/troubleshooting.md](docs/troubleshooting.md).
 - **Testes:** `npm test` corre sem internet. `LIVE=1` liga um teste que faz um pedido real ao Auchan.pt (no PowerShell: `$env:LIVE=1; npm test`).
 

package/dist/index.js

@@ -16,7 +16,7 @@ import { pathToFileURL } from "node:url";
 // src/cart.js
 import * as cheerio from "cheerio";
 var PIPELINE = "/on/demandware.store/Sites-AuchanPT-Site/pt_PT/";
-var CART_ACTIONS = ["Cart-Show", "Cart-AddProduct", "Cart-UpdateQuantity", "Cart-RemoveProductLineItem"];
+var CART_ACTIONS = ["Cart-Show", "Cart-AddProduct", "Cart-RemoveProductLineItem"];
 function cartPath(action, params = {}) {
   if (!CART_ACTIONS.includes(action)) throw new Error(`a\xE7\xE3o n\xE3o permitida: ${action}`);
   const query = new URLSearchParams(params).toString();
@@ -35,22 +35,28 @@ function validateCartInput(name, args) {
 }
 function parseCart(html) {
   const $ = cheerio.load(html);
-  const lines = /* @__PURE__ */ new Map();
-  $("[data-pid][data-uuid]").each((_, el) => {
+  const items = [];
+  $(".auc-cart__product-card[data-pid]").each((_, el) => {
     const $el = $(el);
-    const uuid3 = $el.attr("data-uuid");
-    const line = lines.get(uuid3) ?? { product_id: $el.attr("data-pid"), uuid: uuid3, name: null, quantity: null, price: null };
-    const value = $el.is("select") ? $el.find("option[selected]").attr("value") ?? $el.val() : $el.attr("value");
-    if ($el.is("input, select") && line.quantity === null && value !== void 0) line.quantity = Number(value);
-    const $line = $el.closest(".product-info, .line-item, .card");
-    line.name ??= $el.attr("data-name") || $line.find(".line-item-name").first().text().replace(/\s+/g, " ").trim() || null;
-    const price = Number($line.find(".sales .value[content]").first().attr("content") || NaN);
-    if (line.price === null && Number.isFinite(price) && price > 0) line.price = price;
-    lines.set(uuid3, line);
+    const input2 = $el.find("input.auc-js-update-product-quantity").first();
+    const uuid3 = input2.attr("data-uuid") || $el.find("[data-uuid]").first().attr("data-uuid") || null;
+    let gtm = {};
+    try {
+      gtm = JSON.parse($el.attr("data-gtm") || "{}");
+    } catch {
+    }
+    const price = Number(gtm.price);
+    items.push({
+      product_id: $el.attr("data-pid"),
+      uuid: uuid3,
+      name: gtm.name || $el.find(".auc-product-tile__name a, .line-item-name").first().text().replace(/s+/g, " ").trim() || null,
+      quantity: Number(input2.attr("value")),
+      price: Number.isFinite(price) && price > 0 ? price : null
+    });
   });
   const csrf = $('input[name="csrf_token"]').attr("value") || $("[data-csrf-protection-token]").attr("data-csrf-protection-token") || null;
-  const total = $(".grand-total, .grand-total-sum").first().text().replace(/\s+/g, " ").trim() || null;
-  return { items: [...lines.values()].filter((item) => Number.isFinite(item.quantity)), total, csrf };
+  const total = $(".basket-total").first().text().replace(/s+/g, " ").trim() || null;
+  return { items: items.filter((item) => item.uuid && Number.isFinite(item.quantity)), total, csrf };
 }
 var publicCart = (cart) => ({
   store: "auchan",
@@ -71,6 +77,9 @@ async function sendChange(site, request) {
     payload = JSON.parse(res.text);
   } catch {
   }
+  if (payload?.showDeliveryOptionsModal === true) {
+    return { ok: false, error: "o Auchan ainda precisa de saber se queres entrega ou levantamento; usa a ferramenta login e escolhe-o na janela" };
+  }
   if (res.status >= 400 || !payload || payload.error === true || payload.success === false) {
     return { ok: false, error: payload?.message || `o site recusou a altera\xE7\xE3o (HTTP ${res.status})` };
   }
@@ -93,14 +102,27 @@ async function addToCart(site, productId, quantity) {
   if (!sent.ok) return { success: false, error: sent.error, writeAttempted: true };
   return confirmQuantity(site, productId, previous + quantity);
 }
+var addForm = (productId, quantity, csrf) => ({ pid: productId, quantity: String(quantity), options: "[]", ...csrf && { csrf_token: csrf } });
 async function updateCartItem(site, productId, quantity) {
   const before = await getCart(site);
   const line = before.items.find((item) => item.product_id === productId);
   if (!line) return { success: false, error: "not_in_cart", product_id: productId, writeAttempted: false };
+  const current = quantityOf(before, productId);
+  if (quantity === current) return { success: true, product_id: productId, cart_quantity: current };
+  if (quantity > current) {
+    const sent = await sendChange(site, () => site.post(cartPath("Cart-AddProduct"), addForm(productId, quantity - current, before.csrf)));
+    if (!sent.ok) return { success: false, error: sent.error, writeAttempted: true };
+    return confirmQuantity(site, productId, quantity);
+  }
   const params = { pid: productId, uuid: line.uuid };
   if (before.csrf) params.csrf_token = before.csrf;
-  const sent = quantity === 0 ? await sendChange(site, () => site.get(cartPath("Cart-RemoveProductLineItem", params))) : await sendChange(site, () => site.get(cartPath("Cart-UpdateQuantity", { ...params, quantity: String(quantity) })));
-  if (!sent.ok) return { success: false, error: sent.error, writeAttempted: true };
+  const removed = await sendChange(site, () => site.get(cartPath("Cart-RemoveProductLineItem", params)));
+  if (!removed.ok) return { success: false, error: removed.error, writeAttempted: true };
+  if (quantity > 0) {
+    const after = await getCart(site);
+    const sent = await sendChange(site, () => site.post(cartPath("Cart-AddProduct"), addForm(productId, quantity, after.csrf)));
+    if (!sent.ok) return { success: false, error: sent.error, writeAttempted: true };
+  }
   return confirmQuantity(site, productId, quantity);
 }
 
@@ -110,6 +132,7 @@ var AUCHAN_BASE = "https://www.auchan.pt";
 var VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
 var USER_AGENT = `supermercados-mcp/${VERSION} (auchan-mcp; +https://github.com/vasco-branco06/supermercados-mcp)`;
 var BLOCK_MARKERS = /captcha|cf-challenge|just a moment\.\.\.|_incapsula_|datadome|perimeterx|px-captcha|access denied/i;
+var CHALLENGE_MAX_BYTES = 3e4;
 var BlockedError = class extends Error {
 };
 function createThrottle(intervalMs = 1e3, now = Date.now, sleep = (ms) => new Promise((r) => setTimeout(r, ms))) {
@@ -130,7 +153,7 @@ function createThrottle(intervalMs = 1e3, now = Date.now, sleep = (ms) => new Pr
 var throttle = createThrottle();
 function assertNotBlocked(status, body = "") {
   if (status === 403 || status === 429) throw new BlockedError(`o site bloqueou o pedido (HTTP ${status}); tenta mais tarde`);
-  if (BLOCK_MARKERS.test(body) && !body.includes("data-pid=")) {
+  if (body.length < CHALLENGE_MAX_BYTES && BLOCK_MARKERS.test(body) && !body.includes("data-pid=")) {
     throw new BlockedError("o site pediu uma verifica\xE7\xE3o anti-rob\xF4 (CAPTCHA); abre o auchan.pt no browser e tenta mais tarde");
   }
 }
@@ -153,7 +176,6 @@ async function fetchPage(url2, { fetchImpl = fetch, gate = throttle } = {}) {
 }
 
 // src/paths.js
-import { existsSync, readFileSync as readFileSync2 } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 function resolveStatePaths(env = process.env) {
@@ -161,33 +183,14 @@ function resolveStatePaths(env = process.env) {
   return {
     stateDir,
     cacheDir: join(stateDir, "cache"),
-    credentialFile: join(stateDir, "credentials.env"),
     cookieFile: join(stateDir, "cookies.json")
   };
 }
-function parseEnvFile(contents) {
-  const parsed = {};
-  for (const line of contents.split(/\r?\n/)) {
-    const raw = line.trim().replace(/^export\s+/, "");
-    const index = raw.indexOf("=");
-    if (!raw || raw.startsWith("#") || index === -1) continue;
-    const key = raw.slice(0, index).trim();
-    const value = raw.slice(index + 1).trim().replace(/^(["'])(.*)\1$/, "$2");
-    if (/^[A-Z_][A-Z0-9_]*$/.test(key)) parsed[key] = value;
-  }
-  return parsed;
-}
-function loadCredentials(env = process.env) {
-  const { credentialFile } = resolveStatePaths(env);
-  if (!existsSync(credentialFile)) return null;
-  const { AUCHAN_EMAIL: email3, AUCHAN_PASSWORD: password } = parseEnvFile(readFileSync2(credentialFile, "utf8"));
-  return email3 && password ? { email: email3, password } : null;
-}
 
 // src/search.js
 import * as cheerio2 from "cheerio";
 import { createHash } from "node:crypto";
-import { mkdirSync, readFileSync as readFileSync3, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
 import { join as join2 } from "node:path";
 
 // ../../node_modules/zod/v4/classic/external.js
@@ -20007,7 +20010,7 @@ var searchUrl = (query) => `${AUCHAN_BASE}/pt/pesquisa?q=${encodeURIComponent(qu
 var cacheFile = (cacheDir, query) => join2(cacheDir, `${createHash("sha256").update(query.trim().toLowerCase()).digest("hex").slice(0, 32)}.json`);
 function readCache(file2, now) {
   try {
-    const entry = JSON.parse(readFileSync3(file2, "utf8"));
+    const entry = JSON.parse(readFileSync2(file2, "utf8"));
     if (now - Date.parse(entry.fetched_at) < CACHE_TTL_MS && Array.isArray(entry.raw)) return entry;
   } catch {
   }
@@ -20032,113 +20035,224 @@ async function searchProducts(query, limit = 10, { cacheDir, fetchImpl, now = Da
 }
 
 // src/session.js
-import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
+import { chmodSync, existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync3, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname } from "node:path";
 var LOGIN_URL = `${AUCHAN_BASE}/on/demandware.store/Sites-AuchanPT-Site/pt_PT/Login-OAuthLogin?oauthProvider=Salesforce&oauthLoginTargetEndPoint=1`;
-var ACCOUNT_URL = `${AUCHAN_BASE}/on/demandware.store/Sites-AuchanPT-Site/pt_PT/Account-Show`;
-var EMAIL_FIELD = 'input[type="email"], input[name="username"], input[name="email"]';
-var PASSWORD_FIELD = 'input[type="password"]';
-var SUBMIT = 'button[type="submit"], input[type="submit"]';
-function writeCookies(path, cookies) {
+var DELIVERY_URL = `${AUCHAN_BASE}/on/demandware.store/Sites-AuchanPT-Site/pt_PT/Delivery-Header`;
+var CART_URL = `${AUCHAN_BASE}/on/demandware.store/Sites-AuchanPT-Site/pt_PT/Cart-Show`;
+var BROWSER_CHANNELS = ["msedge", "chrome", void 0];
+var NO_PLAYWRIGHT = "falta o Playwright; instala o pacote de novo (npm install auchan-mcp)";
+var NO_BROWSER = 'n\xE3o encontrei o Microsoft Edge nem o Google Chrome para abrir a janela de login; instala um deles ou corre "npx playwright install chromium"';
+function writeState(path, state) {
   mkdirSync2(dirname(path), { recursive: true, mode: 448 });
-  writeFileSync2(path, JSON.stringify(cookies, null, 2), { mode: 384 });
+  writeFileSync2(path, JSON.stringify(state, null, 2), { mode: 384 });
   chmodSync(path, 384);
 }
-function createSession({ credentials, cookieFile, log = console.error }) {
-  let browser = null;
-  let context = null;
-  async function login(page) {
-    log("[auth] A iniciar sess\xE3o no Auchan...");
-    await throttle(() => page.goto(LOGIN_URL, { waitUntil: "domcontentloaded", timeout: 3e4 }));
-    await checkChallenge(page);
-    await page.locator(EMAIL_FIELD).first().fill(credentials.email, { timeout: 15e3 });
-    const password = page.locator(PASSWORD_FIELD).first();
-    if (!await password.isVisible().catch(() => false)) {
-      await throttle(() => page.locator(SUBMIT).first().click());
-    }
-    await password.fill(credentials.password, { timeout: 15e3 });
-    await throttle(() => page.locator(SUBMIT).first().click());
-    await page.waitForURL((url2) => url2.hostname === "www.auchan.pt", { timeout: 3e4 }).catch(async () => {
-      await checkChallenge(page);
-      throw new Error("o login n\xE3o terminou; confirma o email e a palavra-passe em credentials.env");
-    });
-    writeCookies(cookieFile, await context.cookies());
-    log("[auth] Sess\xE3o iniciada.");
-  }
-  async function checkChallenge(page) {
-    const captcha = await page.locator('iframe[src*="captcha"], .g-recaptcha, .h-captcha, #px-captcha').count();
-    if (captcha) throw new BlockedError("o site pediu uma verifica\xE7\xE3o anti-rob\xF4 (CAPTCHA) no login; entra uma vez no auchan.pt pelo browser e tenta mais tarde");
-    assertNotBlocked(200, await page.content());
+function readState(path) {
+  if (!existsSync(path)) return null;
+  try {
+    const saved = JSON.parse(readFileSync3(path, "utf8"));
+    const state = Array.isArray(saved) ? { cookies: saved, origins: [] } : { cookies: saved?.cookies, origins: saved?.origins ?? [] };
+    return Array.isArray(state.cookies) && state.cookies.length ? state : null;
+  } catch {
+    return null;
   }
-  async function open2() {
-    if (context) return;
-    let chromium;
-    try {
-      ({ chromium } = await import("playwright"));
-    } catch {
-      throw new Error('falta o Playwright; corre "npm install" e "npx playwright install chromium" na pasta servers/auchan');
+}
+function createSession({
+  cookieFile,
+  log = console.error,
+  loadPlaywright = () => import("playwright"),
+  loginTimeoutMs = 5 * 60 * 1e3,
+  keepAliveMs = 10 * 60 * 1e3,
+  pollMs = 3e3,
+  sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+}) {
+  let playwright = null;
+  let api = null;
+  let state = null;
+  let loggedIn = false;
+  let pending = null;
+  let inFlight = 0;
+  let timer = null;
+  let beating = false;
+  async function pw() {
+    if (!playwright) {
+      try {
+        playwright = await loadPlaywright();
+      } catch {
+        throw new Error(NO_PLAYWRIGHT);
+      }
     }
-    browser = await chromium.launch({ headless: process.env.AUCHAN_LOGIN_HEADLESS !== "false" });
-    browser.on("disconnected", () => {
-      browser = context = null;
+    return playwright;
+  }
+  async function openApi(next) {
+    state = next;
+    await api?.dispose().catch(() => {
     });
-    context = await browser.newContext({ userAgent: USER_AGENT, locale: "pt-PT" });
-    if (existsSync2(cookieFile)) {
+    api = await (await pw()).request.newContext({
+      userAgent: USER_AGENT,
+      locale: "pt-PT",
+      storageState: { cookies: next.cookies, origins: [] }
+    });
+  }
+  async function isLoggedIn(requester) {
+    const res = await throttle(() => requester.get(CART_URL, { timeout: 15e3 }));
+    assertNotBlocked(res.status(), "");
+    return res.ok() && /data-authenticated="true"/.test(await res.text());
+  }
+  async function hasDeliveryContext(requester) {
+    const res = await throttle(() => requester.get(DELIVERY_URL, { timeout: 15e3 }));
+    assertNotBlocked(res.status(), "");
+    return res.ok() && /data-has-context="true"/.test(await res.text());
+  }
+  async function launch(chromium, headless) {
+    for (const channel of BROWSER_CHANNELS) {
       try {
-        await context.addCookies(JSON.parse(readFileSync4(cookieFile, "utf8")));
+        return await chromium.launch({ headless, ...channel && { channel } });
       } catch {
-        log("[auth] N\xE3o consegui ler as cookies guardadas; vou iniciar sess\xE3o de novo.");
       }
     }
-    if (await isLoggedIn()) return;
-    const page = await context.newPage();
+    return null;
+  }
+  async function interactiveLogin(saved = null) {
+    const { chromium } = await pw();
+    const browser = await launch(chromium, false);
+    if (!browser) throw new Error(NO_BROWSER);
+    const closed = new Promise((resolve) => browser.on("disconnected", () => resolve("closed")));
     try {
-      await login(page);
+      const context = await browser.newContext({ locale: "pt-PT", ...saved && { storageState: saved } });
+      const page = await context.newPage();
+      log(saved ? "[auth] Abri uma janela do browser: escolhe a entrega ou o levantamento no Auchan." : "[auth] Abri uma janela do browser: faz o login no Auchan e escolhe a entrega ou o levantamento.");
+      await throttle(() => page.goto(saved ? `${AUCHAN_BASE}/pt/` : LOGIN_URL, { waitUntil: "domcontentloaded", timeout: 3e4 }));
+      const deadline = Date.now() + loginTimeoutMs;
+      while (Date.now() < deadline) {
+        if (await Promise.race([closed, sleep(pollMs).then(() => "tick")]) === "closed") {
+          throw new Error("a janela de login foi fechada antes de o login terminar; tenta de novo");
+        }
+        const url2 = new URL(page.url());
+        if (url2.hostname !== "www.auchan.pt" || /login/i.test(url2.pathname)) continue;
+        if (await isLoggedIn(context.request) && await hasDeliveryContext(context.request)) {
+          const next = await context.storageState();
+          writeState(cookieFile, next);
+          log("[auth] Sess\xE3o iniciada.");
+          return next;
+        }
+      }
+      throw new Error("o login n\xE3o terminou em 5 minutos; tenta de novo");
     } finally {
-      await page.close().catch(() => {
+      await browser.close().catch(() => {
       });
     }
-    if (!await isLoggedIn()) {
-      await close();
-      throw new Error("o login n\xE3o ficou ativo; confirma o email e a palavra-passe em credentials.env");
+  }
+  let lastPersist = 0;
+  async function persist(force = false) {
+    if (!api || !state || !force && Date.now() - lastPersist < 5 * 60 * 1e3) return;
+    lastPersist = Date.now();
+    try {
+      const { cookies } = await api.storageState();
+      if (cookies.length) {
+        state = { cookies, origins: state.origins };
+        writeState(cookieFile, state);
+      }
+    } catch {
     }
   }
-  async function isLoggedIn() {
-    const res = await throttle(() => context.request.get(ACCOUNT_URL, { timeout: 15e3 }));
-    assertNotBlocked(res.status(), "");
-    return res.ok() && !/login/i.test(new URL(res.url()).pathname);
+  function startKeepAlive() {
+    if (timer || !keepAliveMs) return;
+    timer = setInterval(async () => {
+      if (!api || !loggedIn || pending || inFlight || beating) return;
+      beating = true;
+      try {
+        if (await isLoggedIn(api)) {
+          await persist(true);
+          return;
+        }
+        loggedIn = false;
+      } catch {
+      } finally {
+        beating = false;
+      }
+    }, keepAliveMs);
+    timer.unref?.();
+  }
+  function ensureSession() {
+    if (api && loggedIn) return Promise.resolve("saved");
+    pending ??= (async () => {
+      try {
+        const saved = readState(cookieFile);
+        if (saved) {
+          await openApi(saved);
+          const logged = await isLoggedIn(api);
+          if (logged && await hasDeliveryContext(api)) {
+            loggedIn = true;
+            await persist(true);
+            startKeepAlive();
+            return "saved";
+          }
+          log(logged ? "[auth] Falta escolher a entrega." : "[auth] A sess\xE3o guardada expirou.");
+          await openApi(await interactiveLogin(logged ? saved : null));
+          loggedIn = true;
+          startKeepAlive();
+          return "window";
+        }
+        await openApi(await interactiveLogin());
+        loggedIn = true;
+        startKeepAlive();
+        return "window";
+      } finally {
+        pending = null;
+      }
+    })();
+    return pending;
   }
-  const call = (fn) => throttle(async () => {
-    const res = await fn();
+  const call = (method, path, form) => throttle(async () => {
+    const options = form ? { form, timeout: 15e3 } : { timeout: 15e3 };
+    const res = await api[method](new URL(path, AUCHAN_BASE).href, options);
     const text2 = await res.text();
     assertNotBlocked(res.status(), text2);
-    return { status: res.status(), text: text2 };
+    return { status: res.status(), text: text2, url: res.url() };
   });
-  const site = {
-    get: (path) => scrubbed(async () => {
-      await open2();
-      return call(() => context.request.get(new URL(path, AUCHAN_BASE).href, { timeout: 15e3 }));
-    }),
-    post: (path, form) => scrubbed(async () => {
-      await open2();
-      return call(() => context.request.post(new URL(path, AUCHAN_BASE).href, { form, timeout: 15e3 }));
-    })
-  };
-  async function scrubbed(fn) {
+  async function request(method, path, form) {
+    inFlight++;
     try {
-      return await fn();
-    } catch (error62) {
-      for (const secret of [credentials.email, credentials.password]) error62.message = String(error62.message).split(secret).join("***");
-      throw error62;
+      await ensureSession();
+      let result = await call(method, path, form);
+      if (/login/i.test(new URL(result.url).pathname)) {
+        loggedIn = false;
+        await ensureSession();
+        result = await call(method, path, form);
+        if (/login/i.test(new URL(result.url).pathname)) throw new Error("o site n\xE3o aceitou a sess\xE3o; tenta usar a ferramenta login de novo");
+      }
+      await persist();
+      return { status: result.status, text: result.text };
+    } finally {
+      inFlight--;
     }
   }
+  const site = {
+    get: (path) => request("get", path),
+    post: (path, form) => request("post", path, form)
+  };
+  async function login() {
+    return ensureSession();
+  }
   async function close() {
-    const current = browser;
-    browser = context = null;
-    if (current) await current.close().catch(() => {
+    if (timer) {
+      clearInterval(timer);
+      timer = null;
+    }
+    await persist(true);
+    const current = api;
+    api = null;
+    loggedIn = false;
+    await current?.dispose().catch(() => {
     });
   }
-  return { site, close };
+  async function logout() {
+    await close();
+    rmSync(cookieFile, { force: true });
+  }
+  return { site, login, logout, close };
 }
 
 // src/index.js
@@ -20185,6 +20299,18 @@ var CART_TOOLS = [
     }
   }
 ];
+var LOGIN_TOOLS = [
+  {
+    name: "login",
+    description: "Connect your Auchan account. Opens a browser window on the Auchan.pt login page; the person logs in there and chooses home delivery or pickup with a postal code (Auchan needs this before any cart change), then the window closes. Tell the person this before calling. The password is never seen or stored. Cart tools call this automatically when there is no session.",
+    inputSchema: { type: "object", properties: {} }
+  },
+  {
+    name: "logout",
+    description: "Disconnect your Auchan account: deletes the saved session from this computer.",
+    inputSchema: { type: "object", properties: {} }
+  }
+];
 var CLOSE_TOOL = {
   name: "close_session",
   description: "Close the browser session. Call when done to free resources.",
@@ -20212,12 +20338,10 @@ var AuchanServer = class {
   // `session` and `fetchImpl` are injectable so tests never touch the network or a browser.
   constructor({ env = process.env, session, fetchImpl } = {}) {
     const paths = resolveStatePaths(env);
-    const credentials = loadCredentials(env);
     this.cacheDir = paths.cacheDir;
     this.fetchImpl = fetchImpl;
-    this.cartEnabled = Boolean(credentials);
-    this.session = session ?? (credentials ? createSession({ credentials, cookieFile: paths.cookieFile }) : null);
-    this.tools = [SEARCH_TOOL, ...this.cartEnabled ? CART_TOOLS : [], CLOSE_TOOL];
+    this.session = session ?? createSession({ cookieFile: paths.cookieFile });
+    this.tools = [SEARCH_TOOL, ...CART_TOOLS, ...LOGIN_TOOLS, CLOSE_TOOL];
     this.server = new Server({ name: "auchan-mcp", version: VERSION }, { capabilities: { tools: {} } });
     this.server.onclose = () => {
       void this.session?.close();
@@ -20259,6 +20383,11 @@ var AuchanServer = class {
             () => quantity === 0 ? `Removido do carrinho: ${product_id}. ${CHECKOUT_NOTE}` : `Quantidade de ${product_id} no carrinho: ${quantity}. ${CHECKOUT_NOTE}`
           );
         }
+        case "login":
+          return text(await this.session.login() === "saved" ? "J\xE1 tens a sess\xE3o do Auchan iniciada." : "Sess\xE3o do Auchan iniciada. J\xE1 posso usar o teu carrinho.");
+        case "logout":
+          await this.session.logout();
+          return text("Sess\xE3o do Auchan terminada: apaguei a sess\xE3o guardada neste computador.");
         case "close_session":
           await this.session?.close();
           return text("Session closed.");
@@ -20269,7 +20398,7 @@ var AuchanServer = class {
   }
   async start() {
     await this.server.connect(new StdioServerTransport());
-    console.error(`Auchan MCP v${VERSION} started${this.cartEnabled ? "" : " (search only: no credentials file)"}`);
+    console.error(`Auchan MCP v${VERSION} started`);
   }
 };
 if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auchan-mcp",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Servidor MCP para o Auchan.pt: pesquisa de produtos e gestão do carrinho.",
   "type": "module",
   "main": "dist/index.js",
@@ -28,7 +28,6 @@
   "license": "MIT",
   "files": [
     "dist/",
-    ".env.example",
     "LICENSE",
     "README.md"
   ],

package/.env.example

@@ -1,17 +0,0 @@
-# auchan-mcp: variáveis de ambiente
-# Copia as duas primeiras linhas para um ficheiro privado:
-#   Windows: %USERPROFILE%\.auchan-mcp\credentials.env
-#   macOS/Linux: ~/.auchan-mcp/credentials.env
-# Esse ficheiro nunca vai para o git. A pesquisa funciona sem ele.
-
-# Necessárias para o carrinho (get_cart, add_to_cart, update_cart_item).
-# AUCHAN_EMAIL=tu@exemplo.pt
-# AUCHAN_PASSWORD=a-tua-palavra-passe
-
-# As seguintes definem-se no "env" do servidor no cliente MCP, não no ficheiro acima.
-
-# Outra pasta para credenciais, cookies e cache (por omissão: ~/.auchan-mcp).
-# AUCHAN_STATE_DIR=C:\caminho\para\pasta
-
-# Põe false só para ver o browser durante o login, ao procurar um problema.
-# AUCHAN_LOGIN_HEADLESS=true