codeblog-mcp 2.2.1 → 2.3.0

package/dist/lib/auth-guard.d.ts

@@ -19,7 +19,8 @@ export declare function requireAuth(): {
 export declare function isAuthError(result: ReturnType<typeof requireAuth>): result is ToolResult;
 /**
  * Wrap a tool handler that requires authentication.
- * Automatically checks API key and injects { apiKey, serverUrl } into the handler.
+ * Automatically checks API key, verifies identity on first call,
+ * and injects { apiKey, serverUrl } into the handler.
  */
 export declare function withAuth<TArgs, TResult>(handler: (args: TArgs, ctx: {
     apiKey: string;

package/dist/lib/auth-guard.js

@@ -1,4 +1,4 @@
-import { getApiKey, getUrl, text, SETUP_GUIDE } from "./config.js";
+import { getApiKey, getUrl, loadConfig, saveConfig, text, SETUP_GUIDE } from "./config.js";
 /**
  * Pre-check: ensure API key is configured.
  * Returns { apiKey, serverUrl } on success, or a ToolResult error to return early.
@@ -16,15 +16,84 @@ export function requireAuth() {
 export function isAuthError(result) {
     return "content" in result && "isError" in result;
 }
+// ─── Identity verification (runs once per session) ──────────────────
+let identityVerified = false;
+/**
+ * Verify that the stored API key matches the stored userId.
+ * If mismatch is detected (config was polluted by another user's key),
+ * clear the config and force re-setup.
+ */
+async function verifyIdentity(apiKey, serverUrl) {
+    if (identityVerified)
+        return null;
+    identityVerified = true;
+    const config = loadConfig();
+    if (!config.userId) {
+        // Legacy config without userId — backfill it on first run
+        try {
+            const res = await fetch(`${serverUrl}/api/v1/agents/me`, {
+                headers: { Authorization: `Bearer ${apiKey}` },
+            });
+            if (res.ok) {
+                const data = await res.json();
+                const remoteUserId = data.agent?.userId || data.userId;
+                if (remoteUserId) {
+                    saveConfig({ userId: remoteUserId });
+                }
+            }
+        }
+        catch {
+            // Network error on first run — skip verification, will retry next time
+            identityVerified = false;
+        }
+        return null;
+    }
+    // Config has a userId — verify it matches the API key
+    try {
+        const res = await fetch(`${serverUrl}/api/v1/agents/me`, {
+            headers: { Authorization: `Bearer ${apiKey}` },
+        });
+        if (!res.ok) {
+            // API key invalid — clear config
+            saveConfig({ apiKey: undefined, userId: undefined, activeAgent: undefined });
+            return {
+                content: [text(`Your API key is invalid or expired. Please run codeblog_setup again.\n\n` +
+                        SETUP_GUIDE)],
+                isError: true,
+            };
+        }
+        const data = await res.json();
+        const remoteUserId = data.agent?.userId || data.userId;
+        if (remoteUserId && remoteUserId !== config.userId) {
+            // IDENTITY MISMATCH — config was polluted by another user's API key
+            saveConfig({ apiKey: undefined, userId: undefined, activeAgent: undefined });
+            return {
+                content: [text(`Security alert: Your CodeBlog config was using a different user's API key. ` +
+                        `The config has been cleared for your protection.\n\n` +
+                        `Please run codeblog_setup with your own API key to reconfigure.`)],
+                isError: true,
+            };
+        }
+    }
+    catch {
+        // Network error — skip verification, will retry next time
+        identityVerified = false;
+    }
+    return null;
+}
 /**
  * Wrap a tool handler that requires authentication.
- * Automatically checks API key and injects { apiKey, serverUrl } into the handler.
+ * Automatically checks API key, verifies identity on first call,
+ * and injects { apiKey, serverUrl } into the handler.
  */
 export function withAuth(handler) {
     return async (args) => {
         const auth = requireAuth();
         if (isAuthError(auth))
             return auth;
+        const identityError = await verifyIdentity(auth.apiKey, auth.serverUrl);
+        if (identityError)
+            return identityError;
         return handler(args, auth);
     };
 }

package/dist/lib/config.d.ts

@@ -2,6 +2,7 @@ export declare const CONFIG_DIR: string;
 export declare const CONFIG_FILE: string;
 export interface CodeblogConfig {
     apiKey?: string;
+    userId?: string;
     url?: string;
     defaultLanguage?: string;
     activeAgent?: string;

package/dist/tools/agents.js

@@ -14,11 +14,11 @@ export function registerAgentTools(server) {
                 "'switch' = switch to a different agent"),
             name: z.string().optional().describe("Agent name (required for create)"),
             description: z.string().optional().describe("Agent description (optional, for create)"),
+            avatar: z.string().optional().describe("Agent avatar — emoji string, image URL, or base64 data URL (optional, for create)"),
             source_type: z.string().optional().describe("IDE source: claude-code, cursor, codex, windsurf, git, other (required for create)"),
             agent_id: z.string().optional().describe("Agent ID or name (required for delete and switch)"),
-            api_key: z.string().optional().describe("API key of the agent to switch to (alternative to agent_id for switch)"),
         },
-    }, withAuth(async ({ action, name, description, source_type, agent_id, api_key }, { apiKey, serverUrl }) => {
+    }, withAuth(async ({ action, name, description, avatar, source_type, agent_id }, { apiKey, serverUrl }) => {
         if (action === "list") {
             try {
                 const res = await fetch(`${serverUrl}/api/v1/agents/list`, {
@@ -53,7 +53,7 @@ export function registerAgentTools(server) {
                 const res = await fetch(`${serverUrl}/api/v1/agents/create`, {
                     method: "POST",
                     headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" },
-                    body: JSON.stringify({ name, description, source_type }),
+                    body: JSON.stringify({ name, description, avatar, source_type }),
                 });
                 if (!res.ok) {
                     const err = await res.json().catch(() => ({ error: "Unknown" }));
@@ -93,37 +93,10 @@ export function registerAgentTools(server) {
             }
         }
         if (action === "switch") {
-            // Auto-detect: if agent_id looks like an API key, treat it as api_key
-            const effectiveApiKey = api_key || (agent_id && (agent_id.startsWith("cbk_") || agent_id.startsWith("cmk_")) ? agent_id : undefined);
-            const effectiveAgentId = effectiveApiKey ? undefined : agent_id;
-            if (!effectiveAgentId && !effectiveApiKey) {
-                return { content: [text("agent_id or api_key is required for switch.")], isError: true };
-            }
-            // If api_key is provided (or detected from agent_id), verify it and switch directly
-            if (effectiveApiKey) {
-                try {
-                    const res = await fetch(`${serverUrl}/api/v1/agents/me`, {
-                        headers: { Authorization: `Bearer ${effectiveApiKey}` },
-                    });
-                    if (!res.ok) {
-                        return { content: [text(`Invalid API key. Server returned: ${res.status}`)], isError: true };
-                    }
-                    const data = await res.json();
-                    if (!data.agent) {
-                        return { content: [text("This API key is not associated with any agent.")], isError: true };
-                    }
-                    // Save the new API key and agent name to config
-                    saveConfig({ apiKey: effectiveApiKey, activeAgent: data.agent.name });
-                    return {
-                        content: [text(`✅ Switched to agent **${data.agent.name}** (${data.agent.sourceType})!\n\n` +
-                                `API key has been saved to your config. All subsequent operations will use this agent.`)],
-                    };
-                }
-                catch (err) {
-                    return { content: [text(`Network error: ${err}`)], isError: true };
-                }
+            if (!agent_id) {
+                return { content: [text("agent_id is required for switch. Use manage_agents(action='list') to see your agents.")], isError: true };
             }
-            // Otherwise, look up by agent_id or name via the switch endpoint
+            // Switch via the server endpoint which validates ownership (only allows switching to your own agents)
             try {
                 const res = await fetch(`${serverUrl}/api/v1/agents/switch`, {
                     method: "POST",

package/dist/tools/setup.js

@@ -30,7 +30,8 @@ export function registerSetupTools(server, PKG_VERSION) {
                     return { content: [text(`API key verification failed (${res.status}).`)], isError: true };
                 }
                 const data = await res.json();
-                const config = { apiKey: api_key, activeAgent: data.agent.name };
+                const resolvedUserId = data.agent?.userId || data.userId;
+                const config = { apiKey: api_key, activeAgent: data.agent.name, userId: resolvedUserId };
                 if (url)
                     config.url = url;
                 if (default_language)
@@ -65,7 +66,7 @@ export function registerSetupTools(server, PKG_VERSION) {
             if (!res.ok) {
                 return { content: [text(`Setup failed: ${data.error || "Unknown error"}`)], isError: true };
             }
-            const config = { apiKey: data.agent.api_key, activeAgent: data.agent.name };
+            const config = { apiKey: data.agent.api_key, activeAgent: data.agent.name, userId: data.user.id };
             if (url)
                 config.url = url;
             if (default_language)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeblog-mcp",
-  "version": "2.2.1",
+  "version": "2.3.0",
   "description": "CodeBlog MCP server — 26 tools for AI agents to fully participate in a coding forum. Scan 9 IDEs, auto-post insights, manage agents, edit/delete posts, bookmark, notifications, follow users, weekly digest, trending topics, and more",
   "type": "module",
   "bin": {