constructor-research-mcp 0.3.2 → 0.4.0-beta.1

package/dist/set-token.js

@@ -1,48 +0,0 @@
-#!/usr/bin/env node
-// Save the session from a copied cURL (or a bare token) for the MCP without printing it.
-// Usage: npx -y -p constructor-research-mcp constructor-research-set-token <file with a copied cURL, or a token> --for claude-code|codex|opencode
-//        (or --to <session file>); the session belongs to the Constructor the cURL was sent to.
-import { readFileSync } from "node:fs";
-import { configFromEnv, HARNESSES, originOf, sessionArgs } from "./config.js";
-import { claims, saveSession, sessionCookies } from "./session.js";
-const { file: target, rest } = sessionArgs(process.argv.slice(2), configFromEnv());
-const source = rest[0];
-if (!source || !target) {
-    console.error(`Usage: npx -y -p constructor-research-mcp constructor-research-set-token <file with a copied cURL> --for ${HARNESSES.join("|")}   (or --to <session file>)`);
-    process.exit(2);
-}
-const text = readFileSync(source, "utf8");
-const found = sessionCookies(text);
-const token = found.get("ap_access_token");
-if (!token) {
-    console.error("No ap_access_token found in " + source + ".");
-    process.exit(1);
-}
-const { exp, max_slt } = claims(token) ?? {};
-if (exp && exp * 1000 <= Date.now() && !found.has("ap_refresh_token")) {
-    console.error("That token already expired at " +
-        new Date(exp * 1000).toISOString() +
-        "; copy a fresh one.");
-    process.exit(1);
-}
-// The Constructor the cURL was sent to; a bare token names its own issuer.
-const sent = /\bcurl\s+(?:-\S+\s+)*['"]?(https?:\/\/[^\s'"]+)/.exec(text)?.[1];
-let host;
-try {
-    host = sent ? originOf(sent) : undefined;
-}
-catch { }
-await saveSession(target, found, host);
-const time = (s) => new Date(s * 1000).toISOString().slice(0, 16).replace("T", " ") + " UTC";
-console.log("Saved to " +
-    target +
-    (host ? ` (for ${host})` : "") +
-    (found.has("ap_refresh_token")
-        ? `, with the refresh token: the MCP renews the session itself${max_slt ? " until " + time(max_slt) : ""}. The browser this cURL came from holds the same session, and a refresh token works once: whichever renews first logs the other out. The sign_in tool (or constructor-research-login) gives the MCP a session of its own.`
-        : exp
-            ? "; expires " +
-                time(exp) +
-                " (in " +
-                Math.round((exp * 1000 - Date.now()) / 60000) +
-                " min). Copy the cURL with the ap_refresh_token cookie, or use the sign_in tool, and the MCP renews it itself."
-            : "."));

package/dist/signin.d.ts

@@ -1,19 +0,0 @@
-import type { Config } from "./config.js";
-export type SignInResult = {
-    status: "signed_in";
-    message: string;
-    session_file: string;
-    host: string;
-    until?: string;
-} | {
-    status: "sign_in_failed";
-    message: string;
-};
-/** A Chromium-based browser on macOS, Windows or Linux; CONSTRUCTOR_BROWSER overrides. */
-export declare function findBrowser(): string | undefined;
-/**
- * Opens the sign-in window, waits for the user to sign in (up to 15 min), saves the
- * session cookies to `file`, and closes the window at once. Never returns a token.
- * `opened` runs once the window is up.
- */
-export declare function signIn(config: Pick<Config, "baseUrl" | "apiPath" | "requestTimeoutMs">, file: string, opened?: () => void): Promise<SignInResult>;

package/dist/signin.js

@@ -1,209 +0,0 @@
-// Sign in to Constructor in a separate Chrome window and save the session.
-// The window uses a fresh temporary profile: a session nothing else holds, so the MCP can
-// renew it without logging out the user's own browser (a refresh token works only once).
-import { spawn } from "node:child_process";
-import { existsSync } from "node:fs";
-import { mkdtemp, readFile, rm } from "node:fs/promises";
-import { homedir, tmpdir } from "node:os";
-import { delimiter, join } from "node:path";
-import { setTimeout as delay } from "node:timers/promises";
-import { claims, saveSession, setCookies, SESSION_COOKIES } from "./session.js";
-const SIGN_IN_MINUTES = 15;
-/** A Chromium-based browser on macOS, Windows or Linux; CONSTRUCTOR_BROWSER overrides. */
-export function findBrowser() {
-    if (process.env.CONSTRUCTOR_BROWSER)
-        return existsSync(process.env.CONSTRUCTOR_BROWSER)
-            ? process.env.CONSTRUCTOR_BROWSER
-            : undefined;
-    const env = process.env;
-    const installed = process.platform === "win32"
-        ? [env.PROGRAMFILES, env["PROGRAMFILES(X86)"], env.LOCALAPPDATA]
-            .filter((d) => !!d)
-            .flatMap((d) => [
-            join(d, "Google", "Chrome", "Application", "chrome.exe"),
-            join(d, "Microsoft", "Edge", "Application", "msedge.exe"),
-            join(d, "Chromium", "Application", "chrome.exe"),
-            join(d, "BraveSoftware", "Brave-Browser", "Application", "brave.exe"),
-        ])
-        : process.platform === "darwin"
-            ? [
-                "Google Chrome.app/Contents/MacOS/Google Chrome",
-                "Chromium.app/Contents/MacOS/Chromium",
-                "Microsoft Edge.app/Contents/MacOS/Microsoft Edge",
-                "Brave Browser.app/Contents/MacOS/Brave Browser",
-            ].flatMap((app) => [
-                join("/Applications", app),
-                join(homedir(), "Applications", app),
-            ])
-            : [];
-    // Then the PATH, as Linux installs them (and any OS where the user put one there).
-    const names = [
-        "google-chrome",
-        "google-chrome-stable",
-        "chromium",
-        "chromium-browser",
-        "microsoft-edge",
-        "brave-browser",
-        "chrome",
-        "msedge",
-    ];
-    const exts = process.platform === "win32"
-        ? (env.PATHEXT ?? ".EXE").split(";").filter(Boolean)
-        : [""];
-    const onPath = (env.PATH ?? "")
-        .split(delimiter)
-        .filter(Boolean)
-        .flatMap((dir) => names.flatMap((n) => exts.map((e) => join(dir, n + e.toLowerCase()))));
-    return [...installed, ...onPath].find((c) => existsSync(c));
-}
-/** Minimal Chrome DevTools Protocol client over the browser's WebSocket. */
-async function devtools(url) {
-    const ws = new WebSocket(url);
-    await new Promise((ok, fail) => {
-        ws.onopen = ok;
-        ws.onerror = () => fail(new Error("Could not connect to the browser."));
-    });
-    let id = 0;
-    const waiting = new Map();
-    ws.onmessage = (e) => {
-        const m = JSON.parse(String(e.data));
-        waiting.get(m.id)?.(m);
-        waiting.delete(m.id);
-    };
-    return {
-        send(method, params = {}) {
-            return new Promise((ok, fail) => {
-                const n = ++id;
-                waiting.set(n, (m) => m.error ? fail(new Error(m.error.message)) : ok(m.result));
-                ws.send(JSON.stringify({ id: n, method, params }));
-            });
-        },
-        close: () => ws.close(),
-    };
-}
-/**
- * Opens the sign-in window, waits for the user to sign in (up to 15 min), saves the
- * session cookies to `file`, and closes the window at once. Never returns a token.
- * `opened` runs once the window is up.
- */
-export async function signIn(config, file, opened = () => { }) {
-    const fallback = `save a session from a copied cURL instead: npx -y -p constructor-research-mcp constructor-research-set-token <file with the cURL> --to ${file}`;
-    const headless = !!process.env.CONSTRUCTOR_LOGIN_HEADLESS;
-    if (process.platform === "linux" &&
-        !headless &&
-        !process.env.DISPLAY &&
-        !process.env.WAYLAND_DISPLAY)
-        return {
-            status: "sign_in_failed",
-            message: `This machine has no screen to open a sign-in window on (no DISPLAY or WAYLAND_DISPLAY). Sign in where the MCP has a desktop, or ${fallback}.`,
-        };
-    const exe = findBrowser();
-    if (!exe)
-        return {
-            status: "sign_in_failed",
-            message: `No Chrome, Edge, Chromium or Brave found. Set CONSTRUCTOR_BROWSER in the MCP settings to the browser's executable, or ${fallback}.`,
-        };
-    const host = new URL(config.baseUrl).hostname;
-    const profile = await mkdtemp(join(tmpdir(), "constructor-login-"));
-    const chrome = spawn(exe, [
-        `--user-data-dir=${profile}`,
-        "--remote-debugging-port=0",
-        "--remote-allow-origins=http://127.0.0.1",
-        "--no-first-run",
-        "--no-default-browser-check",
-        "--disable-sync",
-        // Tests run the browser without a window.
-        ...(headless ? ["--headless=new"] : []),
-        "--new-window",
-        `${config.baseUrl}/research/`,
-    ], { stdio: "ignore" });
-    let exited = false;
-    chrome.on("exit", () => (exited = true));
-    chrome.on("error", () => (exited = true));
-    const failed = (message) => ({
-        status: "sign_in_failed",
-        message,
-    });
-    try {
-        let port, path;
-        for (let i = 0; i < 300 && !port && !exited; i++) {
-            try {
-                [port, path] = (await readFile(join(profile, "DevToolsActivePort"), "utf8")).split("\n");
-            }
-            catch {
-                await delay(100);
-            }
-        }
-        if (!port)
-            return failed(`The browser did not start (${exe}); ${fallback}.`);
-        const cdp = await devtools(`ws://127.0.0.1:${port}${path}`);
-        opened();
-        const session = async () => {
-            const { cookies } = await cdp.send("Storage.getCookies");
-            return new Map(cookies
-                .filter((c) => SESSION_COOKIES.includes(c.name) &&
-                (c.domain.replace(/^\./, "") === host ||
-                    host.endsWith(c.domain.startsWith(".") ? c.domain : "." + c.domain)))
-                .map((c) => [c.name, c.value]));
-        };
-        const deadline = Date.now() + SIGN_IN_MINUTES * 60000;
-        let found;
-        while (!exited && Date.now() < deadline) {
-            const s = await session().catch(() => undefined);
-            const exp = claims(s?.get("ap_access_token"))?.exp;
-            if (s?.has("ap_refresh_token") && exp && exp * 1000 > Date.now()) {
-                // The page may still be loading; read again once it settles, then close at once so
-                // the window never renews this session itself.
-                await delay(3000);
-                found = (await session().catch(() => undefined)) ?? s;
-                break;
-            }
-            await delay(1000);
-        }
-        await cdp.send("Browser.close").catch(() => { });
-        cdp.close();
-        if (!found)
-            return failed(exited
-                ? "The window was closed before sign-in finished; nothing was saved."
-                : `No sign-in within ${SIGN_IN_MINUTES} min; nothing was saved.`);
-        // Check the access token without sending the refresh token, so nothing is renewed.
-        const response = await fetch(config.baseUrl + config.apiPath + "/auth/session", {
-            headers: {
-                Cookie: `ap_access_token=${found.get("ap_access_token")}`,
-                Accept: "application/json",
-            },
-            redirect: "manual",
-            signal: AbortSignal.timeout(config.requestTimeoutMs),
-        }).catch(() => undefined);
-        await response?.body?.cancel();
-        if (response?.status === 401)
-            return failed("Constructor rejected the new session; nothing was saved.");
-        await saveSession(file, new Map([...found, ...(response ? setCookies(response) : [])]), config.baseUrl);
-        const end = claims(found.get("ap_access_token"))?.max_slt;
-        const until = end
-            ? new Date(end * 1000).toISOString().slice(0, 16).replace("T", " ") +
-                " UTC"
-            : undefined;
-        return {
-            status: "signed_in",
-            message: `Signed in to ${config.baseUrl}. Session saved to ${file}` +
-                (until ? `; the MCP renews it automatically until ${until}.` : "."),
-            session_file: file,
-            host: config.baseUrl,
-            until,
-        };
-    }
-    catch (e) {
-        return failed(`Sign-in failed: ${e?.message ?? e}. Nothing was saved.`);
-    }
-    finally {
-        if (!exited) {
-            chrome.kill();
-            for (let i = 0; i < 50 && !exited; i++)
-                await delay(100);
-            if (!exited)
-                chrome.kill("SIGKILL"); // TerminateProcess on Windows
-        }
-        await rm(profile, { recursive: true, force: true }).catch(() => { });
-    }
-}