continente-mcp 4.0.0 → 4.1.0

package/.env.example

@@ -8,7 +8,8 @@
 # CONTINENTE_EMAIL=you@example.com
 # CONTINENTE_PASSWORD=your-password
 
-# Optional: point the tools at a different private env file.
+# Optional: use a different private env file. This one cannot go in the file
+# itself; set it in your MCP client's server "env" instead.
 # CONTINENTE_ENV_PATH=/absolute/path/to/credentials.env
 
 # Set to false only for local debugging, so you can watch the login browser.
@@ -20,7 +21,8 @@
 
 # If you run the MCP server on a second machine and sync cookies via a shared
 # folder (e.g. Obsidian vault, Syncthing, Dropbox), set this to the shared path
-# for automatic login to also write cookies there.
+# for automatic login to also write cookies there. These cookies give access
+# to your account: only use a private folder you control.
 # CONTINENTE_VAULT_COOKIE_PATH=/path/to/shared/folder/cookies.json
 
 # Override the state directory (preferences and default cookies)

package/README.md

@@ -1,102 +1,64 @@
 # Continente MCP
 
-A local MCP server for Continente.pt: search products, rank favourites, manage your basket, and read order history. Checkout and payment stay on Continente.pt.
+Let your AI assistant search Continente.pt and fill your basket with the products you usually buy.
 
-## Setup
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
-Requires **Node.js 20.18.1 or later** and a Continente account for favourites, basket and order history. Public product search works without login.
+## Features
 
-```bash
-git clone https://github.com/davidmarqu3s/continente-mcp
-cd continente-mcp
-npm install
-npm run setup
-mkdir -p ~/.continente
-cp .env.example ~/.continente/credentials.env
-chmod 600 ~/.continente/credentials.env
-```
+- **Search that knows your habits** — catalogue results put your saved favourites first.
+- **Hands-free basket** — add, change and remove items; every change is checked against the basket afterwards.
+- **Order history** — read recent orders and see your most-bought products.
+- **Automatic login** — expired sessions sign in again on their own from a private credentials file.
+- **You stay in control** — checkout and payment always happen on Continente.pt.
+
+## Install
 
-Edit the private credentials file and set `CONTINENTE_EMAIL` and `CONTINENTE_PASSWORD`, then verify login:
+Requires Node.js 20.18.1 or later. Install the browser the server uses (on Linux, add `--with-deps`):
 
 ```bash
-node continente-auto-login.js
+npx -y -p continente-mcp playwright install chromium
 ```
 
-Login uses Playwright Chromium and saves a private session cache in `~/.continente/cookies.json`. Protected tool calls automatically log in again when the session expires. Python and scheduled keepalive jobs are not required to use the MCP server.
+For favourites, basket and order history, create `~/.continente/credentials.env` with your Continente login and make it private to your user (`chmod 600` on macOS/Linux). Search works without it.
+
+```
+CONTINENTE_EMAIL=you@example.com
+CONTINENTE_PASSWORD=your-password
+```
 
-Add the server to your MCP client using its local-server configuration. Clients using JSON `mcpServers` configuration can use:
+Then add the server to your MCP client and restart it:
 
 ```json
 {
   "mcpServers": {
-    "continente": {
-      "command": "node",
-      "args": ["/absolute/path/to/continente-mcp/src/index.js"]
-    }
+    "continente": { "command": "npx", "args": ["-y", "continente-mcp"] }
   }
 }
 ```
 
-Restart the client after configuration or server changes. The published package can also run with `npx continente-mcp`; the local clone configuration above runs the code you just installed and tested. This is a local stdio server, not a hosted MCP endpoint.
+To run from source instead, clone the repository, run `npm install && npm run setup`, and use `node /absolute/path/to/continente-mcp/src/index.js` as the command.
 
-For Windows, use your user profile directory instead of `~` and restrict the credentials/state directory through Windows filesystem permissions. On Linux, `npm run setup` may need administrator permission to install Chromium system dependencies; if already installed, `npx playwright install chromium` installs only the browser.
+## Use
 
-## Tools
+Ask your assistant things like "add milk, eggs and bread to my Continente basket". Run `refresh_favorites` once so searches know what you buy.
 
 | Tool | Purpose |
 | --- | --- |
-| `search_products` | Search the catalogue, with saved favourites ranked first |
-| `get_favorites` | Read cached favourites |
-| `refresh_favorites` | Refresh favourites from your account |
-| `get_cart` | Read the account basket |
-| `add_to_cart` | Add a product by ID |
-| `update_cart_item` | Set a basket quantity; zero removes the item |
-| `get_order_history` | Read recent orders |
-| `get_most_bought` | Aggregate products from order history |
+| `search_products` | Search the catalogue, favourites first |
+| `get_favorites` / `refresh_favorites` | Read cached favourites / refresh them from your account |
+| `get_cart` | Read the basket |
+| `add_to_cart` / `update_cart_item` | Add a product / set its quantity (zero removes it) |
+| `get_order_history` / `get_most_bought` | Read recent orders / your most-bought products |
 | `close_session` | Close the browser session |
 
-Run `refresh_favorites` once to personalise searches. Read the basket before changing it and verify quantities afterwards. An unrecognised basket page is an error, never proof that the basket is empty. Order aggregation can be slow because it visits order detail pages.
+## More
 
-The bundled [groceries skill](skills/groceries/SKILL.md) guides agents through matching names to favourites and previous purchases. Add that skill directory through your client's supported skill installation mechanism.
-
-## Configuration and security
-
-Keep real credentials and cookie values out of the repository, client configuration, logs and screenshots. Both credentials and session cookies grant access to private account data. On macOS/Linux, use owner-only permissions (`chmod 600`) for secret files.
-
-See [`.env.example`](.env.example). Process environment settings override the private credentials file.
-
-| Variable | Purpose |
-| --- | --- |
-| `CONTINENTE_ENV_PATH` | Private credentials file; defaults to `~/.continente/credentials.env` |
-| `CONTINENTE_EMAIL`, `CONTINENTE_PASSWORD` | Account credentials for automatic login |
-| `CONTINENTE_STATE_DIR` | Local state directory; defaults to `~/.continente` |
-| `CONTINENTE_COOKIES_PATH` | Custom cookie cache path |
-| `CONTINENTE_LOGIN_HEADLESS` | Set `false` to inspect login in a visible browser |
-| `CONTINENTE_VAULT_COOKIE_PATH` | Optional secondary cookie file for private multi-machine sync |
-
-Prefer absolute paths for custom settings.
-
-## Troubleshooting and development
-
-- **Login required:** check the private credentials file and run `node continente-auto-login.js`.
-- **Browser missing:** run `npm run setup`.
-- **No favourites:** run `refresh_favorites`; catalogue search still works without them.
-- **Unexpected cart or product page:** report the tool and error, excluding account details and secrets.
-
-```bash
-npm test
-npm audit --omit=dev
-npm pack --dry-run
-```
-
-Unit tests do not establish that Continente's live website still matches every selector. Verify the affected tool against the live site after parser changes; do not place orders during testing.
-
-Personal backup, keepalive, browser-cookie export and monitoring scripts are maintained separately in the private operations repository. They are not part of the npm package or the normal login workflow. Existing operators must migrate scheduled script paths before switching to this checkout.
+- **Agents:** the [groceries skill](skills/groceries/SKILL.md) teaches assistants to pick the products you usually buy.
+- **Settings:** custom credential, state and cookie paths are listed in [`.env.example`](.env.example).
+- **Troubleshooting:** [docs/troubleshooting.md](docs/troubleshooting.md).
+- **Developers:** [docs/development.md](docs/development.md) and [docs/releases.md](docs/releases.md).
 
 ## License
 
 [MIT](LICENSE)
-
-## Releases
-
-See the [changelog](CHANGELOG.md) and [release instructions](docs/releases.md). Version tags run the platform checks and publish matching npm/GitHub releases. Release candidates use npm's `next` channel; `latest` stays on the last stable release.

package/continente-auto-login.js

@@ -13,9 +13,10 @@ function log(message) {
   console.error(`[continente-auto-login] ${message}`);
 }
 
-function writeCookies(path, cookies) {
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, JSON.stringify(cookies, null, 2));
+export function writeCookies(path, cookies) {
+  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+  // Create owner-only; chmod also tightens files created by older versions.
+  writeFileSync(path, JSON.stringify(cookies, null, 2), { mode: 0o600 });
   chmodSync(path, 0o600);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "continente-mcp",
-  "version": "4.0.0",
+  "version": "4.1.0",
   "description": "MCP server for Continente.pt — search products, manage your cart, and browse order history.",
   "type": "module",
   "main": "src/index.js",
@@ -46,7 +46,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/sdk": "^1.32.1",
     "cheerio": "^1.2.0",
     "playwright": "^1.59.1"
   }

package/skills/groceries/SKILL.md

@@ -22,11 +22,11 @@ The goal is to pick the product the user actually buys, not just any product wit
 
 **1. Search with favourites context**
 
-Call `search_products` with the item name. Results are automatically ranked by the favourites list — the top result is usually correct. Note the top 3.
+Call `search_products` with the item name. Favourites are ranked first and marked ⭐ — the top result is usually correct. Note the top 3.
 
-**2. Cross-check favourites**
+**2. Prefer favourites**
 
-Call `get_favorites` once (reuse for all items in this request). If any favourite matches the item name, prefer it — even if not the top search result. A favourite is a stronger signal than search rank.
+If any result is marked ⭐, prefer it — even if it is not the top result. A favourite is a stronger signal than search rank. If nothing is marked and the user seems to have favourites, call `refresh_favorites` once and search again.
 
 **3. Fallback: order history**
 
@@ -40,7 +40,10 @@ If confidence is high (clear favourite or obvious top result), add silently and
 
 Call `add_to_cart` with `product_id`. Default quantity is 1 unless specified (e.g. "2 pacotes de leite").
 
-After adding products with a requested quantity greater than 1, call `get_cart` and verify the displayed quantity. Some Continente products use internal weighted units, so the quantity returned by `add_to_cart` can differ from the requested display quantity. If the cart quantity is wrong, call `update_cart_item` with the same `product_id` and the desired displayed quantity, then call `get_cart` again.
+`add_to_cart` and `update_cart_item` both check the basket afterwards and only report success when it holds the requested quantity. Products sold by weight (e.g. bananas) are counted in units, like on the website.
+
+- `below_minimum_quantity` — the product has a minimum, shown as ⚖️ in search results and in the error. Nothing was added; ask whether to add the minimum instead.
+- `cart_add_not_confirmed` or `cart_quantity_not_confirmed` — the change may still have happened. Call `get_cart`, never repeat `add_to_cart`, and correct with `update_cart_item` if needed.
 
 ## Output format
 
@@ -56,9 +59,9 @@ After all items are processed, print a compact summary:
 ## Error handling
 
 - No search results → report as not found, skip, continue with others
-- `add_to_cart` fails → report the error, move on
+- `add_to_cart` fails → handle the errors above, otherwise report the error and move on
 - Never stop the whole run because one item failed
 
 ## Performance
 
-`get_favorites` is slow. Call it once and reuse across all items. Only call `get_order_history` when favourites give no clear signal.
+`get_order_history` opens each order and is slow. Only call it when search and favourites give no clear signal.

package/src/cart-utils.js

@@ -16,9 +16,22 @@ export function quantityForCartUpdate(displayQuantity, measureOptions = {}) {
     throw new Error('Quantity must be a non-negative number');
   }
 
-  const conversion = Number(measureOptions.primaryToSecondary || measureOptions.unitConversionRate);
+  const conversion = Number(measureOptions.primaryToSecondary ?? measureOptions.unitConversionRate);
   const hasAlternativeUnit = measureOptions.hasAlternativeSaleUnit || measureOptions.hasConversionRate;
-  const cartQuantity = hasAlternativeUnit && conversion > 0 ? quantity * conversion : quantity;
+  if ((hasAlternativeUnit && (!Number.isFinite(conversion) || conversion <= 0)) ||
+    // Without an alternative sale unit, quantities are counted in the primary unit;
+    // secondaryunit is only the price reference (e.g. €/kg for a unit product).
+    (!hasAlternativeUnit && ((measureOptions.primaryunit && measureOptions.primaryunit !== 'un') ||
+      (measureOptions.selectedunit && measureOptions.selectedunit !== 'primary')))) {
+    throw new Error('quantity_semantics_unknown');
+  }
+  const cartQuantity = hasAlternativeUnit ? quantity * conversion : quantity;
+  if (!Number.isFinite(cartQuantity)) throw new Error('quantity_semantics_unknown');
+  const minimum = Number(measureOptions.minOrderQuantity);
+  if (quantity > 0 && minimum > 0 && cartQuantity < minimum - 0.0005) {
+    const displayMinimum = hasAlternativeUnit ? minimum / conversion : minimum;
+    throw new Error(`below_minimum_quantity: the minimum is ${Number(displayMinimum.toFixed(3))}`);
+  }
 
   return Number(cartQuantity.toFixed(3)).toString();
 }
@@ -74,3 +87,27 @@ function moneyOrNull(value) {
   const amount = Number(value);
   return Number.isFinite(amount) && amount >= 0 ? amount : null;
 }
+
+// Order lines show "12 un", or "1.2 kg" for products bought by weight.
+export function parseOrderQuantity(text) {
+  const match = String(text ?? '').trim().match(/^(\d+(?:[.,]\d+)?)\s*([a-zA-Z]*)/);
+  if (!match) return { qty: 1, unit: 'un' };
+  return { qty: Number(match[1].replace(',', '.')), unit: match[2].toLowerCase() || 'un' };
+}
+
+// Units and weights cannot be added together, so totals are kept per unit.
+// Sorted by how many orders include the product, then by units bought.
+export function tallyMostBought(orders) {
+  const tally = new Map();
+  for (const products of orders) {
+    const seenInOrder = new Set();
+    for (const { name, qty, unit } of products) {
+      const entry = tally.get(name) ?? { name, quantities: {}, orders: 0 };
+      entry.quantities[unit] = Number(((entry.quantities[unit] ?? 0) + qty).toFixed(3));
+      if (!seenInOrder.has(name)) { entry.orders += 1; seenInOrder.add(name); }
+      tally.set(name, entry);
+    }
+  }
+  return Array.from(tally.values())
+    .sort((a, b) => b.orders - a.orders || (b.quantities.un ?? 0) - (a.quantities.un ?? 0));
+}

package/src/index.js

@@ -5,10 +5,11 @@ import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprot
 import { chromium } from 'playwright';
 import * as cheerio from 'cheerio';
 import { pathToFileURL } from 'node:url';
-import { existsSync, readFileSync, writeFileSync, mkdirSync, statSync } from 'fs';
+import { chmodSync, existsSync, readFileSync, writeFileSync, mkdirSync, statSync, realpathSync } from 'fs';
 import { normalizeCookies } from './utils.js';
-import { normalizeCartProductId, quantityForCartUpdate, summarizeCartState } from './cart-utils.js';
+import { normalizeCartProductId, parseOrderQuantity, quantityForCartUpdate, summarizeCartState, tallyMostBought } from './cart-utils.js';
 import { refreshAuthCookies, resolveStatePaths } from './auth-session.js';
+import { createQueue, normalizeFavoriteId, retryAuthentication, validateToolInput } from './reliability.js';
 
 const CONTINENTE_BASE = 'https://www.continente.pt';
 const { stateDir: STATE_DIR, cookieFile: COOKIE_FILE } = resolveStatePaths();
@@ -39,6 +40,8 @@ async function refreshAuthSession() {
   return refreshed;
 }
 
+const NOT_LOGGED_IN = 'Not logged in. Add CONTINENTE_EMAIL and CONTINENTE_PASSWORD to ~/.continente/credentials.env (or the server environment), then try again.';
+
 async function ensureBrowser() {
   const cookieFile = COOKIE_FILE;
   if (!existsSync(cookieFile)) {
@@ -52,7 +55,12 @@ async function ensureBrowser() {
   }
 
   if (!browser) {
-    browser = await chromium.launch({ headless: true });
+    const launched = await chromium.launch({ headless: true });
+    // After a crash, start a fresh browser on the next call instead of failing until close_session.
+    launched.on('disconnected', () => {
+      if (browser === launched) { browser = context = page = null; loadedCookieMtimeMs = null; }
+    });
+    browser = launched;
   }
 
   if (!context) {
@@ -67,14 +75,15 @@ async function ensureBrowser() {
         const cookies = JSON.parse(readFileSync(cookieFile, 'utf8'));
         const normalized = normalizeCookies(cookies);
         await context.addCookies(normalized);
-        loadedCookieMtimeMs = nextCookieMtimeMs;
       } catch (e) {
         console.error('Could not read the cookie cache; refresh login or replace the cache.');
       }
+      // Record the attempt even when it fails, so an unreadable cache does not reset the session on every call.
+      loadedCookieMtimeMs = nextCookieMtimeMs;
     }
   }
 
-  if (!page) {
+  if (!page || page.isClosed()) {
     page = await context.newPage();
   }
   return browser;
@@ -88,17 +97,8 @@ async function goto(url, wait = 'networkidle') {
   return page;
 }
 
-async function retryAfterAutoLogin(operation) {
-  const first = await operation();
-  if (first?.error !== 'not_authenticated') {
-    return first;
-  }
-
-  if (!(await refreshAuthSession())) {
-    return first;
-  }
-
-  return operation();
+async function retryAfterAutoLogin(operation, mutation = false) {
+  return retryAuthentication(operation, refreshAuthSession, mutation);
 }
 
 async function closeBrowser() {
@@ -112,7 +112,7 @@ async function closeBrowser() {
 
 async function fetchFavorites() {
   await goto(`${CONTINENTE_BASE}/conta/lista-produtos/?list=favorites`);
-  if (page.url().includes('/login')) return { error: 'not_authenticated' };
+  if (page.url().includes('/login')) return { error: 'not_authenticated', writeAttempted: false };
   const html = await page.content();
   const $ = cheerio.load(html);
   const products = [];
@@ -123,7 +123,7 @@ async function fetchFavorites() {
     const href = $el.attr('href') || '';
     if (text.length > 5 && href) {
       const idMatch = href.match(/\/produto\/([^\/\?]+)/);
-      const productId = idMatch ? idMatch[1] : null;
+      const productId = idMatch ? normalizeFavoriteId(idMatch[1]) : null;
       const priceMatch = text.match(/(\d+[,.]\d+€)/);
       const name = text.replace(/\d+[,.]\d+€/g, '').trim().substring(0, 120);
       if (name && name.length > 3 && productId) {
@@ -143,10 +143,30 @@ async function fetchFavorites() {
 
 // ─── Product Search ────────────────────────────────────────────────────────────
 
-async function searchProducts(query, limit = 10) {
+async function searchProducts(query, extraPages = 0) {
   await goto(`${CONTINENTE_BASE}/pesquisa/?q=${encodeURIComponent(query)}`);
   const html = await page.content();
-  return parseProducts(html, limit);
+  const products = parseProducts(html, Infinity);
+
+  // The search page holds one page of results (35); the grid endpoint serves the next ones.
+  const moreUrl = extraPages > 0 ? cheerio.load(html)('[data-url*="Search-UpdateGrid"]').attr('data-url') : null;
+  if (moreUrl) {
+    const url = new URL(moreUrl, CONTINENTE_BASE);
+    const start = Number(url.searchParams.get('start')) || products.length;
+    const size = Number(url.searchParams.get('sz')) || products.length;
+    if (url.origin === CONTINENTE_BASE && size > 0) {
+      const pages = await Promise.all(Array.from({ length: extraPages }, (_, i) => {
+        url.searchParams.set('start', String(start + i * size));
+        return context.request.get(url.href, { timeout: 10000 })
+          .then(res => res.ok() ? res.text() : '')
+          .catch(() => '');
+      }));
+      for (const pageHtml of pages) products.push(...parseProducts(pageHtml, Infinity));
+    }
+  }
+
+  const seen = new Set();
+  return products.filter(p => !seen.has(p.product_id) && seen.add(p.product_id));
 }
 
 function parseProducts(html, limit = 30) {
@@ -173,6 +193,9 @@ function parseProducts(html, limit = 30) {
     const secondaryText = $el.find('.pwc-tile--price-secondary').first().text().replace(/\s+/g, ' ').trim();
     const unitMatch = secondaryText.match(/(\d+[,.]\d+€)\/([a-zA-Z]+)/);
 
+    // e.g. "Quant. Mínima = 600 gr (3 un)" on products sold by weight
+    const minimumMatch = $el.find('.pwc-tile--quantity').first().text().replace(/\s+/g, ' ').match(/M[ií]nima\s*=\s*(.+?)\s*$/i);
+
     const nameLink = $el.find('a[href*="/produto/"]').filter((_, a) => $(a).text().trim().length > 0).first();
     let name = nameLink.text().replace(/\s+/g, ' ').trim().substring(0, 100);
     if (name.length < 3) return;
@@ -183,7 +206,8 @@ function parseProducts(html, limit = 30) {
       currency: '€',
       product_id: productId,
       url: href.startsWith('http') ? href : CONTINENTE_BASE + href,
-      unit: unitMatch ? `${unitMatch[1]}/${unitMatch[2]}` : null
+      unit: unitMatch ? `${unitMatch[1]}/${unitMatch[2]}` : null,
+      minimum: minimumMatch ? minimumMatch[1] : null
     });
   });
 
@@ -222,10 +246,10 @@ async function getCart() {
 
 async function updateCartItem(productId, quantity) {
   const before = await getCart();
-  if (before.error) return { success: false, error: before.error };
+  if (before.error) return { success: false, error: before.error, writeAttempted: false };
   await goto(`${CONTINENTE_BASE}/checkout/carrinho/`);
 
-  if (page.url().includes('/login')) return { error: 'not_authenticated' };
+  if (page.url().includes('/login')) return { error: 'not_authenticated', writeAttempted: false };
 
   const cartPid = normalizeCartProductId(productId);
   const updateData = await page.evaluate(({ cartPid }) => {
@@ -268,7 +292,7 @@ async function updateCartItem(productId, quantity) {
 
     const params = new URLSearchParams({ pid: cartPid, uuid: updateData.removeUuid });
     const result = await requestCartChange(updateData.removeUrl, params);
-    if (result.error) return { success: false, error: result.error };
+    if (result.error) return { success: false, error: result.error, writeAttempted: true };
     return verifyCartQuantity(cartPid, 0);
   }
 
@@ -293,7 +317,7 @@ async function updateCartItem(productId, quantity) {
   });
 
   const result = await requestCartChange(updateData.updateUrl, params);
-  if (result.error) return { success: false, error: result.error };
+  if (result.error) return { success: false, error: result.error, writeAttempted: true };
   return verifyCartQuantity(cartPid, quantity);
 }
 
@@ -315,18 +339,32 @@ async function verifyCartQuantity(productId, expectedQuantity) {
   const actual = cart.items?.find(item => item.id === productId)?.qty ?? 0;
   if (cart.error || Math.abs(actual - expectedQuantity) > 0.0005) {
     // A write may have happened. Never automatically repeat it after this point.
-    return { success: false, error: 'cart_quantity_not_confirmed' };
+    return { success: false, error: 'cart_quantity_not_confirmed', writeAttempted: true };
   }
   return { success: true, product_id: productId, cart_quantity: actual };
 }
 
 async function addToCart(productId, quantity = 1) {
   const before = await getCart();
-  if (before.error) return { success: false, error: before.error };
+  if (before.error) return { success: false, error: before.error, writeAttempted: false };
   const slug = productId.endsWith('.html') ? productId : `${productId}.html`;
   await goto(`${CONTINENTE_BASE}/produto/${slug}`, 'domcontentloaded');
   await page.waitForSelector('input.add-to-cart-url', { state: 'attached', timeout: 10000 });
 
+  const measureOptions = await page.evaluate(() => {
+    const options = document.querySelector('.ct-tile-quantity-update[data-measure-options]')?.dataset.measureOptions;
+    try { return options ? JSON.parse(options) : {}; } catch { return null; }
+  });
+  if (!measureOptions) return { success: false, error: 'quantity_semantics_unknown', writeAttempted: false };
+  const numericPid = normalizeCartProductId(productId);
+  const previousQuantity = before.items.find(item => item.id === numericPid)?.qty ?? 0;
+  // Rejects unclear units and basket totals below the product minimum.
+  quantityForCartUpdate(previousQuantity + quantity, measureOptions);
+  // Like the website, weighted products are added at their minimum (-1), then set to the exact quantity.
+  const weighted = Boolean(measureOptions.hasAlternativeSaleUnit || measureOptions.hasConversionRate);
+  if (weighted && previousQuantity > 0) return updateCartItem(numericPid, previousQuantity + quantity);
+  const cartQuantity = weighted ? -1 : quantity;
+
   // Extract numeric PID and Cart-AddProduct URL from page
   const result = await page.evaluate(async (qty) => {
     const pidInput = document.querySelector('input[name="productID"]');
@@ -338,6 +376,8 @@ async function addToCart(productId, quantity = 1) {
     const pid = pidInput.value;
     const cartUrl = urlInput.value;
     const csrf = csrfInput ? csrfInput.value : '';
+    // Only send the session and CSRF token to Continente itself.
+    if (new URL(cartUrl, location.href).origin !== location.origin) return { success: false, message: 'invalid_cart_action' };
 
     const body = new URLSearchParams({ pid, quantity: String(qty), options: '[]' });
     if (csrf) body.append('csrf_token', csrf);
@@ -355,14 +395,15 @@ async function addToCart(productId, quantity = 1) {
     } catch (e) {
       return { success: false, message: e.message };
     }
-  }, quantity);
+  }, cartQuantity);
 
   if (!result.success || result.payload?.error || result.payload?.resources?.customerAuthenticated === false) {
-    return { success: false, error: 'cart_add_not_confirmed' };
+    return { success: false, error: 'cart_add_not_confirmed', writeAttempted: true };
   }
-  const numericPid = normalizeCartProductId(productId);
-  const previousQuantity = before.items.find(item => item.id === numericPid)?.qty ?? 0;
-  return verifyCartQuantity(numericPid, previousQuantity + quantity);
+  if (!weighted) return verifyCartQuantity(numericPid, previousQuantity + quantity);
+  // The add already wrote to the basket, so any failure from here must not be retried.
+  const updated = await updateCartItem(numericPid, previousQuantity + quantity);
+  return updated.success ? updated : { ...updated, writeAttempted: true };
 }
 
 // ─── Order History ────────────────────────────────────────────────────────────
@@ -370,7 +411,7 @@ async function addToCart(productId, quantity = 1) {
 async function getOrderHistory(limit = 5) {
   await goto(`${CONTINENTE_BASE}/conta/encomendas/`);
 
-  if (page.url().includes('/login')) return { error: 'not_authenticated' };
+  if (page.url().includes('/login')) return { error: 'not_authenticated', writeAttempted: false };
 
   const text = await page.evaluate(() => document.body.innerText);
   const rawLines = text.split('\n').map(l => l.trim()).filter(Boolean);
@@ -391,17 +432,22 @@ async function getOrderHistory(limit = 5) {
     const seen = new Set();
     return Array.from(document.querySelectorAll('a[href*="detalhe-encomenda"]'))
       .map(a => a.href)
+      .filter(h => h.startsWith(`${location.origin}/`))
       .filter(h => { if (seen.has(h)) return false; seen.add(h); return true; });
   });
 
-  // Fetch product lines for each order up to limit
-  const detailLinks = orderLinks.slice(0, limit);
-  for (let idx = 0; idx < detailLinks.length; idx++) {
+  // Links carry an internal ID, not the order number, so they are paired by position.
+  // If the counts disagree, show orders without items rather than attach the wrong ones.
+  if (orderLinks.length !== orders.length) {
+    orders.forEach(order => { order.linesUnavailable = true; });
+    return orders;
+  }
+  for (let idx = 0; idx < Math.min(limit, orders.length); idx++) {
     try {
-      const products = await getOrderProducts(detailLinks[idx]);
-      if (orders[idx]) orders[idx].lines = products.map(p => `${p.qty}x ${p.name}`);
+      const products = await getOrderProducts(orderLinks[idx]);
+      orders[idx].lines = products.map(p => `${p.unit === 'un' ? `${p.qty}x` : `${p.qty} ${p.unit}`} ${p.name}`);
     } catch (e) {
-      // skip failed pages
+      orders[idx].linesUnavailable = true;
     }
   }
 
@@ -409,9 +455,10 @@ async function getOrderHistory(limit = 5) {
 }
 
 async function getOrderProducts(orderDetailUrl) {
-  await page.goto(orderDetailUrl, { waitUntil: 'networkidle', timeout: 20000 });
+  const response = await page.goto(orderDetailUrl, { waitUntil: 'networkidle', timeout: 20000 });
+  if (!response?.ok() || page.url().includes('/login')) throw new Error('order_detail_unavailable');
 
-  return page.evaluate(() => {
+  const products = await page.evaluate(() => {
     const products = [];
     document.querySelectorAll('[class*="product-line"]').forEach(el => {
       const qtyEl = el.querySelector('[class*="qty"], [class*="quantity"], [class*="amount"]');
@@ -422,13 +469,11 @@ async function getOrderProducts(orderDetailUrl) {
       // Take only first line — rest is brand/subcopy
       const name = rawName.split('\n')[0].trim();
 
-      const qtyMatch = qtyEl.textContent.trim().match(/^(\d+)/);
-      const qty = qtyMatch ? parseInt(qtyMatch[1], 10) : 1;
-
-      if (name && name.length > 3) products.push({ name, qty });
+      if (name && name.length > 3) products.push({ name, qtyText: qtyEl.textContent.trim() });
     });
     return products;
   });
+  return products.map(({ name, qtyText }) => ({ name, ...parseOrderQuantity(qtyText) }));
 }
 
 async function getMostBought(limit = 10) {
@@ -446,29 +491,21 @@ async function getMostBought(limit = 10) {
 
   if (orderLinks.length === 0) return { error: 'no_orders' };
 
-  // Tally products across recent orders
-  const tally = new Map(); // name -> { qty, orders }
+  const orderProducts = [];
 
-  for (const link of orderLinks.slice(0, limit)) {
+  const scanned = orderLinks.slice(0, limit);
+  let failed = 0;
+  for (const link of scanned) {
     try {
       const products = await getOrderProducts(link);
-      for (const { name, qty } of products) {
-        const existing = tally.get(name);
-        if (existing) {
-          existing.qty += qty;
-          existing.orders += 1;
-        } else {
-          tally.set(name, { qty, orders: 1 });
-        }
-      }
+      orderProducts.push(products);
     } catch (e) {
-      // skip failed order pages
+      failed++;
     }
   }
+  if (failed === scanned.length) return { error: 'order_details_unavailable' };
 
-  return Array.from(tally.entries())
-    .map(([name, { qty, orders }]) => ({ name, qty, orders }))
-    .sort((a, b) => b.qty - a.qty);
+  return { products: tallyMostBought(orderProducts), scanned: scanned.length, failed };
 }
 
 // ─── Preferences ───────────────────────────────────────────────────────────────
@@ -484,9 +521,10 @@ async function getPreferences() {
 }
 
 async function savePreferences(prefs) {
-  try { mkdirSync(STATE_DIR, { recursive: true }); } catch (e) {}
+  try { mkdirSync(STATE_DIR, { recursive: true, mode: 0o700 }); } catch (e) {}
   const prefsFile = `${STATE_DIR}/preferences.json`;
-  writeFileSync(prefsFile, JSON.stringify(prefs, null, 2));
+  writeFileSync(prefsFile, JSON.stringify(prefs, null, 2), { mode: 0o600 });
+  chmodSync(prefsFile, 0o600);
 }
 
 async function updatePreferencesFromFavorites() {
@@ -526,7 +564,7 @@ export class ContinenteServer {
       { capabilities: { tools: {} } }
     );
     this.server.onclose = () => { void closeBrowser(); };
-    this.pending = Promise.resolve();
+    this.pending = createQueue();
     this.setupTools();
   }
 
@@ -618,22 +656,12 @@ export class ContinenteServer {
 
   callTool(name, args = {}) {
     // All tools share one browser page, including close_session.
-    const result = this.pending.then(() => this.executeTool(name, args));
-    this.pending = result.catch(() => {});
-    return result;
+    return this.pending(() => this.executeTool(name, args));
   }
 
   async executeTool(name, args) {
       try {
-        if (!args || typeof args !== 'object' || Array.isArray(args)) throw new Error('Arguments must be an object');
-        if (['search_products', 'get_order_history', 'get_most_bought'].includes(name) && args.limit !== undefined &&
-          (!Number.isInteger(args.limit) || args.limit < 1 || args.limit > 50)) throw new Error('limit must be an integer from 1 to 50');
-        if (name === 'search_products' && (typeof args.query !== 'string' || !args.query.trim())) throw new Error('query must be a non-empty string');
-        if (['add_to_cart', 'update_cart_item'].includes(name)) {
-          if (typeof args.product_id !== 'string' || !/^[a-zA-Z0-9_-]+(?:\.html)?$/.test(args.product_id)) throw new Error('Invalid product_id');
-          const quantity = args.quantity ?? (name === 'add_to_cart' ? 1 : undefined);
-          if (typeof quantity !== 'number' || !Number.isFinite(quantity) || quantity < 0 || (name === 'add_to_cart' && quantity === 0)) throw new Error('Invalid quantity');
-        }
+        args = validateToolInput(name, args);
         switch (name) {
           case 'search_products':
             return await this.handle_search(args.query, args.limit || 10);
@@ -667,18 +695,21 @@ export class ContinenteServer {
       const fav = preferences?.favorites?.find(f => normalizeCartProductId(f.productId) === normalizeCartProductId(p.product_id));
       const favBadge = fav ? ' ⭐ (favorite)' : '';
       const unitStr = p.unit ? ` (${p.unit})` : '';
-      return `${i + 1}. ${p.name}${favBadge}\n   💰 ${p.price?.toFixed(2) || '?'}€${unitStr}\n   🆔 ${p.product_id}`;
+      const minimumStr = p.minimum ? `\n   ⚖️ Minimum ${p.minimum}` : '';
+      return `${i + 1}. ${p.name}${favBadge}\n   💰 ${p.price?.toFixed(2) || '?'}€${unitStr}${minimumStr}\n   🆔 ${p.product_id}`;
     }).join('\n\n');
   }
 
   async handle_search(query, limit) {
     const prefs = await getPreferences();
-    const products = await searchProducts(query, limit * 2);
+    // Look further down the results when there are favourites to rank first.
+    const products = await searchProducts(query, prefs?.favorites?.length ? 2 : 0);
     const ranked = rankByPreference(products, prefs);
     const top = ranked.slice(0, limit);
 
     const favCount = prefs?.favorites?.length || 0;
     return {
+      structuredContent: { products: top },
       content: [{
         type: 'text',
         text: `Found ${products.length} products for "${query}" (${favCount} favorites loaded)${top.some(p => p.score > 0) ? ' — ⭐ = in your favorites' : ''}:\n\n${this.formatProducts(top, prefs)}\n\nUse add_to_cart with the product_id.`
@@ -717,13 +748,13 @@ export class ContinenteServer {
   async handle_get_cart() {
     const cart = await retryAfterAutoLogin(() => getCart());
     if (cart?.error === 'not_authenticated') {
-      return { content: [{ type: 'text', text: 'Not logged in. Set CONTINENTE_EMAIL and CONTINENTE_PASSWORD in the MCP server environment, or refresh cookies manually.' }], isError: true };
+      return { content: [{ type: 'text', text: NOT_LOGGED_IN }], isError: true };
     }
     if (cart?.error) {
       return { content: [{ type: 'text', text: `Could not load cart. (${cart.error})` }], isError: true };
     }
     if (!Array.isArray(cart.items) || cart.items.length === 0) {
-      return { content: [{ type: 'text', text: '🛒 Cart is empty.' }] };
+      return { structuredContent: cart, content: [{ type: 'text', text: '🛒 Cart is empty.' }] };
     }
     const total = cart.total;
     const totalText = total === null ? 'Unavailable' : `${total.toFixed(2)}€`;
@@ -731,6 +762,7 @@ export class ContinenteServer {
       `${i + 1}. ${item.name}\n   Qtd: ${item.qty} × ${item.price?.toFixed(2) || '?'}€\n   🆔 ${item.id}`
     ).join('\n');
     return {
+      structuredContent: cart,
       content: [{
         type: 'text',
         text: `🛒 Cart (${cart.items.length} items):\n\n${list}\n\n💶 Total: ${totalText}\n\nGo to https://www.continente.pt/checkout/carrinho/ to checkout.`
@@ -739,23 +771,23 @@ export class ContinenteServer {
   }
 
   async handle_add_to_cart(productId, quantity) {
-    const result = await retryAfterAutoLogin(() => addToCart(productId, quantity));
+    const result = await retryAfterAutoLogin(() => addToCart(productId, quantity), true);
     if (result.success) {
-      return { content: [{ type: 'text', text: `✅ Added to cart! (${quantity}x)\n\nUse get_cart to review.` }] };
+      return { structuredContent: result, content: [{ type: 'text', text: `✅ Added to cart! (${quantity}x)\n\nUse get_cart to review.` }] };
     }
     return { content: [{ type: 'text', text: `⚠️ ${result.error || result.message || 'Could not add to cart.'}` }], isError: true };
   }
 
   async handle_update_cart_item(productId, quantity) {
-    const result = await retryAfterAutoLogin(() => updateCartItem(productId, quantity));
+    const result = await retryAfterAutoLogin(() => updateCartItem(productId, quantity), true);
     if (result?.error === 'not_authenticated') {
-      return { content: [{ type: 'text', text: 'Not logged in. Set CONTINENTE_EMAIL and CONTINENTE_PASSWORD in the MCP server environment, or refresh cookies manually.' }], isError: true };
+      return { content: [{ type: 'text', text: NOT_LOGGED_IN }], isError: true };
     }
     if (result?.error === 'not_found') {
       return { content: [{ type: 'text', text: `Product ${productId} is not in the cart.` }], isError: true };
     }
     if (result.success) {
-      return { content: [{ type: 'text', text: `✅ Updated cart item ${productId} to ${quantity}.\n\nUse get_cart to review.` }] };
+      return { structuredContent: result, content: [{ type: 'text', text: `✅ Updated cart item ${productId} to ${quantity}.\n\nUse get_cart to review.` }] };
     }
     return { content: [{ type: 'text', text: `⚠️ ${result.error || 'Could not update cart item.'}` }], isError: true };
   }
@@ -763,7 +795,7 @@ export class ContinenteServer {
   async handle_order_history(limit) {
     const orders = await retryAfterAutoLogin(() => getOrderHistory(limit));
     if (orders?.error === 'not_authenticated') {
-      return { content: [{ type: 'text', text: 'Not logged in. Set CONTINENTE_EMAIL and CONTINENTE_PASSWORD in the MCP server environment, or refresh cookies manually.' }], isError: true };
+      return { content: [{ type: 'text', text: NOT_LOGGED_IN }], isError: true };
     }
     if (!Array.isArray(orders) || orders.length === 0) {
       return { content: [{ type: 'text', text: 'Could not load order history. Check https://www.continente.pt/conta/encomendas/' }] };
@@ -772,7 +804,7 @@ export class ContinenteServer {
       if (o.raw) return `${i + 1}. ${o.raw}`;
       const date = o.date ? `📅 ${o.date}` : '';
       const total = o.total ? ` — ${o.total}` : '';
-      const lines = o.lines ? o.lines.join(' · ') : '';
+      const lines = o.lines ? o.lines.join(' · ') : o.linesUnavailable ? '(items could not be read)' : '';
       return `${i + 1}. ${date}${total}\n   ${lines}`;
     }).join('\n\n');
     return {
@@ -786,19 +818,20 @@ export class ContinenteServer {
   async handle_most_bought(limit) {
     const result = await retryAfterAutoLogin(() => getMostBought(limit));
     if (result.error) {
-      return { content: [{ type: 'text', text: result.error === 'not_authenticated' ? 'Not logged in. Set CONTINENTE_EMAIL and CONTINENTE_PASSWORD in the MCP server environment, or refresh cookies manually.' : `Error: ${result.error}` }], isError: true };
+      return { content: [{ type: 'text', text: result.error === 'not_authenticated' ? NOT_LOGGED_IN : `Error: ${result.error}` }], isError: true };
     }
-    if (!Array.isArray(result) || result.length === 0) {
+    if (!Array.isArray(result.products) || result.products.length === 0) {
       return { content: [{ type: 'text', text: 'Could not calculate most bought items from order history.' }] };
     }
-    const top = result.slice(0, 25);
+    const top = result.products.slice(0, 25);
     const list = top.map((item, i) =>
-      `${i + 1}. ${item.name} — ${item.qty} units across ${item.orders} order${item.orders > 1 ? 's' : ''}`
+      `${i + 1}. ${item.name} — ${Object.entries(item.quantities).map(([unit, qty]) => `${qty} ${unit}`).join(' + ')} across ${item.orders} order${item.orders > 1 ? 's' : ''}`
     ).join('\n');
     return {
       content: [{
         type: 'text',
-        text: `Most bought products (calculated from your order history):\n\n${list}`
+        text: `Most bought products (calculated from your order history):\n\n${list}` +
+          (result.failed ? `\n\n⚠️ ${result.failed} of ${result.scanned} orders could not be read and are not counted.` : '')
       }]
     };
   }
@@ -810,7 +843,8 @@ export class ContinenteServer {
   }
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+// npm bins run through symlinks, so compare the resolved path.
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {
   const server = new ContinenteServer();
   server.start().catch(error => { console.error(error.message); process.exitCode = 1; });
 }

package/src/reliability.js

@@ -0,0 +1,44 @@
+export const normalizeFavoriteId = value => String(value ?? '').replace(/\.html$/, '');
+
+export function createQueue() {
+  let tail = Promise.resolve();
+  return operation => {
+    const result = tail.then(operation);
+    tail = result.catch(() => {});
+    return result;
+  };
+}
+
+export function validateToolInput(name, args = {}) {
+  if (!args || typeof args !== 'object' || Array.isArray(args)) throw new Error('Invalid arguments');
+  if (['add_to_cart', 'update_cart_item'].includes(name)) {
+    if (typeof args.product_id !== 'string' || args.product_id.length > 250 ||
+      !/^(?:[a-zA-Z0-9]+-)*\d+(?:-master)?(?:\.html)?$/.test(args.product_id)) {
+      throw new Error('Invalid product_id: expected a numeric PID or product slug ending in a numeric PID');
+    }
+    const quantity = args.quantity === undefined && name === 'add_to_cart' ? 1 : args.quantity;
+    if (typeof quantity !== 'number' || !Number.isFinite(quantity) || quantity < 0 ||
+      (name === 'add_to_cart' && quantity === 0)) {
+      throw new Error(name === 'add_to_cart'
+        ? 'Quantity must be finite and greater than zero'
+        : 'Quantity must be finite and non-negative; zero removes the item');
+    }
+  }
+  if (['search_products', 'get_order_history', 'get_most_bought'].includes(name) && args.limit !== undefined &&
+    (!Number.isInteger(args.limit) || args.limit < 1 || args.limit > 50)) {
+    throw new Error('Limit must be an integer from 1 to 50');
+  }
+  if (name === 'search_products' &&
+    (typeof args.query !== 'string' || !args.query.trim() || args.query.length > 250 || /[\x00-\x1f\x7f]/.test(args.query))) {
+    throw new Error('Query must be nonempty text, at most 250 characters, without control characters');
+  }
+  return args;
+}
+
+export async function retryAuthentication(operation, refresh, mutation = false) {
+  const first = await operation();
+  if (first?.error !== 'not_authenticated' || first.writeAttempted === true ||
+    (mutation && first.writeAttempted !== false)) return first;
+  if (!(await refresh())) return first;
+  return operation();
+}