cyberdyne-mcp 0.7.0 → 0.7.2

package/dist/bankr.js

@@ -219,6 +219,13 @@ export async function bankrSiweProvision(opts = {}) {
     });
     if (!nonceRes.ok)
         throw new BankrApiError(nonceRes.status, "/cli/siwe/nonce", "nonce request failed");
+    // The nonce endpoint sets AWS load-balancer stickiness cookies (AWSALB…); the nonce is
+    // instance-local, so /cli/siwe/verify MUST carry them to reach the same backend — without
+    // this it intermittently fails "Nonce expired or already used" depending on LB routing.
+    const cookie = (typeof nonceRes.headers.getSetCookie === "function" ? nonceRes.headers.getSetCookie() : [])
+        .map((c) => c.split(";")[0])
+        .filter(Boolean)
+        .join("; ");
     const { nonce } = (await nonceRes.json());
     if (!nonce)
         throw new BankrApiError(200, "/cli/siwe/nonce", "no nonce in response");
@@ -239,7 +246,12 @@ export async function bankrSiweProvision(opts = {}) {
     const signature = await account.signMessage({ message });
     const verifyRes = await fetch(`${BANKR_API_URL}/cli/siwe/verify`, {
         method: "POST",
-        headers: { "content-type": "application/json", accept: "application/json", "user-agent": "cyberdyne-mcp" },
+        headers: {
+            "content-type": "application/json",
+            accept: "application/json",
+            "user-agent": "cyberdyne-mcp",
+            ...(cookie ? { cookie } : {}),
+        },
         body: JSON.stringify({
             message,
             signature,

package/dist/onboard.js

@@ -180,8 +180,9 @@ export async function onboard(env = process.env, opts = {}) {
         }
     }
     const jar = new Map();
-    // 1. nonce
-    const nonceRes = await fetch(`${apiUrl}/api/auth/siwe/nonce`, { headers: { accept: "application/json" } });
+    // 1. nonce — the platform binds the nonce to the signer address (hardening), so the
+    //    nonce endpoint REQUIRES ?address=<wallet>; omitting it returns 400.
+    const nonceRes = await fetch(`${apiUrl}/api/auth/siwe/nonce?address=${address}`, { headers: { accept: "application/json" } });
     if (!nonceRes.ok)
         throw new Error(`GET /api/auth/siwe/nonce → ${nonceRes.status}`);
     collectCookies(nonceRes, jar); // carry siwe-nonce to verify

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cyberdyne-mcp",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "mcpName": "io.github.Cyberdyne-OS/cyberdyne-mcp",
   "publishConfig": {
     "access": "public"

package/src/bankr.ts

@@ -275,6 +275,13 @@ export async function bankrSiweProvision(
     signal: AbortSignal.timeout(20_000),
   });
   if (!nonceRes.ok) throw new BankrApiError(nonceRes.status, "/cli/siwe/nonce", "nonce request failed");
+  // The nonce endpoint sets AWS load-balancer stickiness cookies (AWSALB…); the nonce is
+  // instance-local, so /cli/siwe/verify MUST carry them to reach the same backend — without
+  // this it intermittently fails "Nonce expired or already used" depending on LB routing.
+  const cookie = (typeof nonceRes.headers.getSetCookie === "function" ? nonceRes.headers.getSetCookie() : [])
+    .map((c) => c.split(";")[0])
+    .filter(Boolean)
+    .join("; ");
   const { nonce } = (await nonceRes.json()) as { nonce?: string };
   if (!nonce) throw new BankrApiError(200, "/cli/siwe/nonce", "no nonce in response");
 
@@ -296,7 +303,12 @@ export async function bankrSiweProvision(
 
   const verifyRes = await fetch(`${BANKR_API_URL}/cli/siwe/verify`, {
     method: "POST",
-    headers: { "content-type": "application/json", accept: "application/json", "user-agent": "cyberdyne-mcp" },
+    headers: {
+      "content-type": "application/json",
+      accept: "application/json",
+      "user-agent": "cyberdyne-mcp",
+      ...(cookie ? { cookie } : {}),
+    },
     body: JSON.stringify({
       message,
       signature,

package/src/onboard.ts

@@ -224,8 +224,9 @@ export async function onboard(
 
   const jar = new Map<string, string>();
 
-  // 1. nonce
-  const nonceRes = await fetch(`${apiUrl}/api/auth/siwe/nonce`, { headers: { accept: "application/json" } });
+  // 1. nonce — the platform binds the nonce to the signer address (hardening), so the
+  //    nonce endpoint REQUIRES ?address=<wallet>; omitting it returns 400.
+  const nonceRes = await fetch(`${apiUrl}/api/auth/siwe/nonce?address=${address}`, { headers: { accept: "application/json" } });
   if (!nonceRes.ok) throw new Error(`GET /api/auth/siwe/nonce → ${nonceRes.status}`);
   collectCookies(nonceRes, jar); // carry siwe-nonce to verify
   const { nonce } = (await nonceRes.json()) as { nonce?: string };