htmlhost-mcp 1.3.0 → 1.5.0

package/README.md

@@ -22,7 +22,9 @@ npx, keep `@latest` in the command: a bare `npx -y htmlhost-mcp` keeps reusing i
 
 ### 2. Authenticate
 
-The MCP server reuses the same token as the CLI. If you've already run `htmlhost login`, you're set.
+Nothing to do up front: the first time your AI tool needs your account, it calls the `login` tool, which opens an
+approval page in your browser. Check the code matches and click Approve. The server shares its token with the CLI, so
+if you've already run `htmlhost login`, you're set. You can also sign in from a terminal:
 
 ```bash
 npx htmlhost-cli login
@@ -86,10 +88,11 @@ htmlhost-mcp
 |---|---|
 | `deploy` | Deploy a local file or directory to htmlhost.co |
 | `deploy_html` | Deploy raw HTML content directly (no local files needed) |
-| `list_sites` | List all your sites |
+| `list_sites` | List your sites and the ones shared with you |
 | `get_site` | Get details about a specific site (pages, assets, version) |
 | `pull_site` | Download a site's files to a local directory |
 | `delete_site` | Permanently delete a site |
+| `login` | Sign in: opens an approval page in your browser |
 | `whoami` | Show the current authenticated user |
 | `list_versions` | List a site's published versions and what each changed |
 | `restore_version` | Make an earlier version live again (Pro) |
@@ -123,7 +126,7 @@ ttl       (optional)  Time-to-live: 1d, 7d, 30d, or never
 
 ### `list_sites`
 
-Returns all sites, their URLs, sizes, TTLs, and plan usage.
+Returns all your sites, their URLs, sizes, TTLs, and plan usage, plus `shared`: the sites shared with you as a collaborator, with their owner. You can pull, deploy to and restore those with your own key; only the owner can delete them.
 
 ### `get_site`
 
@@ -149,6 +152,11 @@ slug      (required)  The site slug to delete
 confirm   (required)  Must be true — safety check
 ```
 
+### `login`
+
+Signs in to your htmlhost.co account. Opens an approval page in your browser and waits briefly; if you haven't
+approved yet, it returns the link and code, and your AI tool calls it again once you have.
+
 ### `whoami`
 
 Returns the authenticated user's email, name, handle, and plan.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "htmlhost-mcp",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "description": "MCP server for htmlhost.co — deploy, list, and manage sites from AI coding tools",
   "type": "module",
   "bin": {

package/src/api.mjs

@@ -2,10 +2,10 @@
  * API client for the htmlhost MCP server.
  *
  * Reuses the same ~/.htmlhostrc token and API base as the CLI,
- * so `htmlhost login` is the only setup step needed.
+ * so signing in once (the `login` tool or `htmlhost login`) covers both.
  */
 import { readFileSync, writeFileSync, statSync, readdirSync, mkdirSync, existsSync } from "node:fs";
-import { join, basename, dirname, resolve } from "node:path";
+import { join, basename, dirname, resolve, sep } from "node:path";
 import { homedir } from "node:os";
 import { createHash } from "node:crypto";
 
@@ -14,7 +14,7 @@ import { createHash } from "node:crypto";
 // ---------------------------------------------------------------------------
 const CONFIG_PATH = join(homedir(), ".htmlhostrc");
 /** Sent with every request, so the API can tell which version is calling. Kept in step with server.mjs. */
-export const CLIENT_VERSION = "1.3.0";
+export const CLIENT_VERSION = "1.5.0";
 const DEFAULT_API = "https://htmlhost.co";
 
 export function readConfig() {
@@ -56,7 +56,7 @@ class ApiError extends Error {
 
 function headers(extra = {}) {
   const token = getToken();
-  if (!token) throw new ApiError("Not logged in. Run `htmlhost login` in a terminal first.", 0);
+  if (!token) throw new ApiError("Not signed in to htmlhost. Call the `login` tool: it opens an approval page in the user's browser.", 0);
   return { Authorization: `Bearer ${token}`, "X-HTMLHost-Client": "mcp", "X-HTMLHost-Client-Version": CLIENT_VERSION, ...extra };
 }
 
@@ -161,7 +161,8 @@ export function findAllFiles(baseDir, currentDir) {
     } else if (entry.isFile()) {
       let size;
       try { size = statSync(fullPath).size; } catch { continue; }
-      results.push({ filePath: fullPath, relativePath: fullPath.slice(baseDir.length + 1), size });
+      // Always with "/" (Windows paths have "\", an address no browser can ask for).
+      results.push({ filePath: fullPath, relativePath: fullPath.slice(baseDir.length + 1).split(sep).join("/"), size });
     }
   }
   return results;

package/src/login.mjs

@@ -0,0 +1,93 @@
+/**
+ * The `login` tool: browser-approved sign-in, the same flow as `htmlhost login`
+ * in htmlhost-cli (keep the two in step). It opens the approval page in the
+ * user's browser and waits a little; if they haven't approved yet it returns
+ * the link and code for the AI to show, and the next call picks the same
+ * sign-in up. The token lands in ~/.htmlhostrc, shared with the CLI.
+ * Never writes to stdout (the MCP channel).
+ */
+import { hostname } from "node:os";
+import { exec } from "node:child_process";
+import { readConfig, writeConfig, getApi, getToken, CLIENT_VERSION } from "./api.mjs";
+
+/** How long one call waits for the approval before handing the link back. */
+const CALL_WAIT_MS = 25_000;
+
+function openBrowser(url) {
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? 'start ""' : "xdg-open";
+  exec(`${cmd} "${url}"`, () => {});
+}
+
+async function currentUser() {
+  const token = getToken();
+  if (!token) return null;
+  try {
+    const res = await fetch(`${getApi()}/api/tokens/me`, { headers: { Authorization: `Bearer ${token}`, "X-HTMLHost-Client": "mcp", "X-HTMLHost-Client-Version": CLIENT_VERSION } });
+    return res.ok ? await res.json() : null;
+  } catch {
+    return null;
+  }
+}
+
+async function startLogin() {
+  const res = await fetch(`${getApi()}/api/cli-login`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", "X-HTMLHost-Client": "mcp", "X-HTMLHost-Client-Version": CLIENT_VERSION },
+    body: JSON.stringify({ client: "mcp", deviceName: hostname() }),
+  });
+  if (res.status === 404 || res.status === 405) return null;
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) throw new Error(data.error || `Couldn't start sign-in (HTTP ${res.status}).`);
+  const pending = {
+    deviceCode: data.deviceCode,
+    userCode: data.userCode,
+    verifyUrl: data.verifyUrl,
+    interval: data.interval || 3,
+    expiresAt: Date.now() + (data.expiresIn || 600) * 1000,
+    api: getApi(),
+  };
+  writeConfig({ pendingLogin: pending });
+  openBrowser(pending.verifyUrl);
+  return pending;
+}
+
+/** One call of the tool: the message for the AI. */
+export async function loginStep() {
+  const user = await currentUser();
+  if (user) return `Already signed in to htmlhost as ${user.email}.`;
+
+  const saved = readConfig().pendingLogin;
+  let pending = saved && saved.api === getApi() && saved.expiresAt > Date.now() + 5_000 ? saved : null;
+  if (!pending) {
+    pending = await startLogin();
+    if (!pending) return `This htmlhost server doesn't offer browser sign-in yet. Ask the user to run \`npx htmlhost-cli login\` in a terminal.`;
+  }
+
+  const until = Math.min(pending.expiresAt, Date.now() + CALL_WAIT_MS);
+  let interval = pending.interval * 1000;
+  while (Date.now() < until) {
+    await new Promise((r) => setTimeout(r, interval));
+    let data;
+    try {
+      const res = await fetch(`${getApi()}/api/cli-login/poll`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ deviceCode: pending.deviceCode }),
+      });
+      data = await res.json();
+    } catch {
+      continue;
+    }
+    if (data.status === "approved") {
+      writeConfig({ token: data.token, api: getApi(), pendingLogin: undefined });
+      return `Signed in to htmlhost as ${data.email || "the user's account"}. You can use the htmlhost tools now.`;
+    }
+    if (data.status === "slow_down") interval += 1000;
+    else if (data.status === "denied" || data.status === "expired" || data.status === "too_many_tokens") {
+      writeConfig({ pendingLogin: undefined });
+      if (data.status === "too_many_tokens") return `The user's account has 10 API keys. Ask them to remove one at ${getApi()}/settings#keys, then call login again.`;
+      return data.status === "denied" ? "The user cancelled the sign-in." : "That sign-in expired. Call login again for a new link.";
+    }
+  }
+  return `Not signed in yet. The approval page opened in the user's browser. Ask them to open ${pending.verifyUrl} if it didn't, check it shows the code ${pending.userCode}, and click Approve. Then call login again.`;
+}

package/src/server.mjs

@@ -27,6 +27,10 @@ import {
   CLIENT_VERSION,
 } from "./api.mjs";
 import { checkForUpdate } from "./update.mjs";
+import { loginStep } from "./login.mjs";
+
+/** What every tool says before the user has signed in: the login tool does it, no terminal needed. */
+const NOT_SIGNED_IN = "Not signed in to htmlhost. Call the `login` tool: it opens an approval page in the user's browser.";
 
 const VERSION = CLIENT_VERSION;
 
@@ -81,7 +85,7 @@ export function createServer() {
       }),
     },
     wrap(async ({ path, slug, title, ttl }) => {
-      if (!isLoggedIn()) return "Not logged in. Run `htmlhost login` in a terminal first.";
+      if (!isLoggedIn()) return NOT_SIGNED_IN;
 
       const resolvedPath = resolve(path);
       if (!existsSync(resolvedPath)) return `Path not found: ${path}`;
@@ -118,12 +122,13 @@ export function createServer() {
     {
       title: "List sites",
       description:
-        "List all sites owned by the authenticated user on htmlhost.co. " +
-        "Returns slug, URL, title, size, TTL, and expiration for each site.",
+        "List the authenticated user's sites on htmlhost.co, and the sites shared with them as a collaborator (`shared`). " +
+        "Returns slug, URL, title, size, TTL, and expiration for each site. " +
+        "Shared sites can be pulled, deployed to and restored with this key like your own, but only their owner can delete them.",
       inputSchema: z.object({}),
     },
     wrap(async () => {
-      if (!isLoggedIn()) return "Not logged in. Run `htmlhost login` in a terminal first.";
+      if (!isLoggedIn()) return NOT_SIGNED_IN;
 
       const data = await apiGet("/api/sites");
       const sites = (data.sites || []).map((s) => ({
@@ -136,10 +141,20 @@ export function createServer() {
         expiresAt: s.expiresAt || null,
       }));
 
+      const shared = (data.shared || []).map((s) => ({
+        slug: s.slug,
+        url: `https://${s.slug}.htmlhost.co`,
+        title: s.title || null,
+        owner: s.owner || null,
+        isMultiPage: s.isMultiPage,
+        expiresAt: s.expiresAt || null,
+      }));
+
       return {
         count: sites.length,
         usage: data.usage,
         sites,
+        ...(shared.length && { shared }),
       };
     })
   );
@@ -158,7 +173,7 @@ export function createServer() {
       }),
     },
     wrap(async ({ slug }) => {
-      if (!isLoggedIn()) return "Not logged in. Run `htmlhost login` in a terminal first.";
+      if (!isLoggedIn()) return NOT_SIGNED_IN;
 
       const cleanSlug = slug.replace(/\.htmlhost\.co$/, "");
       const data = await apiGet(`/api/sites/pull?slug=${encodeURIComponent(cleanSlug)}&meta=true`);
@@ -197,7 +212,7 @@ export function createServer() {
       }),
     },
     wrap(async ({ slug, directory }) => {
-      if (!isLoggedIn()) return "Not logged in. Run `htmlhost login` in a terminal first.";
+      if (!isLoggedIn()) return NOT_SIGNED_IN;
 
       const cleanSlug = slug.replace(/\.htmlhost\.co$/, "");
       const destDir = resolve(directory);
@@ -263,7 +278,7 @@ export function createServer() {
       }),
     },
     wrap(async ({ slug, confirm }) => {
-      if (!isLoggedIn()) return "Not logged in. Run `htmlhost login` in a terminal first.";
+      if (!isLoggedIn()) return NOT_SIGNED_IN;
       if (!confirm) return "Deletion not confirmed. Set confirm to true to proceed.";
 
       const cleanSlug = slug.replace(/\.htmlhost\.co$/, "");
@@ -276,6 +291,19 @@ export function createServer() {
   // -------------------------------------------------------------------
   // Tool: whoami
   // -------------------------------------------------------------------
+  server.registerTool(
+    "login",
+    {
+      title: "Sign in to htmlhost",
+      description:
+        "Sign in to the user's htmlhost.co account. Opens an approval page in their browser and waits briefly; " +
+        "if they haven't approved yet, it returns the link and code to show them. Call it again after they approve. " +
+        "Use it when another htmlhost tool says you're not signed in.",
+      inputSchema: z.object({}),
+    },
+    wrap(async () => loginStep())
+  );
+
   server.registerTool(
     "whoami",
     {
@@ -284,7 +312,7 @@ export function createServer() {
       inputSchema: z.object({}),
     },
     wrap(async () => {
-      if (!isLoggedIn()) return "Not logged in. Run `htmlhost login` in a terminal first.";
+      if (!isLoggedIn()) return NOT_SIGNED_IN;
 
       const data = await apiGet("/api/tokens/me");
       return {
@@ -314,7 +342,7 @@ export function createServer() {
       }),
     },
     wrap(async ({ html, slug, title, ttl }) => {
-      if (!isLoggedIn()) return "Not logged in. Run `htmlhost login` in a terminal first.";
+      if (!isLoggedIn()) return NOT_SIGNED_IN;
 
       const body = { html };
       if (slug) body.slug = slug;
@@ -349,7 +377,7 @@ export function createServer() {
       }),
     },
     wrap(async ({ slug }) => {
-      if (!isLoggedIn()) return "Not logged in. Run `htmlhost login` in a terminal first.";
+      if (!isLoggedIn()) return NOT_SIGNED_IN;
       const cleanSlug = slug.replace(/\.htmlhost\.co$/, "");
       return apiGet(`/api/sites/${encodeURIComponent(cleanSlug)}/versions`);
     })
@@ -372,7 +400,7 @@ export function createServer() {
       }),
     },
     wrap(async ({ slug, version, confirm }) => {
-      if (!isLoggedIn()) return "Not logged in. Run `htmlhost login` in a terminal first.";
+      if (!isLoggedIn()) return NOT_SIGNED_IN;
       if (!confirm) return "Restore not confirmed. Set confirm to true to proceed.";
       const cleanSlug = slug.replace(/\.htmlhost\.co$/, "");
       const data = await apiPost(`/api/sites/${encodeURIComponent(cleanSlug)}/versions/${version}/restore`, {});