kloudy 0.4.6 → 0.4.7

package/README.md

@@ -307,3 +307,8 @@ MCP: operation `conversation`, `conversation_operation` = `read`, `append` or `s
 The engine owns encryption, scope checks, condensation gates and transcript deletion. Returned cards are lossy context, never grants. Artifact pointers do not authorize repository reads. The client never persists message bodies in its session file. Replayed commands return metadata only: issue a read for current cards. Conflicts and failures are not retried automatically; read the cursor and reconcile before resubmitting. Added in 0.4.1. The no-key installer and public discovery remain unchanged.
 
 Official MCP Registry name: `ai.kloudy/kloudy`. Remote endpoint: https://kloudy.ai/mcp. Public discovery and Sample cards do not grant private tools or authorize spending.
+
+## Card and website fallback (0.4.7)
+
+The remote MCP adapter returns supported card metadata and a plain-text HTTPS chooser link together. Hosts control rendering and link launch. Call show_pending_chooser_link to display the last offer/selection again in the same MCP process. Website sign-in verifies private account projects; the public template locator is never an account token or authorization. A presentation goal may be retained in the current MCP process and is kept out of the URL. Automatic authenticated IDE return is not claimed. If the process resets, use the website's existing project recovery path. No models, installation or spending are activated by these links.
+

package/package.json

@@ -1,68 +1,68 @@
-{
-  "name": "kloudy",
-  "version": "0.4.6",
-  "description": "Ask for Kloudy: CLI, MCP and SDK clients for the same scoped engine session.",
-  "type": "module",
-  "license": "Apache-2.0",
-  "engines": {
-    "node": ">=20.19.0"
-  },
-  "bin": {
-    "kloudy": "bin/entry.mjs"
-  },
-  "exports": {
-    ".": "./src/client.mjs",
-    "./mcp": "./src/mcp.mjs",
-    "./wrap": "./src/wrap.mjs",
-    "./session": "./src/connection.mjs",
-    "./httpk": "./src/httpk.mjs",
-    "./hosted": "./src/hosted.mjs",
-    "./public": "./src/public.mjs",
-    "./strings": "./src/strings.mjs",
-    "./sdf": "./src/sdf.mjs",
-    "./query": "./src/query.mjs",
-    "./activity": "./src/activity.mjs",
-    "./status-indicator.css": "./src/status-indicator.css",
-    "./models": "./src/models.mjs",
-    "./host-interface": "./src/host-interface.mjs",
-    "./replies": "./src/replies.mjs",
-    "./conversation": "./src/conversation.mjs"
-  },
-  "files": [
-    "bin",
-    "src",
-    "schemas",
-    "README.md",
-    "MCP-DEFAULT.md",
-    "LICENSE"
-  ],
-  "scripts": {
-    "test": "node --test test/*.test.mjs",
-    "check": "node --check bin/kloudy.mjs && node --check src/client.mjs && npm test",
-    "start": "node bin/kloudy.mjs",
-    "proof": "node scripts/prove.mjs",
-    "build:approval": "node scripts/build-approval.mjs"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/ext-apps": "2.0.3",
-    "@modelcontextprotocol/sdk": "1.31.0",
-    "ajv": "8.20.0",
-    "ajv-formats": "3.0.1",
-    "js-tiktoken": "1.0.21",
-    "jsonc-parser": "3.3.1",
-    "smol-toml": "1.9.0",
-    "zod": "4.6.5"
-  },
-  "devDependencies": {
-    "esbuild": "0.28.2"
-  },
-  "mcpName": "ai.kloudy/kloudy",
-  "homepage": "https://kloudy.ai/install",
-  "publishConfig": {
-    "access": "public",
-    "registry": "https://registry.npmjs.org"
-  },
-  "bugs": {
-    "url": "https://kloudy.ai/support"
-  }
-}
+{
+  "name": "kloudy",
+  "version": "0.4.7",
+  "description": "Ask for Kloudy: CLI, MCP and SDK clients for the same scoped engine session.",
+  "type": "module",
+  "license": "Apache-2.0",
+  "engines": {
+    "node": ">=20.19.0"
+  },
+  "bin": {
+    "kloudy": "bin/entry.mjs"
+  },
+  "exports": {
+    ".": "./src/client.mjs",
+    "./mcp": "./src/mcp.mjs",
+    "./wrap": "./src/wrap.mjs",
+    "./session": "./src/connection.mjs",
+    "./httpk": "./src/httpk.mjs",
+    "./hosted": "./src/hosted.mjs",
+    "./public": "./src/public.mjs",
+    "./strings": "./src/strings.mjs",
+    "./sdf": "./src/sdf.mjs",
+    "./query": "./src/query.mjs",
+    "./activity": "./src/activity.mjs",
+    "./status-indicator.css": "./src/status-indicator.css",
+    "./models": "./src/models.mjs",
+    "./host-interface": "./src/host-interface.mjs",
+    "./replies": "./src/replies.mjs",
+    "./conversation": "./src/conversation.mjs"
+  },
+  "files": [
+    "bin",
+    "src",
+    "schemas",
+    "README.md",
+    "MCP-DEFAULT.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "test": "node --test test/*.test.mjs",
+    "check": "node --check bin/kloudy.mjs && node --check src/client.mjs && npm test",
+    "start": "node bin/kloudy.mjs",
+    "proof": "node scripts/prove.mjs",
+    "build:approval": "node scripts/build-approval.mjs"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/ext-apps": "2.0.3",
+    "@modelcontextprotocol/sdk": "1.31.0",
+    "ajv": "8.20.0",
+    "ajv-formats": "3.0.1",
+    "js-tiktoken": "1.0.21",
+    "jsonc-parser": "3.3.1",
+    "smol-toml": "1.9.0",
+    "zod": "4.6.5"
+  },
+  "devDependencies": {
+    "esbuild": "0.28.2"
+  },
+  "mcpName": "ai.kloudy/kloudy",
+  "homepage": "https://kloudy.ai/install",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "bugs": {
+    "url": "https://kloudy.ai/support"
+  }
+}

package/src/chooser-link.mjs

@@ -0,0 +1,17 @@
+// Public presentation adapter. URLs contain public template locators only, never
+// a connection credential, authorization token, goal text or identity claim.
+export const CHOOSER_URL='https://kloudy.ai/api/customer/visual-chooser/start';
+export const pendingChooserTool={name:'show_pending_chooser_link',description:'Show the pending Kloudy card and its HTTPS website fallback again. The website verifies account sign-in; the link is not authorization. This does not run a tool, model, installation or payment.',inputSchema:{type:'object',properties:{},additionalProperties:false},annotations:{readOnlyHint:true,destructiveHint:false,idempotentHint:true,openWorldHint:false}};
+export function chooserResponse(result,{apps=false,goal}={}){
+ if(!result||typeof result!=='object'||Array.isArray(result)||result.isError)return result;
+ const data=result.structuredContent;if(!data||typeof data!=='object'||Array.isArray(data))return result;
+ const option=typeof data.selectedOptionId==='string'&&/^[a-z0-9-]{1,80}$/.test(data.selectedOptionId)?data.selectedOptionId:null;
+ const set=typeof data.choiceSetId==='string'&&/^visual-[a-f0-9]{1,64}$/.test(data.choiceSetId)?data.choiceSetId:null;
+ const url=option&&set?CHOOSER_URL+'#choice='+encodeURIComponent(option)+'&set='+encodeURIComponent(set):CHOOSER_URL;
+ const chooser={url,linkIsAuthorization:false,identityFromEmail:false,accountBindingVerified:false,returnMethod:'existing-authenticated-website-project-manifest',automaticIdeReturnVerified:false,...(set?{publicChoiceSetId:set}:{}),...(option?{publicOptionId:option}:{}),...(goal?{request:goal}:{})};
+ const text='Website chooser: '+url+'\nOpen this HTTPS link if your host does not show the card. Complete account sign-in/2FA on the website before opening private project choices. Email is a lookup hint, not proof. The host controls card rendering, clickable links and browser launch. Account-bound automatic return is not established by this public template locator.';
+ return {...result,content:[...(Array.isArray(result.content)?result.content:[]),{type:'text',text}],structuredContent:{...data,chooser},...(apps?{_meta:{...result._meta,ui:{...result._meta?.ui,resourceUri:'ui://widget/kloudy-visual-setup-v1.html'}}}:{})};
+}
+export function pendingChooserResponse(pending){
+ return pending?structuredClone(pending):{content:[{type:'text',text:'No pending chooser is retained in this MCP process. Open '+CHOOSER_URL+' and sign in to recover your existing project. This link is not a bearer token or authorization.'}],structuredContent:{pending:false,chooser:{url:CHOOSER_URL,linkIsAuthorization:false,accountBindingVerified:false}}};
+}

package/src/remote.mjs

@@ -7,6 +7,7 @@ import {StdioServerTransport} from '@modelcontextprotocol/sdk/server/stdio.js';
 import {ListToolsRequestSchema,CallToolRequestSchema,ListResourcesRequestSchema,ReadResourceRequestSchema,ListResourceTemplatesRequestSchema,ToolListChangedNotificationSchema,ResourceListChangedNotificationSchema} from '@modelcontextprotocol/sdk/types.js';
 import {REMOTE} from './editor-install.mjs';
 import {autoupdateEnabled} from './autoupdate.mjs';
+import {chooserResponse,pendingChooserResponse,pendingChooserTool} from './chooser-link.mjs';
 const transports=new WeakMap();
 // This proxy can relay Apps rendering, but cannot service sampling, roots or elicitation.
 export function forwardedCapabilities(value={}){
@@ -28,7 +29,7 @@ export async function askRemote(question,options){
 }
 export async function serveRemote(options={}){
  const connect=options.connect??connectRemote,enabled=autoupdateEnabled(options.autoupdate??process.env.KLOUDY_MCP_AUTOUPDATE);
- let remote=await connect({...options,capabilities:{}}),ready=Promise.resolve(),closed=false,reconnecting;
+ let remote=await connect({...options,capabilities:{}}),ready=Promise.resolve(),closed=false,reconnecting,pendingChooser,requestGoal;
  const upstream=remote.getServerCapabilities(),capabilities={};
  if(upstream.tools)capabilities.tools=enabled&&upstream.tools.listChanged?{listChanged:true}:{};
  if(upstream.resources)capabilities.resources=enabled&&upstream.resources.listChanged?{listChanged:true}:{};
@@ -54,7 +55,22 @@ export async function serveRemote(options={}){
    return run(remote);
   }
  };
- if(capabilities.tools){server.setRequestHandler(ListToolsRequestSchema,req=>invoke('listTools',req.params));server.setRequestHandler(CallToolRequestSchema,req=>invoke('callTool',req.params));}
+ if(capabilities.tools){
+  server.setRequestHandler(ListToolsRequestSchema,async req=>{
+   const result=await invoke('listTools',req.params);
+   return {...result,tools:[...result.tools.map(tool=>tool.name==='show_visual_setup_choices'?{...tool,inputSchema:{...tool.inputSchema,properties:{...tool.inputSchema.properties,goal:{type:'string',minLength:1,maxLength:1000,description:'Presentation request retained in this MCP process; never sent as a credential or URL.'}}}}:tool),...(result.tools.some(t=>t.name===pendingChooserTool.name)?[]:[pendingChooserTool])]};
+  });
+  server.setRequestHandler(CallToolRequestSchema,async req=>{
+   if(req.params.name===pendingChooserTool.name){if(Object.keys(req.params.arguments||{}).length)throw Error('Pending chooser lookup takes no identity or credential fields');return pendingChooserResponse(pendingChooser);}
+   if(req.params.name!=='show_visual_setup_choices')return invoke('callTool',req.params);
+   const argumentsValue={...(req.params.arguments||{})};
+   let nextGoal=requestGoal;
+   if(Object.hasOwn(argumentsValue,'goal')){if(typeof argumentsValue.goal!=='string'||!argumentsValue.goal.trim()||argumentsValue.goal.length>1000)throw Error('Use a presentation request of 1-1000 characters');nextGoal=argumentsValue.goal;delete argumentsValue.goal;}
+   const result=await invoke('callTool',{...req.params,arguments:argumentsValue});
+   const decorated=chooserResponse(result,{apps:!!forwardedCapabilities(server.getClientCapabilities()).experimental,goal:nextGoal});
+   if(!decorated.isError){requestGoal=nextGoal;pendingChooser=decorated;}return decorated;
+  });
+ }
  // Resource delivery is independent of notification/autoupdate opt-in.
  if(capabilities.resources){
   server.setRequestHandler(ListResourcesRequestSchema,req=>invoke('listResources',req.params));