mc8yp 2.8.3 → 2.8.4

package/dist/{add-Bt0fMQY3.mjs → add-Sf15gY0D.mjs}

@@ -774,6 +774,12 @@ const command = defineCommand({
 				cancel: "reject"
 			});
 			parse(pipe(string(), url()), tenantUrl);
+			const { protocol, hostname } = new URL(tenantUrl);
+			if (protocol === "http:" && ![
+				"localhost",
+				"127.0.0.1",
+				"[::1]"
+			].includes(hostname)) consola.warn(`${tenantUrl} uses plain http — your password (and TFA code) would be sent unencrypted. Use https unless this is a trusted local setup.`);
 			const user = await consola.prompt("Username:", {
 				type: "text",
 				cancel: "reject"

package/dist/cli.mjs

@@ -6,12 +6,12 @@ import { join, sep } from "node:path";
 import * as tty from "node:tty";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { Buffer as Buffer$1 } from "node:buffer";
-import { AsyncEntry, findCredentialsAsync } from "@napi-rs/keyring";
 import { lookup } from "node:dns";
 import { createSandbox } from "@iso4/sandbox";
 import { Bash } from "just-bash";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
+import { AsyncEntry, findCredentialsAsync } from "@napi-rs/keyring";
 //#region \0rolldown/runtime.js
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -1847,7 +1847,7 @@ const consola = createConsola();
 //#endregion
 //#region package.json
 var name = "mc8yp";
-var version = "2.8.3";
+var version = "2.8.4";
 var description$1 = "Cumulocity IoT MCP Server - Model Context Protocol integration for IoT device management";
 //#endregion
 //#region \0virtual:core-openapi
@@ -127256,148 +127256,6 @@ function getBundledOnlyCapabilities() {
 		mcpServers: {}
 	};
 }
-//#endregion
-//#region src/utils/credentials.ts
-/**
-* Thrown when the platform rejects a login because a TFA code is required.
-* `creds add` catches it to prompt for the code.
-*/
-var TfaRequiredError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "TfaRequiredError";
-	}
-};
-/**
-* Turn a failed platform response into an Error carrying the platform's own
-* message (e.g. "Invalid credentials! : TFA TOTP code required.").
-* @param res - Non-2xx response from the tenant
-* @param action - What was attempted, for the message prefix
-*/
-async function platformError(res, action) {
-	const body = await res.json().catch(() => void 0);
-	const message = `${action} failed: ${res.status} ${res.statusText}${body?.message ? ` — ${body.message}` : ""}`;
-	return res.status === 401 && /\bTFA\b/i.test(body?.message ?? "") ? new TfaRequiredError(message) : new Error(message);
-}
-async function resolveTenantId(tenantUrl, authorizationHeader) {
-	const res = await fetch(`${tenantUrl}/tenant/currentTenant`, { headers: {
-		Authorization: authorizationHeader,
-		Accept: "application/json"
-	} });
-	if (!res.ok) throw await platformError(res, "Login");
-	return (await res.json()).name;
-}
-/**
-* Exchange user, password and a current TFA code for an OAI-Secure access
-* token via `POST /tenant/oauth/token`.
-* @param creds - Tenant URL, user, password, and the tenant ID when already known
-* @param tfaCode - Current TFA code (TOTP)
-*/
-async function requestTfaSession(creds, tfaCode) {
-	const url = new URL("/tenant/oauth/token", creds.tenantUrl);
-	if (creds.tenantId) url.searchParams.set("tenant_id", creds.tenantId);
-	const res = await fetch(url, {
-		method: "POST",
-		headers: {
-			"Content-Type": "application/x-www-form-urlencoded",
-			"Accept": "application/json"
-		},
-		body: new URLSearchParams({
-			grant_type: "PASSWORD",
-			username: creds.user,
-			password: creds.password,
-			tfa_code: tfaCode.trim()
-		})
-	});
-	if (!res.ok) throw await platformError(res, "TFA login");
-	const { access_token: token } = await res.json();
-	if (!token) throw new Error("TFA login failed: the platform response contained no access token.");
-	let exp;
-	try {
-		exp = JSON.parse(Buffer$1.from(token.split(".")[1] ?? "", "base64url").toString("utf8")).exp;
-	} catch {}
-	if (typeof exp !== "number") throw new Error("TFA login failed: could not read the expiry (exp claim) of the access token.");
-	return {
-		token,
-		expiresAt: exp * 1e3
-	};
-}
-async function writeStoredC8yAuth(creds) {
-	const jsonString = JSON.stringify(creds);
-	const entry = new AsyncEntry(name, creds.tenantUrl);
-	try {
-		await entry.setPassword(jsonString);
-	} catch (err) {
-		throw new Error("Failed to store credentials", { cause: err });
-	}
-}
-function parseStoredUserC8yAuth(jsonString, tenantUrl) {
-	const cred = JSON.parse(jsonString);
-	if (!cred.tenantId) throw new Error(`Stored credentials for tenant URL ${tenantUrl} are outdated. Remove and add them again with tenantId.`);
-	return {
-		tenantUrl,
-		user: cred.user,
-		password: cred.password,
-		tenantId: cred.tenantId,
-		...cred.tfaSession ? { tfaSession: cred.tfaSession } : {}
-	};
-}
-async function getStoredC8yAuth() {
-	const found = await findCredentialsAsync(name);
-	const creds = [];
-	for (const entry of found) {
-		const { account, password: jsonString } = entry;
-		creds.push(parseStoredUserC8yAuth(jsonString, cleanTenantUrl(account)));
-	}
-	return creds;
-}
-async function getCredentialsByTenantUrl(tenantUrl) {
-	const cleanedUrl = cleanTenantUrl(tenantUrl);
-	const entry = (await findCredentialsAsync(name)).find((e) => cleanTenantUrl(e.account) === cleanedUrl);
-	if (!entry) throw new Error(`No stored credentials found for tenant URL: ${cleanedUrl}`);
-	return parseStoredUserC8yAuth(entry.password, cleanedUrl);
-}
-async function setStoredC8yAuth(creds) {
-	const cleanedTenantUrl = cleanTenantUrl(creds.tenantUrl);
-	await writeStoredC8yAuth({
-		...creds,
-		tenantUrl: cleanedTenantUrl,
-		tenantId: creds.tenantId ?? await resolveTenantId(cleanedTenantUrl, creds.tfaSession ? `Bearer ${creds.tfaSession.token}` : `Basic ${Buffer$1.from(`${creds.user}:${creds.password}`).toString("base64")}`)
-	});
-}
-/**
-* Replace the stored TFA session for an existing credential entry.
-* @param creds - The stored credentials the new session belongs to
-* @param tfaSession - Freshly obtained session token
-*/
-async function updateStoredTfaSession(creds, tfaSession) {
-	const updated = {
-		...creds,
-		tfaSession
-	};
-	await writeStoredC8yAuth(updated);
-	return updated;
-}
-function cleanTenantUrl(url) {
-	let cleaned = url.trim();
-	const slashIndex = cleaned.indexOf("/", cleaned.indexOf("://") + 3);
-	if (slashIndex !== -1) cleaned = cleaned.slice(0, slashIndex);
-	if (cleaned.endsWith("/")) cleaned = cleaned.slice(0, -1);
-	return cleaned;
-}
-async function deleteStoredC8yAuth(tenantUrl) {
-	const cleanedUrl = cleanTenantUrl(tenantUrl);
-	if (!(await findCredentialsAsync(name)).some((entry) => cleanTenantUrl(entry.account) === cleanedUrl)) return false;
-	const entry = new AsyncEntry(name, cleanedUrl);
-	let deleteError;
-	try {
-		await entry.deletePassword();
-	} catch (err) {
-		deleteError = err;
-	}
-	if (!(await findCredentialsAsync(name)).some((e) => cleanTenantUrl(e.account) === cleanedUrl)) return true;
-	throw new Error(`Keyring refused to delete the credentials for ${cleanedUrl}. The entry is present when listing but cannot be removed by target — this is typically a libsecret / WSL2 locked-collection issue. Unlock the login keyring (e.g. \`gnome-keyring-daemon --unlock --components=secrets\`) and try again, or remove the entry manually with \`secret-tool clear service ${name} account ${cleanedUrl}\`.`, deleteError instanceof Error ? { cause: deleteError } : void 0);
-}
 const inFlight = /* @__PURE__ */ new Map();
 /**
 * Build a \@c8y/client for stored CLI credentials: Bearer with the TFA
@@ -127444,18 +127302,20 @@ async function renewTfaSession(creds) {
 	if (!c8yMcpServer.ctx.sessionInfo?.clientCapabilities?.elicitation) throw new Error(`${state} This MCP client cannot prompt for a new TFA code (no elicitation support). ${shellHint}`);
 	let code;
 	try {
-		const answer = await c8yMcpServer.elicitation(`${state} Enter the current code from your authenticator app to continue.`, /* @__PURE__ */ object({ code: /* @__PURE__ */ pipe(/* @__PURE__ */ string(), /* @__PURE__ */ regex(/^\s*\d{6,8}\s*$/, "Enter the 6-digit code from your authenticator app."), /* @__PURE__ */ description("TFA code")) }));
+		const answer = await c8yMcpServer.elicitation(`mc8yp — the Cumulocity MCP server your AI assistant is using — needs a new TFA code to keep acting as ${creds.user} on ${creds.tenantUrl}. The current session ${expiresAt <= Date.now() ? "expired" : "expires"} at ${new Date(expiresAt).toLocaleString()}. Entering the code from your authenticator app renews the assistant's access to this tenant for the full token lifetime set by your tenant. Decline if you did not expect this prompt.`, /* @__PURE__ */ object({ code: /* @__PURE__ */ pipe(/* @__PURE__ */ string(), /* @__PURE__ */ regex(/^\s*\d{6,8}\s*$/, "Enter the 6-digit code from your authenticator app."), /* @__PURE__ */ description("TFA code")) }));
 		code = answer.action === "accept" ? answer.content?.code : void 0;
 	} catch (error) {
 		if (isInputRequired(error)) throw error;
 		throw new Error(`${state} Prompting for a new TFA code failed (${error instanceof Error ? error.message : String(error)}). ${shellHint}`);
 	}
 	if (!code) throw new Error(`${state} No TFA code was entered. ${shellHint}`);
-	return updateStoredTfaSession(creds, await requestTfaSession(creds, code));
+	const session = await globalThis._requestTfaSession(creds, code);
+	return globalThis._updateStoredTfaSession(creds, session);
 }
 //#endregion
 //#region src/cli/tenant-context.ts
 let _context = null;
+let _pendingTenantUrl = null;
 /**
 * Return the current CLI tenant context, or null if none has been set.
 */
@@ -127463,6 +127323,13 @@ function getCliTenantContext() {
 	return _context;
 }
 /**
+* Return the tenant that is selected but waits for a new TFA code before it
+* can be activated, or null.
+*/
+function getPendingCliTenantUrl() {
+	return _pendingTenantUrl;
+}
+/**
 * Drop the in-memory tenant context. Used by drift-recovery (credentials
 * disappeared for the active tenant) and by the explicit reset path on
 * set-active-tenant. Does not touch persistence — the caller is responsible
@@ -127470,6 +127337,7 @@ function getCliTenantContext() {
 */
 function clearCliTenantContext() {
 	_context = null;
+	_pendingTenantUrl = null;
 }
 /**
 * Set (or update) the active tenant context.
@@ -127486,34 +127354,74 @@ function clearCliTenantContext() {
 * @param tenantUrl - Base URL of the Cumulocity tenant to activate
 */
 async function setCliTenantContext(tenantUrl) {
+	_context = await resolveCliTenantContext(tenantUrl);
+	_pendingTenantUrl = null;
+	return _context;
+}
+/**
+* Restore the persisted tenant at CLI startup. A TFA session that has run
+* out (or is about to) cannot be renewed yet — no client is connected to
+* ask for a code — so the tenant is only marked pending and activated on
+* the first call instead.
+* @param tenantUrl - Persisted active tenant URL
+* @returns The activated context, or null when activation waits for a TFA code
+*/
+async function restoreCliTenantContext(tenantUrl) {
+	const creds = await globalThis._getCredentialsByTenantUrl(tenantUrl);
+	if (creds.tfaSession && creds.tfaSession.expiresAt - Date.now() <= 3e5) {
+		_pendingTenantUrl = tenantUrl;
+		return null;
+	}
+	return setCliTenantContext(tenantUrl);
+}
+async function resolveCliTenantContext(tenantUrl) {
 	const creds = await getFreshCliCredentials(tenantUrl);
 	const authHeaders = createC8yAuthHeaders(creds);
 	const cliClient = createCliClient(creds);
 	const { specs: discovered, installedContextPaths, mcpServers } = await startDiscovery(creds.tenantId, cliClient);
-	_context = {
+	return {
 		tenantUrl,
 		authorizationHeader: authHeaders.Authorization,
 		specs: resolveCapabilities(discovered, installedContextPaths, mcpServers),
 		tfaExpiresAt: creds.tfaSession?.expiresAt
 	};
-	return _context;
 }
 /**
-* Renew the active tenant's TFA session when it is about to expire, and
-* push the new Authorization header into the shared MCP context. Noop for
-* Basic-auth tenants and while the token is still fresh, so the keyring is
-* only read near expiry. Called by the codemode tool before each run.
+* Make the selected tenant usable before a codemode run:
+* - a tenant left pending at startup is activated now (asks for the TFA
+*   code, then runs discovery);
+* - an active tenant whose TFA session is about to expire is renewed.
+*
+* The new auth (and, on activation, specs) is pushed into the shared MCP
+* context. Noop for Basic-auth tenants and while the token is still fresh,
+* so the keyring is only read near expiry.
 *
-* Throws (via `getFreshCliCredentials`) when the session cannot be renewed
-* here; the codemode tool surfaces that message to the agent.
+* Throws (via `getFreshCliCredentials`) when the code cannot be obtained;
+* the codemode tool then fails the call without running the code.
 */
-async function renewCliTenantAuthIfExpiring() {
+async function ensureCliTenantReady() {
+	const custom = c8yMcpServer.ctx.custom;
+	const pending = _pendingTenantUrl;
+	if (!_context && pending) {
+		const ctx = await resolveCliTenantContext(pending);
+		if (_pendingTenantUrl !== pending || _context) return;
+		_context = ctx;
+		_pendingTenantUrl = null;
+		if (custom) {
+			custom.auth = {
+				tenantUrl: ctx.tenantUrl,
+				authorizationHeader: ctx.authorizationHeader
+			};
+			custom.specs = ctx.specs;
+		}
+		return;
+	}
 	const ctx = _context;
 	if (!ctx?.tfaExpiresAt || ctx.tfaExpiresAt - Date.now() > 3e5) return;
 	const creds = await getFreshCliCredentials(ctx.tenantUrl);
+	if (_context !== ctx) return;
 	ctx.authorizationHeader = createC8yAuthHeaders(creds).Authorization;
 	ctx.tfaExpiresAt = creds.tfaSession?.expiresAt;
-	const custom = c8yMcpServer.ctx.custom;
 	if (custom) custom.auth = {
 		tenantUrl: ctx.tenantUrl,
 		authorizationHeader: ctx.authorizationHeader
@@ -147433,7 +147341,7 @@ async () => {
 		replayable: true
 	}, async (input) => {
 		try {
-			if (env === "cli") await renewCliTenantAuthIfExpiring();
+			if (env === "cli") await ensureCliTenantReady();
 			return tool.text(await execute(input.code));
 		} catch (error) {
 			if (isInputRequired(error)) throw error;
@@ -147526,8 +147434,8 @@ function createSetActiveTenantTool() {
 				const available = storedCreds.map((c) => c.tenantUrl).join(", ");
 				return tool.error(`Tenant ${input.tenantUrl} not found in stored credentials.${available ? ` Known tenants: ${available}` : " No tenants stored — use creds add first."}`);
 			}
-			writeActiveTenant(input.tenantUrl);
 			const ctx = await setCliTenantContext(input.tenantUrl);
+			writeActiveTenant(input.tenantUrl);
 			const custom = c8yMcpServer.ctx.custom;
 			if (!custom) throw new Error("MCP server context not initialized");
 			custom.auth = {
@@ -147560,6 +147468,7 @@ function createStatusTool() {
 async function buildCliStatus(refresh) {
 	const creds = await globalThis._getStoredC8yAuth();
 	let active = getCliTenantContext();
+	let pending = getPendingCliTenantUrl();
 	const sections = [];
 	if (active && !creds.some((c) => c.tenantUrl === active.tenantUrl)) {
 		const cleared = active.tenantUrl;
@@ -147567,14 +147476,21 @@ async function buildCliStatus(refresh) {
 		active = null;
 		sections.push(`Active tenant ${cleared} was cleared automatically because no credentials are stored for it. Codemode discovery now falls back to all bundled OpenAPI snapshots; live API calls are unavailable until you set a tenant.`);
 	}
+	if (pending && !creds.some((c) => c.tenantUrl === pending)) {
+		sections.push(`Selected tenant ${pending} was cleared automatically because no credentials are stored for it.`);
+		resetActiveTenant();
+		pending = null;
+	}
 	if (refresh) {
-		if (!active) sections.push("Refresh requested but no tenant is active — nothing to refresh. Call set-active-tenant first.");
+		if (pending) sections.push(`Refresh skipped: ${pending} is waiting for a new TFA code. The next codemode or set-active-tenant call asks for it and runs discovery.`);
+		else if (!active) sections.push("Refresh requested but no tenant is active — nothing to refresh. Call set-active-tenant first.");
 		else {
 			sections.push(await refreshCliActiveTenant(active.tenantUrl));
 			active = getCliTenantContext();
 		}
 	}
 	if (active) sections.push(`Active tenant: ${active.tenantUrl}`);
+	else if (pending) sections.push(`Active tenant: ${pending} — waiting for a new TFA code because the stored TFA session expired. The next codemode or set-active-tenant call asks the user for it; until then codemode calls fail without running.`);
 	else sections.push("Active tenant: (none) — codemode discovery falls back to all bundled OpenAPI snapshots; live API calls are unavailable until set-active-tenant is called. Visibility in the bundled-only mode does NOT guarantee any service is installed on any tenant.");
 	if (creds.length === 0) sections.push("Stored credentials: (none). Use `creds add` from the shell to register a tenant before calling set-active-tenant.");
 	else {
@@ -147584,7 +147500,7 @@ async function buildCliStatus(refresh) {
 		}).join("\n");
 		sections.push(`Stored credentials:\n${lines}`);
 	}
-	if (!active && creds.length > 0) sections.push("Next step: call set-active-tenant with one of the tenant URLs above before making live API calls through codemode.");
+	if (!active && !pending && creds.length > 0) sections.push("Next step: call set-active-tenant with one of the tenant URLs above before making live API calls through codemode.");
 	return sections.join("\n\n");
 }
 /**
@@ -147600,9 +147516,19 @@ async function refreshCliActiveTenant(tenantUrl) {
 		const result = await refreshCapabilities(creds.tenantId, client);
 		const resolved = resolveCapabilities(result.specs, result.installedContextPaths, result.mcpServers);
 		const cliCtx = getCliTenantContext();
-		if (cliCtx) cliCtx.specs = resolved;
-		const custom = c8yMcpServer.ctx.custom;
-		if (custom) custom.specs = resolved;
+		if (cliCtx?.tenantUrl === tenantUrl) {
+			cliCtx.specs = resolved;
+			cliCtx.authorizationHeader = createC8yAuthHeaders(creds).Authorization;
+			cliCtx.tfaExpiresAt = creds.tfaSession?.expiresAt;
+			const custom = c8yMcpServer.ctx.custom;
+			if (custom) {
+				custom.specs = resolved;
+				custom.auth = {
+					tenantUrl,
+					authorizationHeader: cliCtx.authorizationHeader
+				};
+			}
+		}
 		return `Refreshed API discovery for ${tenantUrl}: ${result.specs.length} spec(s) downloaded, ${result.mcpServers.length} MCP server(s) connected, ${result.installedContextPaths.size} subscribed application(s).`;
 	} catch (err) {
 		if (isInputRequired(err)) throw err;
@@ -147624,6 +147550,159 @@ function setupMcpServer(env) {
 		c8yMcpServer.tool(createSetActiveTenantTool());
 	}
 }
+//#endregion
+//#region src/utils/credentials.ts
+/**
+* Upper bound for a stored TFA session's expiry. Keeps a malformed `exp`
+* claim from producing an out-of-range Date.
+*/
+const MAX_TFA_SESSION_MS = 31536e6;
+/**
+* Thrown when the platform rejects a login because a TFA code is required.
+* `creds add` catches it to prompt for the code.
+*/
+var TfaRequiredError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "TfaRequiredError";
+	}
+};
+/**
+* Turn a failed platform response into an Error carrying the platform's own
+* message (e.g. "Invalid credentials! : TFA TOTP code required.").
+* @param res - Non-2xx response from the tenant
+* @param action - What was attempted, for the message prefix
+*/
+async function platformError(res, action) {
+	const body = await res.json().catch(() => void 0);
+	const message = `${action} failed: ${res.status} ${res.statusText}${body?.message ? ` — ${body.message}` : ""}`;
+	return res.status === 401 && /\bTFA\b/i.test(body?.message ?? "") ? new TfaRequiredError(message) : new Error(message);
+}
+async function resolveTenantId(tenantUrl, authorizationHeader) {
+	const res = await fetch(`${tenantUrl}/tenant/currentTenant`, {
+		headers: {
+			Authorization: authorizationHeader,
+			Accept: "application/json"
+		},
+		redirect: "error"
+	});
+	if (!res.ok) throw await platformError(res, "Login");
+	return (await res.json()).name;
+}
+/**
+* Exchange user, password and a current TFA code for an OAI-Secure access
+* token via `POST /tenant/oauth/token`.
+* @param creds - Tenant URL, user, password, and the tenant ID when already known
+* @param tfaCode - Current TFA code (TOTP)
+*/
+async function requestTfaSession(creds, tfaCode) {
+	const url = new URL("/tenant/oauth/token", creds.tenantUrl);
+	if (creds.tenantId) url.searchParams.set("tenant_id", creds.tenantId);
+	const res = await fetch(url, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/x-www-form-urlencoded",
+			"Accept": "application/json"
+		},
+		body: new URLSearchParams({
+			grant_type: "PASSWORD",
+			username: creds.user,
+			password: creds.password,
+			tfa_code: tfaCode.trim()
+		}),
+		redirect: "error"
+	});
+	if (!res.ok) throw await platformError(res, "TFA login");
+	const { access_token: token } = await res.json();
+	if (!token) throw new Error("TFA login failed: the platform response contained no access token.");
+	let exp;
+	try {
+		exp = JSON.parse(Buffer$1.from(token.split(".")[1] ?? "", "base64url").toString("utf8")).exp;
+	} catch {}
+	if (typeof exp !== "number" || !Number.isFinite(exp)) throw new Error("TFA login failed: could not read the expiry (exp claim) of the access token.");
+	const expiresAt = exp * 1e3;
+	if (expiresAt <= Date.now()) throw new Error(`TFA login failed: the platform issued an access token that already expired (${new Date(expiresAt).toISOString()}).`);
+	return {
+		token,
+		expiresAt: Math.min(expiresAt, Date.now() + MAX_TFA_SESSION_MS)
+	};
+}
+async function writeStoredC8yAuth(creds) {
+	const jsonString = JSON.stringify(creds);
+	const entry = new AsyncEntry(name, creds.tenantUrl);
+	try {
+		await entry.setPassword(jsonString);
+	} catch (err) {
+		throw new Error("Failed to store credentials", { cause: err });
+	}
+}
+function parseStoredUserC8yAuth(jsonString, tenantUrl) {
+	const cred = JSON.parse(jsonString);
+	if (!cred.tenantId) throw new Error(`Stored credentials for tenant URL ${tenantUrl} are outdated. Remove and add them again with tenantId.`);
+	return {
+		tenantUrl,
+		user: cred.user,
+		password: cred.password,
+		tenantId: cred.tenantId,
+		...cred.tfaSession ? { tfaSession: cred.tfaSession } : {}
+	};
+}
+async function getStoredC8yAuth() {
+	const found = await findCredentialsAsync(name);
+	const creds = [];
+	for (const entry of found) {
+		const { account, password: jsonString } = entry;
+		creds.push(parseStoredUserC8yAuth(jsonString, cleanTenantUrl(account)));
+	}
+	return creds;
+}
+async function getCredentialsByTenantUrl(tenantUrl) {
+	const cleanedUrl = cleanTenantUrl(tenantUrl);
+	const entry = (await findCredentialsAsync(name)).find((e) => cleanTenantUrl(e.account) === cleanedUrl);
+	if (!entry) throw new Error(`No stored credentials found for tenant URL: ${cleanedUrl}`);
+	return parseStoredUserC8yAuth(entry.password, cleanedUrl);
+}
+async function setStoredC8yAuth(creds) {
+	const cleanedTenantUrl = cleanTenantUrl(creds.tenantUrl);
+	await writeStoredC8yAuth({
+		...creds,
+		tenantUrl: cleanedTenantUrl,
+		tenantId: creds.tenantId ?? await resolveTenantId(cleanedTenantUrl, creds.tfaSession ? `Bearer ${creds.tfaSession.token}` : `Basic ${Buffer$1.from(`${creds.user}:${creds.password}`).toString("base64")}`)
+	});
+}
+/**
+* Replace the stored TFA session for an existing credential entry.
+* @param creds - The stored credentials the new session belongs to
+* @param tfaSession - Freshly obtained session token
+*/
+async function updateStoredTfaSession(creds, tfaSession) {
+	const updated = {
+		...creds,
+		tfaSession
+	};
+	await writeStoredC8yAuth(updated);
+	return updated;
+}
+function cleanTenantUrl(url) {
+	let cleaned = url.trim();
+	const slashIndex = cleaned.indexOf("/", cleaned.indexOf("://") + 3);
+	if (slashIndex !== -1) cleaned = cleaned.slice(0, slashIndex);
+	if (cleaned.endsWith("/")) cleaned = cleaned.slice(0, -1);
+	return cleaned;
+}
+async function deleteStoredC8yAuth(tenantUrl) {
+	const cleanedUrl = cleanTenantUrl(tenantUrl);
+	if (!(await findCredentialsAsync(name)).some((entry) => cleanTenantUrl(entry.account) === cleanedUrl)) return false;
+	const entry = new AsyncEntry(name, cleanedUrl);
+	let deleteError;
+	try {
+		await entry.deletePassword();
+	} catch (err) {
+		deleteError = err;
+	}
+	if (!(await findCredentialsAsync(name)).some((e) => cleanTenantUrl(e.account) === cleanedUrl)) return true;
+	throw new Error(`Keyring refused to delete the credentials for ${cleanedUrl}. The entry is present when listing but cannot be removed by target — this is typically a libsecret / WSL2 locked-collection issue. Unlock the login keyring (e.g. \`gnome-keyring-daemon --unlock --components=secrets\`) and try again, or remove the entry manually with \`secret-tool clear service ${name} account ${cleanedUrl}\`.`, deleteError instanceof Error ? { cause: deleteError } : void 0);
+}
 runMain(defineCommand({
 	meta: {
 		name: `${name}-cli`,
@@ -147659,8 +147738,10 @@ runMain(defineCommand({
 	setup: () => {
 		globalThis._getCredentialsByTenantUrl = getCredentialsByTenantUrl;
 		globalThis._getStoredC8yAuth = getStoredC8yAuth;
+		globalThis._requestTfaSession = requestTfaSession;
+		globalThis._updateStoredTfaSession = updateStoredTfaSession;
 	},
-	subCommands: { creds: () => import("./creds-BQypJsxt.mjs").then((m) => m.default) },
+	subCommands: { creds: () => import("./creds-DXlyJw6X.mjs").then((m) => m.default) },
 	run: async ({ args }) => {
 		const requested = (Array.isArray(args.spec) ? args.spec.at(-1) : args.spec) ?? getCoreOpenApiVersion();
 		const selected = specs.find((e) => e.version === requested);
@@ -147684,11 +147765,13 @@ runMain(defineCommand({
 		if (externalMcpServers.length > 0) consola.info(`External MCP namespaces: ${externalMcpServers.map((s) => `${s.name} (${s.url})`).join(", ")}`);
 		const activeTenant = readActiveTenantUrl();
 		if (activeTenant) try {
-			const tenantCtx = await setCliTenantContext(activeTenant);
-			const specKeys = Object.keys(tenantCtx.specs.specs);
-			const mcpKeys = Object.keys(tenantCtx.specs.mcpServers);
-			consola.info(`Active tenant: ${activeTenant}`);
-			consola.info(`Startup discovery complete — OpenAPI specs: ${specKeys.length > 0 ? specKeys.join(", ") : "none"}; MCP servers: ${mcpKeys.length > 0 ? mcpKeys.join(", ") : "none"}`);
+			const tenantCtx = await restoreCliTenantContext(activeTenant);
+			if (tenantCtx) {
+				const specKeys = Object.keys(tenantCtx.specs.specs);
+				const mcpKeys = Object.keys(tenantCtx.specs.mcpServers);
+				consola.info(`Active tenant: ${activeTenant}`);
+				consola.info(`Startup discovery complete — OpenAPI specs: ${specKeys.length > 0 ? specKeys.join(", ") : "none"}; MCP servers: ${mcpKeys.length > 0 ? mcpKeys.join(", ") : "none"}`);
+			}
 		} catch (err) {
 			const message = err instanceof Error ? err.message : String(err);
 			if (message.includes("No stored credentials found for tenant URL")) {

package/dist/{creds-BQypJsxt.mjs → creds-DXlyJw6X.mjs}

@@ -6,12 +6,12 @@ const command = defineCommand({
 		description: "Manage your Cumulocity credentials"
 	},
 	subCommands: {
-		add: () => import("./add-Bt0fMQY3.mjs").then((m) => m.default),
+		add: () => import("./add-Sf15gY0D.mjs").then((m) => m.default),
 		remove: () => import("./remove-DeJzuKJK.mjs").then((m) => m.default),
 		list: () => import("./list-Cr6LlrRt.mjs").then((m) => m.default)
 	},
 	run: async ({ rawArgs }) => {
-		const command = await import("./add-Bt0fMQY3.mjs").then((m) => m.default);
+		const command = await import("./add-Sf15gY0D.mjs").then((m) => m.default);
 		await runCommand(command, { rawArgs });
 	}
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mc8yp",
-  "version": "2.8.3",
+  "version": "2.8.4",
   "type": "module",
   "description": "Cumulocity IoT MCP Server - Model Context Protocol integration for IoT device management",
   "keywords": [