vault-go 0.9.0 → 0.10.1

package/README.md

@@ -1,3 +1,9 @@
+## Login no navegador
+
+`bunx --bun vault-go@latest` abre o autenticador do AI Vault Memory no navegador. E-mail, senha e MFA são informados apenas no portal. Ao concluir, o terminal recebe um código de uso único por `127.0.0.1` e o troca com PKCE; tokens não aparecem na URL nem no console. O listener fecha ao concluir ou após cinco minutos.
+
+Para trocar a conta: `bunx --bun vault-go@latest login --force`. Para chave de API explícita: `bunx --bun vault-go@latest login --force --api-key`. Se a abertura automática falhar, use o endereço exibido no mesmo computador. Requer uma sessão local com navegador para o retorno loopback.
+
 # vault-go
 
 Servidor MCP em Bun para pesquisar, contextualizar e registrar memória na
@@ -59,7 +65,7 @@ bunx --bun vault-go@latest
 O assistente:
 
 1. valida uma sessão existente em `~/.memvault`;
-2. se necessário, solicita login por e-mail, senha e MFA ou uma chave de API
+2. se necessário, abre o login do AI Vault Memory no navegador (chave de API somente com `--api-key`)
    `vg_live_...`;
 3. detecta os clientes instalados;
 4. permite escolher onde registrar o MCP;

package/dist/auth.d.ts

@@ -1,9 +1,16 @@
 export interface AuthenticationResult {
     email: string;
-    method: 'password' | 'api-key' | 'existing';
+    method: 'password' | 'browser' | 'api-key' | 'existing';
 }
 type Fetcher = typeof fetch;
 export declare function authenticateWithPassword(email: string, password: string, requestMfa: () => Promise<string>, home: string, fetcher?: Fetcher): Promise<AuthenticationResult>;
 export declare function authenticateWithApiKey(apiKey: string, home: string, fetcher?: Fetcher): Promise<AuthenticationResult>;
 export declare function validateExistingAuthentication(home: string, fetcher?: Fetcher): Promise<AuthenticationResult | null>;
+export declare function openVaultBrowser(url: string): Promise<void>;
+export declare function authenticateWithBrowser(home: string, options?: {
+    fetcher?: Fetcher;
+    openBrowser?: (url: string) => Promise<void>;
+    timeoutMs?: number;
+    report?: (message: string) => void;
+}): Promise<AuthenticationResult>;
 export {};

package/dist/auth.js

@@ -1,3 +1,6 @@
+import { createServer } from 'node:http';
+import { randomBytes, createHash, timingSafeEqual } from 'node:crypto';
+import { execFile } from 'node:child_process';
 import { loadConfig, loadTokens, saveConfig, saveTokens, } from './config.js';
 function endpoint(home, path) {
     const apiUrl = new URL(loadConfig(home).apiUrl);
@@ -10,6 +13,7 @@ async function errorMessage(response) {
 async function accountForToken(token, home, fetcher) {
     const response = await fetcher(endpoint(home, '/me'), {
         headers: { authorization: `Bearer ${token}` },
+        redirect: 'error',
         signal: AbortSignal.timeout(10_000),
     });
     if (response.status === 401 || response.status === 403)
@@ -97,3 +101,101 @@ export async function validateExistingAuthentication(home, fetcher = fetch) {
     persist(tokens, account.email, home);
     return { email: account.email, method: 'existing' };
 }
+export function openVaultBrowser(url) {
+    const command = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'rundll32' : 'xdg-open';
+    const args = process.platform === 'win32' ? ['url.dll,FileProtocolHandler', url] : [url];
+    return new Promise((resolve, reject) => { execFile(command, args, { timeout: 10_000 }, error => error ? reject(error) : resolve()); });
+}
+export async function authenticateWithBrowser(home, options = {}) {
+    const fetcher = options.fetcher ?? fetch;
+    const report = options.report ?? (message => process.stderr.write(message + '\n'));
+    const start = endpoint(home, '/auth/oauth/resolveup/start');
+    if (start.protocol !== 'https:' && !(start.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(start.hostname)))
+        throw new Error('A autenticação Vault requer HTTPS.');
+    const verifier = randomBytes(32).toString('base64url');
+    const state = randomBytes(32).toString('base64url');
+    let port = 0;
+    let claim;
+    let rejectClaim;
+    let accepted = false;
+    const received = new Promise((resolve, reject) => { claim = resolve; rejectClaim = reject; });
+    // A timeout can occur while the browser opener is still running.
+    void received.catch(() => { });
+    const server = createServer((req, res) => {
+        res.setHeader('Cache-Control', 'no-store');
+        res.setHeader('Referrer-Policy', 'no-referrer');
+        res.setHeader('Content-Security-Policy', "default-src 'none'; frame-ancestors 'none'");
+        let url;
+        try {
+            url = new URL(req.url ?? '/', `http://127.0.0.1:${port}`);
+        }
+        catch {
+            res.writeHead(400).end();
+            return;
+        }
+        if (req.method !== 'GET' || req.headers.host !== `127.0.0.1:${port}` || url.pathname !== '/callback') {
+            res.writeHead(404).end();
+            return;
+        }
+        const incoming = url.searchParams.get('state') ?? '';
+        const validState = /^[A-Za-z0-9_-]{43}$/.test(incoming) && timingSafeEqual(Buffer.from(incoming), Buffer.from(state));
+        const code = url.searchParams.get('code');
+        if (!validState || url.searchParams.getAll('state').length !== 1 || accepted) {
+            res.writeHead(400).end('Retorno de autenticação inválido.');
+            return;
+        }
+        if (url.searchParams.has('error')) {
+            accepted = true;
+            res.writeHead(400).end('Login não concluído. Volte ao terminal.');
+            rejectClaim?.(new Error('Login cancelado ou recusado no Vault.'));
+            return;
+        }
+        if (!code || !/^[A-Za-z0-9_-]{43}$/.test(code) || url.searchParams.getAll('code').length !== 1) {
+            res.writeHead(400).end('Código inválido.');
+            return;
+        }
+        accepted = true;
+        res.setHeader('Content-Type', 'text/html; charset=utf-8');
+        res.end('<!doctype html><html lang="pt-BR"><title>AI Vault Memory</title><h1>AI Vault Memory</h1><p>Retorno recebido. Volte ao terminal para concluir.</p></html>');
+        claim?.(code);
+    });
+    let timer;
+    try {
+        await new Promise((resolve, reject) => { server.once('error', reject); server.listen(0, '127.0.0.1', resolve); });
+        const address = server.address();
+        if (!address || typeof address === 'string')
+            throw new Error('Não foi possível iniciar o retorno local.');
+        port = address.port;
+        start.searchParams.set('mobile_challenge', createHash('sha256').update(verifier).digest('base64url'));
+        start.searchParams.set('mobile_state', state);
+        start.searchParams.set('cli_port', String(port));
+        timer = setTimeout(() => rejectClaim?.(new Error('Tempo de login esgotado. Execute vault-go login novamente.')), options.timeoutMs ?? 300_000);
+        report('Abrindo o autenticador do AI Vault Memory no navegador…');
+        report(`Se o navegador não abrir, acesse neste computador: ${start.href}`);
+        try {
+            await (options.openBrowser ?? openVaultBrowser)(start.href);
+        }
+        catch {
+            report('Não foi possível abrir o navegador automaticamente. Use o endereço acima.');
+        }
+        const code = await received;
+        const response = await fetcher(endpoint(home, '/auth/mobile/exchange'), {
+            method: 'POST', headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ code, verifier }), redirect: 'error', signal: AbortSignal.timeout(15_000),
+        });
+        if (!response.ok)
+            throw new Error('Não foi possível concluir o login do Vault. Tente novamente.');
+        const tokens = normalizeTokens(await response.json());
+        const account = await accountForToken(tokens.accessToken, home, fetcher);
+        if (!account)
+            throw new Error('O Vault não confirmou a conta autenticada.');
+        persist(tokens, account.email, home);
+        return { email: account.email, method: 'browser' };
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+        server.closeAllConnections();
+        await new Promise(resolve => server.close(() => resolve()));
+    }
+}

package/dist/cli.js

@@ -1,4 +1,4 @@
-import { authenticateWithApiKey, authenticateWithPassword, validateExistingAuthentication, } from './auth.js';
+import { authenticateWithApiKey, authenticateWithBrowser, validateExistingAuthentication, } from './auth.js';
 import { vaultHome } from './config.js';
 import { detectMcpClients, installMcpClient, MCP_CLIENTS, parseClientSelection, } from './installer.js';
 import { promptSecret, promptText } from './prompt.js';
@@ -24,7 +24,7 @@ function optionValue(args, name) {
     const prefix = `${name}=`;
     return args.find((argument) => argument.startsWith(prefix))?.slice(prefix.length);
 }
-async function ensureAuthentication(home, force = false) {
+async function ensureAuthentication(home, force = false, apiKeyMode = false) {
     if (!force) {
         const existing = await validateExistingAuthentication(home);
         if (existing) {
@@ -32,21 +32,12 @@ async function ensureAuthentication(home, force = false) {
             return existing;
         }
     }
-    process.stderr.write('\nAutenticação Vault\n');
-    process.stderr.write('  1. E-mail, senha e MFA\n');
-    process.stderr.write('  2. Chave de API (vg_live_...)\n');
-    const method = (await promptText('Escolha [1]: ')) || '1';
-    if (method === '2') {
-        const apiKey = await promptSecret('Chave de API: ');
-        const result = await authenticateWithApiKey(apiKey, home);
+    if (apiKeyMode) {
+        const result = await authenticateWithApiKey(await promptSecret('Chave de API: '), home);
         process.stderr.write(`✓ Chave validada para ${result.email}.\n`);
         return result;
     }
-    if (method !== '1')
-        throw new Error('Método de autenticação inválido.');
-    const email = await promptText('E-mail: ');
-    const password = await promptSecret('Senha: ');
-    const result = await authenticateWithPassword(email, password, () => promptSecret('Código MFA ou backup: '), home);
+    const result = await authenticateWithBrowser(home);
     process.stderr.write(`✓ Login realizado como ${result.email}.\n`);
     return result;
 }
@@ -73,7 +64,7 @@ export async function runLogin(args) {
     if (!process.stdin.isTTY || !process.stderr.isTTY) {
         throw new Error('O login requer um terminal interativo.');
     }
-    await ensureAuthentication(vaultHome(), args.includes('--force'));
+    await ensureAuthentication(vaultHome(), args.includes('--force'), args.includes('--api-key'));
     return 0;
 }
 export async function runSetup(args) {
@@ -81,7 +72,7 @@ export async function runSetup(args) {
         throw new Error('O setup requer um terminal interativo.');
     }
     process.stderr.write('vault-go — configuração MCP universal\n');
-    await ensureAuthentication(vaultHome(), args.includes('--reauth'));
+    await ensureAuthentication(vaultHome(), args.includes('--reauth'), args.includes('--api-key'));
     const clients = await chooseClients(args);
     if (clients.length === 0)
         throw new Error('Nenhum cliente MCP selecionado.');
@@ -113,12 +104,12 @@ Servidor MCP universal para a plataforma Vault.
 
 Uso:
   bunx --bun vault-go@latest
-      Autentica no Vault e instala nos clientes detectados.
+      Abre o login Vault no navegador e instala nos clientes detectados.
 
   bunx --bun vault-go@latest setup [--clients lista] [--reauth]
       Executa o assistente de autenticação e instalação.
 
-  bunx --bun vault-go@latest login [--force]
+  bunx --bun vault-go@latest login [--force] [--api-key]
       Autentica sem alterar clientes MCP.
 
   bunx --bun vault-go@latest serve

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vault-go",
-  "version": "0.9.0",
+  "version": "0.10.1",
   "description": "Servidor MCP universal com autenticação e instalação multi-cliente para a plataforma Vault.",
   "type": "module",
   "bin": {
@@ -58,10 +58,10 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/GutierrezHenrique/vault-go.git"
+    "url": "git+https://github.com/resolveup-cloud/vault-go.git"
   },
   "bugs": {
-    "url": "https://github.com/GutierrezHenrique/vault-go/issues"
+    "url": "https://github.com/resolveup-cloud/vault-go/issues"
   },
   "homepage": "https://vault.resolveup.com.br",
   "keywords": [