@1sat/cli 0.0.12 → 0.0.14

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@1sat/cli",
-	"version": "0.0.12",
+	"version": "0.0.14",
 	"description": "CLI for 1Sat Ordinals SDK",
 	"type": "module",
 	"main": "./src/cli.ts",
@@ -24,7 +24,8 @@
 		"chalk": "^5.0.0",
 		"@clack/prompts": "^0.8.0",
 		"bitcoin-backup": "^0.0.11",
-		"dotenv": "^17.0.0"
+		"dotenv": "^17.0.0",
+		"evlog": "^2.10.0"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.9",

package/src/commands/mcp-proxy.ts

@@ -1,54 +1,126 @@
 /**
  * 1sat mcp-proxy — stdio-to-HTTP bridge for the wallet-desktop MCP server.
  *
- * Authenticates with BRC-103/104 via AuthFetch + ProtoWallet and proxies
- * JSON-RPC newline-delimited messages from stdin to the local MCP server
- * at :3322, writing responses to stdout.
- *
- * Used by Claude Code's .mcp.json to connect agents to the running
- * 1Sat desktop wallet.
+ * Performs BRC-31 handshake, then proxies JSON-RPC messages from stdin
+ * to the MCP server at :3322 with signed auth headers on each request.
  */
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
-import { AuthFetch, PrivateKey, ProtoWallet } from '@bsv/sdk'
+import { Hash, KeyDeriver, PrivateKey, Signature, Utils } from '@bsv/sdk'
+import type { WalletProtocol } from '@bsv/sdk'
+import { createLogger, initLogger } from 'evlog'
+
+const { toBase64, toArray } = Utils
+
+initLogger({ env: { service: '1sat-mcp-proxy' } })
 
 const MCP_URL = process.env.ONESAT_MCP_URL ?? 'http://127.0.0.1:3322'
 const KEY_DIR = `${process.env.HOME}/.1sat-wallet`
 const CLIENT_KEY_PATH = `${KEY_DIR}/mcp-agent.key`
+const AUTH_PROTOCOL_ID: WalletProtocol = [2, 'authrite message signature']
 
-function log(msg: string): void {
-	process.stderr.write(`[1sat mcp-proxy] ${msg}\n`)
+function generateNonce(): string {
+	const bytes = new Uint8Array(32)
+	crypto.getRandomValues(bytes)
+	return toBase64(Array.from(bytes))
 }
 
 function getClientKey(): PrivateKey {
 	mkdirSync(KEY_DIR, { recursive: true })
-
 	if (existsSync(CLIENT_KEY_PATH)) {
 		return PrivateKey.fromWif(readFileSync(CLIENT_KEY_PATH, 'utf-8').trim())
 	}
-
 	const key = PrivateKey.fromRandom()
 	writeFileSync(CLIENT_KEY_PATH, key.toWif(), { mode: 0o600 })
-	log('Generated new agent identity key')
+	const log = createLogger({ context: 'startup' })
+	log.set({ event: 'key_generated', path: CLIENT_KEY_PATH })
+	log.emit()
 	return key
 }
 
+interface Session {
+	serverIdentityKey: string
+	serverNonce: string
+	clientKey: PrivateKey
+}
+
+async function handshake(key: PrivateKey): Promise<Session> {
+	const pubkey = key.toPublicKey().toString()
+	const clientNonce = generateNonce()
+
+	const res = await fetch(`${MCP_URL}/.well-known/auth`, {
+		method: 'POST',
+		headers: { 'Content-Type': 'application/json' },
+		body: JSON.stringify({
+			authrite: '0.1',
+			messageType: 'initialRequest',
+			identityKey: pubkey,
+			nonce: clientNonce,
+		}),
+	})
+
+	if (!res.ok) throw new Error(`Handshake failed: HTTP ${res.status}`)
+
+	const data = await res.json()
+	if (data.messageType !== 'initialResponse') throw new Error(`Unexpected: ${data.messageType}`)
+
+	const serverNonce = data.nonce as string
+	const deriver = new KeyDeriver(key)
+	const serverPub = deriver.derivePublicKey(
+		AUTH_PROTOCOL_ID, `${serverNonce} ${clientNonce}`, data.identityKey as string, false,
+	)
+
+	const clientNonceBytes = toArray(clientNonce, 'base64')
+	const serverNonceBytes = toArray(serverNonce, 'base64')
+	const msgHash = Hash.sha256(Array.from(new Uint8Array([...clientNonceBytes, ...serverNonceBytes])))
+
+	const sig = Signature.fromDER(data.signature as string, 'hex')
+	if (!serverPub.verify(Array.from(msgHash), sig)) throw new Error('Server signature verification failed')
+
+	const log = createLogger({ context: 'auth' })
+	log.set({ event: 'handshake_complete', serverIdentityKey: (data.identityKey as string).slice(0, 16) })
+	log.emit()
+
+	return { serverIdentityKey: data.identityKey as string, serverNonce, clientKey: key }
+}
+
+function signHeaders(session: Session, pathname: string): Record<string, string> {
+	const { serverIdentityKey, serverNonce, clientKey: key } = session
+	const nonce = generateNonce()
+	const deriver = new KeyDeriver(key)
+	const derivedKey = deriver.derivePrivateKey(AUTH_PROTOCOL_ID, `${nonce} ${serverNonce}`, serverIdentityKey)
+	const payload = new TextEncoder().encode(pathname)
+	const msgHash = Hash.sha256(Array.from(payload))
+	const sig = derivedKey.sign(Array.from(msgHash))
+
+	return {
+		'x-bsv-auth-version': '0.1',
+		'x-bsv-auth-identity-key': key.toPublicKey().toString(),
+		'x-bsv-auth-nonce': nonce,
+		'x-bsv-auth-your-nonce': serverNonce,
+		'x-bsv-auth-signature': sig.toDER('hex') as string,
+	}
+}
+
 export async function handleMcpProxyCommand(): Promise<void> {
-	// Health check before doing anything else
+	const startLog = createLogger({ context: 'startup' })
+
 	try {
 		await fetch(MCP_URL, { signal: AbortSignal.timeout(2000) })
 	} catch {
-		log(`Server not reachable at ${MCP_URL} — is 1Sat wallet running?`)
+		startLog.set({ event: 'server_unreachable', url: MCP_URL })
+		startLog.emit()
+		process.stderr.write(`[1sat mcp-proxy] Server not reachable at ${MCP_URL} — is 1Sat wallet running?\n`)
 		process.exit(1)
 	}
 
-	const key = getClientKey()
-	const wallet = new ProtoWallet(key)
-	const authFetch = new AuthFetch(wallet)
+	startLog.set({ event: 'started', url: MCP_URL })
+	startLog.emit()
 
-	log(`Connecting to ${MCP_URL}/mcp`)
+	const key = getClientKey()
+	const session = await handshake(key)
 
 	let mcpSessionId: string | null = null
-
+	let requestCount = 0
 	const decoder = new TextDecoder()
 	const reader = Bun.stdin.stream().getReader()
 	let buffer = ''
@@ -63,12 +135,15 @@ export async function handleMcpProxyCommand(): Promise<void> {
 		while ((newlineIdx = buffer.indexOf('\n')) !== -1) {
 			const line = buffer.slice(0, newlineIdx).trim()
 			buffer = buffer.slice(newlineIdx + 1)
-
 			if (!line) continue
 
+			requestCount++
+			const reqLog = createLogger({ context: 'proxy' })
+
 			const headers: Record<string, string> = {
 				'Content-Type': 'application/json',
 				Accept: 'application/json, text/event-stream',
+				...signHeaders(session, '/mcp'),
 			}
 
 			if (mcpSessionId) {
@@ -76,17 +151,28 @@ export async function handleMcpProxyCommand(): Promise<void> {
 			}
 
 			try {
-				const res = await authFetch.fetch(`${MCP_URL}/mcp`, {
-					method: 'POST',
-					body: line,
-					headers,
-				})
+				let method: string | undefined
+				try {
+					method = JSON.parse(line).method
+				} catch {}
+
+				const res = await fetch(`${MCP_URL}/mcp`, { method: 'POST', headers, body: line })
 
 				const sessionHeader = res.headers.get('mcp-session-id')
 				if (sessionHeader) mcpSessionId = sessionHeader
 
 				const contentType = res.headers.get('content-type') ?? ''
 
+				reqLog.set({
+					event: 'request',
+					requestNum: requestCount,
+					method,
+					status: res.status,
+					contentType: contentType.split(';')[0],
+					sessionId: mcpSessionId?.slice(0, 8),
+				})
+				reqLog.emit()
+
 				if (contentType.includes('text/event-stream')) {
 					const text = await res.text()
 					for (const eventLine of text.split('\n')) {
@@ -101,14 +187,13 @@ export async function handleMcpProxyCommand(): Promise<void> {
 				}
 			} catch (err) {
 				const msg = err instanceof Error ? err.message : String(err)
-				log(`Request failed: ${msg}`)
-				process.stdout.write(
-					`${JSON.stringify({
-						jsonrpc: '2.0',
-						error: { code: -32000, message: `MCP proxy error: ${msg}` },
-						id: null,
-					})}\n`,
-				)
+				reqLog.set({ event: 'request_failed', requestNum: requestCount, error: msg })
+				reqLog.emit()
+				process.stdout.write(`${JSON.stringify({
+					jsonrpc: '2.0',
+					error: { code: -32000, message: `MCP proxy error: ${msg}` },
+					id: null,
+				})}\n`)
 			}
 		}
 	}