@ahmednawaz/crank 0.1.2

package/lib/team-auth.js

@@ -0,0 +1,82 @@
+'use strict';
+
+const TEAM_TOKEN = String(process.env.CRANK_TEAM_TOKEN || '').trim();
+
+function teamAuthRequired() {
+  return TEAM_TOKEN.length > 0;
+}
+
+function extractTeamToken(req) {
+  if (!req) return '';
+  const header =
+    req.get?.('x-crank-team-token') ||
+    req.headers?.['x-crank-team-token'] ||
+    req.headers?.['X-Crank-Team-Token'];
+  if (header) return String(header).trim();
+
+  const auth = req.get?.('authorization') || req.headers?.authorization || '';
+  const bearer = auth.replace(/^Bearer\s+/i, '').trim();
+  if (bearer) return bearer;
+
+  if (req.body && typeof req.body.teamToken === 'string') {
+    return req.body.teamToken.trim();
+  }
+  if (req.query && req.query.teamToken) {
+    return String(req.query.teamToken).trim();
+  }
+
+  try {
+    const raw = req.url || '';
+    const q = raw.indexOf('?');
+    if (q >= 0) {
+      const params = new URLSearchParams(raw.slice(q + 1));
+      return (
+        params.get('teamToken') ||
+        params.get('token') ||
+        ''
+      ).trim();
+    }
+  } catch {
+    // ignore
+  }
+  return '';
+}
+
+function isTeamTokenValid(token) {
+  if (!teamAuthRequired()) return true;
+  return String(token || '').trim() === TEAM_TOKEN;
+}
+
+function teamAuthMiddleware(req, res, next) {
+  if (!teamAuthRequired()) {
+    next();
+    return;
+  }
+  if (isTeamTokenValid(extractTeamToken(req))) {
+    next();
+    return;
+  }
+  res.status(401).json({
+    ok: false,
+    code: 'TEAM_TOKEN_REQUIRED',
+    error:
+      'Crank team token required. Ask your team for the passphrase, then pass header X-Crank-Team-Token or set CRANK_TEAM_TOKEN for the agent.'
+  });
+}
+
+function getAuthStatus() {
+  return {
+    teamAuthRequired: teamAuthRequired(),
+    hint: teamAuthRequired()
+      ? 'Ask your team lead for the Crank team token. Agents: pass teamToken on MCP tools or set CRANK_TEAM_TOKEN in the environment.'
+      : null
+  };
+}
+
+module.exports = {
+  teamAuthRequired,
+  extractTeamToken,
+  isTeamTokenValid,
+  teamAuthMiddleware,
+  getAuthStatus
+};

package/lib/urls.js

@@ -0,0 +1,164 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { readJson } = require('./detect');
+const { env } = require('./env');
+
+function companionPort() {
+  return Number(env('PORT', '3344')) || 3344;
+}
+
+function mcpHttpPort() {
+  return Number(env('MCP_HTTP_PORT', '3345')) || 3345;
+}
+
+/**
+ * Public HTTPS host for Replit exposed ports.
+ * Pattern: https://{port}-{replSlug}.{owner}.repl.co
+ */
+function replitPortHost(port) {
+  const explicit = env('PUBLIC_URL', '');
+  if (explicit) {
+    try {
+      const u = new URL(explicit);
+      return `${u.protocol}//${port}-${u.host}`;
+    } catch {
+      // fall through
+    }
+  }
+
+  const devDomain = process.env.REPLIT_DEV_DOMAIN || '';
+  if (devDomain) {
+    const host = devDomain.replace(/^https?:\/\//, '').replace(/\/$/, '');
+    if (/^\d+-/.test(host)) {
+      return `https://${port}-${host.replace(/^\d+-/, '')}`;
+    }
+    return `https://${port}-${host}`;
+  }
+
+  const slug = process.env.REPL_SLUG;
+  const owner = process.env.REPL_OWNER;
+  if (slug && owner) {
+    return `https://${port}-${slug}.${owner}.repl.co`;
+  }
+
+  return null;
+}
+
+/**
+ * Resolve listen + public URLs for companion and HTTP MCP.
+ */
+function resolveUrls(detectEnv = {}) {
+  const port = companionPort();
+  const mcpPort = mcpHttpPort();
+  const isReplit = Boolean(detectEnv.isReplit);
+  const publicOverride = env('PUBLIC_URL', '');
+
+  let listenHost = env('HOST', isReplit ? '0.0.0.0' : '127.0.0.1');
+  if (listenHost === 'localhost') {
+    listenHost = '127.0.0.1';
+  }
+
+  let companionPublic;
+  let mcpPublic;
+
+  if (publicOverride) {
+    companionPublic = publicOverride.replace(/\/$/, '');
+    if (isReplit) {
+      mcpPublic = replitPortHost(mcpPort) || `http://127.0.0.1:${mcpPort}`;
+    } else {
+      mcpPublic = `http://127.0.0.1:${mcpPort}`;
+    }
+  } else if (isReplit) {
+    companionPublic = replitPortHost(port) || `http://127.0.0.1:${port}`;
+    mcpPublic = replitPortHost(mcpPort) || `http://127.0.0.1:${mcpPort}`;
+  } else {
+    companionPublic = `http://127.0.0.1:${port}`;
+    mcpPublic = `http://127.0.0.1:${mcpPort}`;
+  }
+
+  const companionLocal = `http://127.0.0.1:${port}`;
+  const mcpLocal = `http://127.0.0.1:${mcpPort}`;
+
+  return {
+    isReplit,
+    listenHost,
+    companionPort: port,
+    mcpHttpPort: mcpPort,
+    companionPublic,
+    companionLocal,
+    companionWs: companionPublic.replace(/^http/i, 'ws'),
+    mcpPublic,
+    mcpLocal,
+    mcpEndpoint: `${mcpPublic}/mcp`
+  };
+}
+
+function readRuntimeManifest(projectRoot) {
+  const file = path.join(projectRoot, '.crank', 'runtime.json');
+  if (!fs.existsSync(file)) {
+    return null;
+  }
+  return readJson(file, null);
+}
+
+function writeRuntimeManifest(projectRoot, detectEnv) {
+  const urls = resolveUrls(detectEnv);
+  const dir = path.join(projectRoot, '.crank');
+  fs.mkdirSync(dir, { recursive: true });
+  const manifest = {
+    version: 1,
+    updatedAt: new Date().toISOString(),
+    projectRoot: path.resolve(projectRoot),
+    environment: {
+      isReplit: urls.isReplit,
+      hasVite: Boolean(detectEnv.hasVite)
+    },
+    companion: {
+      listenHost: urls.listenHost,
+      port: urls.companionPort,
+      publicUrl: urls.companionPublic,
+      localUrl: urls.companionLocal,
+      wsUrl: urls.companionWs,
+      devLoader: `${urls.companionPublic}/dev-loader.js`,
+      bookmarklet: `${urls.companionPublic}/bookmarklet.js`
+    },
+    mcp: {
+      mode:
+        urls.isReplit || String(process.env.CRANK_MCP_MODE || '').toLowerCase() === 'http'
+          ? 'http'
+          : 'stdio',
+      httpPort: urls.mcpHttpPort,
+      publicUrl: urls.mcpPublic,
+      localUrl: urls.mcpLocal,
+      endpoint: urls.mcpEndpoint
+    }
+  };
+  const file = path.join(dir, 'runtime.json');
+  fs.writeFileSync(file, `${JSON.stringify(manifest, null, 2)}\n`);
+  return manifest;
+}
+
+function applyUrlEnv(urls) {
+  process.env.CRANK_HOST = urls.listenHost;
+  process.env.CRANK_PORT = String(urls.companionPort);
+  process.env.HOST = urls.listenHost;
+  process.env.PORT = String(urls.companionPort);
+  process.env.CRANK_COMPANION_URL = urls.companionLocal;
+  process.env.CRANK_PUBLIC_URL = urls.companionPublic;
+  process.env.CRANK_MCP_HTTP_PORT = String(urls.mcpHttpPort);
+  if (urls.isReplit) {
+    process.env.CRANK_MCP_MODE = 'http';
+  }
+}
+
+module.exports = {
+  companionPort,
+  mcpHttpPort,
+  resolveUrls,
+  readRuntimeManifest,
+  writeRuntimeManifest,
+  applyUrlEnv,
+  replitPortHost
+};

package/mcp-server/index.js

@@ -0,0 +1,174 @@
+#!/usr/bin/env node
+/**
+ * Crank MCP server
+ *
+ * Modes:
+ *   CRANK_MCP_MODE=stdio (default) — Cursor / Claude Desktop local MCP
+ *   CRANK_MCP_MODE=http  — remote MCP for Replit Agent (HTTPS endpoint required in prod)
+ *
+ * Sources:
+ *   Replit custom MCP: https://docs.replit.com/build/connect-via-mcp
+ *   Replit MCP list / auth headers: https://docs.replit.com/references/mcp/overview
+ */
+
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import {
+  CallToolRequestSchema,
+  ListToolsRequestSchema
+} from '@modelcontextprotocol/sdk/types.js';
+import express from 'express';
+import { toolDefinitions, callTool } from './tools.js';
+
+const MODE = (process.env.CRANK_MCP_MODE || 'stdio').toLowerCase();
+const HTTP_PORT = Number(process.env.CRANK_MCP_HTTP_PORT || 3345);
+const API_KEY = process.env.CRANK_MCP_API_KEY || '';
+
+function createMcpServer() {
+  const server = new Server(
+    { name: 'crank', version: '0.1.2' },
+    { capabilities: { tools: {} } }
+  );
+
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({
+    tools: toolDefinitions
+  }));
+
+  server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    const name = request.params.name;
+    const args = request.params.arguments || {};
+    try {
+      return await callTool(name, args);
+    } catch (err) {
+      return {
+        isError: true,
+        content: [{ type: 'text', text: String(err.message || err) }]
+      };
+    }
+  });
+
+  return server;
+}
+
+async function startStdio() {
+  const server = createMcpServer();
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+  console.error('[Crank MCP] stdio transport ready');
+}
+
+/**
+ * Minimal Streamable HTTP / JSON-RPC style endpoint for remote agents.
+ * Replit expects an HTTPS MCP endpoint — tunnel or deploy this service.
+ * Auth: optional X-API-Key / Authorization bearer via CRANK_MCP_API_KEY.
+ */
+async function startHttp() {
+  const app = express();
+  app.use(express.json({ limit: '2mb' }));
+
+  function authorize(req, res, next) {
+    if (!API_KEY) {
+      next();
+      return;
+    }
+    const headerKey =
+      req.get('x-api-key') ||
+      (req.get('authorization') || '').replace(/^Bearer\s+/i, '');
+    if (headerKey !== API_KEY) {
+      res.status(401).json({ error: 'Unauthorized' });
+      return;
+    }
+    next();
+  }
+
+  app.get('/health', (_req, res) => {
+    res.json({ ok: true, service: 'crank-mcp', mode: 'http' });
+  });
+
+  // Simple JSON tool surface (also useful for demos / curl).
+  // Full MCP streamable HTTP can replace this once the Motives hosting shape is fixed.
+  app.get('/mcp/tools', authorize, (_req, res) => {
+    res.json({ tools: toolDefinitions });
+  });
+
+  app.post('/mcp/call', authorize, async (req, res) => {
+    try {
+      const name = req.body?.name;
+      const args = req.body?.arguments || {};
+      const result = await callTool(name, args);
+      res.json({ ok: true, result });
+    } catch (err) {
+      res.status(400).json({ ok: false, error: err.message });
+    }
+  });
+
+  // MCP-ish initialize / tools/list / tools/call over JSON-RPC for remote agents
+  app.post('/mcp', authorize, async (req, res) => {
+    const body = req.body || {};
+    const method = body.method;
+    const id = body.id ?? null;
+
+    try {
+      if (method === 'initialize') {
+        res.json({
+          jsonrpc: '2.0',
+          id,
+          result: {
+            protocolVersion: '2024-11-05',
+            capabilities: { tools: {} },
+            serverInfo: { name: 'crank', version: '0.1.0' }
+          }
+        });
+        return;
+      }
+      if (method === 'tools/list') {
+        res.json({
+          jsonrpc: '2.0',
+          id,
+          result: { tools: toolDefinitions }
+        });
+        return;
+      }
+      if (method === 'tools/call') {
+        const name = body.params?.name;
+        const args = body.params?.arguments || {};
+        const result = await callTool(name, args);
+        res.json({ jsonrpc: '2.0', id, result });
+        return;
+      }
+      if (method === 'notifications/initialized' || method === 'ping') {
+        res.json({ jsonrpc: '2.0', id, result: {} });
+        return;
+      }
+      res.json({
+        jsonrpc: '2.0',
+        id,
+        error: { code: -32601, message: `Method not found: ${method}` }
+      });
+    } catch (err) {
+      res.json({
+        jsonrpc: '2.0',
+        id,
+        error: { code: -32000, message: String(err.message || err) }
+      });
+    }
+  });
+
+  // Also wire stdio SDK server for local debugging in parallel? No — HTTP only here.
+  const listenHost =
+    process.env.CRANK_HOST === '0.0.0.0' || process.env.REPL_ID ? '0.0.0.0' : '127.0.0.1';
+  app.listen(HTTP_PORT, listenHost, () => {
+    console.error(
+      `[Crank MCP] HTTP listening on http://${listenHost}:${HTTP_PORT}/mcp`
+    );
+    console.error(
+      '[Crank MCP] For Replit: expose this URL over HTTPS and add as custom MCP server'
+    );
+  });
+}
+
+if (MODE === 'http') {
+  await startHttp();
+} else {
+  await startStdio();
+}

package/mcp-server/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "@crank/mcp-server",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "main": "index.js",
+  "scripts": {
+    "start": "node index.js",
+    "start:http": "CRANK_MCP_MODE=http node index.js"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.12.1",
+    "express": "^4.21.2",
+    "zod": "^3.24.2"
+  }
+}