@ainecto/mcp 0.1.0

package/dist/bin/mcp.js

@@ -0,0 +1,586 @@
+#!/usr/bin/env node
+
+// src/core/config/endpoints.ts
+var DEFAULT_ENDPOINTS = {
+  prod: "https://ainecto.com/mcp",
+  dev: "https://dev.ainecto.com/mcp"
+};
+function resolveEndpoint(input = {}) {
+  const envVars = input.envVars ?? process.env;
+  const env = input.env ?? "prod";
+  if (input.endpoint) {
+    return { env, endpoint: normalizeEndpoint(input.endpoint), source: "flag" };
+  }
+  if (envVars.AINECTO_MCP_ENDPOINT) {
+    return { env, endpoint: normalizeEndpoint(envVars.AINECTO_MCP_ENDPOINT), source: "env" };
+  }
+  return { env, endpoint: DEFAULT_ENDPOINTS[env], source: "default" };
+}
+function normalizeEndpoint(endpoint) {
+  const url = new URL(endpoint);
+  url.hash = "";
+  return url.toString().replace(/\/$/, "");
+}
+function assertEnv(value) {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (value === "prod" || value === "dev") {
+    return value;
+  }
+  throw new Error(`Invalid --env value "${value}". Expected "prod" or "dev".`);
+}
+
+// src/core/auth/tokenStore.ts
+import { createHash } from "crypto";
+import { mkdir, readFile, rename, rm, stat, writeFile, chmod } from "fs/promises";
+import { homedir } from "os";
+import { dirname, join } from "path";
+var FileTokenStore = class {
+  filePath;
+  constructor(rootDir = join(homedir(), ".ainecto")) {
+    this.filePath = join(rootDir, "tokens.json");
+  }
+  async load(endpoint) {
+    const file = await this.readFile();
+    return file[tokenKey(endpoint)];
+  }
+  async save(endpoint, token) {
+    const file = await this.readFile();
+    file[tokenKey(endpoint)] = { ...token, endpoint, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    await this.writeFile(file);
+  }
+  async delete(endpoint) {
+    const file = await this.readFile();
+    delete file[tokenKey(endpoint)];
+    await this.writeFile(file);
+  }
+  async readFile() {
+    try {
+      const raw = await readFile(this.filePath, "utf8");
+      const parsed = JSON.parse(raw);
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error("Token file must contain an object.");
+      }
+      return parsed;
+    } catch (error) {
+      if (isNodeError(error, "ENOENT")) {
+        return {};
+      }
+      throw error;
+    }
+  }
+  async writeFile(file) {
+    await mkdir(dirname(this.filePath), { recursive: true, mode: 448 });
+    await chmod(dirname(this.filePath), 448);
+    const tmpPath = `${this.filePath}.${process.pid}.${Date.now()}.tmp`;
+    await writeFile(tmpPath, `${JSON.stringify(file, null, 2)}
+`, { mode: 384 });
+    await chmod(tmpPath, 384);
+    await rename(tmpPath, this.filePath);
+    await chmod(this.filePath, 384);
+  }
+};
+function tokenKey(endpoint) {
+  return createHash("sha256").update(endpoint).digest("hex");
+}
+function isNodeError(error, code) {
+  return error instanceof Error && "code" in error && error.code === code;
+}
+
+// src/core/auth/oauth.ts
+import { createHash as createHash2, randomBytes } from "crypto";
+import { createServer } from "http";
+import { spawn } from "child_process";
+import { URLSearchParams } from "url";
+
+// src/core/auth/clientRegistration.ts
+async function registerPublicClient(registrationEndpoint, redirectUri, fetchImpl = fetch) {
+  const response = await fetchImpl(registrationEndpoint, {
+    method: "POST",
+    headers: { "content-type": "application/json", accept: "application/json" },
+    body: JSON.stringify({
+      client_name: "Ainecto CLI",
+      redirect_uris: [redirectUri],
+      token_endpoint_auth_method: "none",
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"]
+    })
+  });
+  if (!response.ok) {
+    throw new Error(`OAuth client registration failed with HTTP ${response.status}.`);
+  }
+  const body = await response.json();
+  if (!isRecord(body) || typeof body.client_id !== "string") {
+    throw new Error("OAuth client registration response did not include client_id.");
+  }
+  return {
+    clientId: body.client_id,
+    clientSecret: typeof body.client_secret === "string" ? body.client_secret : void 0
+  };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/core/auth/oauth.ts
+var OAuthClient = class {
+  constructor(options) {
+    this.options = options;
+    this.fetchImpl = options.fetchImpl ?? fetch;
+    this.envVars = options.envVars ?? process.env;
+    this.openBrowserImpl = options.openBrowser ?? openBrowser;
+  }
+  options;
+  fetchImpl;
+  envVars;
+  openBrowserImpl;
+  async getAccessToken() {
+    const envToken = this.envVars.AINECTO_TOKEN;
+    if (envToken) {
+      return envToken;
+    }
+    const stored = await this.options.tokenStore.load(this.options.endpoint);
+    if (!stored) {
+      return void 0;
+    }
+    if (!shouldRefresh(stored)) {
+      return stored.accessToken;
+    }
+    return this.refreshStoredToken(stored);
+  }
+  async refreshAfterUnauthorized() {
+    const stored = await this.options.tokenStore.load(this.options.endpoint);
+    if (!stored?.refreshToken) {
+      return void 0;
+    }
+    return this.refreshStoredToken(stored);
+  }
+  async login() {
+    const pkce = generatePkcePair();
+    const state = generateOAuthState();
+    const loopback = await createLoopbackReceiver(state);
+    try {
+      const metadata = await discoverOAuthMetadata(this.options.endpoint, this.fetchImpl);
+      const registration = metadata.registrationEndpoint ? await registerPublicClient(metadata.registrationEndpoint, loopback.redirectUri, this.fetchImpl) : { clientId: "ainecto-cli" };
+      const authorizeUrl = new URL(metadata.authorizationEndpoint);
+      authorizeUrl.searchParams.set("response_type", "code");
+      authorizeUrl.searchParams.set("client_id", registration.clientId);
+      authorizeUrl.searchParams.set("redirect_uri", loopback.redirectUri);
+      authorizeUrl.searchParams.set("code_challenge", pkce.codeChallenge);
+      authorizeUrl.searchParams.set("code_challenge_method", "S256");
+      authorizeUrl.searchParams.set("resource", this.options.endpoint);
+      authorizeUrl.searchParams.set("state", state);
+      await this.openBrowserImpl(authorizeUrl.toString());
+      const code = await loopback.waitForCode();
+      const token = await exchangeToken(metadata.tokenEndpoint, {
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: loopback.redirectUri,
+        client_id: registration.clientId,
+        code_verifier: pkce.codeVerifier,
+        resource: this.options.endpoint,
+        ...registration.clientSecret ? { client_secret: registration.clientSecret } : {}
+      }, this.fetchImpl);
+      const stored = toStoredToken(this.options.endpoint, token, metadata, registration);
+      await this.options.tokenStore.save(this.options.endpoint, stored);
+      return stored;
+    } finally {
+      await loopback.close();
+    }
+  }
+  async logout() {
+    await this.options.tokenStore.delete(this.options.endpoint);
+  }
+  async refreshStoredToken(stored) {
+    if (!stored.refreshToken) {
+      return stored.accessToken;
+    }
+    const metadata = await discoverOAuthMetadata(this.options.endpoint, this.fetchImpl);
+    const token = await exchangeToken(metadata.tokenEndpoint, {
+      grant_type: "refresh_token",
+      refresh_token: stored.refreshToken,
+      client_id: stored.clientId ?? "ainecto-cli",
+      ...stored.clientSecret ? { client_secret: stored.clientSecret } : {},
+      resource: this.options.endpoint
+    }, this.fetchImpl);
+    const next = toStoredToken(this.options.endpoint, token, metadata, stored);
+    await this.options.tokenStore.save(this.options.endpoint, next);
+    return next.accessToken;
+  }
+};
+function generatePkcePair() {
+  const codeVerifier = randomBytes(32).toString("base64url");
+  const codeChallenge = createHash2("sha256").update(codeVerifier).digest("base64url");
+  return { codeVerifier, codeChallenge };
+}
+function generateOAuthState() {
+  return randomBytes(32).toString("base64url");
+}
+function shouldRefresh(token, now = Date.now()) {
+  if (!token.expiresAt) {
+    return false;
+  }
+  return token.expiresAt - now < 6e4;
+}
+async function discoverOAuthMetadata(endpoint, fetchImpl = fetch) {
+  const resourceMetadataUrl = await discoverResourceMetadataUrl(endpoint, fetchImpl);
+  const resourceMetadata = await fetchJson(resourceMetadataUrl, fetchImpl);
+  const authorizationServers = resourceMetadata.authorization_servers;
+  if (!Array.isArray(authorizationServers) || typeof authorizationServers[0] !== "string") {
+    throw new Error("OAuth protected resource metadata did not include authorization_servers.");
+  }
+  const authServer = authorizationServers[0];
+  const metadataUrl = authServer.includes("/.well-known/") ? authServer : `${authServer.replace(/\/$/, "")}/.well-known/oauth-authorization-server`;
+  const metadata = await fetchJson(metadataUrl, fetchImpl);
+  if (typeof metadata.authorization_endpoint !== "string" || typeof metadata.token_endpoint !== "string") {
+    throw new Error("OAuth authorization server metadata is missing authorization_endpoint or token_endpoint.");
+  }
+  const codeChallengeMethodsSupported = parseStringArray(metadata.code_challenge_methods_supported);
+  if (!codeChallengeMethodsSupported.includes("S256")) {
+    throw new Error("OAuth authorization server metadata must support PKCE S256.");
+  }
+  return {
+    authorizationEndpoint: metadata.authorization_endpoint,
+    tokenEndpoint: metadata.token_endpoint,
+    registrationEndpoint: typeof metadata.registration_endpoint === "string" ? metadata.registration_endpoint : void 0,
+    issuer: typeof metadata.issuer === "string" ? metadata.issuer : void 0,
+    codeChallengeMethodsSupported
+  };
+}
+async function discoverResourceMetadataUrl(endpoint, fetchImpl) {
+  const challengeUrl = new URL(endpoint);
+  const response = await fetchImpl(challengeUrl, { method: "GET" });
+  const challenge = response.headers.get("www-authenticate");
+  const fromChallenge = challenge ? parseBearerChallengeParam(challenge, "resource_metadata") : void 0;
+  if (fromChallenge) {
+    return fromChallenge;
+  }
+  const origin = new URL(endpoint).origin;
+  return `${origin}/.well-known/oauth-protected-resource`;
+}
+function parseBearerChallengeParam(header, name) {
+  const pattern = new RegExp(`${name}="([^"]+)"`);
+  return pattern.exec(header)?.[1];
+}
+async function exchangeToken(tokenEndpoint, params, fetchImpl) {
+  const response = await fetchImpl(tokenEndpoint, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams(params)
+  });
+  if (!response.ok) {
+    throw new Error(`OAuth token exchange failed with HTTP ${response.status}.`);
+  }
+  return response.json();
+}
+function toStoredToken(endpoint, token, metadata, previous) {
+  if (typeof token.access_token !== "string") {
+    throw new Error("OAuth token response did not include access_token.");
+  }
+  const expiresIn = typeof token.expires_in === "number" ? token.expires_in : void 0;
+  return {
+    endpoint,
+    accessToken: token.access_token,
+    refreshToken: typeof token.refresh_token === "string" ? token.refresh_token : previous?.refreshToken,
+    tokenType: typeof token.token_type === "string" ? token.token_type : previous?.tokenType,
+    expiresAt: expiresIn ? Date.now() + expiresIn * 1e3 : previous?.expiresAt,
+    scope: typeof token.scope === "string" ? token.scope : previous?.scope,
+    clientId: previous?.clientId ?? "ainecto-cli",
+    clientSecret: previous?.clientSecret,
+    authorizationServer: metadata.issuer,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+async function createLoopbackReceiver(expectedState) {
+  let resolveCode;
+  let rejectCode;
+  const codePromise = new Promise((resolve, reject) => {
+    resolveCode = resolve;
+    rejectCode = reject;
+  });
+  codePromise.catch(() => void 0);
+  const server = createServer((req, res) => {
+    const url = new URL(req.url ?? "/", "http://127.0.0.1");
+    const error = url.searchParams.get("error");
+    const code = url.searchParams.get("code");
+    const state = url.searchParams.get("state");
+    if (error) {
+      res.writeHead(400, { "content-type": "text/plain" });
+      res.end("Ainecto CLI authorization failed. You can close this tab.");
+      rejectCode(new Error(`OAuth authorization failed: ${error}`));
+      return;
+    }
+    if (!state || state !== expectedState) {
+      res.writeHead(400, { "content-type": "text/plain" });
+      res.end("Ainecto CLI authorization state mismatch. You can close this tab.");
+      rejectCode(new Error("OAuth state mismatch."));
+      return;
+    }
+    if (!code) {
+      res.writeHead(400, { "content-type": "text/plain" });
+      res.end("Missing OAuth code.");
+      rejectCode(new Error("OAuth redirect did not include a code."));
+      return;
+    }
+    res.writeHead(200, { "content-type": "text/plain" });
+    res.end("Ainecto CLI authorization complete. You can close this tab.");
+    resolveCode(code);
+  });
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const address = server.address();
+  if (!address || typeof address === "string") {
+    throw new Error("Loopback OAuth server did not bind to a TCP port.");
+  }
+  return {
+    redirectUri: `http://127.0.0.1:${address.port}/callback`,
+    waitForCode: () => codePromise,
+    close: () => new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()))
+  };
+}
+function parseStringArray(value) {
+  return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+async function fetchJson(url, fetchImpl) {
+  const response = await fetchImpl(url);
+  if (!response.ok) {
+    throw new Error(`Failed to fetch OAuth metadata from ${url}: HTTP ${response.status}.`);
+  }
+  return response.json();
+}
+async function openBrowser(url) {
+  const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  const child = spawn(command, args, { stdio: "ignore", detached: true });
+  child.unref();
+}
+
+// src/core/mcp/rpcClient.ts
+var McpRpcError = class extends Error {
+  constructor(message, code, details) {
+    super(message);
+    this.code = code;
+    this.details = details;
+  }
+  code;
+  details;
+};
+var McpRpcClient = class {
+  constructor(options) {
+    this.options = options;
+    this.fetchImpl = options.fetchImpl ?? fetch;
+  }
+  options;
+  fetchImpl;
+  nextId = 1;
+  initialize() {
+    return this.request("initialize", {
+      protocolVersion: "2024-11-05",
+      capabilities: {},
+      clientInfo: { name: "@ainecto/mcp", version: "0.1.0" }
+    });
+  }
+  async toolsList() {
+    const result = await this.request("tools/list", {});
+    if (!isRecord2(result) || !Array.isArray(result.tools)) {
+      throw new McpRpcError("tools/list response did not include a tools array.", "MCP_PROTOCOL_ERROR", result);
+    }
+    return result.tools;
+  }
+  async toolsCall(name, args) {
+    return this.request("tools/call", { name, arguments: args ?? {} });
+  }
+  async request(method, params) {
+    const response = await this.sendRaw({
+      jsonrpc: "2.0",
+      id: this.nextId++,
+      method,
+      params
+    });
+    if (!response) {
+      return void 0;
+    }
+    if ("error" in response) {
+      throw new McpRpcError(response.error.message, "MCP_ERROR", response.error);
+    }
+    return response.result;
+  }
+  async sendRaw(request) {
+    const token = await this.options.tokenProvider?.getAccessToken();
+    let response = await this.postJson(request, token);
+    if (response.status === 401 && this.options.tokenProvider) {
+      const refreshed = await this.options.tokenProvider.refreshAfterUnauthorized();
+      if (refreshed) {
+        response = await this.postJson(request, refreshed);
+      }
+    }
+    if (response.status === 204 || response.status === 202) {
+      return void 0;
+    }
+    const text = await response.text();
+    if (!response.ok) {
+      throw new McpRpcError(`MCP HTTP request failed with HTTP ${response.status}.`, "MCP_HTTP_ERROR", {
+        status: response.status,
+        body: safeBodyPreview(text)
+      });
+    }
+    if (!text.trim()) {
+      return void 0;
+    }
+    const parsed = JSON.parse(text);
+    if (!isJsonRpcResponse(parsed)) {
+      throw new McpRpcError("MCP response was not a JSON-RPC response.", "MCP_PROTOCOL_ERROR", parsed);
+    }
+    return parsed;
+  }
+  postJson(request, token) {
+    const headers = {
+      "content-type": "application/json",
+      accept: "application/json"
+    };
+    if (token) {
+      headers.authorization = `Bearer ${token}`;
+    }
+    return this.fetchImpl(this.options.endpoint, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(request)
+    });
+  }
+};
+function isJsonRpcResponse(value) {
+  return isRecord2(value) && value.jsonrpc === "2.0" && ("result" in value || "error" in value);
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function safeBodyPreview(body) {
+  return body.length > 500 ? `${body.slice(0, 500)}...` : body;
+}
+
+// src/core/mcp/stdioBridge.ts
+import { createInterface } from "readline";
+async function runStdioBridge(options) {
+  const lines = createInterface({ input: options.input, crlfDelay: Infinity });
+  for await (const line of lines) {
+    if (!line.trim()) {
+      continue;
+    }
+    try {
+      const request = parseJsonRpcRequest(line);
+      const response = await options.client.sendRaw(request);
+      if (response && request.id !== void 0) {
+        options.output.write(`${JSON.stringify(response)}
+`);
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      options.output.write(`${JSON.stringify({
+        jsonrpc: "2.0",
+        id: null,
+        error: { code: -32603, message }
+      })}
+`);
+    }
+  }
+}
+function parseJsonRpcRequest(line) {
+  const parsed = JSON.parse(line);
+  if (!isRecord3(parsed) || parsed.jsonrpc !== "2.0" || typeof parsed.method !== "string") {
+    throw new Error("Invalid JSON-RPC request.");
+  }
+  return {
+    jsonrpc: "2.0",
+    id: typeof parsed.id === "string" || typeof parsed.id === "number" || parsed.id === null ? parsed.id : void 0,
+    method: parsed.method,
+    params: parsed.params
+  };
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/adapters/mcp/connector.ts
+async function runConnector(options) {
+  const tokenStore = new FileTokenStore();
+  const auth = new OAuthClient({ endpoint: options.endpoint, tokenStore });
+  const client = new McpRpcClient({ endpoint: options.endpoint, tokenProvider: auth });
+  await runStdioBridge({
+    input: options.input,
+    output: options.output,
+    errorOutput: options.errorOutput,
+    client
+  });
+}
+
+// src/core/output/render.ts
+function renderError(error, options = {}) {
+  const shape = toErrorShape(error);
+  if (options.json) {
+    return `${JSON.stringify(shape, null, 2)}
+`;
+  }
+  return `Error: ${shape.error.message}
+`;
+}
+function toErrorShape(error) {
+  if (error instanceof Error) {
+    const maybe = error;
+    return {
+      ok: false,
+      error: {
+        code: maybe.code ?? "CLI_ERROR",
+        message: error.message,
+        details: maybe.details
+      }
+    };
+  }
+  return { ok: false, error: { code: "CLI_ERROR", message: String(error) } };
+}
+
+// src/adapters/mcp/args.ts
+function parseMcpArgs(argv) {
+  const result = { help: false };
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (!arg) {
+      continue;
+    }
+    if (arg === "--env") {
+      result.env = assertEnv(requireFlagValue(arg, argv[++index]));
+    } else if (arg === "--endpoint") {
+      result.endpoint = requireFlagValue(arg, argv[++index]);
+    } else if (arg === "--help" || arg === "-h") {
+      result.help = true;
+    } else {
+      throw new Error(`Unknown argument: ${arg}`);
+    }
+  }
+  return result;
+}
+function requireFlagValue(flag, value) {
+  if (!value || value.startsWith("--")) {
+    throw new Error(`${flag} requires a value.`);
+  }
+  return value;
+}
+
+// src/bin/mcp.ts
+try {
+  const args = parseMcpArgs(process.argv.slice(2));
+  if (args.help) {
+    process.stdout.write("Usage: mcp [--env prod|dev] [--endpoint URL]\n");
+    process.exit(0);
+  }
+  const resolved = resolveEndpoint({ env: args.env, endpoint: args.endpoint });
+  await runConnector({
+    endpoint: resolved.endpoint,
+    input: process.stdin,
+    output: process.stdout,
+    errorOutput: process.stderr
+  });
+} catch (error) {
+  process.stderr.write(renderError(error));
+  process.exitCode = 1;
+}
+//# sourceMappingURL=mcp.js.map