@ainecto/mcp 0.2.0 → 0.5.0

package/dist/bin/mcp.js

@@ -2,13 +2,20 @@
 
 // src/core/config/endpoints.ts
 var DEFAULT_ENDPOINTS = {
-  prod: "https://ai-erd.com/mcp",
+  prod: "https://ainecto.com/mcp",
   dev: "https://dev.ai-erd.com/mcp"
 };
+var LEGACY_PROD_ENDPOINT = "https://ai-erd.com/mcp";
 var LEGACY_DEFAULT_ENDPOINTS = [
-  "https://ainecto.com/mcp",
+  LEGACY_PROD_ENDPOINT,
   "https://dev.ainecto.com/mcp"
 ];
+var TOKEN_SLOT_FALLBACKS = {
+  [DEFAULT_ENDPOINTS.prod]: [LEGACY_PROD_ENDPOINT]
+};
+function fallbackTokenEndpointsFor(endpoint) {
+  return TOKEN_SLOT_FALLBACKS[normalizeEndpoint(endpoint)] ?? [];
+}
 function resolveEndpoint(input = {}) {
   const envVars = input.envVars ?? process.env;
   const env = input.env ?? "prod";
@@ -65,6 +72,37 @@ import { createHash } from "crypto";
 import { mkdir, readFile, rename, rm, stat, writeFile, chmod } from "fs/promises";
 import { homedir } from "os";
 import { dirname, join } from "path";
+
+// src/core/harness/role.ts
+var HARNESS_ROLES = ["design", "development", "test", "validation"];
+var ROLE_SCOPE_PREFIX = "ai-erd:role:";
+var ROLE_HEADER = "X-AI-ERD-Role";
+var ROLE_ENV_VAR = "AINECTO_ROLE";
+var LEGACY_ROLE_ENV_VAR = "AI_ERD_ROLE";
+function resolveRole(input = {}) {
+  if (input.role !== void 0) {
+    return { role: assertRole(input.role), source: "flag" };
+  }
+  const envVars = input.envVars ?? process.env;
+  for (const envVar of [ROLE_ENV_VAR, LEGACY_ROLE_ENV_VAR]) {
+    const fromEnv = envVars[envVar];
+    if (fromEnv && fromEnv.trim()) {
+      return { role: assertRole(fromEnv), source: "env", envVar };
+    }
+  }
+  return { source: "none" };
+}
+function assertRole(value) {
+  const normalized = value.trim().toLowerCase();
+  if (HARNESS_ROLES.includes(normalized)) {
+    return normalized;
+  }
+  throw new Error(
+    `Invalid role "${value}". Expected one of: ${HARNESS_ROLES.join(", ")}.`
+  );
+}
+
+// src/core/auth/tokenStore.ts
 var FileTokenStore = class {
   filePath;
   constructor(rootDir = join(homedir(), ".ainecto")) {
@@ -75,6 +113,7 @@ var FileTokenStore = class {
     return file[tokenKey(endpoint)];
   }
   async save(endpoint, token) {
+    assertNoRoleScope(token);
     const file = await this.readFile();
     file[tokenKey(endpoint)] = { ...token, endpoint, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
     await this.writeFile(file);
@@ -119,6 +158,13 @@ var FileTokenStore = class {
 function tokenKey(endpoint) {
   return createHash("sha256").update(endpoint).digest("hex");
 }
+function assertNoRoleScope(token) {
+  if (token.scope?.split(/\s+/).some((scope) => scope.startsWith(ROLE_SCOPE_PREFIX))) {
+    throw new Error(
+      "Refusing to store a role-scoped access token: sign-in is one per machine and the role comes from the repository. Run `ainecto auth login` again."
+    );
+  }
+}
 function isNodeError(error, code) {
   return error instanceof Error && "code" in error && error.code === code;
 }
@@ -150,7 +196,7 @@ async function registerPublicClient(registrationEndpoint, redirectUri, fetchImpl
     method: "POST",
     headers: { "content-type": "application/json", accept: "application/json" },
     body: JSON.stringify({
-      client_name: "Ainecto CLI",
+      client_name: "AiNecto CLI",
       redirect_uris: [redirectUri],
       token_endpoint_auth_method: "none",
       grant_types: ["authorization_code", "refresh_token"],
@@ -174,6 +220,15 @@ function isRecord(value) {
 }
 
 // src/core/auth/oauth.ts
+var DEFAULT_LOGIN_TIMEOUT_MS = 3e5;
+var OAuthLoginError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "OAuthLoginError";
+  }
+  code;
+};
 var OAuthClient = class {
   constructor(options) {
     this.options = options;
@@ -191,21 +246,27 @@ var OAuthClient = class {
       assertEnvTokenEndpointAllowed(this.options.endpoint, this.envVars);
       return envToken;
     }
-    const stored = await this.options.tokenStore.load(this.options.endpoint);
+    const stored = await this.loadStored();
     if (!stored) {
       return void 0;
     }
     if (!shouldRefresh(stored)) {
       return stored.accessToken;
     }
-    return this.refreshStoredToken(stored);
+    if (this.options.readOnly) {
+      return isExpired(stored) ? void 0 : stored.accessToken;
+    }
+    if (!stored.refreshToken) {
+      return isExpired(stored) ? void 0 : stored.accessToken;
+    }
+    return this.refreshStoredToken({ ...stored, refreshToken: stored.refreshToken });
   }
   async refreshAfterUnauthorized() {
-    const stored = await this.options.tokenStore.load(this.options.endpoint);
-    if (!stored?.refreshToken) {
+    const stored = await this.loadStored();
+    if (this.options.readOnly || !stored?.refreshToken) {
       return void 0;
     }
-    return this.refreshStoredToken(stored);
+    return this.refreshStoredToken({ ...stored, refreshToken: stored.refreshToken });
   }
   async login() {
     const pkce = generatePkcePair();
@@ -223,8 +284,13 @@ var OAuthClient = class {
       authorizeUrl.searchParams.set("resource", this.options.endpoint);
       authorizeUrl.searchParams.set("state", state);
       assertTrustedEndpointUrl(authorizeUrl, "OAuth authorization URL");
-      await this.openBrowserImpl(authorizeUrl.toString());
-      const code = await loopback.waitForCode();
+      const url = authorizeUrl.toString();
+      this.options.onAuthorizeUrl?.(url);
+      const browserFailure = this.openBrowserImpl(url).then(() => new Promise(() => void 0));
+      const code = await withTimeout(
+        Promise.race([loopback.waitForCode(), browserFailure]),
+        this.options.loginTimeoutMs ?? DEFAULT_LOGIN_TIMEOUT_MS
+      );
       const token = await exchangeToken(metadata.tokenEndpoint, {
         grant_type: "authorization_code",
         code,
@@ -241,13 +307,32 @@ var OAuthClient = class {
       await loopback.close();
     }
   }
+  /**
+   * ★대체로 읽는 옛 칸도 함께 지운다. 새 칸만 지우면 다음 읽기가 곧바로 옛 칸으로 대체돼
+   * «로그아웃했는데 여전히 로그인됨»이 된다. 로그인은 기계당 한 번이므로 옛 CLI 의 칸도 같이 끝난다.
+   */
   async logout() {
     await this.options.tokenStore.delete(this.options.endpoint);
+    for (const fallback of fallbackTokenEndpointsFor(this.options.endpoint)) {
+      await this.options.tokenStore.delete(fallback);
+    }
   }
-  async refreshStoredToken(stored) {
-    if (!stored.refreshToken) {
-      return stored.accessToken;
+  /** 이 주소의 칸, 비었으면 옛 기본 주소의 칸({@link fallbackTokenEndpointsFor}). 쓰기는 늘 이 주소의 칸이다. */
+  async loadStored() {
+    const own = await this.options.tokenStore.load(this.options.endpoint);
+    if (own) {
+      return own;
+    }
+    for (const fallback of fallbackTokenEndpointsFor(this.options.endpoint)) {
+      const stored = await this.options.tokenStore.load(fallback);
+      if (stored) {
+        return stored;
+      }
     }
+    return void 0;
+  }
+  /** 부르는 쪽이 refresh token 이 있음을 이미 확인했다 — 타입이 그것을 요구한다. */
+  async refreshStoredToken(stored) {
     const metadata = await discoverOAuthMetadata(this.options.endpoint, this.fetchImpl);
     const token = await exchangeToken(metadata.tokenEndpoint, {
       grant_type: "refresh_token",
@@ -269,6 +354,27 @@ function generatePkcePair() {
 function generateOAuthState() {
   return randomBytes(32).toString("base64url");
 }
+function isExpired(token, now = Date.now()) {
+  return token.expiresAt !== void 0 && token.expiresAt <= now;
+}
+async function withTimeout(work, timeoutMs) {
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      const minutes = timeoutMs / 6e4;
+      const span = Number.isInteger(minutes) ? `${minutes} minute${minutes === 1 ? "" : "s"}` : `${timeoutMs} ms`;
+      reject(new OAuthLoginError(
+        "LOGIN_TIMEOUT",
+        `Sign-in was not completed within ${span}. Nothing was saved \u2014 run the same command again.`
+      ));
+    }, timeoutMs);
+  });
+  try {
+    return await Promise.race([work, timeout]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
 function shouldRefresh(token, now = Date.now()) {
   if (!token.expiresAt) {
     return false;
@@ -361,7 +467,7 @@ function toStoredToken(endpoint, token, metadata, previous) {
     updatedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
 }
-async function createLoopbackReceiver(expectedState) {
+async function createLoopbackReceiver(expectedState, host = "127.0.0.1") {
   let resolveCode;
   let rejectCode;
   const codePromise = new Promise((resolve, reject) => {
@@ -376,13 +482,13 @@ async function createLoopbackReceiver(expectedState) {
     const state = url.searchParams.get("state");
     if (error) {
       res.writeHead(400, { "content-type": "text/plain" });
-      res.end("Ainecto CLI authorization failed. You can close this tab.");
+      res.end("AiNecto CLI authorization failed. You can close this tab.");
       rejectCode(new Error(`OAuth authorization failed: ${error}`));
       return;
     }
     if (!state || state !== expectedState) {
       res.writeHead(400, { "content-type": "text/plain" });
-      res.end("Ainecto CLI authorization state mismatch. You can close this tab.");
+      res.end("AiNecto CLI authorization state mismatch. You can close this tab.");
       rejectCode(new Error("OAuth state mismatch."));
       return;
     }
@@ -393,10 +499,16 @@ async function createLoopbackReceiver(expectedState) {
       return;
     }
     res.writeHead(200, { "content-type": "text/plain" });
-    res.end("Ainecto CLI authorization complete. You can close this tab.");
+    res.end("AiNecto CLI authorization complete. You can close this tab.");
     resolveCode(code);
   });
-  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  await new Promise((resolve, reject) => {
+    server.once("error", (error) => reject(new OAuthLoginError(
+      "CALLBACK_UNAVAILABLE",
+      `Could not start the local sign-in callback on ${host} (${error.message}). If this command runs in a sandbox, allow local network binding or run it outside the sandbox.`
+    )));
+    server.listen(0, host, () => resolve());
+  });
   const address = server.address();
   if (!address || typeof address === "string") {
     throw new Error("Loopback OAuth server did not bind to a TCP port.");
@@ -404,7 +516,10 @@ async function createLoopbackReceiver(expectedState) {
   return {
     redirectUri: `http://127.0.0.1:${address.port}/callback`,
     waitForCode: () => codePromise,
-    close: () => new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()))
+    close: () => new Promise((resolve, reject) => {
+      server.closeAllConnections?.();
+      server.close((error) => error ? reject(error) : resolve());
+    })
   };
 }
 function parseStringArray(value) {
@@ -428,10 +543,39 @@ function getBrowserOpenCommand(url, platform = process.platform) {
   }
   return { command: "xdg-open", args: [url] };
 }
-async function openBrowser(url) {
-  const { command, args } = getBrowserOpenCommand(url);
-  const child = spawn(command, args, { stdio: "ignore", detached: true });
-  child.unref();
+function launchBrowser(url, deps = {}) {
+  const platform = deps.platform ?? process.platform;
+  const { command, args } = getBrowserOpenCommand(url, platform);
+  const spawnImpl = deps.spawnImpl ?? spawn;
+  return new Promise((resolve, reject) => {
+    const unavailable = (reason) => new OAuthLoginError(
+      "BROWSER_UNAVAILABLE",
+      `Could not open a browser on this machine (${command}: ${reason}). Sign-in needs a browser here.`
+    );
+    let child;
+    try {
+      child = spawnImpl(command, args, { stdio: "ignore", detached: true });
+    } catch (error) {
+      reject(unavailable(error instanceof Error ? error.message : String(error)));
+      return;
+    }
+    child.once("error", (error) => reject(unavailable(error.message)));
+    if (platform === "win32") {
+      child.once("spawn", () => resolve());
+    } else {
+      child.once("exit", (code, signal) => {
+        if (code === 0) {
+          resolve();
+        } else {
+          reject(unavailable(code === null ? `stopped by ${signal ?? "a signal"}` : `exited with code ${code}`));
+        }
+      });
+    }
+    child.unref();
+  });
+}
+function openBrowser(url) {
+  return launchBrowser(url);
 }
 function assertEnvTokenEndpointAllowed(endpoint, envVars) {
   if (envVars.AINECTO_ALLOW_CUSTOM_ENDPOINT_TOKEN === "1") {
@@ -443,6 +587,11 @@ function assertEnvTokenEndpointAllowed(endpoint, envVars) {
   throw new Error("AINECTO_TOKEN can only be used with the default prod/dev endpoints. Set AINECTO_ALLOW_CUSTOM_ENDPOINT_TOKEN=1 only when you intentionally trust the custom endpoint.");
 }
 
+// src/core/version.ts
+var CLI_VERSION = true ? "0.5.0" : "dev";
+var PACKAGE_NAME = "@ainecto/mcp";
+var CLI_USER_AGENT = `${PACKAGE_NAME} ${CLI_VERSION}`;
+
 // src/core/mcp/rpcClient.ts
 var McpRpcError = class extends Error {
   constructor(message, code, details) {
@@ -465,7 +614,7 @@ var McpRpcClient = class {
     return this.request("initialize", {
       protocolVersion: "2024-11-05",
       capabilities: {},
-      clientInfo: { name: "@ainecto/mcp", version: "0.1.0" }
+      clientInfo: { name: PACKAGE_NAME, version: CLI_VERSION }
     });
   }
   async toolsList() {
@@ -530,6 +679,9 @@ var McpRpcClient = class {
     if (token) {
       headers.authorization = `Bearer ${token}`;
     }
+    if (this.options.role) {
+      headers[ROLE_HEADER.toLowerCase()] = this.options.role;
+    }
     return this.fetchImpl(this.options.endpoint, {
       method: "POST",
       headers,
@@ -598,9 +750,12 @@ function isRecord3(value) {
 
 // src/adapters/mcp/connector.ts
 async function runConnector(options) {
-  const tokenStore = new FileTokenStore();
-  const auth = new OAuthClient({ endpoint: options.endpoint, tokenStore });
-  const client = new McpRpcClient({ endpoint: options.endpoint, tokenProvider: auth });
+  const auth = new OAuthClient({ endpoint: options.endpoint, tokenStore: new FileTokenStore() });
+  const client = new McpRpcClient({
+    endpoint: options.endpoint,
+    tokenProvider: auth,
+    role: options.role
+  });
   await runStdioBridge({
     input: options.input,
     output: options.output,
@@ -676,6 +831,8 @@ function parseMcpArgs(argv) {
       result.env = assertEnv(requireFlagValue(arg, argv[++index]));
     } else if (arg === "--endpoint") {
       result.endpoint = requireFlagValue(arg, argv[++index]);
+    } else if (arg === "--role") {
+      result.role = assertRole(requireFlagValue(arg, argv[++index]));
     } else if (arg === "--help" || arg === "-h") {
       result.help = true;
     } else {
@@ -695,12 +852,17 @@ function requireFlagValue(flag, value) {
 try {
   const args = parseMcpArgs(process.argv.slice(2));
   if (args.help) {
-    process.stdout.write("Usage: mcp [--env prod|dev] [--endpoint URL]\n");
+    process.stdout.write(
+      `Usage: mcp [--env prod|dev] [--endpoint URL] [--role ${HARNESS_ROLES.join("|")}]
+`
+    );
     process.exit(0);
   }
   const resolved = resolveEndpoint({ env: args.env, endpoint: args.endpoint });
+  const resolvedRole = resolveRole({ role: args.role });
   await runConnector({
     endpoint: resolved.endpoint,
+    role: resolvedRole.role ?? null,
     input: process.stdin,
     output: process.stdout,
     errorOutput: process.stderr