@ainecto/mcp 0.3.0 → 0.6.0

package/dist/bin/mcp.js

@@ -2,13 +2,9 @@
 
 // src/core/config/endpoints.ts
 var DEFAULT_ENDPOINTS = {
-  prod: "https://ai-erd.com/mcp",
-  dev: "https://dev.ai-erd.com/mcp"
+  prod: "https://ainecto.com/mcp",
+  dev: "https://dev.ainecto.com/mcp"
 };
-var LEGACY_DEFAULT_ENDPOINTS = [
-  "https://ainecto.com/mcp",
-  "https://dev.ainecto.com/mcp"
-];
 function resolveEndpoint(input = {}) {
   const envVars = input.envVars ?? process.env;
   const env = input.env ?? "prod";
@@ -28,7 +24,7 @@ function normalizeEndpoint(endpoint) {
 }
 function isDefaultEndpoint(endpoint) {
   const normalized = normalizeEndpoint(endpoint);
-  return Object.values(DEFAULT_ENDPOINTS).includes(normalized) || LEGACY_DEFAULT_ENDPOINTS.includes(normalized);
+  return Object.values(DEFAULT_ENDPOINTS).includes(normalized);
 }
 function assertTrustedEndpointUrl(value, label = "URL") {
   const url = typeof value === "string" ? new URL(value) : value;
@@ -65,23 +61,52 @@ import { createHash } from "crypto";
 import { mkdir, readFile, rename, rm, stat, writeFile, chmod } from "fs/promises";
 import { homedir } from "os";
 import { dirname, join } from "path";
+
+// src/core/harness/role.ts
+var HARNESS_ROLES = ["design", "development", "test", "validation"];
+var ROLE_SCOPE_PREFIX = "ainecto:role:";
+var ROLE_HEADER = "X-AiNecto-Role";
+var ROLE_ENV_VAR = "AINECTO_ROLE";
+function resolveRole(input = {}) {
+  if (input.role !== void 0) {
+    return { role: assertRole(input.role), source: "flag" };
+  }
+  const envVars = input.envVars ?? process.env;
+  const fromEnv = envVars[ROLE_ENV_VAR];
+  if (fromEnv && fromEnv.trim()) {
+    return { role: assertRole(fromEnv), source: "env" };
+  }
+  return { source: "none" };
+}
+function assertRole(value) {
+  const normalized = value.trim().toLowerCase();
+  if (HARNESS_ROLES.includes(normalized)) {
+    return normalized;
+  }
+  throw new Error(
+    `Invalid role "${value}". Expected one of: ${HARNESS_ROLES.join(", ")}.`
+  );
+}
+
+// src/core/auth/tokenStore.ts
 var FileTokenStore = class {
   filePath;
   constructor(rootDir = join(homedir(), ".ainecto")) {
     this.filePath = join(rootDir, "tokens.json");
   }
-  async load(endpoint, role) {
+  async load(endpoint) {
     const file = await this.readFile();
-    return file[tokenKey(endpoint, role)];
+    return file[tokenKey(endpoint)];
   }
-  async save(endpoint, token, role) {
+  async save(endpoint, token) {
+    assertNoRoleScope(token);
     const file = await this.readFile();
-    file[tokenKey(endpoint, role)] = { ...token, endpoint, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    file[tokenKey(endpoint)] = { ...token, endpoint, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
     await this.writeFile(file);
   }
-  async delete(endpoint, role) {
+  async delete(endpoint) {
     const file = await this.readFile();
-    delete file[tokenKey(endpoint, role)];
+    delete file[tokenKey(endpoint)];
     await this.writeFile(file);
   }
   async readFile() {
@@ -116,9 +141,15 @@ var FileTokenStore = class {
     await chmodIfPermissive(this.filePath, 384);
   }
 };
-function tokenKey(endpoint, role) {
-  const material = role && role.trim() ? `${endpoint}#role=${role.trim().toLowerCase()}` : endpoint;
-  return createHash("sha256").update(material).digest("hex");
+function tokenKey(endpoint) {
+  return createHash("sha256").update(endpoint).digest("hex");
+}
+function assertNoRoleScope(token) {
+  if (token.scope?.split(/\s+/).some((scope) => scope.startsWith(ROLE_SCOPE_PREFIX))) {
+    throw new Error(
+      "Refusing to store a role-scoped access token: sign-in is one per machine and the role comes from the repository. Run `ainecto auth login` again."
+    );
+  }
 }
 function isNodeError(error, code) {
   return error instanceof Error && "code" in error && error.code === code;
@@ -151,7 +182,7 @@ async function registerPublicClient(registrationEndpoint, redirectUri, fetchImpl
     method: "POST",
     headers: { "content-type": "application/json", accept: "application/json" },
     body: JSON.stringify({
-      client_name: "Ainecto CLI",
+      client_name: "AiNecto CLI",
       redirect_uris: [redirectUri],
       token_endpoint_auth_method: "none",
       grant_types: ["authorization_code", "refresh_token"],
@@ -174,32 +205,16 @@ function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
-// src/core/harness/role.ts
-var HARNESS_ROLES = ["design", "development", "test", "validation"];
-var ROLE_SCOPE_PREFIX = "ai-erd:role:";
-var ROLE_HEADER = "X-AI-ERD-Role";
-var ROLE_ENV_VAR = "AI_ERD_ROLE";
-function resolveRole(input = {}) {
-  if (input.role !== void 0) {
-    return { role: assertRole(input.role), source: "flag" };
-  }
-  const fromEnv = (input.envVars ?? process.env)[ROLE_ENV_VAR];
-  if (fromEnv && fromEnv.trim()) {
-    return { role: assertRole(fromEnv), source: "env" };
-  }
-  return { source: "none" };
-}
-function assertRole(value) {
-  const normalized = value.trim().toLowerCase();
-  if (HARNESS_ROLES.includes(normalized)) {
-    return normalized;
-  }
-  throw new Error(
-    `Invalid role "${value}". Expected one of: ${HARNESS_ROLES.join(", ")}.`
-  );
-}
-
 // src/core/auth/oauth.ts
+var DEFAULT_LOGIN_TIMEOUT_MS = 3e5;
+var OAuthLoginError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "OAuthLoginError";
+  }
+  code;
+};
 var OAuthClient = class {
   constructor(options) {
     this.options = options;
@@ -217,21 +232,27 @@ var OAuthClient = class {
       assertEnvTokenEndpointAllowed(this.options.endpoint, this.envVars);
       return envToken;
     }
-    const stored = await this.options.tokenStore.load(this.options.endpoint, this.options.role);
+    const stored = await this.options.tokenStore.load(this.options.endpoint);
     if (!stored) {
       return void 0;
     }
     if (!shouldRefresh(stored)) {
       return stored.accessToken;
     }
-    return this.refreshStoredToken(stored);
+    if (this.options.readOnly) {
+      return isExpired(stored) ? void 0 : stored.accessToken;
+    }
+    if (!stored.refreshToken) {
+      return isExpired(stored) ? void 0 : stored.accessToken;
+    }
+    return this.refreshStoredToken({ ...stored, refreshToken: stored.refreshToken });
   }
   async refreshAfterUnauthorized() {
-    const stored = await this.options.tokenStore.load(this.options.endpoint, this.options.role);
-    if (!stored?.refreshToken) {
+    const stored = await this.options.tokenStore.load(this.options.endpoint);
+    if (this.options.readOnly || !stored?.refreshToken) {
       return void 0;
     }
-    return this.refreshStoredToken(stored);
+    return this.refreshStoredToken({ ...stored, refreshToken: stored.refreshToken });
   }
   async login() {
     const pkce = generatePkcePair();
@@ -248,12 +269,14 @@ var OAuthClient = class {
       authorizeUrl.searchParams.set("code_challenge_method", "S256");
       authorizeUrl.searchParams.set("resource", this.options.endpoint);
       authorizeUrl.searchParams.set("state", state);
-      if (this.options.role) {
-        authorizeUrl.searchParams.set("scope", `mcp ${ROLE_SCOPE_PREFIX}${this.options.role}`);
-      }
       assertTrustedEndpointUrl(authorizeUrl, "OAuth authorization URL");
-      await this.openBrowserImpl(authorizeUrl.toString());
-      const code = await loopback.waitForCode();
+      const url = authorizeUrl.toString();
+      this.options.onAuthorizeUrl?.(url);
+      const browserFailure = this.openBrowserImpl(url).then(() => new Promise(() => void 0));
+      const code = await withTimeout(
+        Promise.race([loopback.waitForCode(), browserFailure]),
+        this.options.loginTimeoutMs ?? DEFAULT_LOGIN_TIMEOUT_MS
+      );
       const token = await exchangeToken(metadata.tokenEndpoint, {
         grant_type: "authorization_code",
         code,
@@ -264,19 +287,17 @@ var OAuthClient = class {
         ...registration.clientSecret ? { client_secret: registration.clientSecret } : {}
       }, this.fetchImpl);
       const stored = toStoredToken(this.options.endpoint, token, metadata, registration);
-      await this.options.tokenStore.save(this.options.endpoint, stored, this.options.role);
+      await this.options.tokenStore.save(this.options.endpoint, stored);
       return stored;
     } finally {
       await loopback.close();
     }
   }
   async logout() {
-    await this.options.tokenStore.delete(this.options.endpoint, this.options.role);
+    await this.options.tokenStore.delete(this.options.endpoint);
   }
+  /** 부르는 쪽이 refresh token 이 있음을 이미 확인했다 — 타입이 그것을 요구한다. */
   async refreshStoredToken(stored) {
-    if (!stored.refreshToken) {
-      return stored.accessToken;
-    }
     const metadata = await discoverOAuthMetadata(this.options.endpoint, this.fetchImpl);
     const token = await exchangeToken(metadata.tokenEndpoint, {
       grant_type: "refresh_token",
@@ -286,7 +307,7 @@ var OAuthClient = class {
       resource: this.options.endpoint
     }, this.fetchImpl);
     const next = toStoredToken(this.options.endpoint, token, metadata, stored);
-    await this.options.tokenStore.save(this.options.endpoint, next, this.options.role);
+    await this.options.tokenStore.save(this.options.endpoint, next);
     return next.accessToken;
   }
 };
@@ -298,6 +319,27 @@ function generatePkcePair() {
 function generateOAuthState() {
   return randomBytes(32).toString("base64url");
 }
+function isExpired(token, now = Date.now()) {
+  return token.expiresAt !== void 0 && token.expiresAt <= now;
+}
+async function withTimeout(work, timeoutMs) {
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      const minutes = timeoutMs / 6e4;
+      const span = Number.isInteger(minutes) ? `${minutes} minute${minutes === 1 ? "" : "s"}` : `${timeoutMs} ms`;
+      reject(new OAuthLoginError(
+        "LOGIN_TIMEOUT",
+        `Sign-in was not completed within ${span}. Nothing was saved \u2014 run the same command again.`
+      ));
+    }, timeoutMs);
+  });
+  try {
+    return await Promise.race([work, timeout]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
 function shouldRefresh(token, now = Date.now()) {
   if (!token.expiresAt) {
     return false;
@@ -390,7 +432,7 @@ function toStoredToken(endpoint, token, metadata, previous) {
     updatedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
 }
-async function createLoopbackReceiver(expectedState) {
+async function createLoopbackReceiver(expectedState, host = "127.0.0.1") {
   let resolveCode;
   let rejectCode;
   const codePromise = new Promise((resolve, reject) => {
@@ -405,13 +447,13 @@ async function createLoopbackReceiver(expectedState) {
     const state = url.searchParams.get("state");
     if (error) {
       res.writeHead(400, { "content-type": "text/plain" });
-      res.end("Ainecto CLI authorization failed. You can close this tab.");
+      res.end("AiNecto CLI authorization failed. You can close this tab.");
       rejectCode(new Error(`OAuth authorization failed: ${error}`));
       return;
     }
     if (!state || state !== expectedState) {
       res.writeHead(400, { "content-type": "text/plain" });
-      res.end("Ainecto CLI authorization state mismatch. You can close this tab.");
+      res.end("AiNecto CLI authorization state mismatch. You can close this tab.");
       rejectCode(new Error("OAuth state mismatch."));
       return;
     }
@@ -422,10 +464,16 @@ async function createLoopbackReceiver(expectedState) {
       return;
     }
     res.writeHead(200, { "content-type": "text/plain" });
-    res.end("Ainecto CLI authorization complete. You can close this tab.");
+    res.end("AiNecto CLI authorization complete. You can close this tab.");
     resolveCode(code);
   });
-  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  await new Promise((resolve, reject) => {
+    server.once("error", (error) => reject(new OAuthLoginError(
+      "CALLBACK_UNAVAILABLE",
+      `Could not start the local sign-in callback on ${host} (${error.message}). If this command runs in a sandbox, allow local network binding or run it outside the sandbox.`
+    )));
+    server.listen(0, host, () => resolve());
+  });
   const address = server.address();
   if (!address || typeof address === "string") {
     throw new Error("Loopback OAuth server did not bind to a TCP port.");
@@ -433,7 +481,10 @@ async function createLoopbackReceiver(expectedState) {
   return {
     redirectUri: `http://127.0.0.1:${address.port}/callback`,
     waitForCode: () => codePromise,
-    close: () => new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()))
+    close: () => new Promise((resolve, reject) => {
+      server.closeAllConnections?.();
+      server.close((error) => error ? reject(error) : resolve());
+    })
   };
 }
 function parseStringArray(value) {
@@ -457,10 +508,39 @@ function getBrowserOpenCommand(url, platform = process.platform) {
   }
   return { command: "xdg-open", args: [url] };
 }
-async function openBrowser(url) {
-  const { command, args } = getBrowserOpenCommand(url);
-  const child = spawn(command, args, { stdio: "ignore", detached: true });
-  child.unref();
+function launchBrowser(url, deps = {}) {
+  const platform = deps.platform ?? process.platform;
+  const { command, args } = getBrowserOpenCommand(url, platform);
+  const spawnImpl = deps.spawnImpl ?? spawn;
+  return new Promise((resolve, reject) => {
+    const unavailable = (reason) => new OAuthLoginError(
+      "BROWSER_UNAVAILABLE",
+      `Could not open a browser on this machine (${command}: ${reason}). Sign-in needs a browser here.`
+    );
+    let child;
+    try {
+      child = spawnImpl(command, args, { stdio: "ignore", detached: true });
+    } catch (error) {
+      reject(unavailable(error instanceof Error ? error.message : String(error)));
+      return;
+    }
+    child.once("error", (error) => reject(unavailable(error.message)));
+    if (platform === "win32") {
+      child.once("spawn", () => resolve());
+    } else {
+      child.once("exit", (code, signal) => {
+        if (code === 0) {
+          resolve();
+        } else {
+          reject(unavailable(code === null ? `stopped by ${signal ?? "a signal"}` : `exited with code ${code}`));
+        }
+      });
+    }
+    child.unref();
+  });
+}
+function openBrowser(url) {
+  return launchBrowser(url);
 }
 function assertEnvTokenEndpointAllowed(endpoint, envVars) {
   if (envVars.AINECTO_ALLOW_CUSTOM_ENDPOINT_TOKEN === "1") {
@@ -472,6 +552,11 @@ function assertEnvTokenEndpointAllowed(endpoint, envVars) {
   throw new Error("AINECTO_TOKEN can only be used with the default prod/dev endpoints. Set AINECTO_ALLOW_CUSTOM_ENDPOINT_TOKEN=1 only when you intentionally trust the custom endpoint.");
 }
 
+// src/core/version.ts
+var CLI_VERSION = true ? "0.6.0" : "dev";
+var PACKAGE_NAME = "@ainecto/mcp";
+var CLI_USER_AGENT = `${PACKAGE_NAME} ${CLI_VERSION}`;
+
 // src/core/mcp/rpcClient.ts
 var McpRpcError = class extends Error {
   constructor(message, code, details) {
@@ -494,7 +579,7 @@ var McpRpcClient = class {
     return this.request("initialize", {
       protocolVersion: "2024-11-05",
       capabilities: {},
-      clientInfo: { name: "@ainecto/mcp", version: "0.1.0" }
+      clientInfo: { name: PACKAGE_NAME, version: CLI_VERSION }
     });
   }
   async toolsList() {
@@ -630,8 +715,7 @@ function isRecord3(value) {
 
 // src/adapters/mcp/connector.ts
 async function runConnector(options) {
-  const tokenStore = new FileTokenStore();
-  const auth = new OAuthClient({ endpoint: options.endpoint, tokenStore, role: options.role });
+  const auth = new OAuthClient({ endpoint: options.endpoint, tokenStore: new FileTokenStore() });
   const client = new McpRpcClient({
     endpoint: options.endpoint,
     tokenProvider: auth,
@@ -743,7 +827,7 @@ try {
   const resolvedRole = resolveRole({ role: args.role });
   await runConnector({
     endpoint: resolved.endpoint,
-    role: resolvedRole.role,
+    role: resolvedRole.role ?? null,
     input: process.stdin,
     output: process.stdout,
     errorOutput: process.stderr