@aiwerk/mcp-bridge 2.5.2 → 2.6.0

package/dist/src/transport-base.js

@@ -181,25 +181,83 @@ export function resolveAuthHeaders(config, extraEnv, envFallback) {
     }
     throw new Error("[mcp-bridge] OAuth2 auth requires async header resolution via resolveAuthHeadersAsync");
 }
+/** Check whether an oauth2 auth config uses the authorization_code grant type. */
+export function isAuthCodeOAuth2(auth) {
+    return auth.grantType === "authorization_code";
+}
+/** Check whether an oauth2 auth config uses the device_code grant type. */
+export function isDeviceCodeOAuth2(auth) {
+    return auth.grantType === "device_code";
+}
 export function resolveOAuth2Config(config, extraEnv, envFallback) {
     if (!config.auth || config.auth.type !== "oauth2") {
         throw new Error("[mcp-bridge] resolveOAuth2Config called for non-oauth2 auth config");
     }
-    const scopes = config.auth.scopes?.map((scope, index) => resolveEnvVars(scope, `oauth2 scope[${index}]`, extraEnv, envFallback));
+    if (isAuthCodeOAuth2(config.auth)) {
+        throw new Error("[mcp-bridge] resolveOAuth2Config called for authorization_code config — use resolveAuthCodeOAuth2Config instead");
+    }
+    if (isDeviceCodeOAuth2(config.auth)) {
+        throw new Error("[mcp-bridge] resolveOAuth2Config called for device_code config — use resolveDeviceCodeOAuth2Config instead");
+    }
+    const auth = config.auth;
+    const scopes = auth.scopes?.map((scope, index) => resolveEnvVars(scope, `oauth2 scope[${index}]`, extraEnv, envFallback));
     return {
-        clientId: resolveEnvVars(config.auth.clientId, "oauth2 clientId", extraEnv, envFallback),
-        clientSecret: resolveEnvVars(config.auth.clientSecret, "oauth2 clientSecret", extraEnv, envFallback),
-        tokenUrl: resolveEnvVars(config.auth.tokenUrl, "oauth2 tokenUrl", extraEnv, envFallback),
+        clientId: resolveEnvVars(auth.clientId, "oauth2 clientId", extraEnv, envFallback),
+        clientSecret: resolveEnvVars(auth.clientSecret, "oauth2 clientSecret", extraEnv, envFallback),
+        tokenUrl: resolveEnvVars(auth.tokenUrl, "oauth2 tokenUrl", extraEnv, envFallback),
         ...(scopes && scopes.length > 0 ? { scopes } : {}),
-        ...(config.auth.audience
-            ? { audience: resolveEnvVars(config.auth.audience, "oauth2 audience", extraEnv, envFallback) }
+        ...(auth.audience
+            ? { audience: resolveEnvVars(auth.audience, "oauth2 audience", extraEnv, envFallback) }
             : {}),
     };
 }
-export async function resolveAuthHeadersAsync(config, tokenManager, extraEnv, envFallback) {
+export function resolveAuthCodeOAuth2Config(config, extraEnv, envFallback) {
+    if (!config.auth || config.auth.type !== "oauth2" || !isAuthCodeOAuth2(config.auth)) {
+        throw new Error("[mcp-bridge] resolveAuthCodeOAuth2Config called for non-authorization_code auth config");
+    }
+    const auth = config.auth;
+    const scopes = auth.scopes?.map((scope, index) => resolveEnvVars(scope, `oauth2 scope[${index}]`, extraEnv, envFallback));
+    return {
+        grantType: "authorization_code",
+        tokenUrl: resolveEnvVars(auth.tokenUrl, "oauth2 tokenUrl", extraEnv, envFallback),
+        ...(auth.clientId ? { clientId: resolveEnvVars(auth.clientId, "oauth2 clientId", extraEnv, envFallback) } : {}),
+        ...(auth.clientSecret ? { clientSecret: resolveEnvVars(auth.clientSecret, "oauth2 clientSecret", extraEnv, envFallback) } : {}),
+        ...(scopes && scopes.length > 0 ? { scopes } : {}),
+    };
+}
+export function resolveDeviceCodeOAuth2Config(config, extraEnv, envFallback) {
+    if (!config.auth || config.auth.type !== "oauth2" || !isDeviceCodeOAuth2(config.auth)) {
+        throw new Error("[mcp-bridge] resolveDeviceCodeOAuth2Config called for non-device_code auth config");
+    }
+    const auth = config.auth;
+    const scopes = auth.scopes?.map((scope, index) => resolveEnvVars(scope, `oauth2 scope[${index}]`, extraEnv, envFallback));
+    return {
+        grantType: "device_code",
+        tokenUrl: resolveEnvVars(auth.tokenUrl, "oauth2 tokenUrl", extraEnv, envFallback),
+        clientId: resolveEnvVars(auth.clientId, "oauth2 clientId", extraEnv, envFallback),
+        ...(scopes && scopes.length > 0 ? { scopes } : {}),
+    };
+}
+export async function resolveAuthHeadersAsync(config, tokenManager, extraEnv, envFallback, serverName) {
     if (!config.auth)
         return {};
     if (config.auth.type === "oauth2") {
+        if (isAuthCodeOAuth2(config.auth)) {
+            if (!serverName) {
+                throw new Error("[mcp-bridge] serverName is required for authorization_code OAuth2 flow");
+            }
+            const authCodeConfig = resolveAuthCodeOAuth2Config(config, extraEnv, envFallback);
+            const token = await tokenManager.getTokenForAuthCode(serverName, authCodeConfig);
+            return { Authorization: `Bearer ${token}` };
+        }
+        if (isDeviceCodeOAuth2(config.auth)) {
+            if (!serverName) {
+                throw new Error("[mcp-bridge] serverName is required for device_code OAuth2 flow");
+            }
+            const deviceCodeConfig = resolveDeviceCodeOAuth2Config(config, extraEnv, envFallback);
+            const token = await tokenManager.getTokenForDeviceCode(serverName, deviceCodeConfig);
+            return { Authorization: `Bearer ${token}` };
+        }
         const oauth2Config = resolveOAuth2Config(config, extraEnv, envFallback);
         const token = await tokenManager.getToken(oauth2Config);
         return { Authorization: `Bearer ${token}` };
@@ -214,9 +272,9 @@ export function resolveServerHeaders(config, extraEnv, envFallback) {
     const auth = resolveAuthHeaders(config, extraEnv, envFallback);
     return { ...base, ...auth };
 }
-export async function resolveServerHeadersAsync(config, tokenManager, extraEnv, envFallback) {
+export async function resolveServerHeadersAsync(config, tokenManager, extraEnv, envFallback, serverName) {
     const base = resolveEnvRecord(config.headers || {}, "header", extraEnv, envFallback);
-    const auth = await resolveAuthHeadersAsync(config, tokenManager, extraEnv, envFallback);
+    const auth = await resolveAuthHeadersAsync(config, tokenManager, extraEnv, envFallback, serverName);
     return { ...base, ...auth };
 }
 /**

package/dist/src/transport-sse.d.ts

@@ -7,8 +7,9 @@ export declare class SseTransport extends BaseTransport {
     private resolvedHeaders;
     private pendingRequestControllers;
     private readonly tokenManager;
+    private readonly serverName?;
     protected get transportName(): string;
-    constructor(config: McpServerConfig, clientConfig: McpClientConfig, logger: Logger, onReconnected?: () => Promise<void>, tokenManager?: OAuth2TokenManager, requestIdGenerator?: RequestIdGenerator);
+    constructor(config: McpServerConfig, clientConfig: McpClientConfig, logger: Logger, onReconnected?: () => Promise<void>, tokenManager?: OAuth2TokenManager, requestIdGenerator?: RequestIdGenerator, serverName?: string);
     connect(): Promise<void>;
     private _onEndpointReceived;
     private getBaseHeaders;

package/dist/src/transport-sse.js

@@ -1,15 +1,17 @@
 import { OAuth2TokenManager } from "./oauth2-token-manager.js";
-import { BaseTransport, resolveOAuth2Config, resolveServerHeaders, resolveServerHeadersAsync, warnIfNonTlsRemoteUrl, } from "./transport-base.js";
+import { BaseTransport, isAuthCodeOAuth2, resolveOAuth2Config, resolveServerHeaders, resolveServerHeadersAsync, warnIfNonTlsRemoteUrl, } from "./transport-base.js";
 export class SseTransport extends BaseTransport {
     endpointUrl = null;
     sseAbortController = null;
     resolvedHeaders = null;
     pendingRequestControllers = new Map();
     tokenManager;
+    serverName;
     get transportName() { return "SSE"; }
-    constructor(config, clientConfig, logger, onReconnected, tokenManager, requestIdGenerator) {
+    constructor(config, clientConfig, logger, onReconnected, tokenManager, requestIdGenerator, serverName) {
         super(config, clientConfig, logger, onReconnected, requestIdGenerator);
         this.tokenManager = tokenManager ?? new OAuth2TokenManager(logger);
+        this.serverName = serverName;
     }
     async connect() {
         if (!this.config.url) {
@@ -52,7 +54,7 @@ export class SseTransport extends BaseTransport {
     }
     async refreshResolvedHeaders() {
         if (this.config.auth?.type === "oauth2") {
-            this.resolvedHeaders = await resolveServerHeadersAsync(this.config, this.tokenManager, undefined, this.clientConfig.envFallback);
+            this.resolvedHeaders = await resolveServerHeadersAsync(this.config, this.tokenManager, undefined, this.clientConfig.envFallback, this.serverName);
         }
         else {
             this.resolvedHeaders = resolveServerHeaders(this.config, undefined, this.clientConfig.envFallback);
@@ -63,6 +65,9 @@ export class SseTransport extends BaseTransport {
         if (this.config.auth?.type !== "oauth2") {
             return;
         }
+        if (isAuthCodeOAuth2(this.config.auth)) {
+            return;
+        }
         const oauth2Config = resolveOAuth2Config(this.config, undefined, this.clientConfig.envFallback);
         this.tokenManager.invalidate(oauth2Config.tokenUrl, oauth2Config.clientId);
     }

package/dist/src/transport-stdio.js

@@ -63,7 +63,7 @@ export class StdioTransport extends BaseTransport {
         this.process.stdout.on("data", (data) => {
             this.stdoutBuffer = Buffer.concat([this.stdoutBuffer, data]);
             // Safety limit: prevent unbounded buffer growth from misbehaving servers
-            const MAX_BUFFER = 50 * 1024 * 1024; // 50MB
+            const MAX_BUFFER = 10 * 1024 * 1024; // 10MB
             if (this.stdoutBuffer.length > MAX_BUFFER) {
                 this.logger.error(`[mcp-bridge] Stdio buffer exceeded ${MAX_BUFFER} bytes, killing process`);
                 this.process?.kill();

package/dist/src/transport-streamable-http.d.ts

@@ -6,8 +6,9 @@ export declare class StreamableHttpTransport extends BaseTransport {
     private resolvedHeaders;
     private pendingRequestControllers;
     private readonly tokenManager;
+    private readonly serverName?;
     protected get transportName(): string;
-    constructor(config: McpServerConfig, clientConfig: McpClientConfig, logger: Logger, onReconnected?: () => Promise<void>, tokenManager?: OAuth2TokenManager, requestIdGenerator?: RequestIdGenerator);
+    constructor(config: McpServerConfig, clientConfig: McpClientConfig, logger: Logger, onReconnected?: () => Promise<void>, tokenManager?: OAuth2TokenManager, requestIdGenerator?: RequestIdGenerator, serverName?: string);
     connect(): Promise<void>;
     private getBaseHeaders;
     private refreshResolvedHeaders;

package/dist/src/transport-streamable-http.js

@@ -1,14 +1,16 @@
 import { OAuth2TokenManager } from "./oauth2-token-manager.js";
-import { BaseTransport, resolveOAuth2Config, resolveServerHeaders, resolveServerHeadersAsync, warnIfNonTlsRemoteUrl, } from "./transport-base.js";
+import { BaseTransport, isAuthCodeOAuth2, resolveOAuth2Config, resolveServerHeaders, resolveServerHeadersAsync, warnIfNonTlsRemoteUrl, } from "./transport-base.js";
 export class StreamableHttpTransport extends BaseTransport {
     sessionId;
     resolvedHeaders = null;
     pendingRequestControllers = new Map();
     tokenManager;
+    serverName;
     get transportName() { return "streamable-http"; }
-    constructor(config, clientConfig, logger, onReconnected, tokenManager, requestIdGenerator) {
+    constructor(config, clientConfig, logger, onReconnected, tokenManager, requestIdGenerator, serverName) {
         super(config, clientConfig, logger, onReconnected, requestIdGenerator);
         this.tokenManager = tokenManager ?? new OAuth2TokenManager(logger);
+        this.serverName = serverName;
     }
     async connect() {
         if (!this.config.url) {
@@ -35,7 +37,7 @@ export class StreamableHttpTransport extends BaseTransport {
     }
     async refreshResolvedHeaders() {
         if (this.config.auth?.type === "oauth2") {
-            this.resolvedHeaders = await resolveServerHeadersAsync(this.config, this.tokenManager, undefined, this.clientConfig.envFallback);
+            this.resolvedHeaders = await resolveServerHeadersAsync(this.config, this.tokenManager, undefined, this.clientConfig.envFallback, this.serverName);
         }
         else {
             this.resolvedHeaders = resolveServerHeaders(this.config, undefined, this.clientConfig.envFallback);
@@ -46,6 +48,10 @@ export class StreamableHttpTransport extends BaseTransport {
         if (this.config.auth?.type !== "oauth2") {
             return;
         }
+        // authorization_code tokens are managed via TokenStore, not the in-memory cache
+        if (isAuthCodeOAuth2(this.config.auth)) {
+            return;
+        }
         const oauth2Config = resolveOAuth2Config(this.config, undefined, this.clientConfig.envFallback);
         this.tokenManager.invalidate(oauth2Config.tokenUrl, oauth2Config.clientId);
     }
@@ -111,10 +117,17 @@ export class StreamableHttpTransport extends BaseTransport {
                     try {
                         const contentType = response.headers.get("content-type") || "";
                         if (contentType.includes("text/event-stream")) {
-                            const text = await response.text();
-                            const lines = text.split("\n");
-                            // SSE event boundary parsing: collect data lines, dispatch on empty line
+                            // Stream SSE response incrementally using ReadableStream
+                            // (previous implementation used response.text() which blocked until
+                            // the entire response was received, causing timeouts on long-running calls)
+                            if (!response.body) {
+                                throw new Error("SSE response has no body stream");
+                            }
+                            const reader = response.body.getReader();
+                            const decoder = new TextDecoder();
+                            let partial = "";
                             let dataBuffer = [];
+                            let hasData = false;
                             const dispatch = () => {
                                 if (dataBuffer.length === 0)
                                     return;
@@ -127,19 +140,37 @@ export class StreamableHttpTransport extends BaseTransport {
                                     // skip malformed events
                                 }
                             };
-                            let hasData = false;
-                            for (const line of lines) {
-                                const trimmed = line.trim();
-                                if (trimmed.startsWith("data:")) {
-                                    dataBuffer.push(trimmed.substring(5).trimStart());
-                                    hasData = true;
+                            try {
+                                while (true) {
+                                    const { done, value } = await reader.read();
+                                    if (done)
+                                        break;
+                                    partial += decoder.decode(value, { stream: true });
+                                    const lines = partial.split("\n");
+                                    // Keep the last (potentially incomplete) line in partial
+                                    partial = lines.pop() || "";
+                                    for (const line of lines) {
+                                        const trimmed = line.trim();
+                                        if (trimmed.startsWith("data:")) {
+                                            dataBuffer.push(trimmed.substring(5).trimStart());
+                                            hasData = true;
+                                        }
+                                        else if (trimmed === "" && dataBuffer.length > 0) {
+                                            dispatch();
+                                        }
+                                    }
                                 }
-                                else if (trimmed === "" && dataBuffer.length > 0) {
-                                    dispatch();
+                                // Process any remaining partial line
+                                if (partial.trim().startsWith("data:")) {
+                                    dataBuffer.push(partial.trim().substring(5).trimStart());
+                                    hasData = true;
                                 }
+                                // Dispatch any trailing data (server may omit final empty line)
+                                dispatch();
+                            }
+                            finally {
+                                reader.releaseLock();
                             }
-                            // Dispatch any trailing data (server may omit final empty line)
-                            dispatch();
                             if (!hasData) {
                                 throw new Error("No data lines in SSE response");
                             }

package/dist/src/types.d.ts

@@ -17,6 +17,22 @@ export type HttpAuthConfig = {
     tokenUrl: string;
     scopes?: string[];
     audience?: string;
+} | {
+    type: "oauth2";
+    grantType: "authorization_code";
+    authorizationUrl: string;
+    tokenUrl: string;
+    clientId?: string;
+    clientSecret?: string;
+    scopes?: string[];
+    callbackPort?: number;
+} | {
+    type: "oauth2";
+    grantType: "device_code";
+    deviceAuthorizationUrl: string;
+    tokenUrl: string;
+    clientId: string;
+    scopes?: string[];
 };
 export interface RetryConfig {
     maxAttempts?: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwerk/mcp-bridge",
-  "version": "2.5.2",
+  "version": "2.6.0",
   "description": "Standalone MCP server that multiplexes multiple MCP servers into one interface",
   "type": "module",
   "main": "./dist/src/index.js",
@@ -44,7 +44,7 @@
     "build": "tsc",
     "test": "node --import tsx --test tests/*.test.ts",
     "typecheck": "tsc --noEmit",
-    "prepublishOnly": "bash scripts/validate-recipes.sh",
+    "prepublishOnly": "tsc && bash scripts/validate-recipes.sh",
     "validate-recipe": "npx tsx bin/validate-recipe.ts",
     "lint": "eslint src/",
     "format": "prettier --write src/",