@aiwerk/mcp-bridge 2.6.1 → 2.6.2

package/dist/bin/mcp-bridge.js

@@ -378,6 +378,7 @@ async function cmdAuth(args, logger) {
             deviceAuthorizationUrl: deviceAuth.deviceAuthorizationUrl,
             tokenUrl: deviceAuth.tokenUrl,
             clientId: deviceAuth.clientId,
+            clientSecret: deviceAuth.clientSecret,
             scopes: deviceAuth.scopes,
         }, logger);
     }

package/dist/src/cli-auth.d.ts

@@ -29,6 +29,7 @@ export interface DeviceCodeConfig {
     deviceAuthorizationUrl: string;
     tokenUrl: string;
     clientId: string;
+    clientSecret?: string;
     scopes?: string[];
     /** Skip opening browser (for tests). */
     skipBrowser?: boolean;

package/dist/src/cli-auth.js

@@ -1,6 +1,6 @@
 import { createServer } from "http";
 import { randomBytes, createHash } from "crypto";
-import { exec } from "child_process";
+import { execFile } from "child_process";
 import { platform } from "os";
 /** Escape HTML special characters to prevent XSS in callback responses. */
 function escapeHtml(str) {
@@ -35,23 +35,31 @@ export function computeCodeChallenge(verifier) {
 /**
  * Open a URL in the default browser using platform-specific commands.
  */
+/**
+ * Open a URL in the default browser.
+ * Uses execFile (no shell) to prevent shell injection from untrusted URLs
+ * (e.g. verification_uri_complete from an external authorization server).
+ */
 function openBrowser(url, logger) {
     const os = platform();
-    let cmd;
     if (os === "darwin") {
-        cmd = `open "${url}"`;
+        execFile("open", [url], (err) => {
+            if (err)
+                logger.warn(`[mcp-bridge] Could not open browser automatically. Please visit:\n${url}`);
+        });
     }
     else if (os === "win32") {
-        cmd = `start "" "${url}"`;
+        execFile("cmd", ["/c", "start", "", url], (err) => {
+            if (err)
+                logger.warn(`[mcp-bridge] Could not open browser automatically. Please visit:\n${url}`);
+        });
     }
     else {
-        cmd = `xdg-open "${url}"`;
+        execFile("xdg-open", [url], (err) => {
+            if (err)
+                logger.warn(`[mcp-bridge] Could not open browser automatically. Please visit:\n${url}`);
+        });
     }
-    exec(cmd, (err) => {
-        if (err) {
-            logger.warn(`[mcp-bridge] Could not open browser automatically. Please visit:\n${url}`);
-        }
-    });
 }
 const DEFAULT_EXPIRES_IN = 3600;
 const EXPIRY_BUFFER_SECONDS = 60;
@@ -170,6 +178,8 @@ export async function performDeviceCodeLogin(serverName, config, logger) {
     // Step 1: Request device code
     const formData = new URLSearchParams();
     formData.set("client_id", config.clientId);
+    if (config.clientSecret)
+        formData.set("client_secret", config.clientSecret);
     if (config.scopes?.length)
         formData.set("scope", config.scopes.join(" "));
     const deviceResponse = await fetch(config.deviceAuthorizationUrl, {
@@ -216,12 +226,27 @@ export async function performDeviceCodeLogin(serverName, config, logger) {
         tokenForm.set("grant_type", "urn:ietf:params:oauth:grant-type:device_code");
         tokenForm.set("device_code", deviceCode);
         tokenForm.set("client_id", config.clientId);
+        if (config.clientSecret)
+            tokenForm.set("client_secret", config.clientSecret);
         const tokenResponse = await fetch(config.tokenUrl, {
             method: "POST",
             headers: { "Content-Type": "application/x-www-form-urlencoded" },
             body: tokenForm.toString(),
         });
-        const tokenPayload = (await tokenResponse.json());
+        // Guard against non-JSON responses (e.g. 500 HTML error pages)
+        const contentType = tokenResponse.headers.get("content-type") || "";
+        if (!tokenResponse.ok && !contentType.includes("json")) {
+            logger.warn(`[mcp-bridge] Token poll returned HTTP ${tokenResponse.status} (non-JSON), retrying...`);
+            continue;
+        }
+        let tokenPayload;
+        try {
+            tokenPayload = (await tokenResponse.json());
+        }
+        catch {
+            logger.warn("[mcp-bridge] Token poll returned invalid JSON, retrying...");
+            continue;
+        }
         if (tokenPayload.error) {
             if (tokenPayload.error === "authorization_pending") {
                 continue;

package/dist/src/oauth2-token-manager.d.ts

@@ -18,13 +18,14 @@ export interface DeviceCodeOAuth2Config {
     grantType: "device_code";
     tokenUrl: string;
     clientId: string;
+    clientSecret?: string;
     scopes?: string[];
 }
 export declare class OAuth2TokenManager {
     private readonly logger;
     private readonly tokenCache;
     private readonly inflight;
-    private readonly authCodeInflight;
+    private readonly tokenRefreshInflight;
     private readonly tokenStore?;
     constructor(logger: Logger, tokenStore?: TokenStore);
     getToken(config: OAuth2Config): Promise<string>;

package/dist/src/oauth2-token-manager.js

@@ -4,7 +4,7 @@ export class OAuth2TokenManager {
     logger;
     tokenCache = new Map();
     inflight = new Map();
-    authCodeInflight = new Map();
+    tokenRefreshInflight = new Map();
     tokenStore;
     constructor(logger, tokenStore) {
         this.logger = logger;
@@ -62,17 +62,17 @@ export class OAuth2TokenManager {
         // Token expired — try refresh with inflight dedup to avoid
         // concurrent requests both trying to refresh the same token
         // (the second refresh would fail because the first invalidated the refresh_token)
-        const existingInflight = this.authCodeInflight.get(serverName);
+        const existingInflight = this.tokenRefreshInflight.get(serverName);
         if (existingInflight) {
             return existingInflight;
         }
         const refreshPromise = this.doAuthCodeRefresh(serverName, stored, config);
-        this.authCodeInflight.set(serverName, refreshPromise);
+        this.tokenRefreshInflight.set(serverName, refreshPromise);
         try {
             return await refreshPromise;
         }
         finally {
-            this.authCodeInflight.delete(serverName);
+            this.tokenRefreshInflight.delete(serverName);
         }
     }
     /**
@@ -94,17 +94,17 @@ export class OAuth2TokenManager {
             return stored.accessToken;
         }
         // Token expired — try refresh with inflight dedup
-        const existingInflight = this.authCodeInflight.get(serverName);
+        const existingInflight = this.tokenRefreshInflight.get(serverName);
         if (existingInflight) {
             return existingInflight;
         }
         const refreshPromise = this.doDeviceCodeRefresh(serverName, stored, config);
-        this.authCodeInflight.set(serverName, refreshPromise);
+        this.tokenRefreshInflight.set(serverName, refreshPromise);
         try {
             return await refreshPromise;
         }
         finally {
-            this.authCodeInflight.delete(serverName);
+            this.tokenRefreshInflight.delete(serverName);
         }
     }
     async doDeviceCodeRefresh(serverName, stored, config) {
@@ -129,6 +129,8 @@ export class OAuth2TokenManager {
         formData.set("grant_type", "refresh_token");
         formData.set("refresh_token", stored.refreshToken);
         formData.set("client_id", config.clientId);
+        if (config.clientSecret)
+            formData.set("client_secret", config.clientSecret);
         if (config.scopes?.length)
             formData.set("scope", config.scopes.join(" "));
         const response = await fetch(stored.tokenUrl, {

package/dist/src/transport-base.js

@@ -235,6 +235,7 @@ export function resolveDeviceCodeOAuth2Config(config, extraEnv, envFallback) {
         grantType: "device_code",
         tokenUrl: resolveEnvVars(auth.tokenUrl, "oauth2 tokenUrl", extraEnv, envFallback),
         clientId: resolveEnvVars(auth.clientId, "oauth2 clientId", extraEnv, envFallback),
+        ...(auth.clientSecret ? { clientSecret: resolveEnvVars(auth.clientSecret, "oauth2 clientSecret", extraEnv, envFallback) } : {}),
         ...(scopes && scopes.length > 0 ? { scopes } : {}),
     };
 }

package/dist/src/types.d.ts

@@ -32,6 +32,7 @@ export type HttpAuthConfig = {
     deviceAuthorizationUrl: string;
     tokenUrl: string;
     clientId: string;
+    clientSecret?: string;
     scopes?: string[];
 };
 export interface RetryConfig {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwerk/mcp-bridge",
-  "version": "2.6.1",
+  "version": "2.6.2",
   "description": "Standalone MCP server that multiplexes multiple MCP servers into one interface",
   "type": "module",
   "main": "./dist/src/index.js",