@aiwerk/mcp-bridge 2.6.1 → 2.6.3

package/dist/bin/mcp-bridge.js

@@ -378,6 +378,7 @@ async function cmdAuth(args, logger) {
             deviceAuthorizationUrl: deviceAuth.deviceAuthorizationUrl,
             tokenUrl: deviceAuth.tokenUrl,
             clientId: deviceAuth.clientId,
+            clientSecret: deviceAuth.clientSecret,
             scopes: deviceAuth.scopes,
         }, logger);
     }

package/dist/src/cli-auth.d.ts

@@ -29,6 +29,7 @@ export interface DeviceCodeConfig {
     deviceAuthorizationUrl: string;
     tokenUrl: string;
     clientId: string;
+    clientSecret?: string;
     scopes?: string[];
     /** Skip opening browser (for tests). */
     skipBrowser?: boolean;
@@ -40,4 +41,4 @@ export interface DeviceCodeConfig {
  * 2. Display user_code and verification_uri to the user
  * 3. Poll tokenUrl until the user authorizes or the code expires
  */
-export declare function performDeviceCodeLogin(serverName: string, config: DeviceCodeConfig, logger: Logger): Promise<StoredToken>;
+export declare function performDeviceCodeLogin(serverName: string, config: DeviceCodeConfig, logger: Logger, signal?: AbortSignal): Promise<StoredToken>;

package/dist/src/cli-auth.js

@@ -1,6 +1,6 @@
 import { createServer } from "http";
 import { randomBytes, createHash } from "crypto";
-import { exec } from "child_process";
+import { execFile } from "child_process";
 import { platform } from "os";
 /** Escape HTML special characters to prevent XSS in callback responses. */
 function escapeHtml(str) {
@@ -35,23 +35,31 @@ export function computeCodeChallenge(verifier) {
 /**
  * Open a URL in the default browser using platform-specific commands.
  */
+/**
+ * Open a URL in the default browser.
+ * Uses execFile (no shell) to prevent shell injection from untrusted URLs
+ * (e.g. verification_uri_complete from an external authorization server).
+ */
 function openBrowser(url, logger) {
     const os = platform();
-    let cmd;
     if (os === "darwin") {
-        cmd = `open "${url}"`;
+        execFile("open", [url], (err) => {
+            if (err)
+                logger.warn(`[mcp-bridge] Could not open browser automatically. Please visit:\n${url}`);
+        });
     }
     else if (os === "win32") {
-        cmd = `start "" "${url}"`;
+        execFile("cmd", ["/c", "start", "", url], (err) => {
+            if (err)
+                logger.warn(`[mcp-bridge] Could not open browser automatically. Please visit:\n${url}`);
+        });
     }
     else {
-        cmd = `xdg-open "${url}"`;
+        execFile("xdg-open", [url], (err) => {
+            if (err)
+                logger.warn(`[mcp-bridge] Could not open browser automatically. Please visit:\n${url}`);
+        });
     }
-    exec(cmd, (err) => {
-        if (err) {
-            logger.warn(`[mcp-bridge] Could not open browser automatically. Please visit:\n${url}`);
-        }
-    });
 }
 const DEFAULT_EXPIRES_IN = 3600;
 const EXPIRY_BUFFER_SECONDS = 60;
@@ -166,10 +174,12 @@ const SLOW_DOWN_INCREMENT_S = 5;
  * 2. Display user_code and verification_uri to the user
  * 3. Poll tokenUrl until the user authorizes or the code expires
  */
-export async function performDeviceCodeLogin(serverName, config, logger) {
+export async function performDeviceCodeLogin(serverName, config, logger, signal) {
     // Step 1: Request device code
     const formData = new URLSearchParams();
     formData.set("client_id", config.clientId);
+    if (config.clientSecret)
+        formData.set("client_secret", config.clientSecret);
     if (config.scopes?.length)
         formData.set("scope", config.scopes.join(" "));
     const deviceResponse = await fetch(config.deviceAuthorizationUrl, {
@@ -211,17 +221,39 @@ export async function performDeviceCodeLogin(serverName, config, logger) {
     // Step 3: Poll for token
     const deadline = Date.now() + expiresInS * 1000;
     while (Date.now() < deadline) {
+        if (signal?.aborted) {
+            throw new Error("Device code login aborted");
+        }
         await sleep(intervalS * 1000);
+        if (signal?.aborted) {
+            throw new Error("Device code login aborted");
+        }
         const tokenForm = new URLSearchParams();
         tokenForm.set("grant_type", "urn:ietf:params:oauth:grant-type:device_code");
         tokenForm.set("device_code", deviceCode);
         tokenForm.set("client_id", config.clientId);
+        if (config.clientSecret)
+            tokenForm.set("client_secret", config.clientSecret);
         const tokenResponse = await fetch(config.tokenUrl, {
             method: "POST",
             headers: { "Content-Type": "application/x-www-form-urlencoded" },
             body: tokenForm.toString(),
+            signal,
         });
-        const tokenPayload = (await tokenResponse.json());
+        // Guard against non-JSON responses (e.g. 500 HTML error pages)
+        const contentType = tokenResponse.headers.get("content-type") || "";
+        if (!tokenResponse.ok && !contentType.includes("json")) {
+            logger.warn(`[mcp-bridge] Token poll returned HTTP ${tokenResponse.status} (non-JSON), retrying...`);
+            continue;
+        }
+        let tokenPayload;
+        try {
+            tokenPayload = (await tokenResponse.json());
+        }
+        catch {
+            logger.warn("[mcp-bridge] Token poll returned invalid JSON, retrying...");
+            continue;
+        }
         if (tokenPayload.error) {
             if (tokenPayload.error === "authorization_pending") {
                 continue;

package/dist/src/oauth2-token-manager.d.ts

@@ -18,13 +18,14 @@ export interface DeviceCodeOAuth2Config {
     grantType: "device_code";
     tokenUrl: string;
     clientId: string;
+    clientSecret?: string;
     scopes?: string[];
 }
 export declare class OAuth2TokenManager {
     private readonly logger;
     private readonly tokenCache;
     private readonly inflight;
-    private readonly authCodeInflight;
+    private readonly tokenRefreshInflight;
     private readonly tokenStore?;
     constructor(logger: Logger, tokenStore?: TokenStore);
     getToken(config: OAuth2Config): Promise<string>;
@@ -40,9 +41,12 @@ export declare class OAuth2TokenManager {
      * Checks TokenStore, refreshes if expired, throws if unavailable.
      */
     getTokenForDeviceCode(serverName: string, config: DeviceCodeOAuth2Config): Promise<string>;
-    private doDeviceCodeRefresh;
+    /**
+     * Shared refresh logic for both auth_code and device_code flows.
+     * Takes a refreshFn that performs the actual token exchange.
+     */
+    private doTokenRefresh;
     private refreshDeviceCodeToken;
-    private doAuthCodeRefresh;
     private refreshAuthCodeToken;
     private makeKey;
     private fetchToken;

package/dist/src/oauth2-token-manager.js

@@ -4,7 +4,7 @@ export class OAuth2TokenManager {
     logger;
     tokenCache = new Map();
     inflight = new Map();
-    authCodeInflight = new Map();
+    tokenRefreshInflight = new Map();
     tokenStore;
     constructor(logger, tokenStore) {
         this.logger = logger;
@@ -62,17 +62,17 @@ export class OAuth2TokenManager {
         // Token expired — try refresh with inflight dedup to avoid
         // concurrent requests both trying to refresh the same token
         // (the second refresh would fail because the first invalidated the refresh_token)
-        const existingInflight = this.authCodeInflight.get(serverName);
+        const existingInflight = this.tokenRefreshInflight.get(serverName);
         if (existingInflight) {
             return existingInflight;
         }
-        const refreshPromise = this.doAuthCodeRefresh(serverName, stored, config);
-        this.authCodeInflight.set(serverName, refreshPromise);
+        const refreshPromise = this.doTokenRefresh(serverName, stored, (s) => this.refreshAuthCodeToken(s, config), "Auth code");
+        this.tokenRefreshInflight.set(serverName, refreshPromise);
         try {
             return await refreshPromise;
         }
         finally {
-            this.authCodeInflight.delete(serverName);
+            this.tokenRefreshInflight.delete(serverName);
         }
     }
     /**
@@ -94,28 +94,32 @@ export class OAuth2TokenManager {
             return stored.accessToken;
         }
         // Token expired — try refresh with inflight dedup
-        const existingInflight = this.authCodeInflight.get(serverName);
+        const existingInflight = this.tokenRefreshInflight.get(serverName);
         if (existingInflight) {
             return existingInflight;
         }
-        const refreshPromise = this.doDeviceCodeRefresh(serverName, stored, config);
-        this.authCodeInflight.set(serverName, refreshPromise);
+        const refreshPromise = this.doTokenRefresh(serverName, stored, (s) => this.refreshDeviceCodeToken(s, config), "Device code");
+        this.tokenRefreshInflight.set(serverName, refreshPromise);
         try {
             return await refreshPromise;
         }
         finally {
-            this.authCodeInflight.delete(serverName);
+            this.tokenRefreshInflight.delete(serverName);
         }
     }
-    async doDeviceCodeRefresh(serverName, stored, config) {
+    /**
+     * Shared refresh logic for both auth_code and device_code flows.
+     * Takes a refreshFn that performs the actual token exchange.
+     */
+    async doTokenRefresh(serverName, stored, refreshFn, flowName) {
         if (stored.refreshToken) {
             try {
-                const refreshed = await this.refreshDeviceCodeToken(stored, config);
+                const refreshed = await refreshFn(stored);
                 this.tokenStore.save(serverName, refreshed);
                 return refreshed.accessToken;
             }
             catch (err) {
-                this.logger.warn("[mcp-bridge] Device code token refresh failed:", err);
+                this.logger.warn(`[mcp-bridge] ${flowName} token refresh failed:`, err);
             }
         }
         // Refresh failed or no refresh token
@@ -129,6 +133,8 @@ export class OAuth2TokenManager {
         formData.set("grant_type", "refresh_token");
         formData.set("refresh_token", stored.refreshToken);
         formData.set("client_id", config.clientId);
+        if (config.clientSecret)
+            formData.set("client_secret", config.clientSecret);
         if (config.scopes?.length)
             formData.set("scope", config.scopes.join(" "));
         const response = await fetch(stored.tokenUrl, {
@@ -156,23 +162,6 @@ export class OAuth2TokenManager {
             scopes: config.scopes,
         };
     }
-    async doAuthCodeRefresh(serverName, stored, config) {
-        if (stored.refreshToken) {
-            try {
-                const refreshed = await this.refreshAuthCodeToken(stored, config);
-                this.tokenStore.save(serverName, refreshed);
-                return refreshed.accessToken;
-            }
-            catch (err) {
-                this.logger.warn("[mcp-bridge] Auth code token refresh failed:", err);
-            }
-        }
-        // Refresh failed or no refresh token
-        this.tokenStore.remove(serverName);
-        const error = new Error(`Authentication expired for server "${serverName}". Run: mcp-bridge auth login ${serverName}`);
-        error.code = -32006;
-        throw error;
-    }
     async refreshAuthCodeToken(stored, config) {
         const formData = new URLSearchParams();
         formData.set("grant_type", "refresh_token");

package/dist/src/transport-base.js

@@ -235,6 +235,7 @@ export function resolveDeviceCodeOAuth2Config(config, extraEnv, envFallback) {
         grantType: "device_code",
         tokenUrl: resolveEnvVars(auth.tokenUrl, "oauth2 tokenUrl", extraEnv, envFallback),
         clientId: resolveEnvVars(auth.clientId, "oauth2 clientId", extraEnv, envFallback),
+        ...(auth.clientSecret ? { clientSecret: resolveEnvVars(auth.clientSecret, "oauth2 clientSecret", extraEnv, envFallback) } : {}),
         ...(scopes && scopes.length > 0 ? { scopes } : {}),
     };
 }

package/dist/src/types.d.ts

@@ -32,6 +32,7 @@ export type HttpAuthConfig = {
     deviceAuthorizationUrl: string;
     tokenUrl: string;
     clientId: string;
+    clientSecret?: string;
     scopes?: string[];
 };
 export interface RetryConfig {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwerk/mcp-bridge",
-  "version": "2.6.1",
+  "version": "2.6.3",
   "description": "Standalone MCP server that multiplexes multiple MCP servers into one interface",
   "type": "module",
   "main": "./dist/src/index.js",