@bibobonking/opensol 3.1.0 → 3.1.1

package/server/lib/mcp.mjs

@@ -1,8 +1,19 @@
-// Minimal Model Context Protocol client (stdio + Streamable HTTP), zero dependencies.
+// Minimal Model Context Protocol client (stdio, Streamable HTTP, legacy HTTP+SSE, OAuth), zero dependencies.
 // The daemon owns every connection: the browser only sees tool metadata and results.
 import { spawn } from 'node:child_process'
 import os from 'node:os'
 import { HttpError } from './http.mjs'
+import {
+  AuthRequiredError,
+  PendingAuthorizations,
+  buildAuthorizationUrl,
+  createPkce,
+  discover,
+  exchangeCode,
+  refreshTokens,
+  registerClient,
+  tokenIsFresh,
+} from './mcp-oauth.mjs'
 
 const PROTOCOL_VERSION = '2025-03-26'
 const CONNECT_TIMEOUT_MS = 60_000
@@ -191,31 +202,90 @@ async function readSse(response, wantedId) {
   throw new Error('The MCP server closed the stream without answering.')
 }
 
+/** Parses a text/event-stream response into { event, data } records. */
+async function* sseEvents(response, signal) {
+  const reader = response.body.getReader()
+  const decoder = new TextDecoder()
+  let buffer = ''
+  try {
+    for (;;) {
+      if (signal?.aborted) return
+      const { value, done } = await reader.read()
+      if (done) return
+      buffer += decoder.decode(value, { stream: true })
+      let boundary
+      while ((boundary = buffer.search(/\r?\n\r?\n/)) >= 0) {
+        const block = buffer.slice(0, boundary)
+        buffer = buffer.slice(boundary).replace(/^\r?\n\r?\n/, '')
+        let event = 'message'
+        const data = []
+        for (const line of block.split(/\r?\n/)) {
+          if (line.startsWith('event:')) event = line.slice(6).trim()
+          else if (line.startsWith('data:')) data.push(line.slice(5).replace(/^ /, ''))
+        }
+        if (data.length) yield { event, data: data.join('\n') }
+      }
+    }
+  } finally {
+    reader.cancel().catch(() => undefined)
+  }
+}
+
+function checkRemoteUrl(value) {
+  let parsed
+  try {
+    parsed = new URL(value)
+  } catch {
+    throw new Error('The MCP server URL is not valid.')
+  }
+  if (!['http:', 'https:'].includes(parsed.protocol)) throw new Error('MCP servers must use http or https.')
+  return parsed
+}
+
+/** Request headers for a remote server: OAuth bearer first, then user-defined headers. */
+async function remoteHeaders(config, auth, extra) {
+  const bearer = auth ? await auth.header() : ''
+  return {
+    ...extra,
+    ...(bearer ? { Authorization: bearer } : {}),
+    ...(config.headers ?? {}),
+  }
+}
+
+/**
+ * fetch() with OAuth handling: a 401 triggers one token refresh and retry, then
+ * surfaces AuthRequiredError so the manager can ask the person to sign in.
+ */
+async function authedFetch(url, build, auth) {
+  for (let attempt = 0; ; attempt += 1) {
+    const response = await fetch(url, await build())
+    if (response.status !== 401) return response
+    const challenge = response.headers.get('www-authenticate') ?? ''
+    await response.body?.cancel().catch(() => undefined)
+    if (auth && attempt === 0 && (await auth.refresh())) continue
+    throw new AuthRequiredError(challenge)
+  }
+}
+
 /** Streamable HTTP transport: one POST per message, JSON or SSE replies. */
 class HttpTransport {
-  constructor(config) {
+  constructor(config, { auth } = {}) {
     this.config = config
+    this.auth = auth
     this.sessionId = ''
   }
 
   async start() {
-    let parsed
-    try {
-      parsed = new URL(this.config.url)
-    } catch {
-      throw new Error('The MCP server URL is not valid.')
-    }
-    if (!['http:', 'https:'].includes(parsed.protocol)) throw new Error('MCP servers must use http or https.')
+    checkRemoteUrl(this.config.url)
   }
 
   #headers() {
-    return {
+    return remoteHeaders(this.config, this.auth, {
       'Content-Type': 'application/json',
       Accept: 'application/json, text/event-stream',
       'MCP-Protocol-Version': PROTOCOL_VERSION,
       ...(this.sessionId ? { 'Mcp-Session-Id': this.sessionId } : {}),
-      ...(this.config.headers ?? {}),
-    }
+    })
   }
 
   async request(method, params, timeoutMs = REQUEST_TIMEOUT_MS) {
@@ -223,12 +293,16 @@ class HttpTransport {
     const controller = new AbortController()
     const timer = setTimeout(() => controller.abort(), timeoutMs)
     try {
-      const response = await fetch(this.config.url, {
-        method: 'POST',
-        headers: this.#headers(),
-        body: JSON.stringify({ jsonrpc: '2.0', id, method, params }),
-        signal: controller.signal,
-      })
+      const response = await authedFetch(
+        this.config.url,
+        async () => ({
+          method: 'POST',
+          headers: await this.#headers(),
+          body: JSON.stringify({ jsonrpc: '2.0', id, method, params }),
+          signal: controller.signal,
+        }),
+        this.auth,
+      )
       const session = response.headers.get('mcp-session-id')
       if (session) this.sessionId = session
       if (!response.ok) {
@@ -249,12 +323,16 @@ class HttpTransport {
   }
 
   async notify(method, params) {
-    const response = await fetch(this.config.url, {
-      method: 'POST',
-      headers: this.#headers(),
-      body: JSON.stringify({ jsonrpc: '2.0', method, params }),
-      signal: AbortSignal.timeout(15_000),
-    })
+    const response = await authedFetch(
+      this.config.url,
+      async () => ({
+        method: 'POST',
+        headers: await this.#headers(),
+        body: JSON.stringify({ jsonrpc: '2.0', method, params }),
+        signal: AbortSignal.timeout(15_000),
+      }),
+      this.auth,
+    )
     await response.body?.cancel().catch(() => undefined)
   }
 
@@ -262,12 +340,143 @@ class HttpTransport {
     if (!this.sessionId) return
     await fetch(this.config.url, {
       method: 'DELETE',
-      headers: this.#headers(),
+      headers: await this.#headers(),
       signal: AbortSignal.timeout(3000),
     }).catch(() => undefined)
   }
 }
 
+/**
+ * Legacy HTTP+SSE transport (protocol 2024-11-05): a long-lived GET stream carries every
+ * server message; the first `endpoint` event names the URL that requests are POSTed to.
+ */
+class SseTransport {
+  constructor(config, { auth, onNotification } = {}) {
+    this.config = config
+    this.auth = auth
+    this.onNotification = onNotification
+    this.pending = new Map()
+    this.closed = false
+    this.controller = new AbortController()
+  }
+
+  async start() {
+    const base = checkRemoteUrl(this.config.url)
+    const response = await authedFetch(
+      this.config.url,
+      async () => ({
+        method: 'GET',
+        headers: await remoteHeaders(this.config, this.auth, { Accept: 'text/event-stream' }),
+        signal: this.controller.signal,
+      }),
+      this.auth,
+    )
+    if (!response.ok || !response.body) {
+      const text = await response.text().catch(() => '')
+      throw new Error(`MCP server answered ${response.status}${text ? `: ${text.slice(0, 200)}` : ''}`)
+    }
+    const endpoint = new Promise((resolve, reject) => {
+      this.resolveEndpoint = resolve
+      this.rejectEndpoint = reject
+    })
+    void this.#pump(response, base)
+    await withTimeout(endpoint, 30_000, 'SSE endpoint handshake')
+  }
+
+  async #pump(response, base) {
+    let failure = new Error('The MCP server closed the SSE stream.')
+    try {
+      for await (const { event, data } of sseEvents(response, this.controller.signal)) {
+        if (event === 'endpoint') {
+          const target = new URL(data.trim(), base)
+          if (target.origin !== base.origin) throw new Error('The SSE server pointed to a different host; refusing to follow it.')
+          this.endpoint = target.toString()
+          this.resolveEndpoint?.()
+          continue
+        }
+        let message
+        try {
+          message = JSON.parse(data)
+        } catch {
+          continue
+        }
+        this.#dispatch(message)
+      }
+    } catch (error) {
+      if (!this.controller.signal.aborted) failure = error instanceof Error ? error : failure
+    }
+    const wasClosed = this.closed
+    this.closed = true
+    this.rejectEndpoint?.(failure)
+    for (const entry of this.pending.values()) entry.reject(failure)
+    this.pending.clear()
+    if (!wasClosed) this.onExit?.(failure)
+  }
+
+  #dispatch(message) {
+    if (message && message.id !== undefined && (message.result !== undefined || message.error)) {
+      const entry = this.pending.get(message.id)
+      if (!entry) return
+      this.pending.delete(message.id)
+      if (message.error) entry.reject(new RpcError(message.error))
+      else entry.resolve(message.result)
+      return
+    }
+    if (message?.method && message.id !== undefined) {
+      const reply =
+        message.method === 'ping'
+          ? { jsonrpc: '2.0', id: message.id, result: {} }
+          : { jsonrpc: '2.0', id: message.id, error: { code: -32601, message: 'Method not supported by OpenSol.' } }
+      void this.#post(reply).catch(() => undefined)
+      return
+    }
+    if (message?.method) this.onNotification?.(message.method, message.params)
+  }
+
+  async #post(message) {
+    if (this.closed || !this.endpoint) throw new Error('The MCP server is not connected.')
+    const response = await authedFetch(
+      this.endpoint,
+      async () => ({
+        method: 'POST',
+        headers: await remoteHeaders(this.config, this.auth, { 'Content-Type': 'application/json' }),
+        body: JSON.stringify(message),
+        signal: AbortSignal.timeout(30_000),
+      }),
+      this.auth,
+    )
+    if (!response.ok) {
+      const text = await response.text().catch(() => '')
+      throw new Error(`MCP server answered ${response.status}${text ? `: ${text.slice(0, 200)}` : ''}`)
+    }
+    await response.body?.cancel().catch(() => undefined)
+  }
+
+  request(method, params, timeoutMs = REQUEST_TIMEOUT_MS) {
+    const id = ++requestCounter
+    const promise = new Promise((resolve, reject) => {
+      this.pending.set(id, { resolve, reject })
+      this.#post({ jsonrpc: '2.0', id, method, params }).catch((error) => {
+        this.pending.delete(id)
+        reject(error)
+      })
+    })
+    return withTimeout(promise, timeoutMs, method).catch((error) => {
+      this.pending.delete(id)
+      throw error
+    })
+  }
+
+  notify(method, params) {
+    return this.#post({ jsonrpc: '2.0', method, params })
+  }
+
+  async close() {
+    this.closed = true
+    this.controller.abort()
+  }
+}
+
 function slug(value, max) {
   return (
     String(value ?? '')
@@ -314,7 +523,7 @@ export function sanitizeServerConfig(input, existing) {
   const raw = input && typeof input === 'object' ? input : {}
   const name = typeof raw.name === 'string' ? raw.name.trim().slice(0, 60) : ''
   if (!name) throw new HttpError(400, 'Give each MCP server a name.', 'bad_mcp')
-  const transport = raw.transport === 'http' ? 'http' : 'stdio'
+  const transport = raw.transport === 'http' || raw.transport === 'sse' ? raw.transport : 'stdio'
   const id =
     typeof raw.id === 'string' && /^[a-z0-9][a-z0-9-]{0,39}$/.test(raw.id)
       ? raw.id
@@ -361,6 +570,16 @@ export function sanitizeServerConfig(input, existing) {
       if (!/^[A-Za-z0-9-]{1,80}$/.test(key)) delete headers[key]
     }
     config.headers = headers
+    const oauth = raw.oauth && typeof raw.oauth === 'object' && raw.oauth.enabled ? raw.oauth : null
+    if (oauth) {
+      const text = (value, max) => (typeof value === 'string' ? value.trim().slice(0, max) : '')
+      config.oauth = {
+        enabled: true,
+        clientId: text(oauth.clientId, 300),
+        clientSecret: oauth.clientSecret === MASK ? existing?.oauth?.clientSecret ?? '' : text(oauth.clientSecret, 600),
+        scope: text(oauth.scope, 400),
+      }
+    }
   }
   return config
 }
@@ -370,6 +589,122 @@ export class McpManager {
     this.configs = new Map()
     this.runtime = new Map()
     this.getCwd = async () => os.homedir()
+    this.pendingAuth = new PendingAuthorizations()
+    this.refreshing = new Map()
+    // OAuth client + tokens per server. The daemon swaps in the encrypted secrets file.
+    const memory = new Map()
+    this.authStore = {
+      get: async (id) => memory.get(id) ?? null,
+      set: async (id, value) => void memory.set(id, value),
+      delete: async (id) => void memory.delete(id),
+    }
+  }
+
+  /** Auth hooks handed to a remote transport; null when the server does not use OAuth. */
+  #authHooks(config) {
+    if (!config.oauth?.enabled) return null
+    const id = config.id
+    const refresh = () => {
+      const running = this.refreshing.get(id)
+      if (running) return running
+      const task = (async () => {
+        const entry = await this.authStore.get(id)
+        if (!entry?.tokens?.refreshToken || !entry.metadata || !entry.client) return false
+        try {
+          const tokens = await refreshTokens({ metadata: entry.metadata, client: entry.client, tokens: entry.tokens, resource: entry.metadata.resource })
+          await this.authStore.set(id, { ...entry, tokens })
+          return true
+        } catch (error) {
+          // A rejected refresh token means the grant is gone; anything else may be transient.
+          if (error?.oauthError === 'invalid_grant') await this.authStore.set(id, { ...entry, tokens: null })
+          return false
+        }
+      })().finally(() => this.refreshing.delete(id))
+      this.refreshing.set(id, task)
+      return task
+    }
+    return {
+      refresh,
+      header: async () => {
+        let entry = await this.authStore.get(id)
+        if (!entry?.tokens) return ''
+        if (!tokenIsFresh(entry.tokens)) {
+          if (!(await refresh())) return ''
+          entry = await this.authStore.get(id)
+        }
+        return entry?.tokens?.accessToken ? `Bearer ${entry.tokens.accessToken}` : ''
+      },
+    }
+  }
+
+  /** Step 1 of sign-in: returns the URL the person must open to approve access. */
+  async startAuth(id, redirectUri) {
+    const config = this.configs.get(id)
+    if (!config) throw new HttpError(404, 'Unknown MCP server.', 'mcp_missing')
+    if (!config.oauth?.enabled) throw new HttpError(400, 'OAuth is not turned on for this server.', 'mcp_no_oauth')
+    const state = this.runtime.get(id)
+    try {
+      const stored = await this.authStore.get(id)
+      const metadata = await discover(config.url, state?.wwwAuthenticate ?? '')
+      let client
+      if (config.oauth.clientId) {
+        client = { clientId: config.oauth.clientId, clientSecret: config.oauth.clientSecret || '' }
+      } else if (stored?.client?.redirectUri === redirectUri && stored.client.issuer === metadata.issuer) {
+        client = stored.client
+      } else {
+        client = { ...(await registerClient(metadata, redirectUri, 'OpenSol')), redirectUri, issuer: metadata.issuer }
+      }
+      const { verifier, challenge } = createPkce()
+      const resource = metadata.resource || config.url
+      const key = this.pendingAuth.create({ id, verifier, redirectUri, metadata, client, resource })
+      return {
+        url: buildAuthorizationUrl({
+          metadata,
+          clientId: client.clientId,
+          redirectUri,
+          state: key,
+          challenge,
+          scope: config.oauth.scope,
+          resource,
+        }),
+      }
+    } catch (error) {
+      throw new HttpError(502, error instanceof Error ? error.message : 'Could not start sign-in.', 'mcp_auth_failed')
+    }
+  }
+
+  /** Step 2: the authorization server redirected back with a code. */
+  async finishAuth(stateKey, code) {
+    const pending = this.pendingAuth.take(stateKey)
+    if (!pending) throw new HttpError(400, 'This sign-in link expired or was already used. Start again from the MCP panel.', 'mcp_auth_state')
+    const config = this.configs.get(pending.id)
+    if (!config) throw new HttpError(404, 'That MCP server was removed.', 'mcp_missing')
+    let tokens
+    try {
+      tokens = await exchangeCode({
+        metadata: pending.metadata,
+        client: pending.client,
+        code,
+        verifier: pending.verifier,
+        redirectUri: pending.redirectUri,
+        resource: pending.resource,
+      })
+    } catch (error) {
+      throw new HttpError(502, error instanceof Error ? error.message : 'Could not finish sign-in.', 'mcp_auth_failed')
+    }
+    await this.authStore.set(pending.id, { metadata: pending.metadata, client: pending.client, tokens })
+    await this.connect(pending.id)
+    return config
+  }
+
+  async signOut(id) {
+    await this.authStore.delete(id)
+    await this.disconnect(id)
+    const config = this.configs.get(id)
+    if (config?.enabled && config.oauth?.enabled) {
+      this.runtime.set(id, { status: 'needs_auth', error: '', tools: [], authorized: false })
+    }
+    return config ? this.view(config) : null
   }
 
   async setConfigs(configs) {
@@ -401,6 +736,15 @@ export class McpManager {
       error: state.error ?? '',
       serverInfo: state.serverInfo ?? null,
       connectedAt: state.connectedAt ?? null,
+      oauth: config.oauth?.enabled
+        ? {
+            enabled: true,
+            clientId: config.oauth.clientId,
+            clientSecret: config.oauth.clientSecret ? MASK : '',
+            scope: config.oauth.scope,
+            authorized: state.authorized === true,
+          }
+        : null,
       tools: (state.tools ?? []).map((tool) => ({
         name: tool.name,
         fn: functionName(config.id, tool.name),
@@ -425,18 +769,20 @@ export class McpManager {
     const state = { status: 'connecting', error: '', tools: [] }
     this.runtime.set(id, state)
     try {
+      const onNotification = (method) => {
+        if (method === 'notifications/tools/list_changed') void this.refresh(id).catch(() => undefined)
+      }
+      const auth = config.transport === 'stdio' ? null : this.#authHooks(config)
       const transport =
         config.transport === 'http'
-          ? new HttpTransport(config)
-          : new StdioTransport(config, {
-              cwd: await this.getCwd(),
-              onNotification: (method) => {
-                if (method === 'notifications/tools/list_changed') void this.refresh(id).catch(() => undefined)
-              },
-            })
+          ? new HttpTransport(config, { auth })
+          : config.transport === 'sse'
+            ? new SseTransport(config, { auth, onNotification })
+            : new StdioTransport(config, { cwd: await this.getCwd(), onNotification })
       state.transport = transport
+      state.authorized = Boolean(auth && (await this.authStore.get(id))?.tokens)
       await transport.start()
-      if (config.transport === 'stdio') {
+      if (config.transport !== 'http') {
         transport.onExit = (error) => {
           if (this.runtime.get(id) === state && state.status === 'connected') {
             state.status = 'error'
@@ -458,9 +804,22 @@ export class McpManager {
       state.tools = await this.#listTools(transport)
       state.status = 'connected'
       state.connectedAt = Date.now()
+      state.authorized = Boolean(auth && (await this.authStore.get(id))?.tokens)
     } catch (error) {
-      state.status = 'error'
-      state.error = error instanceof Error ? error.message : 'Could not connect.'
+      if (error instanceof AuthRequiredError) {
+        state.authorized = false
+        if (config.oauth?.enabled) {
+          state.status = 'needs_auth'
+          state.error = ''
+          state.wwwAuthenticate = error.wwwAuthenticate
+        } else {
+          state.status = 'error'
+          state.error = 'The server answered 401 (sign-in required). Add credentials under Headers, or turn on OAuth.'
+        }
+      } else {
+        state.status = 'error'
+        state.error = error instanceof Error ? error.message : 'Could not connect.'
+      }
       await state.transport?.close().catch(() => undefined)
       state.transport = null
     }
@@ -511,7 +870,7 @@ export class McpManager {
     const state = this.runtime.get(id)
     if (!config) throw new HttpError(404, 'Unknown MCP server.', 'mcp_missing')
     if (!state?.transport || state.status !== 'connected') {
-      throw new HttpError(409, `${config.name} is not connected. Reconnect it in Settings → MCP.`, 'mcp_disconnected')
+      throw new HttpError(409, `${config.name} is not connected. Reconnect it in the MCP panel.`, 'mcp_disconnected')
     }
     if ((config.disabledTools ?? []).includes(toolName)) {
       throw new HttpError(403, `${toolName} is turned off for ${config.name}.`, 'mcp_tool_disabled')
@@ -524,6 +883,14 @@ export class McpManager {
       return { text: flattenContent(result), isError: result?.isError === true }
     } catch (error) {
       if (error instanceof RpcError) return { text: error.message, isError: true }
+      if (error instanceof AuthRequiredError) {
+        state.status = 'needs_auth'
+        state.authorized = false
+        state.wwwAuthenticate = error.wwwAuthenticate
+        await state.transport?.close().catch(() => undefined)
+        state.transport = null
+        throw new HttpError(401, `${config.name} needs you to sign in again. Open the MCP panel and press Authorize.`, 'mcp_auth')
+      }
       throw new HttpError(502, error instanceof Error ? error.message : 'The MCP call failed.', 'mcp_failed')
     }
   }

package/src/App.tsx

@@ -4,6 +4,7 @@ import { ChatView } from './components/ChatView'
 import { WorkspacePanel } from './components/WorkspacePanel'
 import { SettingsModal } from './components/SettingsModal'
 import { DeployModal } from './components/DeployModal'
+import { McpPanel } from './components/McpPanel'
 import { CommandPalette } from './components/CommandPalette'
 import { Splash } from './components/Splash'
 import { ConfirmDialog, ToastHost } from './components/ui'
@@ -138,6 +139,7 @@ export default function App() {
             <WorkspacePanel />
           </div>
           <SettingsModal />
+          <McpPanel />
           <DeployModal />
           <CommandPalette />
           <ConfirmDialog />

package/src/components/CommandPalette.tsx

@@ -11,6 +11,7 @@ import {
   MessageSquare,
   Moon,
   Palette,
+  Plug,
   Plus,
   Rocket,
   Search,
@@ -39,6 +40,7 @@ export function CommandPalette() {
   const open = useUi((state) => state.paletteOpen)
   const setOpen = useUi((state) => state.setPaletteOpen)
   const openSettings = useUi((state) => state.openSettings)
+  const setMcpOpen = useUi((state) => state.setMcpOpen)
   const setWorkspaceOpen = useUi((state) => state.setWorkspaceOpen)
   const setDeployOpen = useUi((state) => state.setDeployOpen)
   const focusComposer = useUi((state) => state.focusComposer)
@@ -146,6 +148,17 @@ export function CommandPalette() {
           close()
         },
       },
+      {
+        id: 'action-mcp',
+        label: 'MCP servers',
+        hint: 'Connections, OAuth sign-in and tools',
+        group: 'Settings',
+        icon: Plug,
+        action: () => {
+          close()
+          setMcpOpen(true)
+        },
+      },
       {
         id: 'action-skills',
         label: 'Skills',
@@ -241,7 +254,7 @@ export function CommandPalette() {
       }))
 
     return [...actions, ...chatCommands, ...fileCommands]
-  }, [sessions, entries, focusComposer, notify, openSettings, setOpen, setWorkspaceOpen, setDeployOpen])
+  }, [sessions, entries, focusComposer, notify, openSettings, setMcpOpen, setOpen, setWorkspaceOpen, setDeployOpen])
 
   const filtered = useMemo(() => {
     const needle = query.trim().toLowerCase()

package/src/components/Logo.tsx

@@ -35,7 +35,7 @@ export function LogoLockup({ compact = false }: { compact?: boolean }) {
 export function BrandFooter() {
   return (
     <p className="text-[11px] tracking-[0.01em] text-faint">
-      OpenSol <span className="px-1 text-line">/</span> by OpenSoft
+      OpenSol <span className="px-1 text-line">/</span> by OpenSoftX
     </p>
   )
 }