@brainmcp/brainmcp 0.1.12 → 0.1.14

package/dist/hooks/vscode.js

@@ -0,0 +1,27 @@
+export function parseVsCodeEvent(raw, eventName = 'sessionStart') {
+    const input = (raw && typeof raw === 'object' ? raw : {});
+    return {
+        client: 'vscode',
+        event: eventName,
+        sessionKey: input.session_id || input.sessionId || 'default_session',
+        cwd: input.cwd || input.workspace,
+        source: input.source,
+        prompt: input.prompt,
+        toolName: input.tool_name,
+        toolInput: input.tool_input,
+        toolResult: input.tool_result ?? input.tool_response,
+        model: input.model,
+    };
+}
+export function emitVsCodeOutput(event, additionalContext) {
+    if ((event.event === 'SessionStart' || event.event === 'sessionStart') && additionalContext) {
+        return {
+            hookSpecificOutput: {
+                hookEventName: 'SessionStart',
+                additionalContext,
+            },
+        };
+    }
+    return {};
+}
+//# sourceMappingURL=vscode.js.map

package/dist/hooks/vscode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vscode.js","sourceRoot":"","sources":["../../src/hooks/vscode.ts"],"names":[],"mappings":"AAuBA,MAAM,UAAU,gBAAgB,CAAC,GAAY,EAAE,SAAS,GAAG,cAAc;IACvE,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAoB,CAAC;IAC7E,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,SAAS;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,IAAI,iBAAiB;QACpE,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,SAAS;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,SAAS;QACzB,SAAS,EAAE,KAAK,CAAC,UAAU;QAC3B,UAAU,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,aAAa;QACpD,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAgB,EAAE,iBAA0B;IAC3E,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,cAAc,IAAI,KAAK,CAAC,KAAK,KAAK,cAAc,CAAC,IAAI,iBAAiB,EAAE,CAAC;QAC5F,OAAO;YACL,kBAAkB,EAAE;gBAClB,aAAa,EAAE,cAAc;gBAC7B,iBAAiB;aAClB;SACF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/index.js

@@ -1,106 +1,11 @@
 #!/usr/bin/env node
-import { argv, cwd, stdin, stdout } from 'node:process';
-import { createInterface } from 'node:readline/promises';
-import { BRAINMCP_CLI_PACKAGE_SPEC, BRAINMCP_GLOBAL_CLIENTS } from './agent-config.js';
-import { doctor, init, initAll, printConfig, remove } from './commands/index.js';
-import { assertClientId, CLIENT_IDS, clientLabel } from './lib/config.js';
-const HELP = `brainmcp — configure BrainMCP for agent projects
-
-Recommended setup (supported agents, all projects):
-  npx --yes ${BRAINMCP_CLI_PACKAGE_SPEC} init --all --scope user
-
-Usage:
-  brainmcp init [--client <client>] [--workspace <id>] [--scope project|user] [--yes]
-  brainmcp init --all [--workspace <id>] [--scope project|user] [--yes]
-  brainmcp doctor [--client <client>] [--workspace <id>] [--scope project|user]
-  brainmcp print [--client <client>] [--workspace <id>] [--scope project|user]
-  brainmcp remove [--client <client>] [--scope project|user] [--yes]
-
-Clients: ${CLIENT_IDS.join(', ')}
---all configures ${BRAINMCP_GLOBAL_CLIENTS.map(clientLabel).join(', ')} (generic is client-specific).
-Project scope is the default. User scope writes to each host's supported per-user locations.
-Every mutation previews a diff and needs confirmation unless a trailing CLI --yes is supplied.
-The leading npx --yes above accepts npm's package download; it does not skip the file preview.`;
-async function main() {
-    const [command, ...rawOptions] = argv.slice(2);
-    if (!command || command === '--help' || command === '-h' || command === 'help') {
-        console.log(HELP);
-        return;
-    }
-    const values = parseOptions(rawOptions);
-    if (values.all && values.client)
-        throw new Error('Use either --all or --client, not both.');
-    if (values.all && command !== 'init')
-        throw new Error('--all is currently supported only by init.');
-    const options = {
-        root: values.root ?? cwd(),
-        client: values.client,
-        workspace: values.workspace,
-        scope: values.scope ?? 'project',
-        yes: values.yes,
-        output: console.log,
-        confirm: confirm,
-    };
-    switch (command) {
-        case 'init':
-            await (values.all ? initAll(options) : init(options));
-            return;
-        case 'doctor':
-            await doctor(options);
-            return;
-        case 'print':
-            await printConfig(options);
-            return;
-        case 'remove':
-            await remove(options);
-            return;
-        default:
-            throw new Error(`Unknown command: ${command}\n\n${HELP}`);
-    }
-}
-function parseOptions(args) {
-    const result = { yes: false, all: false };
-    for (let index = 0; index < args.length; index += 1) {
-        const option = args[index];
-        if (option === '--yes' || option === '-y')
-            result.yes = true;
-        else if (option === '--all')
-            result.all = true;
-        else if (option === '--client')
-            result.client = assertClientId(readValue(args, ++index, option));
-        else if (option === '--workspace')
-            result.workspace = readValue(args, ++index, option);
-        else if (option === '--scope') {
-            const scope = readValue(args, ++index, option);
-            if (scope !== 'project' && scope !== 'user')
-                throw new Error('--scope must be project or user.');
-            result.scope = scope;
-        }
-        else if (option === '--root')
-            result.root = readValue(args, ++index, option);
-        else
-            throw new Error(`Unknown option: ${option}`);
-    }
-    return result;
-}
-function readValue(args, index, option) {
-    const value = args[index];
-    if (!value || value.startsWith('-'))
-        throw new Error(`${option} requires a value.`);
-    return value;
-}
-async function confirm(message) {
-    if (!stdin.isTTY || !stdout.isTTY)
-        return false;
-    const readline = createInterface({ input: stdin, output: stdout });
-    try {
-        return (await readline.question(`${message} [y/N] `)).trim().toLowerCase() === 'y';
-    }
-    finally {
-        readline.close();
-    }
-}
-main().catch((error) => {
+import { argv } from 'node:process';
+import { dispatch } from './commands/dispatch.js';
+dispatch(argv.slice(2))
+    .then((code) => {
+    process.exitCode = code;
+})
+    .catch((error) => {
     console.error(error instanceof Error ? error.message : String(error));
     process.exitCode = 1;
 });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,IAAI,EAAE,GAAG,EAAY,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAuB,MAAM,qBAAqB,CAAC;AACtG,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAA6B,MAAM,iBAAiB,CAAC;AAErG,MAAM,IAAI,GAAG;;;cAGC,yBAAyB;;;;;;;;;WAS5B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;mBACb,uBAAuB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;+FAGyB,CAAC;AAEhG,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC5F,IAAI,MAAM,CAAC,GAAG,IAAI,OAAO,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACpG,MAAM,OAAO,GAAmB;QAC9B,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,GAAG,EAAE;QAC1B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,SAAS;QAChC,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,MAAM,EAAE,OAAO,CAAC,GAAG;QACnB,OAAO,EAAE,OAAO;KACjB,CAAC;IACF,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,MAAM;YACT,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACtD,OAAO;QACT,KAAK,QAAQ;YACX,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO;QACT,KAAK,OAAO;YACV,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;YAC3B,OAAO;QACT,KAAK,QAAQ;YACX,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO;QACT;YACE,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,OAAO,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAc;IAClC,MAAM,MAAM,GAAwG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAC/I,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;aACxD,IAAI,MAAM,KAAK,OAAO;YAAE,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;aAC1C,IAAI,MAAM,KAAK,UAAU;YAAE,MAAM,CAAC,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;aAC5F,IAAI,MAAM,KAAK,aAAa;YAAE,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;aAClF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC/C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACjG,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACvB,CAAC;aAAM,IAAI,MAAM,KAAK,QAAQ;YAAE,MAAM,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;;YAC1E,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,IAAc,EAAE,KAAa,EAAE,MAAc;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,oBAAoB,CAAC,CAAC;IACpF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,OAAe;IACpC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,GAAG,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC;IACrF,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC9B,OAAO,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,IAAI,EAAY,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAElD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;KACpB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;IACb,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;AAC1B,CAAC,CAAC;KACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IACxB,OAAO,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/lib/api-client.d.ts

@@ -0,0 +1,32 @@
+import type { CredentialStore, StoredCredentials } from './credentials.js';
+import { OAuthClient } from './oauth-client.js';
+export interface ApiClientOptions {
+    apiUrl?: string;
+    store: CredentialStore;
+    oauthClient?: OAuthClient;
+    fetchFn?: typeof fetch;
+    serviceTokenEnv?: string;
+    timeoutMs?: number;
+}
+export interface ApiRequestOptions {
+    method?: string;
+    headers?: Record<string, string>;
+    body?: unknown;
+    timeoutMs?: number;
+    skipAuth?: boolean;
+    signal?: AbortSignal;
+    expectedAuthorizationId?: string;
+    beforeSend?: () => boolean;
+}
+export declare class ApiClient {
+    private apiUrl;
+    private store;
+    private oauthClient;
+    private fetchFn;
+    private serviceToken?;
+    private defaultTimeoutMs;
+    constructor(options: ApiClientOptions);
+    getEffectiveCredentials(): Promise<StoredCredentials | null>;
+    request<T>(path: string, options?: ApiRequestOptions): Promise<T>;
+    private refreshTokensWithLock;
+}

package/dist/lib/api-client.js

@@ -0,0 +1,207 @@
+import { randomUUID } from 'node:crypto';
+import { describeMisdirectedCompanionApi, resolveCompanionApiUrl } from './endpoints.js';
+import { grantedCliScopes, OAuthClient } from './oauth-client.js';
+import { validateHttpUrl, withRequestDeadline } from './http.js';
+export class ApiClient {
+    apiUrl;
+    store;
+    oauthClient;
+    fetchFn;
+    serviceToken;
+    defaultTimeoutMs;
+    constructor(options) {
+        this.apiUrl = (options.apiUrl ?? resolveCompanionApiUrl()).replace(/\/+$/, '');
+        this.store = options.store;
+        this.fetchFn = options.fetchFn ?? fetch;
+        this.oauthClient = options.oauthClient ?? new OAuthClient({ fetchFn: this.fetchFn });
+        this.serviceToken = options.serviceTokenEnv ?? process.env.BRAINMCP_SERVICE_TOKEN;
+        this.defaultTimeoutMs = options.timeoutMs ?? 15_000;
+        validateHttpUrl(this.apiUrl);
+    }
+    async getEffectiveCredentials() {
+        const stored = await this.store.get();
+        if (stored?.authType === 'oauth' && stored.accessToken) {
+            return stored;
+        }
+        if (this.serviceToken) {
+            return {
+                version: 1,
+                authType: 'service',
+                serviceToken: this.serviceToken,
+                updatedAt: new Date().toISOString(),
+            };
+        }
+        return stored;
+    }
+    async request(path, options = {}) {
+        return withRequestDeadline(options.timeoutMs ?? this.defaultTimeoutMs, options.signal, async (signal) => {
+            const explicitAuthorization = new Headers(options.headers).has('Authorization');
+            const useStoredAuth = !options.skipAuth && !explicitAuthorization;
+            const creds = useStoredAuth ? await this.getEffectiveCredentials() : null;
+            signal.throwIfAborted();
+            if (options.expectedAuthorizationId && creds?.authorizationId !== options.expectedAuthorizationId) {
+                throw new Error('Companion authorization changed before the request.');
+            }
+            const url = new URL(path, `${this.apiUrl}/`);
+            if (url.origin !== new URL(this.apiUrl).origin || url.username || url.password) {
+                throw new Error('API requests must use the configured API origin.');
+            }
+            const isOrientEndpoint = url.pathname.endsWith('/orient');
+            if (creds?.authType === 'service' && isOrientEndpoint) {
+                throw new Error('Service tokens cannot access /orient. Interactive companion OAuth credentials are required for session orientation.');
+            }
+            const requestId = randomUUID();
+            const execute = async (token) => {
+                const headers = new Headers(options.headers);
+                headers.set('x-request-id', requestId);
+                headers.set('Accept', 'application/json');
+                if (options.body && !headers.has('Content-Type')) {
+                    headers.set('Content-Type', 'application/json');
+                }
+                if (token && useStoredAuth) {
+                    headers.set('Authorization', `Bearer ${token}`);
+                }
+                signal.throwIfAborted();
+                if (options.beforeSend && !options.beforeSend())
+                    throw new Error('Request cancelled because capture consent changed.');
+                return await this.fetchFn(url.toString(), {
+                    method: options.method ?? (options.body ? 'POST' : 'GET'),
+                    headers,
+                    body: options.body ? JSON.stringify(options.body) : undefined,
+                    signal,
+                    redirect: 'error',
+                });
+            };
+            let token = creds?.authType === 'oauth' ? creds.accessToken ?? null : creds?.serviceToken ?? null;
+            let res = await execute(token);
+            // Handle 401 with refresh-once policy if using OAuth credentials
+            if (res.status === 401 && creds?.authType === 'oauth' && creds.refreshToken) {
+                await res.body?.cancel();
+                const refreshed = await this.refreshTokensWithLock(token, creds, signal);
+                if (refreshed) {
+                    token = refreshed.accessToken ?? null;
+                    res = await execute(token);
+                }
+            }
+            if (!res.ok) {
+                // Response bodies can echo credentials or captured content. Keep them out
+                // of terminal output, persisted queue errors, and hook diagnostics.
+                const misdirected = res.status === 404 ? describeMisdirectedCompanionApi(this.apiUrl) : null;
+                const error = new Error(misdirected
+                    ? `API request failed (status 404) for ${url.pathname}. ${misdirected}`
+                    : `API request failed (status ${res.status})`);
+                error.status = res.status;
+                throw error;
+            }
+            if (res.status === 204) {
+                return undefined;
+            }
+            return (await res.json());
+        });
+    }
+    async refreshTokensWithLock(failedAccessToken, original, signal) {
+        const leaseHolder = randomUUID();
+        const leaseDurationMs = 15_000;
+        let refreshToken = null;
+        // Claim a short fenced lease under the credential lock, then release the
+        // filesystem lock before doing OAuth network I/O. A concurrent process
+        // either reuses the rotated credential or waits for the lease owner.
+        for (let attempt = 0; attempt < 50; attempt += 1) {
+            signal.throwIfAborted();
+            const claim = await this.store.withRefreshLock(async (current) => {
+                signal.throwIfAborted();
+                if (current?.authorizationId !== original.authorizationId || current?.userId !== original.userId) {
+                    return { kind: 'missing', current: null };
+                }
+                if (!current || current.authType !== 'oauth' || !current.refreshToken) {
+                    return { kind: 'missing', current };
+                }
+                if (current.accessToken && current.accessToken !== failedAccessToken) {
+                    return { kind: 'reuse', current };
+                }
+                const leaseExpiry = current.refreshLease
+                    ? Date.parse(current.refreshLease.expiresAt)
+                    : Number.NaN;
+                if (current.refreshLease &&
+                    current.refreshLease.leaseHolder !== leaseHolder &&
+                    Number.isFinite(leaseExpiry) &&
+                    leaseExpiry > Date.now()) {
+                    return { kind: 'wait', current };
+                }
+                const updated = {
+                    ...current,
+                    refreshLease: {
+                        leaseHolder,
+                        expiresAt: new Date(Date.now() + leaseDurationMs).toISOString(),
+                        revision: (current.refreshLease?.revision ?? 0) + 1,
+                    },
+                    updatedAt: new Date().toISOString(),
+                };
+                await this.store.set(updated);
+                return { kind: 'claimed', current: updated };
+            });
+            if (claim.kind === 'missing')
+                return claim.current;
+            if (claim.kind === 'reuse')
+                return claim.current;
+            if (claim.kind === 'claimed') {
+                refreshToken = claim.current.refreshToken ?? null;
+                break;
+            }
+            await new Promise((resolve) => setTimeout(resolve, 80 + Math.floor(Math.random() * 40)));
+        }
+        if (!refreshToken)
+            return null;
+        try {
+            const endpoints = await this.oauthClient.discoverEndpoints(signal);
+            const tokenResponse = await this.oauthClient.refreshAccessToken({
+                tokenEndpoint: endpoints.tokenEndpoint,
+                refreshToken,
+                signal,
+            });
+            return await this.store.withRefreshLock(async (current) => {
+                signal.throwIfAborted();
+                if (!current || current.authType !== 'oauth' || current.authorizationId !== original.authorizationId || current.userId !== original.userId)
+                    return null;
+                if (current.refreshLease?.leaseHolder !== leaseHolder) {
+                    return current.accessToken !== failedAccessToken ? current : null;
+                }
+                if (current.refreshToken && current.refreshToken !== refreshToken) {
+                    const reused = { ...current, refreshLease: undefined, updatedAt: new Date().toISOString() };
+                    await this.store.set(reused);
+                    return reused;
+                }
+                const now = new Date();
+                const scopes = tokenResponse.scope === undefined
+                    ? current.scopes
+                    : grantedCliScopes(current.scopes ?? [], tokenResponse.scope);
+                const updated = {
+                    ...current,
+                    accessToken: tokenResponse.access_token,
+                    refreshToken: tokenResponse.refresh_token ?? current.refreshToken,
+                    scopes,
+                    expiresAt: tokenResponse.expires_in
+                        ? new Date(now.getTime() + tokenResponse.expires_in * 1000).toISOString()
+                        : current.expiresAt,
+                    refreshLease: undefined,
+                    updatedAt: now.toISOString(),
+                };
+                await this.store.set(updated);
+                return updated;
+            });
+        }
+        catch (error) {
+            await this.store.withRefreshLock(async (current) => {
+                if (current?.authType === 'oauth' && current.refreshLease?.leaseHolder === leaseHolder) {
+                    await this.store.set({
+                        ...current,
+                        refreshLease: undefined,
+                        updatedAt: new Date().toISOString(),
+                    });
+                }
+            });
+            throw error;
+        }
+    }
+}
+//# sourceMappingURL=api-client.js.map

package/dist/lib/api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../../src/lib/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,+BAA+B,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAsBjE,MAAM,OAAO,SAAS;IACZ,MAAM,CAAS;IACf,KAAK,CAAkB;IACvB,WAAW,CAAc;IACzB,OAAO,CAAe;IACtB,YAAY,CAAU;IACtB,gBAAgB,CAAS;IAEjC,YAAY,OAAyB;QACnC,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,sBAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;QAClF,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;QACpD,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,uBAAuB;QAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACtC,IAAI,MAAM,EAAE,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO;gBACL,OAAO,EAAE,CAAC;gBACV,QAAQ,EAAE,SAAS;gBACnB,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,OAAO,CAAI,IAAY,EAAE,UAA6B,EAAE;QAC5D,OAAO,mBAAmB,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACxG,MAAM,qBAAqB,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAChF,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,qBAAqB,CAAC;YAClE,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1E,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,IAAI,OAAO,CAAC,uBAAuB,IAAI,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,uBAAuB,EAAE,CAAC;gBAClG,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;YAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAC/E,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,gBAAgB,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAE1D,IAAI,KAAK,EAAE,QAAQ,KAAK,SAAS,IAAI,gBAAgB,EAAE,CAAC;gBACtD,MAAM,IAAI,KAAK,CACb,qHAAqH,CACtH,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,KAAK,EAAE,KAAoB,EAAqB,EAAE;gBAChE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBAC7C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;gBACvC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;gBAE1C,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;oBACjD,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;gBAClD,CAAC;gBAED,IAAI,KAAK,IAAI,aAAa,EAAE,CAAC;oBAC3B,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;gBAClD,CAAC;gBAED,MAAM,CAAC,cAAc,EAAE,CAAC;gBACxB,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;gBACvH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;oBACtC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;oBACzD,OAAO;oBACP,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;oBAC7D,MAAM;oBACN,QAAQ,EAAE,OAAO;iBAClB,CAAC,CAAC;YACP,CAAC,CAAC;YAEF,IAAI,KAAK,GAAG,KAAK,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,YAAY,IAAI,IAAI,CAAC;YAClG,IAAI,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;YAE/B,iEAAiE;YACjE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,EAAE,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;gBAC5E,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBACzB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;gBACzE,IAAI,SAAS,EAAE,CAAC;oBACd,KAAK,GAAG,SAAS,CAAC,WAAW,IAAI,IAAI,CAAC;oBACtC,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,0EAA0E;gBAC1E,oEAAoE;gBACpE,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,+BAA+B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC7F,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,WAAW;oBACT,CAAC,CAAC,uCAAuC,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE;oBACvE,CAAC,CAAC,8BAA8B,GAAG,CAAC,MAAM,GAAG,CAClB,CAAC;gBAChC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;gBAC1B,MAAM,KAAK,CAAC;YACd,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,OAAO,SAAc,CAAC;YACxB,CAAC;YAED,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,iBAAgC,EAChC,QAA2B,EAC3B,MAAmB;QAEnB,MAAM,WAAW,GAAG,UAAU,EAAE,CAAC;QACjC,MAAM,eAAe,GAAG,MAAM,CAAC;QAC/B,IAAI,YAAY,GAAkB,IAAI,CAAC;QAEvC,yEAAyE;QACzE,uEAAuE;QACvE,qEAAqE;QACrE,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC/D,MAAM,CAAC,cAAc,EAAE,CAAC;gBACxB,IAAI,OAAO,EAAE,eAAe,KAAK,QAAQ,CAAC,eAAe,IAAI,OAAO,EAAE,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;oBACjG,OAAO,EAAE,IAAI,EAAE,SAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBACrD,CAAC;gBACD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;oBACtE,OAAO,EAAE,IAAI,EAAE,SAAkB,EAAE,OAAO,EAAE,CAAC;gBAC/C,CAAC;gBACD,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,KAAK,iBAAiB,EAAE,CAAC;oBACrE,OAAO,EAAE,IAAI,EAAE,OAAgB,EAAE,OAAO,EAAE,CAAC;gBAC7C,CAAC;gBACD,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY;oBACtC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC;oBAC5C,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACf,IACE,OAAO,CAAC,YAAY;oBACpB,OAAO,CAAC,YAAY,CAAC,WAAW,KAAK,WAAW;oBAChD,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAC5B,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,EACxB,CAAC;oBACD,OAAO,EAAE,IAAI,EAAE,MAAe,EAAE,OAAO,EAAE,CAAC;gBAC5C,CAAC;gBACD,MAAM,OAAO,GAAsB;oBACjC,GAAG,OAAO;oBACV,YAAY,EAAE;wBACZ,WAAW;wBACX,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC,CAAC,WAAW,EAAE;wBAC/D,QAAQ,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC;qBACpD;oBACD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC,CAAC;gBACF,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC9B,OAAO,EAAE,IAAI,EAAE,SAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YACxD,CAAC,CAAC,CAAC;YAEH,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC,OAAO,CAAC;YACnD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;gBAAE,OAAO,KAAK,CAAC,OAAO,CAAC;YACjD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC7B,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC;gBAClD,MAAM;YACR,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3F,CAAC;QAED,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACnE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC;gBAC9D,aAAa,EAAE,SAAS,CAAC,aAAa;gBACtC,YAAY;gBACZ,MAAM;aACP,CAAC,CAAC;YAEH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBACxD,MAAM,CAAC,cAAc,EAAE,CAAC;gBACxB,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;oBAAE,OAAO,IAAI,CAAC;gBACxJ,IAAI,OAAO,CAAC,YAAY,EAAE,WAAW,KAAK,WAAW,EAAE,CAAC;oBACtD,OAAO,OAAO,CAAC,WAAW,KAAK,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;gBACpE,CAAC;gBACD,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;oBAClE,MAAM,MAAM,GAAG,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;oBAC5F,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBAC7B,OAAO,MAAM,CAAC;gBAChB,CAAC;gBAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,KAAK,SAAS;oBAC9C,CAAC,CAAC,OAAO,CAAC,MAAM;oBAChB,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;gBAChE,MAAM,OAAO,GAAsB;oBACjC,GAAG,OAAO;oBACV,WAAW,EAAE,aAAa,CAAC,YAAY;oBACvC,YAAY,EAAE,aAAa,CAAC,aAAa,IAAI,OAAO,CAAC,YAAY;oBACjE,MAAM;oBACN,SAAS,EAAE,aAAa,CAAC,UAAU;wBACjC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;wBACzE,CAAC,CAAC,OAAO,CAAC,SAAS;oBACrB,YAAY,EAAE,SAAS;oBACvB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;iBAC7B,CAAC;gBACF,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC9B,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBACjD,IAAI,OAAO,EAAE,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,WAAW,KAAK,WAAW,EAAE,CAAC;oBACvF,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;wBACnB,GAAG,OAAO;wBACV,YAAY,EAAE,SAAS;wBACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;qBACpC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/lib/callback-server.d.ts

@@ -0,0 +1,17 @@
+export interface CallbackResult {
+    code?: string;
+    error?: string;
+    errorDescription?: string;
+}
+export interface CallbackServerOptions {
+    expectedState: string;
+    timeoutMs?: number;
+    pathname?: string;
+}
+export interface ActiveCallbackServer {
+    port: number;
+    redirectUri: string;
+    waitForCallback(): Promise<CallbackResult>;
+    close(): Promise<void>;
+}
+export declare function startCallbackServer(options: CallbackServerOptions): Promise<ActiveCallbackServer>;

package/dist/lib/callback-server.js

@@ -0,0 +1,145 @@
+import { createServer } from 'node:http';
+import { URL } from 'node:url';
+const SUCCESS_HTML = `<!DOCTYPE html>
+<html>
+<head><title>BrainMCP Authentication Successful</title><style>
+body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; display: flex; align-items: center; justify-content: center; height: 100vh; margin: 0; background: #0f172a; color: #f8fafc; }
+.card { background: #1e293b; padding: 2rem 3rem; border-radius: 12px; border: 1px solid #334155; text-align: center; max-width: 480px; box-shadow: 0 10px 25px rgba(0,0,0,0.5); }
+h1 { font-size: 1.5rem; margin-bottom: 0.5rem; color: #38bdf8; }
+p { color: #94a3b8; font-size: 0.95rem; line-height: 1.5; }
+</style></head>
+<body><div class="card"><h1>Authentication Successful</h1><p>You may close this tab and return to your terminal.</p></div></body>
+</html>`;
+const ERROR_HTML = (msg) => `<!DOCTYPE html>
+<html>
+<head><title>BrainMCP Authentication Failed</title><style>
+body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; display: flex; align-items: center; justify-content: center; height: 100vh; margin: 0; background: #0f172a; color: #f8fafc; }
+.card { background: #1e293b; padding: 2rem 3rem; border-radius: 12px; border: 1px solid #dc2626; text-align: center; max-width: 480px; }
+h1 { font-size: 1.5rem; margin-bottom: 0.5rem; color: #f87171; }
+p { color: #94a3b8; font-size: 0.95rem; line-height: 1.5; }
+</style></head>
+<body><div class="card"><h1>Authentication Failed</h1><p>${escapeHtml(msg)}</p></div></body>
+</html>`;
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+export async function startCallbackServer(options) {
+    const timeoutMs = options.timeoutMs ?? 300_000;
+    const expectedPathname = options.pathname ?? '/callback';
+    let hasFinished = false;
+    let isConsumed = false;
+    let server = null;
+    let timeoutHandle = null;
+    let resolveResult;
+    let rejectResult;
+    const resultPromise = new Promise((resolve, reject) => {
+        resolveResult = resolve;
+        rejectResult = reject;
+    });
+    // Prevent unhandledRejection if close() is invoked before consumer calls waitForCallback()
+    resultPromise.catch(() => { });
+    const closeServer = async () => {
+        if (timeoutHandle) {
+            clearTimeout(timeoutHandle);
+            timeoutHandle = null;
+        }
+        if (server) {
+            const s = server;
+            server = null;
+            await new Promise((resolve) => s.close(() => resolve()));
+        }
+    };
+    server = createServer((req, res) => {
+        if (!req.url) {
+            res.writeHead(400, { 'Content-Type': 'text/plain' });
+            res.end('Bad Request');
+            return;
+        }
+        const hostHeader = req.headers.host;
+        // Strict host check: must be 127.0.0.1 or localhost with optional port
+        if (!hostHeader || !/^(127\.0\.0\.1|localhost)(:\d+)?$/.test(hostHeader)) {
+            res.writeHead(400, { 'Content-Type': 'text/plain' });
+            res.end('Invalid host header');
+            return;
+        }
+        const parsedUrl = new URL(req.url, `http://${hostHeader}`);
+        // Path verification
+        if (parsedUrl.pathname !== expectedPathname) {
+            res.writeHead(404, { 'Content-Type': 'text/plain' });
+            res.end('Not Found');
+            return;
+        }
+        // One-shot check
+        if (isConsumed) {
+            res.writeHead(409, { 'Content-Type': 'text/html' });
+            res.end(ERROR_HTML('Callback already consumed or timed out.'));
+            return;
+        }
+        // State verification
+        const state = parsedUrl.searchParams.get('state');
+        if (!state || state !== options.expectedState) {
+            res.writeHead(400, { 'Content-Type': 'text/html' });
+            res.end(ERROR_HTML('State parameter mismatch or missing.'));
+            return;
+        }
+        // Mark as consumed
+        isConsumed = true;
+        hasFinished = true;
+        const error = parsedUrl.searchParams.get('error');
+        const errorDescription = parsedUrl.searchParams.get('error_description') ?? undefined;
+        const code = parsedUrl.searchParams.get('code') ?? undefined;
+        if (error) {
+            res.writeHead(200, { 'Content-Type': 'text/html' });
+            res.end(ERROR_HTML(errorDescription || `Error: ${error}`));
+            resolveResult({ error, errorDescription });
+            setTimeout(() => void closeServer(), 500);
+            return;
+        }
+        if (!code) {
+            res.writeHead(400, { 'Content-Type': 'text/html' });
+            res.end(ERROR_HTML('Missing authorization code in callback.'));
+            resolveResult({ error: 'missing_code', errorDescription: 'Authorization code was not provided.' });
+            setTimeout(() => void closeServer(), 500);
+            return;
+        }
+        res.writeHead(200, { 'Content-Type': 'text/html' });
+        res.end(SUCCESS_HTML);
+        resolveResult({ code });
+        setTimeout(() => void closeServer(), 500);
+    });
+    // Bind exclusively to 127.0.0.1 port 0
+    await new Promise((resolve, reject) => {
+        server.listen(0, '127.0.0.1', () => resolve());
+        server.on('error', reject);
+    });
+    const address = server.address();
+    const port = address.port;
+    const redirectUri = `http://127.0.0.1:${port}${expectedPathname}`;
+    timeoutHandle = setTimeout(() => {
+        if (!hasFinished) {
+            hasFinished = true;
+            isConsumed = true;
+            rejectResult(new Error(`Authentication timed out after ${Math.round(timeoutMs / 1000)} seconds.`));
+            void closeServer();
+        }
+    }, timeoutMs);
+    return {
+        port,
+        redirectUri,
+        waitForCallback: () => resultPromise,
+        close: async () => {
+            if (!hasFinished) {
+                hasFinished = true;
+                isConsumed = true;
+                rejectResult(new Error('Authentication cancelled by user.'));
+            }
+            await closeServer();
+        },
+    };
+}
+//# sourceMappingURL=callback-server.js.map

package/dist/lib/callback-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-server.js","sourceRoot":"","sources":["../../src/lib/callback-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AAEjG,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAqB/B,MAAM,YAAY,GAAG;;;;;;;;;QASb,CAAC;AAET,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC;;;;;;;;2DAQuB,UAAU,CAAC,GAAG,CAAC;QAClE,CAAC;AAET,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAA8B;IACtE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC;IAC/C,MAAM,gBAAgB,GAAG,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAC;IACzD,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,aAAa,GAA0B,IAAI,CAAC;IAEhD,IAAI,aAA+C,CAAC;IACpD,IAAI,YAAsC,CAAC;IAE3C,MAAM,aAAa,GAAG,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACpE,aAAa,GAAG,OAAO,CAAC;QACxB,YAAY,GAAG,MAAM,CAAC;IACxB,CAAC,CAAC,CAAC;IACH,2FAA2F;IAC3F,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAE9B,MAAM,WAAW,GAAG,KAAK,IAAI,EAAE;QAC7B,IAAI,aAAa,EAAE,CAAC;YAClB,YAAY,CAAC,aAAa,CAAC,CAAC;YAC5B,aAAa,GAAG,IAAI,CAAC;QACvB,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,GAAG,MAAM,CAAC;YACjB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;QAClE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QACpC,uEAAuE;QACvE,IAAI,CAAC,UAAU,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,UAAU,EAAE,CAAC,CAAC;QAE3D,oBAAoB;QACpB,IAAI,SAAS,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;YAC5C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,iBAAiB;QACjB,IAAI,UAAU,EAAE,CAAC;YACf,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,yCAAyC,CAAC,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QAED,qBAAqB;QACrB,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;YAC9C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,sCAAsC,CAAC,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,mBAAmB;QACnB,UAAU,GAAG,IAAI,CAAC;QAClB,WAAW,GAAG,IAAI,CAAC;QAEnB,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,gBAAgB,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,SAAS,CAAC;QACtF,MAAM,IAAI,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;QAE7D,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,gBAAgB,IAAI,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC;YAC3D,aAAa,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC3C,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,yCAAyC,CAAC,CAAC,CAAC;YAC/D,aAAa,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,sCAAsC,EAAE,CAAC,CAAC;YACnG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;QACpD,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtB,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACxB,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,uCAAuC;IACvC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAO,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAChD,MAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,MAAM,WAAW,GAAG,oBAAoB,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAElE,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;QAC9B,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,WAAW,GAAG,IAAI,CAAC;YACnB,UAAU,GAAG,IAAI,CAAC;YAClB,YAAY,CAAC,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YACnG,KAAK,WAAW,EAAE,CAAC;QACrB,CAAC;IACH,CAAC,EAAE,SAAS,CAAC,CAAC;IAEd,OAAO;QACL,IAAI;QACJ,WAAW;QACX,eAAe,EAAE,GAAG,EAAE,CAAC,aAAa;QACpC,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,WAAW,GAAG,IAAI,CAAC;gBACnB,UAAU,GAAG,IAAI,CAAC;gBAClB,YAAY,CAAC,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,WAAW,EAAE,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC"}