@ellery/savio 0.1.0

package/dist/index.js

@@ -0,0 +1,293 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { Command } from "commander";
+
+// src/credentials.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+var CREDENTIALS_DIR = join(homedir(), ".savio");
+var CREDENTIALS_FILE = join(CREDENTIALS_DIR, "credentials.json");
+function loadCredentials() {
+  try {
+    if (!existsSync(CREDENTIALS_FILE)) return null;
+    const raw = readFileSync(CREDENTIALS_FILE, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (parsed.refreshToken && parsed.serverUrl) {
+      return parsed;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function saveCredentials(creds) {
+  if (!existsSync(CREDENTIALS_DIR)) {
+    mkdirSync(CREDENTIALS_DIR, { recursive: true, mode: 448 });
+  }
+  writeFileSync(CREDENTIALS_FILE, JSON.stringify(creds, null, 2), { mode: 384 });
+}
+function clearCredentials() {
+  try {
+    if (existsSync(CREDENTIALS_FILE)) {
+      unlinkSync(CREDENTIALS_FILE);
+      return true;
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
+
+// src/auth.ts
+var TokenManager = class {
+  constructor(refreshToken, serverUrl) {
+    this.refreshToken = refreshToken;
+    this.serverUrl = serverUrl;
+  }
+  refreshToken;
+  serverUrl;
+  accessToken = null;
+  expiresAt = 0;
+  cachedUser = null;
+  async getAccessToken() {
+    if (this.accessToken && Date.now() < this.expiresAt - 6e4) {
+      return this.accessToken;
+    }
+    const res = await fetch(`${this.serverUrl}/auth/cli/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ refreshToken: this.refreshToken })
+    });
+    if (!res.ok) {
+      const body = await res.json().catch(() => ({ error: "Unknown error" }));
+      const msg = body.error || `HTTP ${res.status}`;
+      throw new TokenRefreshError(msg);
+    }
+    const data = await res.json();
+    this.accessToken = data.accessToken;
+    this.expiresAt = Date.now() + data.expiresIn * 1e3;
+    this.cachedUser = data.user;
+    return data.accessToken;
+  }
+  getUser() {
+    return this.cachedUser;
+  }
+};
+var TokenRefreshError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TokenRefreshError";
+  }
+};
+
+// src/login.ts
+import { createServer } from "http";
+import { randomBytes } from "crypto";
+import { URL as URL2 } from "url";
+import open from "open";
+var LOGIN_TIMEOUT_MS = 12e4;
+async function browserLogin(serverUrl) {
+  const state = randomBytes(32).toString("hex");
+  const { port, token } = await startCallbackServer(state);
+  const authUrl = `${serverUrl}/cli-auth?port=${port}&state=${encodeURIComponent(state)}`;
+  process.stderr.write(`Opening browser to authorize...
+`);
+  process.stderr.write(`If the browser doesn't open, visit:
+  ${authUrl}
+
+`);
+  await open(authUrl);
+  const refreshToken = await token;
+  saveCredentials({ refreshToken, serverUrl });
+  process.stderr.write(`Authenticated successfully. Credentials saved.
+`);
+}
+function startCallbackServer(expectedState) {
+  return new Promise((resolveSetup) => {
+    let resolveToken;
+    let rejectToken;
+    const tokenPromise = new Promise((resolve, reject) => {
+      resolveToken = resolve;
+      rejectToken = reject;
+    });
+    const server = createServer((req, res) => {
+      const url = new URL2(req.url, `http://localhost`);
+      if (url.pathname === "/callback") {
+        const token = url.searchParams.get("token");
+        const state = url.searchParams.get("state");
+        if (state !== expectedState) {
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end("<h2>State mismatch</h2><p>Authorization failed. Please try again.</p>");
+          rejectToken(new Error("State mismatch \u2014 possible CSRF"));
+          server.close();
+          return;
+        }
+        if (!token) {
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end("<h2>Missing token</h2><p>Authorization failed. Please try again.</p>");
+          rejectToken(new Error("No token in callback"));
+          server.close();
+          return;
+        }
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(
+          "<h2>Authorized</h2><p>You can close this tab and return to your terminal.</p><script>window.close()</script>"
+        );
+        resolveToken(token);
+        server.close();
+      } else {
+        res.writeHead(404);
+        res.end("Not found");
+      }
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const addr = server.address();
+      const port = typeof addr === "object" && addr ? addr.port : 0;
+      resolveSetup({ port, token: tokenPromise });
+    });
+    const timeout = setTimeout(() => {
+      rejectToken(new Error("Login timed out after 2 minutes"));
+      server.close();
+    }, LOGIN_TIMEOUT_MS);
+    tokenPromise.then(() => clearTimeout(timeout)).catch(() => clearTimeout(timeout));
+  });
+}
+
+// src/proxy.ts
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import {
+  ListToolsRequestSchema,
+  CallToolRequestSchema,
+  ListResourcesRequestSchema,
+  ReadResourceRequestSchema,
+  ListResourceTemplatesRequestSchema
+} from "@modelcontextprotocol/sdk/types.js";
+async function startProxy(refreshToken, serverUrl) {
+  const tokenManager = new TokenManager(refreshToken, serverUrl);
+  try {
+    await tokenManager.getAccessToken();
+  } catch (err) {
+    if (err instanceof TokenRefreshError) {
+      process.stderr.write(`Authentication failed: ${err.message}
+`);
+      process.stderr.write(`Run: npx @ellery/savio login --server ${serverUrl}
+`);
+      process.exit(1);
+    }
+    throw err;
+  }
+  const httpTransport = new StreamableHTTPClientTransport(
+    new URL(`${serverUrl}/mcp`),
+    {
+      fetch: async (input, init) => {
+        const token = await tokenManager.getAccessToken();
+        const headers = new Headers(init?.headers);
+        headers.set("Authorization", `Bearer ${token}`);
+        return globalThis.fetch(input, { ...init, headers });
+      }
+    }
+  );
+  const client = new Client({ name: "savio", version: "1.0.0" });
+  await client.connect(httpTransport);
+  process.stderr.write(`Connected to ${serverUrl}
+`);
+  const server = new Server(
+    { name: "savio", version: "1.0.0" },
+    { capabilities: { tools: {}, resources: {} } }
+  );
+  server.setRequestHandler(ListToolsRequestSchema, async (req) => {
+    return client.listTools(req.params);
+  });
+  server.setRequestHandler(CallToolRequestSchema, async (req) => {
+    return client.callTool(req.params);
+  });
+  server.setRequestHandler(ListResourcesRequestSchema, async (req) => {
+    return client.listResources(req.params);
+  });
+  server.setRequestHandler(ReadResourceRequestSchema, async (req) => {
+    return client.readResource(req.params);
+  });
+  server.setRequestHandler(ListResourceTemplatesRequestSchema, async (req) => {
+    return client.listResourceTemplates(req.params);
+  });
+  const stdioTransport = new StdioServerTransport();
+  await server.connect(stdioTransport);
+  process.stderr.write(`MCP proxy ready (stdio)
+`);
+  const shutdown = async () => {
+    process.stderr.write(`Shutting down...
+`);
+    await server.close();
+    await client.close();
+    process.exit(0);
+  };
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
+}
+
+// src/index.ts
+var DEFAULT_SERVER = "https://app.savio.so";
+var program = new Command().name("savio").description("Savio MCP proxy \u2014 browser auth for Claude Code").version("0.1.0");
+program.command("proxy", { isDefault: true, hidden: true }).description("Start the MCP stdio proxy (default command)").action(async () => {
+  const creds = loadCredentials();
+  if (!creds) {
+    process.stderr.write("Not authenticated. Run: npx @ellery/savio login\n");
+    process.exit(1);
+  }
+  try {
+    await startProxy(creds.refreshToken, creds.serverUrl);
+  } catch (err) {
+    process.stderr.write(`Proxy error: ${err instanceof Error ? err.message : err}
+`);
+    process.exit(1);
+  }
+});
+program.command("login").description("Authenticate via browser").option("--server <url>", "Savio server URL", DEFAULT_SERVER).action(async (opts) => {
+  try {
+    await browserLogin(opts.server);
+  } catch (err) {
+    process.stderr.write(`Login failed: ${err instanceof Error ? err.message : err}
+`);
+    process.exit(1);
+  }
+});
+program.command("logout").description("Clear stored credentials").action(() => {
+  if (clearCredentials()) {
+    process.stderr.write("Credentials cleared.\n");
+  } else {
+    process.stderr.write("No credentials stored.\n");
+  }
+});
+program.command("whoami").description("Show current user info").action(async () => {
+  const creds = loadCredentials();
+  if (!creds) {
+    process.stderr.write("Not authenticated. Run: npx @ellery/savio login\n");
+    process.exit(1);
+  }
+  const tokenManager = new TokenManager(creds.refreshToken, creds.serverUrl);
+  try {
+    await tokenManager.getAccessToken();
+    const user = tokenManager.getUser();
+    if (user) {
+      process.stderr.write(`${user.name} (${user.email})
+`);
+      process.stderr.write(`Server: ${creds.serverUrl}
+`);
+    }
+  } catch (err) {
+    if (err instanceof TokenRefreshError) {
+      process.stderr.write(`Token expired or revoked: ${err.message}
+`);
+      process.stderr.write(`Run: npx @ellery/savio login --server ${creds.serverUrl}
+`);
+      process.exit(1);
+    }
+    throw err;
+  }
+});
+program.parse();

package/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "@ellery/savio",
+  "version": "0.1.0",
+  "description": "Savio MCP proxy — browser auth, local stdio transport for Claude Code",
+  "type": "module",
+  "bin": {
+    "savio": "./dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.27.1",
+    "commander": "^12.1.0",
+    "open": "^10.1.0"
+  },
+  "devDependencies": {
+    "tsup": "^8.3.0",
+    "typescript": "^5.7.0"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "license": "MIT"
+}