@hapticpaper/mcp-server 1.0.2 → 1.0.4

package/dist/auth/access.js

@@ -14,10 +14,16 @@ function parseScopesFromClaims(claims) {
     }
     return Array.from(new Set(scopes));
 }
-export function verifyAccessToken(extra) {
+/**
+ * Try to verify an access token from the MCP extra.authInfo.
+ * Returns null if no token is present (allows fallback to client tokenProvider for stdio mode).
+ * Throws if token is invalid.
+ */
+export function tryVerifyAccessToken(extra) {
     const token = extra?.authInfo?.token;
     if (!token) {
-        throw new Error('Authentication required: connect your account to use this tool.');
+        // No token in extra - this is OK for stdio transport, let the API client handle auth
+        return null;
     }
     const secret = process.env.JWT_SECRET;
     if (!secret) {
@@ -37,13 +43,30 @@ export function verifyAccessToken(extra) {
         raw: decoded,
     };
 }
+/**
+ * Backwards-compatible - throws if no token. Use tryVerifyAccessToken for nullable return.
+ */
+export function verifyAccessToken(extra) {
+    const auth = tryVerifyAccessToken(extra);
+    if (!auth) {
+        throw new Error('Authentication required: connect your account to use this tool.');
+    }
+    return auth;
+}
+/**
+ * Check scopes. Returns null if no token in extra (for stdio fallback to API client auth).
+ */
 export function requireScopes(extra, required) {
-    const auth = verifyAccessToken(extra);
-    if (required.length === 0)
-        return auth;
-    const ok = required.every((s) => auth.scopes.includes(s));
-    if (!ok) {
-        throw new Error(`Missing required permission(s): ${required.join(', ')}`);
+    const auth = tryVerifyAccessToken(extra);
+    if (!auth) {
+        // No token in extra - let the API client handle auth (stdio mode with tokenProvider)
+        return null;
+    }
+    if (required.length > 0) {
+        const ok = required.every((s) => auth.scopes.includes(s));
+        if (!ok) {
+            throw new Error(`Missing required permission(s): ${required.join(', ')}`);
+        }
     }
     return auth;
 }

package/dist/index.js

@@ -96,12 +96,36 @@ ${widgetJs}
         registerAllResources(server, client);
         return server;
     }
-    // Initialize Client
+    // Helper to run interactive OAuth flow
+    const runOAuthFlow = async () => {
+        console.error('No valid token found. Starting authentication...');
+        const auth = new MCPOAuthHandler({
+            clientId: 'mcp-client',
+            authorizationUrl: process.env.AUTH_URL || 'https://hapticpaper.com/oauth/authorize',
+            tokenUrl: process.env.TOKEN_URL || 'https://hapticpaper.com/api/v1/oauth/token',
+            redirectUri: 'http://localhost:8765/callback',
+            scopes: ['tasks:read', 'tasks:write', 'workers:read']
+        });
+        const tokens = await auth.authenticate();
+        await tokenManager.saveTokens(tokens);
+        console.error('Authentication successful!');
+        return tokens.access_token;
+    };
+    // Initialize Client with auto-auth tokenProvider
     const client = new HireHumanClient({
         baseUrl: process.env.API_URL || 'https://hapticpaper.com/api/v1',
         tokenProvider: async () => {
             const tokens = await tokenManager.loadTokens();
-            return tokens?.access_token || '';
+            if (tokens?.access_token) {
+                // Check if token is expired (with 5 min buffer)
+                if (tokens.expires_at && tokens.expires_at < Date.now() + 5 * 60 * 1000) {
+                    console.error('Token expired, re-authenticating...');
+                    return runOAuthFlow();
+                }
+                return tokens.access_token;
+            }
+            // No token - auto-trigger OAuth
+            return runOAuthFlow();
         }
     });
     // Transport

package/dist/tools/account.js

@@ -32,8 +32,9 @@ export function registerAccountTools(server, client) {
     const getAccountInvoked = 'Account details ready';
     const getAccountHandler = async (_args, extra) => {
         try {
+            // For HTTP transport, auth comes from extra.authInfo. For stdio, auth is handled by tokenProvider.
             const auth = requireScopes(extra, ['account:read']);
-            const result = await client.getAccount(auth.token);
+            const result = await client.getAccount(auth?.token);
             const account = result.data;
             const widgetSessionId = `account:${account.userId}`;
             return {

package/dist/tools/estimates.js

@@ -37,8 +37,8 @@ export function registerEstimateTools(server, client) {
     const getEstimateHandler = async (args, extra) => {
         try {
             const auth = requireScopes(extra, ['tasks:read']);
-            const est = await client.getEstimate(args, auth.token);
-            const widgetSessionId = stableSessionId('estimate', JSON.stringify({ userId: auth.userId ?? auth.clientId, args }));
+            const est = await client.getEstimate(args, auth?.token);
+            const widgetSessionId = stableSessionId('estimate', JSON.stringify({ userId: auth?.userId ?? auth?.clientId, args }));
             return {
                 structuredContent: {
                     estimate: {
@@ -90,7 +90,7 @@ export function registerEstimateTools(server, client) {
         try {
             const auth = requireScopes(extra, ['tasks:read']);
             const cats = await client.getSkillCategories();
-            const widgetSessionId = stableSessionId('skills', auth.userId ?? auth.clientId);
+            const widgetSessionId = stableSessionId('skills', auth?.userId ?? auth?.clientId);
             const text = cats
                 .map((c) => `### ${c.name}\n${c.description}\nRange: $${c.priceRange.min}-$${c.priceRange.max}`)
                 .join('\n\n');

package/dist/tools/tasks.js

@@ -53,7 +53,7 @@ export function registerTaskTools(server, client) {
     const createTaskHandler = async (args, extra) => {
         try {
             const auth = requireScopes(extra, ['tasks:write']);
-            const task = await client.createTask(args, auth.token);
+            const task = await client.createTask(args, auth?.token);
             const widgetSessionId = `task:${task.id}`;
             return {
                 structuredContent: {
@@ -101,7 +101,7 @@ export function registerTaskTools(server, client) {
     const getTaskHandler = async (args, extra) => {
         try {
             const auth = requireScopes(extra, ['tasks:read']);
-            const task = await client.getTask(args.taskId, auth.token);
+            const task = await client.getTask(args.taskId, auth?.token);
             const widgetSessionId = `task:${args.taskId}`;
             return {
                 structuredContent: {
@@ -144,9 +144,9 @@ export function registerTaskTools(server, client) {
     const listTasksHandler = async (args, extra) => {
         try {
             const auth = requireScopes(extra, ['tasks:read']);
-            const tasks = await client.listTasks(args, auth.token);
+            const tasks = await client.listTasks(args, auth?.token);
             const items = Array.isArray(tasks) ? tasks : tasks?.tasks ?? [];
-            const widgetSessionId = stableSessionId('tasks', auth.userId ?? auth.clientId);
+            const widgetSessionId = stableSessionId('tasks', auth?.userId ?? auth?.clientId);
             if (items.length === 0) {
                 return {
                     structuredContent: { tasks: [] },
@@ -204,7 +204,7 @@ export function registerTaskTools(server, client) {
     const cancelTaskHandler = async (args, extra) => {
         try {
             const auth = requireScopes(extra, ['tasks:write']);
-            const res = await client.cancelTask(args.taskId, args.reason, auth.token);
+            const res = await client.cancelTask(args.taskId, args.reason, auth?.token);
             const widgetSessionId = `task:${args.taskId}`;
             return {
                 structuredContent: {

package/dist/tools/workers.js

@@ -45,8 +45,8 @@ export function registerWorkerTools(server, client) {
     const searchWorkersHandler = async (args, extra) => {
         try {
             const auth = requireScopes(extra, ['workers:read']);
-            const result = await client.searchWorkers(args, auth.token);
-            const widgetSessionId = stableSessionId('workers', JSON.stringify({ userId: auth.userId ?? auth.clientId, args }));
+            const result = await client.searchWorkers(args, auth?.token);
+            const widgetSessionId = stableSessionId('workers', JSON.stringify({ userId: auth?.userId ?? auth?.clientId, args }));
             if (!result.workers || result.workers.length === 0) {
                 return {
                     structuredContent: { workers: [], suggestedBudget: result?.suggestedBudget },
@@ -105,7 +105,7 @@ export function registerWorkerTools(server, client) {
     const getWorkerProfileHandler = async (args, extra) => {
         try {
             const auth = requireScopes(extra, ['workers:read']);
-            const worker = await client.getWorkerProfile(args.workerId, auth.token);
+            const worker = await client.getWorkerProfile(args.workerId, auth?.token);
             const widgetSessionId = `worker:${args.workerId}`;
             return {
                 structuredContent: { worker },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hapticpaper/mcp-server",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Official MCP Server for Haptic Paper - Connect your account to AI models",
   "type": "module",
   "main": "dist/index.js",