@holin-work/holin-cli 1.1.3 → 1.2.0

package/bin/holin-cli.js

@@ -119,28 +119,81 @@ async function pingVerify(apiKey) {
   throw new Error("Unexpected response format from MCP server");
 }
 
+/**
+ * Call set_holin_credentials on MCP server to establish server-side session.
+ * This is required for cli-login mode: Accio sends requests without API key,
+ * server reads key from session established by this call.
+ */
+async function setCredentials(apiKey) {
+  const res = await fetch(UPSTREAM_URL, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Accept: "application/json, text/event-stream",
+      "X-API-Key": apiKey,
+    },
+    body: JSON.stringify({
+      jsonrpc: "2.0",
+      id: 2,
+      method: "tools/call",
+      params: { name: "set_holin_credentials", arguments: { api_key: apiKey } },
+    }),
+    signal: AbortSignal.timeout(10000),
+  });
+
+  if (!res.ok) throw new Error(`MCP server responded ${res.status}`);
+
+  const raw = await res.text();
+  for (const line of raw.split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("data:")) {
+      const envelope = JSON.parse(trimmed.slice(5).trim());
+      if (envelope?.error) {
+        throw new Error(envelope.error.message || "set_holin_credentials failed");
+      }
+      const text = envelope?.result?.content?.[0]?.text;
+      if (text) return JSON.parse(text);
+      return { ok: true };
+    }
+  }
+  throw new Error("Unexpected response format from set_holin_credentials");
+}
+
 // ── Proxy Server ─────────────────────────────────────────────────────────────
 
 function createProxyServer() {
   const server = http.createServer((req, res) => {
-    // Block OAuth discovery probes — return 401 so platform knows auth is required
-    if (req.url.startsWith("/.well-known/")) {
-      const body = JSON.stringify({ error: "unauthorized" });
-      res.writeHead(401, { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) });
-      res.end(body);
-      return;
-    }
+    // Collect request body for logging
+    const chunks = [];
+    req.on("data", (c) => chunks.push(c));
+    req.on("end", () => {
+      const rawBody = Buffer.concat(chunks).toString("utf8");
+      let bodyPreview = rawBody.slice(0, 300);
+      try {
+        const parsed = JSON.parse(rawBody);
+        bodyPreview = JSON.stringify({ method: parsed.method, id: parsed.id, params: parsed.params ? Object.keys(parsed.params) : undefined });
+      } catch { /* not JSON */ }
+
+      log(`[proxy] ${req.method} ${req.url} body=${bodyPreview}`);
+
+      // Block OAuth discovery probes — return 401 so platform knows auth is required
+      if (req.url.startsWith("/.well-known/")) {
+        const body = JSON.stringify({ error: "unauthorized" });
+        res.writeHead(401, { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) });
+        res.end(body);
+        return;
+      }
 
-    // Read credentials on every request (hot-reload support)
-    const creds = readCredentials();
-    if (!creds?.api_key) {
-      // No credentials: return 401 so platform knows auth is required (not "no auth needed")
-      const body = JSON.stringify({ error: "unauthorized", message: "Run 'holin-cli auth login' first." });
-      res.writeHead(401, {
-        "Content-Type": "application/json",
-        "Content-Length": Buffer.byteLength(body),
-        "WWW-Authenticate": "Bearer realm=\"Holin API\"",
-      });
+      // Read credentials on every request (hot-reload support)
+      const creds = readCredentials();
+      if (!creds?.api_key) {
+        // No credentials: return 401 so platform knows auth is required (not "no auth needed")
+        const body = JSON.stringify({ error: "unauthorized", message: "Run 'holin-cli auth login' first." });
+        res.writeHead(401, {
+          "Content-Type": "application/json",
+          "Content-Length": Buffer.byteLength(body),
+          "WWW-Authenticate": "Bearer realm=\"Holin API\"",
+        });
       res.end(body);
       return;
     }
@@ -167,19 +220,23 @@ function createProxyServer() {
     // MCP streamable-http has a single endpoint; forward directly to upstream path.
     // Accio requests http://127.0.0.1:18787/mcp → upstream https://api.holin.work/icbu/mcp
     const upstreamUrl = new URL(UPSTREAM_URL);
+    const bodyBuffer = Buffer.concat(chunks);
+    const forwardHeaders = { ...req.headers };
+    delete forwardHeaders["transfer-encoding"];
+    forwardHeaders["content-length"] = bodyBuffer.length;
+    forwardHeaders["host"] = upstreamUrl.hostname;
+    forwardHeaders["X-API-Key"] = creds.api_key;
+
     const options = {
       hostname: upstreamUrl.hostname,
       port: upstreamUrl.port || 443,
       path: upstreamUrl.pathname,
       method: req.method,
-      headers: {
-        ...req.headers,
-        host: upstreamUrl.hostname,
-        "X-API-Key": creds.api_key,
-      },
+      headers: forwardHeaders,
     };
 
     const proxyReq = https.request(options, (proxyRes) => {
+      log(`[proxy] ← ${proxyRes.statusCode} content-type=${proxyRes.headers["content-type"]}`);
       // Forward response headers (strip content-length for chunked SSE)
       const headers = { ...proxyRes.headers };
       delete headers["content-length"];
@@ -211,8 +268,10 @@ function createProxyServer() {
       }
     });
 
-    req.pipe(proxyReq);
-  });
+    proxyReq.write(bodyBuffer);
+    proxyReq.end();
+    }); // end req.on("end")
+  }); // end http.createServer
 
   return server;
 }
@@ -255,6 +314,15 @@ async function cmdAuthLogin() {
   writeCredentials(creds);
   console.log(`[holin-cli] Connected: ${creds.customer_name || creds.customer_id} (${creds.plan})`);
 
+  // Establish server-side session via set_holin_credentials
+  // Accio sends MCP requests without API key; server reads key from this session.
+  try {
+    await setCredentials(apiKey);
+    console.log("[holin-cli] Server-side session established.");
+  } catch (err) {
+    console.error(`[holin-cli] Warning: Failed to establish server session — ${err.message}`);
+  }
+
   // Auto-start proxy in background (detached), wait until it's listening
   try {
     await startProxyDaemon();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holin-work/holin-cli",
-  "version": "1.1.3",
+  "version": "1.2.0",
   "description": "Holin CLI — Accio plugin authorization tool for ICBU batch listing",
   "type": "module",
   "bin": {