@infimind-next/ai-hive-mcp 0.1.1 → 0.2.0

package/dist/api-client.d.ts

@@ -1,17 +1,21 @@
+import type { BearerTokenProvider } from "./auth-token-provider.js";
 type FetchImpl = typeof fetch;
+type AiHiveApiClientInput = {
+    endpoint: string;
+    tokenProvider: BearerTokenProvider;
+    timeoutMs: number;
+    fetchImpl?: FetchImpl;
+};
 export declare class AiHiveApiClient {
     private readonly endpoint;
-    private readonly key;
+    private readonly tokenProvider;
     private readonly timeoutMs;
     private readonly fetchImpl;
-    constructor(input: {
-        endpoint: string;
-        key: string;
-        timeoutMs: number;
-        fetchImpl?: FetchImpl;
-    });
+    constructor(input: AiHiveApiClientInput);
     private withTimeout;
     private request;
+    private send;
+    private readResponse;
     getUserInfo(): Promise<unknown>;
     listModels(input: Record<string, unknown>): Promise<unknown>;
     createMediaUpload(input: unknown): Promise<unknown>;

package/dist/api-client.js

@@ -33,14 +33,22 @@ function errorMessage(body) {
 function timeoutError() {
     return new Error("请求超时，请稍后重试");
 }
+async function discardResponseBody(response) {
+    try {
+        await response.body?.cancel();
+    }
+    catch {
+        return;
+    }
+}
 export class AiHiveApiClient {
     endpoint;
-    key;
+    tokenProvider;
     timeoutMs;
     fetchImpl;
     constructor(input) {
         this.endpoint = input.endpoint.replace(/\/+$/, "");
-        this.key = input.key;
+        this.tokenProvider = input.tokenProvider;
         this.timeoutMs = input.timeoutMs;
         this.fetchImpl = input.fetchImpl ?? fetch;
     }
@@ -70,22 +78,44 @@ export class AiHiveApiClient {
     }
     async request(path, init = {}) {
         return this.withTimeout(async (signal) => {
-            const response = await this.fetchImpl(`${this.endpoint}${path}`, {
-                ...init,
-                signal,
-                headers: {
-                    Authorization: `Bearer ${this.key}`,
-                    ...(init.body ? { "Content-Type": "application/json" } : {}),
-                    ...init.headers,
-                },
-            });
-            const body = await response.json().catch(() => ({}));
-            if (!response.ok) {
-                throw new Error(errorMessage(body));
+            const rejectedToken = await this.tokenProvider.getToken();
+            let response = await this.send(path, init, signal, rejectedToken);
+            if (response.status === 401) {
+                let refreshedToken;
+                try {
+                    refreshedToken =
+                        await this.tokenProvider.refreshAfterUnauthorized(rejectedToken);
+                }
+                catch (error) {
+                    await discardResponseBody(response);
+                    throw error;
+                }
+                if (refreshedToken && refreshedToken !== rejectedToken) {
+                    await discardResponseBody(response);
+                    response = await this.send(path, init, signal, refreshedToken);
+                }
             }
-            return body;
+            return this.readResponse(response);
+        });
+    }
+    send(path, init, signal, token) {
+        return this.fetchImpl(`${this.endpoint}${path}`, {
+            ...init,
+            signal,
+            headers: {
+                Authorization: `Bearer ${token}`,
+                ...(init.body ? { "Content-Type": "application/json" } : {}),
+                ...init.headers,
+            },
         });
     }
+    async readResponse(response) {
+        const body = await response.json().catch(() => ({}));
+        if (!response.ok) {
+            throw new Error(errorMessage(body));
+        }
+        return body;
+    }
     getUserInfo() {
         return this.request("/mcp/user-info");
     }

package/dist/auth-token-provider.d.ts

@@ -0,0 +1,34 @@
+import { type WorkBuddyOAuthClient } from "./workbuddy-oauth-client.js";
+import type { WorkBuddyCredentialStore } from "./workbuddy-credentials.js";
+export type BearerTokenProvider = {
+    getToken(): Promise<string>;
+    refreshAfterUnauthorized(rejectedToken: string): Promise<string | null>;
+};
+export declare function normalizeApiEndpoint(endpoint: string): string;
+export declare class StaticBearerTokenProvider implements BearerTokenProvider {
+    private readonly token;
+    constructor(token: string);
+    getToken(): Promise<string>;
+    refreshAfterUnauthorized(): Promise<string | null>;
+}
+export declare class WorkBuddyTokenProvider implements BearerTokenProvider {
+    private readonly store;
+    private readonly oauthClientFor;
+    private readonly now;
+    private readonly refreshSkewMs;
+    private readonly expectedApiEndpoint;
+    constructor(input: {
+        store: WorkBuddyCredentialStore;
+        oauthClientFor: (apiEndpoint: string) => WorkBuddyOAuthClient;
+        expectedApiEndpoint: string;
+        now?: () => Date;
+        refreshSkewMs?: number;
+    });
+    getToken(): Promise<string>;
+    refreshAfterUnauthorized(rejectedToken: string): Promise<string | null>;
+    private requireCredentials;
+    private readCredentials;
+    private withStoreLock;
+    private needsRefresh;
+    private refresh;
+}

package/dist/auth-token-provider.js

@@ -0,0 +1,115 @@
+import { isWorkBuddyOAuthError, } from "./workbuddy-oauth-client.js";
+class WorkBuddyTokenProviderError extends Error {
+}
+function credentialStoreError() {
+    return new WorkBuddyTokenProviderError("WorkBuddy 凭证操作失败，请在 WorkBuddy 中重新连接");
+}
+function endpointMismatchError() {
+    return new WorkBuddyTokenProviderError("API endpoint 与 WorkBuddy 凭证不一致，请在 WorkBuddy 中重新认证");
+}
+export function normalizeApiEndpoint(endpoint) {
+    return new URL(endpoint).href.replace(/\/+$/, "");
+}
+export class StaticBearerTokenProvider {
+    token;
+    constructor(token) {
+        this.token = token;
+    }
+    async getToken() {
+        return this.token;
+    }
+    async refreshAfterUnauthorized() {
+        return null;
+    }
+}
+export class WorkBuddyTokenProvider {
+    store;
+    oauthClientFor;
+    now;
+    refreshSkewMs;
+    expectedApiEndpoint;
+    constructor(input) {
+        this.store = input.store;
+        this.oauthClientFor = input.oauthClientFor;
+        this.expectedApiEndpoint = normalizeApiEndpoint(input.expectedApiEndpoint);
+        this.now = input.now ?? (() => new Date());
+        this.refreshSkewMs = input.refreshSkewMs ?? 60_000;
+    }
+    async getToken() {
+        const credentials = this.requireCredentials(await this.readCredentials());
+        if (!this.needsRefresh(credentials)) {
+            return credentials.accessToken;
+        }
+        return this.withStoreLock(async () => {
+            const current = this.requireCredentials(await this.readCredentials());
+            if (!this.needsRefresh(current)) {
+                return current.accessToken;
+            }
+            return this.refresh(current);
+        });
+    }
+    async refreshAfterUnauthorized(rejectedToken) {
+        return this.withStoreLock(async () => {
+            const current = this.requireCredentials(await this.readCredentials());
+            if (current.accessToken !== rejectedToken) {
+                return current.accessToken;
+            }
+            return this.refresh(current);
+        });
+    }
+    requireCredentials(credentials) {
+        if (!credentials) {
+            throw new WorkBuddyTokenProviderError("尚未连接 AI-HIVE，请在 WorkBuddy 中重新连接");
+        }
+        return credentials;
+    }
+    async readCredentials() {
+        let credentials;
+        try {
+            credentials = await this.store.read();
+        }
+        catch {
+            throw credentialStoreError();
+        }
+        if (credentials &&
+            normalizeApiEndpoint(credentials.apiEndpoint) !== this.expectedApiEndpoint) {
+            throw endpointMismatchError();
+        }
+        return credentials;
+    }
+    async withStoreLock(action) {
+        try {
+            return await this.store.withLock(action);
+        }
+        catch (error) {
+            if (error instanceof WorkBuddyTokenProviderError ||
+                isWorkBuddyOAuthError(error)) {
+                throw error;
+            }
+            throw credentialStoreError();
+        }
+    }
+    needsRefresh(credentials) {
+        return (new Date(credentials.accessExpiresAt).getTime() - this.now().getTime() <
+            this.refreshSkewMs);
+    }
+    async refresh(credentials) {
+        if (normalizeApiEndpoint(credentials.apiEndpoint) !== this.expectedApiEndpoint) {
+            throw endpointMismatchError();
+        }
+        const payload = await this.oauthClientFor(credentials.apiEndpoint).refreshToken(credentials.refreshToken);
+        const refreshedAt = this.now();
+        if (normalizeApiEndpoint(credentials.apiEndpoint) !== this.expectedApiEndpoint) {
+            throw endpointMismatchError();
+        }
+        await this.store.write({
+            ...credentials,
+            accessToken: payload.accessToken,
+            refreshToken: payload.refreshToken,
+            accessExpiresAt: new Date(refreshedAt.getTime() + payload.expiresIn * 1_000).toISOString(),
+            refreshExpiresAt: new Date(refreshedAt.getTime() + payload.refreshExpiresIn * 1_000).toISOString(),
+            updatedAt: refreshedAt.toISOString(),
+        });
+        return payload.accessToken;
+    }
+}

package/dist/cli.d.ts

@@ -0,0 +1,14 @@
+import type { McpClientConfig } from "./config.js";
+import { runServer as runMcpServer } from "./server.js";
+import { WorkBuddyCredentialStore } from "./workbuddy-credentials.js";
+import { WorkBuddyOAuthClient } from "./workbuddy-oauth-client.js";
+import { listenForWorkBuddyCallback } from "./workbuddy-loopback.js";
+export type CliDependencies = {
+    stdout(line: string): void;
+    stderr(line: string): void;
+    createStore(file: string): WorkBuddyCredentialStore;
+    createOAuthClient(endpoint: string): WorkBuddyOAuthClient;
+    listenForCallback: typeof listenForWorkBuddyCallback;
+    runServer: typeof runMcpServer;
+};
+export declare function runCli(config: McpClientConfig, dependencies?: Partial<CliDependencies>): Promise<number>;

package/dist/cli.js

@@ -0,0 +1,320 @@
+import { normalizeApiEndpoint } from "./auth-token-provider.js";
+import { resolveServerAuth, runServer as runMcpServer } from "./server.js";
+import { WorkBuddyCredentialStore, } from "./workbuddy-credentials.js";
+import { WorkBuddyOAuthClient } from "./workbuddy-oauth-client.js";
+import { listenForWorkBuddyCallback, } from "./workbuddy-loopback.js";
+import { createPkcePair } from "./workbuddy-pkce.js";
+const AUTH_URL_DEADLINE_MS = 10_000;
+const AUTH_CALLBACK_DEADLINE_MS = 5 * 60_000;
+const STATUS_DEADLINE_MS = 8_000;
+const LOGOUT_DEADLINE_MS = 30_000;
+const SAFE_SERVER_ERRORS = new Set([
+    "MCP API Key 未配置，请在配置中传入 --key 或 AI_HIVE_MCP_KEY",
+    "尚未连接 AI-HIVE，请在 WorkBuddy 中重新连接",
+    "API endpoint 与 WorkBuddy 凭证不一致，请在 WorkBuddy 中重新认证",
+    "凭证文件读取失败",
+    "凭证文件无效",
+]);
+class DeadlineError extends Error {
+}
+export async function runCli(config, dependencies) {
+    const resolved = resolveDependencies(config, dependencies);
+    switch (config.command) {
+        case "auth":
+            return runAuth(config, resolved);
+        case "status":
+            return runStatus(config, resolved);
+        case "logout":
+            return runLogout(config, resolved);
+        case "server":
+            return runMcp(config, resolved);
+    }
+}
+function resolveDependencies(config, overrides) {
+    const createOAuthClientWithTimeout = (endpoint, timeoutMs) => new WorkBuddyOAuthClient({
+        apiEndpoint: endpoint,
+        timeoutMs,
+    });
+    return {
+        stdout: overrides?.stdout ?? ((line) => console.log(line)),
+        stderr: overrides?.stderr ?? ((line) => console.error(line)),
+        createStore: overrides?.createStore ?? ((file) => new WorkBuddyCredentialStore(file)),
+        createOAuthClient: overrides?.createOAuthClient ??
+            ((endpoint) => createOAuthClientWithTimeout(endpoint, config.timeoutMs)),
+        createOAuthClientWithTimeout: overrides?.createOAuthClient
+            ? (endpoint) => overrides.createOAuthClient(endpoint)
+            : createOAuthClientWithTimeout,
+        listenForCallback: overrides?.listenForCallback ?? listenForWorkBuddyCallback,
+        runServer: overrides?.runServer ?? runMcpServer,
+    };
+}
+async function runAuth(config, dependencies) {
+    const store = dependencies.createStore(config.credentialsFile);
+    const oauth = dependencies.createOAuthClient(config.endpoint);
+    const { state, codeVerifier, codeChallenge } = createPkcePair();
+    let redirectUri = "";
+    let listenerPromise;
+    try {
+        listenerPromise = Promise.resolve(dependencies.listenForCallback({
+            expectedState: state,
+            timeoutMs: AUTH_CALLBACK_DEADLINE_MS,
+            onCode: async (code) => {
+                const payload = await oauth.exchangeAuthorizationCode({
+                    code,
+                    redirectUri,
+                    codeVerifier,
+                });
+                const updatedAt = new Date();
+                await store.write({
+                    version: 1,
+                    apiEndpoint: config.endpoint,
+                    webOrigin: config.webOrigin,
+                    accessToken: payload.accessToken,
+                    refreshToken: payload.refreshToken,
+                    accessExpiresAt: new Date(updatedAt.getTime() + payload.expiresIn * 1_000).toISOString(),
+                    refreshExpiresAt: new Date(updatedAt.getTime() + payload.refreshExpiresIn * 1_000).toISOString(),
+                    updatedAt: updatedAt.toISOString(),
+                });
+            },
+        }));
+    }
+    catch {
+        dependencies.stderr("连接 AI-HIVE 失败，请重试");
+        return 1;
+    }
+    let listener;
+    try {
+        listener = await withDeadline(listenerPromise, AUTH_URL_DEADLINE_MS);
+    }
+    catch {
+        void listenerPromise.then(async (lateListener) => {
+            await lateListener.close().catch(() => undefined);
+        }, () => undefined);
+        dependencies.stderr("连接 AI-HIVE 失败，请重试");
+        return 1;
+    }
+    redirectUri = listener.redirectUri;
+    try {
+        const authorizeUrl = new URL("/workbuddy/authorize", config.webOrigin);
+        authorizeUrl.searchParams.set("redirect_uri", listener.redirectUri);
+        authorizeUrl.searchParams.set("state", state);
+        authorizeUrl.searchParams.set("code_challenge", codeChallenge);
+        authorizeUrl.searchParams.set("code_challenge_method", "S256");
+        dependencies.stdout(authorizeUrl.href);
+        await listener.completion;
+        return 0;
+    }
+    catch {
+        dependencies.stderr("连接 AI-HIVE 失败，请重试");
+        return 1;
+    }
+    finally {
+        await listener.close().catch(() => undefined);
+    }
+}
+async function runStatus(config, dependencies) {
+    const store = dependencies.createStore(config.credentialsFile);
+    const deadlineAt = Date.now() + STATUS_DEADLINE_MS;
+    try {
+        await checkStatus(config, dependencies, store, deadlineAt);
+        dependencies.stdout("Authenticated");
+        return 0;
+    }
+    catch {
+        dependencies.stderr("Not authenticated");
+        return 1;
+    }
+}
+async function checkStatus(config, dependencies, store, deadlineAt) {
+    let endpoint;
+    let token;
+    if (config.key !== null) {
+        if (!config.key) {
+            throw new Error("MCP API Key 未配置");
+        }
+        endpoint = config.endpoint;
+        token = config.key;
+    }
+    else {
+        const credentials = await readBeforeDeadline(store, deadlineAt);
+        if (!credentials) {
+            throw new Error("尚未连接 AI-HIVE");
+        }
+        assertEndpointMatches(config, credentials);
+        const resolved = await resolveStatusCredentials(config, dependencies, store, credentials, deadlineAt);
+        endpoint = resolved.apiEndpoint;
+        token = resolved.accessToken;
+    }
+    await checkUserInfo(endpoint, token, deadlineAt);
+}
+function assertEndpointMatches(config, credentials) {
+    if (config.endpointExplicit &&
+        normalizeApiEndpoint(config.endpoint) !==
+            normalizeApiEndpoint(credentials.apiEndpoint)) {
+        throw new Error("API endpoint 与 WorkBuddy 凭证不一致");
+    }
+}
+async function resolveStatusCredentials(config, dependencies, store, credentials, deadlineAt) {
+    if (!needsRefresh(credentials)) {
+        return credentials;
+    }
+    const lifecycle = { active: true };
+    let markCommitStarted;
+    const commitStarted = new Promise((resolve) => {
+        markCommitStarted = resolve;
+    });
+    const lockedOperation = store.withLock(async () => {
+        assertPreCommitActive(lifecycle, deadlineAt);
+        const current = await readBeforeDeadline(store, deadlineAt, () => {
+            lifecycle.active = false;
+        });
+        assertPreCommitActive(lifecycle, deadlineAt);
+        if (!current) {
+            throw new Error("尚未连接 AI-HIVE");
+        }
+        assertEndpointMatches(config, current);
+        if (normalizeApiEndpoint(current.apiEndpoint) !==
+            normalizeApiEndpoint(credentials.apiEndpoint)) {
+            throw new Error("API endpoint 与 WorkBuddy 凭证不一致");
+        }
+        if (!needsRefresh(current)) {
+            return current;
+        }
+        const networkTimeoutMs = remainingMs(deadlineAt);
+        const oauth = dependencies.createOAuthClientWithTimeout(current.apiEndpoint, Math.min(config.timeoutMs, networkTimeoutMs));
+        const payload = await withDeadline(oauth.refreshToken(current.refreshToken), networkTimeoutMs, () => {
+            lifecycle.active = false;
+        });
+        assertPreCommitActive(lifecycle, deadlineAt);
+        const updatedAt = new Date();
+        const refreshed = {
+            ...current,
+            accessToken: payload.accessToken,
+            refreshToken: payload.refreshToken,
+            accessExpiresAt: new Date(updatedAt.getTime() + payload.expiresIn * 1_000).toISOString(),
+            refreshExpiresAt: new Date(updatedAt.getTime() + payload.refreshExpiresIn * 1_000).toISOString(),
+            updatedAt: updatedAt.toISOString(),
+        };
+        markCommitStarted();
+        await store.write(refreshed);
+        return refreshed;
+    });
+    const preCommitOperation = Promise.race([
+        lockedOperation.then(() => undefined),
+        commitStarted,
+    ]);
+    try {
+        await withDeadline(preCommitOperation, remainingMs(deadlineAt), () => {
+            lifecycle.active = false;
+        });
+    }
+    catch (error) {
+        lifecycle.active = false;
+        throw error;
+    }
+    return lockedOperation;
+}
+async function checkUserInfo(endpoint, token, deadlineAt) {
+    const response = await requestUserInfo(endpoint, token, deadlineAt);
+    if (!response.ok) {
+        await discardResponse(response);
+        throw new Error("WorkBuddy 凭证无效");
+    }
+    await discardResponse(response);
+}
+async function requestUserInfo(endpoint, token, deadlineAt) {
+    const controller = new AbortController();
+    const timeoutMs = remainingMs(deadlineAt);
+    return withDeadline(fetch(`${endpoint.replace(/\/+$/, "")}/mcp/user-info`, {
+        method: "GET",
+        headers: { Authorization: `Bearer ${token}` },
+        signal: controller.signal,
+    }), timeoutMs, () => controller.abort());
+}
+async function discardResponse(response) {
+    try {
+        await response.body?.cancel();
+    }
+    catch {
+        return;
+    }
+}
+async function runLogout(config, dependencies) {
+    const store = dependencies.createStore(config.credentialsFile);
+    const deadlineAt = Date.now() + LOGOUT_DEADLINE_MS;
+    try {
+        await revokeAndClear(config, dependencies, store, deadlineAt);
+        return 0;
+    }
+    catch {
+        dependencies.stderr("退出 AI-HIVE 失败，请重试");
+        return 1;
+    }
+}
+async function revokeAndClear(config, dependencies, store, deadlineAt) {
+    const credentials = await readBeforeDeadline(store, deadlineAt);
+    if (!credentials) {
+        return;
+    }
+    assertEndpointMatches(config, credentials);
+    const networkTimeoutMs = remainingMs(deadlineAt);
+    const oauth = dependencies.createOAuthClientWithTimeout(credentials.apiEndpoint, Math.min(config.timeoutMs, networkTimeoutMs));
+    await withDeadline(oauth.revoke(credentials.refreshToken), networkTimeoutMs);
+    await store.clear();
+}
+async function runMcp(config, dependencies) {
+    try {
+        const resolved = await resolveServerAuth(config, dependencies.createStore(config.credentialsFile));
+        await dependencies.runServer({
+            ...resolved,
+            timeoutMs: config.timeoutMs,
+        });
+        return 0;
+    }
+    catch (error) {
+        dependencies.stderr(safeServerError(error));
+        return 1;
+    }
+}
+function safeServerError(error) {
+    if (error instanceof Error && SAFE_SERVER_ERRORS.has(error.message)) {
+        return error.message;
+    }
+    return "MCP 启动失败";
+}
+async function withDeadline(operation, timeoutMs, onTimeout) {
+    let timeout;
+    const deadline = new Promise((_, reject) => {
+        timeout = setTimeout(() => {
+            onTimeout?.();
+            reject(new DeadlineError("命令执行超时"));
+        }, timeoutMs);
+    });
+    try {
+        return await Promise.race([operation, deadline]);
+    }
+    finally {
+        if (timeout) {
+            clearTimeout(timeout);
+        }
+    }
+}
+function remainingMs(deadlineAt) {
+    const remaining = deadlineAt - Date.now();
+    if (remaining <= 0) {
+        throw new DeadlineError("命令执行超时");
+    }
+    return remaining;
+}
+function readBeforeDeadline(store, deadlineAt, onTimeout) {
+    return withDeadline(store.read(), remainingMs(deadlineAt), onTimeout);
+}
+function assertPreCommitActive(lifecycle, deadlineAt) {
+    if (!lifecycle.active) {
+        throw new DeadlineError("命令执行超时");
+    }
+    remainingMs(deadlineAt);
+}
+function needsRefresh(credentials) {
+    return new Date(credentials.accessExpiresAt).getTime() - Date.now() < 60_000;
+}

package/dist/config.d.ts

@@ -1,6 +1,11 @@
+export type CliCommand = "server" | "auth" | "status" | "logout";
 export type McpClientConfig = {
+    command: CliCommand;
     endpoint: string;
+    endpointExplicit: boolean;
+    webOrigin: string;
     key: string | null;
+    credentialsFile: string;
     timeoutMs: number;
     verbose: boolean;
 };

package/dist/config.js

@@ -1,30 +1,63 @@
+import { resolveWorkBuddyCredentialsFile } from "./workbuddy-credentials.js";
 const DEFAULT_ENDPOINT = "https://ai-hive.iclip.cn/api";
+const DEFAULT_WEB_ORIGIN = "https://ai-hive.iclip.cn";
+const CLI_COMMANDS = new Set([
+    "server",
+    "auth",
+    "status",
+    "logout",
+]);
+const FLAG_OPTIONS = new Set(["verbose"]);
+const VALUE_OPTIONS = new Set([
+    "endpoint",
+    "web-origin",
+    "key",
+    "timeout-ms",
+    "credentials-file",
+]);
 export function parseConfig(input) {
     const args = input.argv.slice(2);
     const values = new Map();
     const flags = new Set();
+    let command = "server";
+    let commandSeen = false;
     for (let index = 0; index < args.length; index += 1) {
         const arg = args[index];
         if (!arg?.startsWith("--")) {
+            if (commandSeen || !CLI_COMMANDS.has(arg)) {
+                throw new Error("未知命令");
+            }
+            command = arg;
+            commandSeen = true;
             continue;
         }
         const name = arg.slice(2);
-        if (name === "verbose") {
+        if (FLAG_OPTIONS.has(name)) {
             flags.add(name);
             continue;
         }
+        if (!VALUE_OPTIONS.has(name)) {
+            throw new Error("未知选项");
+        }
         const value = args[index + 1];
-        if (value && !value.startsWith("--")) {
-            values.set(name, value);
-            index += 1;
+        if (!value || value.startsWith("--")) {
+            throw new Error("选项缺少值");
         }
+        values.set(name, value);
+        index += 1;
     }
     const timeoutMs = Number.parseInt(values.get("timeout-ms") ?? input.env.AI_HIVE_MCP_TIMEOUT_MS ?? "120000", 10);
+    const endpointOverride = values.get("endpoint") ?? input.env.AI_HIVE_API_ENDPOINT;
     return {
-        endpoint: values.get("endpoint") ??
-            input.env.AI_HIVE_API_ENDPOINT ??
-            DEFAULT_ENDPOINT,
+        command,
+        endpoint: endpointOverride ?? DEFAULT_ENDPOINT,
+        endpointExplicit: endpointOverride !== undefined,
+        webOrigin: values.get("web-origin") ??
+            input.env.AI_HIVE_WEB_ORIGIN ??
+            DEFAULT_WEB_ORIGIN,
         key: values.get("key") ?? input.env.AI_HIVE_MCP_KEY ?? null,
+        credentialsFile: values.get("credentials-file") ??
+            resolveWorkBuddyCredentialsFile(input.env),
         timeoutMs: Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : 120000,
         verbose: flags.has("verbose") || input.env.AI_HIVE_MCP_VERBOSE === "true",
     };