@infimind-next/ai-hive-mcp 0.1.1 → 0.2.0

package/dist/index.js

@@ -1,9 +1,19 @@
 #!/usr/bin/env node
+import { runCli } from "./cli.js";
 import { parseConfig } from "./config.js";
-import { runServer } from "./server.js";
-const config = parseConfig({ argv: process.argv, env: process.env });
-runServer(config).catch((error) => {
-    const message = error instanceof Error ? error.message : "MCP 启动失败";
-    console.error(message);
+function safeTopLevelMessage(error) {
+    if (error instanceof Error &&
+        ["未知命令", "未知选项", "选项缺少值"].includes(error.message)) {
+        return error.message;
+    }
+    return "命令执行失败";
+}
+Promise.resolve()
+    .then(() => parseConfig({ argv: process.argv, env: process.env }))
+    .then((config) => runCli(config))
+    .then((code) => {
+    process.exitCode = code;
+}, (error) => {
+    console.error(safeTopLevelMessage(error));
     process.exitCode = 1;
 });

package/dist/server.d.ts

@@ -1,6 +1,10 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import { AiHiveApiClient } from "./api-client.js";
+import { type BearerTokenProvider } from "./auth-token-provider.js";
+import type { McpClientConfig } from "./config.js";
+import { WorkBuddyCredentialStore } from "./workbuddy-credentials.js";
+export declare const SERVER_VERSION = "0.2.0";
 declare function content(value: unknown): {
     content: {
         type: "text";
@@ -14,14 +18,19 @@ export type ToolDefinition = {
     handler: (args: Record<string, unknown>) => Promise<ReturnType<typeof content>>;
 };
 export declare function createToolDefinitions(client: () => ApiClientLike): ToolDefinition[];
+export type ResolvedServerAuth = {
+    endpoint: string;
+    tokenProvider: BearerTokenProvider;
+};
+export declare function resolveServerAuth(config: McpClientConfig, store: WorkBuddyCredentialStore): Promise<ResolvedServerAuth>;
 export declare function createServer(input: {
     endpoint: string;
-    key: string | null;
+    tokenProvider: BearerTokenProvider;
     timeoutMs: number;
 }): McpServer;
 export declare function runServer(input: {
     endpoint: string;
-    key: string | null;
+    tokenProvider: BearerTokenProvider;
     timeoutMs: number;
 }): Promise<void>;
 export {};

package/dist/server.js

@@ -3,15 +3,11 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { chatTextShape, generateImageShape, generateVideoShape, getGenerationTaskShape, listModelsShape, } from "./schemas.js";
 import { z } from "zod";
 import { AiHiveApiClient } from "./api-client.js";
+import { normalizeApiEndpoint, StaticBearerTokenProvider, WorkBuddyTokenProvider, } from "./auth-token-provider.js";
 import { uploadMediaFromPath } from "./local-media.js";
-const SERVER_VERSION = "0.1.1";
+import { WorkBuddyOAuthClient } from "./workbuddy-oauth-client.js";
+export const SERVER_VERSION = "0.2.0";
 const DEPRECATED_ATTACHMENT_IDS_MESSAGE = "attachmentIds 已废弃，请使用 messages[].mediaIds";
-function requireKey(key) {
-    if (!key) {
-        throw new Error("MCP API Key 未配置，请在配置中传入 --key 或 AI_HIVE_MCP_KEY");
-    }
-    return key;
-}
 function content(value) {
     return {
         content: [{ type: "text", text: JSON.stringify(value) }],
@@ -70,11 +66,42 @@ export function createToolDefinitions(client) {
         },
     ];
 }
+export async function resolveServerAuth(config, store) {
+    if (config.key !== null) {
+        if (!config.key) {
+            throw new Error("MCP API Key 未配置，请在配置中传入 --key 或 AI_HIVE_MCP_KEY");
+        }
+        return {
+            endpoint: config.endpoint,
+            tokenProvider: new StaticBearerTokenProvider(config.key),
+        };
+    }
+    const credentials = await store.read();
+    if (!credentials) {
+        throw new Error("尚未连接 AI-HIVE，请在 WorkBuddy 中重新连接");
+    }
+    if (config.endpointExplicit &&
+        normalizeApiEndpoint(config.endpoint) !==
+            normalizeApiEndpoint(credentials.apiEndpoint)) {
+        throw new Error("API endpoint 与 WorkBuddy 凭证不一致，请在 WorkBuddy 中重新认证");
+    }
+    return {
+        endpoint: credentials.apiEndpoint,
+        tokenProvider: new WorkBuddyTokenProvider({
+            store,
+            expectedApiEndpoint: credentials.apiEndpoint,
+            oauthClientFor: (apiEndpoint) => new WorkBuddyOAuthClient({
+                apiEndpoint,
+                timeoutMs: config.timeoutMs,
+            }),
+        }),
+    };
+}
 export function createServer(input) {
     const server = new McpServer({ name: "ai-hive", version: SERVER_VERSION });
     const client = () => new AiHiveApiClient({
         endpoint: input.endpoint,
-        key: requireKey(input.key),
+        tokenProvider: input.tokenProvider,
         timeoutMs: input.timeoutMs,
     });
     for (const tool of createToolDefinitions(client)) {

package/dist/workbuddy-credentials.d.ts

@@ -0,0 +1,32 @@
+export type WorkBuddyCredentials = {
+    version: 1;
+    apiEndpoint: string;
+    webOrigin: string;
+    accessToken: string;
+    refreshToken: string;
+    accessExpiresAt: string;
+    refreshExpiresAt: string;
+    updatedAt: string;
+};
+export declare function resolveWorkBuddyCredentialsFile(env: Record<string, string | undefined>): string;
+export declare class WorkBuddyCredentialStore {
+    readonly file: string;
+    private readonly now;
+    constructor(file: string, now?: () => Date);
+    read(): Promise<WorkBuddyCredentials | null>;
+    write(credentials: WorkBuddyCredentials): Promise<void>;
+    clear(): Promise<void>;
+    withLock<T>(action: () => Promise<T>): Promise<T>;
+    private acquireLock;
+    private withGuard;
+    private acquireGuard;
+    private tryCreateOwnedLock;
+    private reclaimStaleFile;
+    private startHeartbeat;
+    private renewOwnedLock;
+    private releaseMainLock;
+    private releaseOwnedFile;
+    private pathBelongsTo;
+    private assertBeforeDeadline;
+    private waitForRetry;
+}

package/dist/workbuddy-credentials.js

@@ -0,0 +1,340 @@
+import { randomBytes } from "node:crypto";
+import { chmod, mkdir, open, readFile, rename, stat, unlink, } from "node:fs/promises";
+import { homedir } from "node:os";
+import { basename, dirname, join } from "node:path";
+import { z } from "zod";
+const credentialsSchema = z
+    .object({
+    version: z.literal(1),
+    apiEndpoint: z.string().url(),
+    webOrigin: z.string().url(),
+    accessToken: z.string().min(1),
+    refreshToken: z.string().min(1),
+    accessExpiresAt: z.string().datetime({ offset: true }),
+    refreshExpiresAt: z.string().datetime({ offset: true }),
+    updatedAt: z.string().datetime({ offset: true }),
+})
+    .strict();
+const LOCK_STALE_MS = 10_000;
+const LOCK_WAIT_MS = 5_000;
+const LOCK_POLL_MS = 50;
+const LOCK_HEARTBEAT_MS = 2_500;
+const LOCK_OWNER_PATTERN = /^([1-9]\d*):[a-f0-9]{32}$/;
+function hasErrorCode(error, code) {
+    return (error instanceof Error &&
+        "code" in error &&
+        error.code === code);
+}
+function parseCredentials(value) {
+    const result = credentialsSchema.safeParse(value);
+    if (!result.success) {
+        throw new Error("凭证文件无效");
+    }
+    return result.data;
+}
+async function ensurePrivateDirectory(path) {
+    await mkdir(path, { recursive: true, mode: 0o700 });
+    if (process.platform !== "win32") {
+        await chmod(path, 0o700);
+    }
+}
+async function sleep(milliseconds) {
+    await new Promise((resolve) => {
+        setTimeout(resolve, milliseconds);
+    });
+}
+async function removeIfExists(path) {
+    await unlink(path).catch((error) => {
+        if (!hasErrorCode(error, "ENOENT")) {
+            throw error;
+        }
+    });
+}
+function parseLockOwnerPid(owner) {
+    const match = LOCK_OWNER_PATTERN.exec(owner);
+    const pid = Number(match?.[1]);
+    return Number.isSafeInteger(pid) && pid > 0 ? pid : null;
+}
+function getProcessState(pid) {
+    try {
+        process.kill(pid, 0);
+        return "alive";
+    }
+    catch (error) {
+        if (hasErrorCode(error, "EPERM")) {
+            return "alive";
+        }
+        if (hasErrorCode(error, "ESRCH")) {
+            return "dead";
+        }
+        return "unknown";
+    }
+}
+async function getLockOwnerProcessState(file) {
+    let owner;
+    try {
+        owner = await readFile(file, "utf8");
+    }
+    catch (error) {
+        return hasErrorCode(error, "ENOENT") ? "missing" : "unknown";
+    }
+    const pid = parseLockOwnerPid(owner);
+    return pid === null ? "unknown" : getProcessState(pid);
+}
+export function resolveWorkBuddyCredentialsFile(env) {
+    return (env.AI_HIVE_WORKBUDDY_CREDENTIALS_FILE ??
+        join(homedir(), ".ai-hive", "workbuddy", "credentials.json"));
+}
+export class WorkBuddyCredentialStore {
+    file;
+    now;
+    constructor(file, now = () => new Date()) {
+        this.file = file;
+        this.now = now;
+    }
+    async read() {
+        let contents;
+        try {
+            contents = await readFile(this.file, "utf8");
+        }
+        catch (error) {
+            if (hasErrorCode(error, "ENOENT")) {
+                return null;
+            }
+            throw new Error("凭证文件读取失败");
+        }
+        try {
+            return parseCredentials(JSON.parse(contents));
+        }
+        catch {
+            throw new Error("凭证文件无效");
+        }
+    }
+    async write(credentials) {
+        const validated = parseCredentials(credentials);
+        const parent = dirname(this.file);
+        await ensurePrivateDirectory(parent);
+        const temporaryFile = join(parent, `.${basename(this.file)}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`);
+        let handle;
+        try {
+            handle = await open(temporaryFile, "wx", 0o600);
+            if (process.platform !== "win32") {
+                await chmod(temporaryFile, 0o600);
+            }
+            await handle.writeFile(JSON.stringify(validated), "utf8");
+            await handle.sync();
+            await handle.close();
+            handle = undefined;
+            await rename(temporaryFile, this.file);
+            if (process.platform !== "win32") {
+                await chmod(this.file, 0o600).catch(() => undefined);
+            }
+        }
+        catch {
+            await handle?.close().catch(() => undefined);
+            await removeIfExists(temporaryFile).catch(() => undefined);
+            throw new Error("凭证文件写入失败");
+        }
+    }
+    async clear() {
+        try {
+            await removeIfExists(this.file);
+        }
+        catch {
+            throw new Error("凭证文件删除失败");
+        }
+    }
+    async withLock(action) {
+        const lockFile = `${this.file}.lock`;
+        const deadline = this.now().getTime() + LOCK_WAIT_MS;
+        await ensurePrivateDirectory(dirname(lockFile));
+        const ownedLock = await this.acquireLock(lockFile, deadline);
+        const stopHeartbeat = this.startHeartbeat(lockFile, ownedLock);
+        try {
+            return await action();
+        }
+        finally {
+            await stopHeartbeat();
+            await this.releaseMainLock(lockFile, ownedLock);
+        }
+    }
+    async acquireLock(lockFile, deadline) {
+        while (true) {
+            this.assertBeforeDeadline(deadline);
+            let acquired = null;
+            await this.withGuard(lockFile, deadline, async () => {
+                this.assertBeforeDeadline(deadline);
+                acquired = await this.tryCreateOwnedLock(lockFile);
+                if (!acquired) {
+                    await this.reclaimStaleFile(lockFile);
+                }
+            });
+            if (acquired) {
+                return acquired;
+            }
+            await this.waitForRetry(deadline);
+        }
+    }
+    async withGuard(lockFile, deadline, action) {
+        const guardFile = `${lockFile}.guard`;
+        const guard = await this.acquireGuard(guardFile, deadline);
+        try {
+            return await action();
+        }
+        finally {
+            await this.releaseOwnedFile(guardFile, guard);
+        }
+    }
+    async acquireGuard(guardFile, deadline) {
+        while (true) {
+            this.assertBeforeDeadline(deadline);
+            const guard = await this.tryCreateOwnedLock(guardFile);
+            if (guard) {
+                return guard;
+            }
+            await this.waitForRetry(deadline);
+        }
+    }
+    async tryCreateOwnedLock(file) {
+        const owner = `${process.pid}:${randomBytes(16).toString("hex")}`;
+        let handle;
+        try {
+            handle = await open(file, "wx", 0o600);
+        }
+        catch (error) {
+            if (hasErrorCode(error, "EEXIST")) {
+                return null;
+            }
+            throw new Error("凭证文件锁操作失败");
+        }
+        const owned = { handle, owner };
+        try {
+            await handle.writeFile(owner, "utf8");
+            await handle.sync();
+            return owned;
+        }
+        catch {
+            await this.releaseOwnedFile(file, owned);
+            throw new Error("凭证文件锁操作失败");
+        }
+    }
+    async reclaimStaleFile(file) {
+        let fileStats;
+        try {
+            fileStats = await stat(file);
+        }
+        catch (error) {
+            if (hasErrorCode(error, "ENOENT")) {
+                return true;
+            }
+            throw new Error("凭证文件锁操作失败");
+        }
+        if (this.now().getTime() - fileStats.mtimeMs < LOCK_STALE_MS) {
+            return false;
+        }
+        const ownerState = await getLockOwnerProcessState(file);
+        if (ownerState === "missing") {
+            return true;
+        }
+        if (ownerState !== "dead") {
+            return false;
+        }
+        try {
+            await unlink(file);
+            return true;
+        }
+        catch (error) {
+            if (hasErrorCode(error, "ENOENT")) {
+                return true;
+            }
+            throw new Error("凭证文件锁操作失败");
+        }
+    }
+    startHeartbeat(lockFile, ownedLock) {
+        let stopped = false;
+        let timer;
+        let pending = Promise.resolve();
+        const schedule = () => {
+            timer = setTimeout(() => {
+                pending = this.renewOwnedLock(lockFile, ownedLock).catch(() => undefined);
+                return pending.finally(() => {
+                    if (!stopped) {
+                        schedule();
+                    }
+                });
+            }, LOCK_HEARTBEAT_MS);
+        };
+        schedule();
+        return async () => {
+            stopped = true;
+            if (timer) {
+                clearTimeout(timer);
+            }
+            await pending;
+        };
+    }
+    async renewOwnedLock(lockFile, ownedLock) {
+        const deadline = this.now().getTime() + LOCK_WAIT_MS;
+        await this.withGuard(lockFile, deadline, async () => {
+            if (!(await this.pathBelongsTo(lockFile, ownedLock))) {
+                return;
+            }
+            const refreshedAt = this.now();
+            await ownedLock.handle.utimes(refreshedAt, refreshedAt);
+        });
+    }
+    async releaseMainLock(lockFile, ownedLock) {
+        const deadline = this.now().getTime() + LOCK_WAIT_MS;
+        try {
+            await this.withGuard(lockFile, deadline, async () => {
+                await this.releaseOwnedFile(lockFile, ownedLock);
+            });
+        }
+        catch {
+            await ownedLock.handle.close().catch(() => undefined);
+        }
+    }
+    async releaseOwnedFile(file, ownedLock) {
+        const heldStats = await ownedLock.handle.stat().catch(() => undefined);
+        await ownedLock.handle.close().catch(() => undefined);
+        if (!heldStats) {
+            return;
+        }
+        try {
+            if (!(await this.pathBelongsTo(file, ownedLock, heldStats))) {
+                return;
+            }
+            await unlink(file);
+        }
+        catch {
+            return;
+        }
+    }
+    async pathBelongsTo(file, ownedLock, heldStats) {
+        const expectedStats = heldStats ?? (await ownedLock.handle.stat().catch(() => undefined));
+        if (!expectedStats) {
+            return false;
+        }
+        try {
+            const pathStats = await stat(file);
+            return (pathStats.dev === expectedStats.dev &&
+                pathStats.ino === expectedStats.ino &&
+                (await readFile(file, "utf8")) === ownedLock.owner);
+        }
+        catch {
+            return false;
+        }
+    }
+    assertBeforeDeadline(deadline) {
+        if (this.now().getTime() >= deadline) {
+            throw new Error("凭证文件锁等待超时");
+        }
+    }
+    async waitForRetry(deadline) {
+        const remaining = deadline - this.now().getTime();
+        if (remaining <= 0) {
+            throw new Error("凭证文件锁等待超时");
+        }
+        await sleep(Math.min(LOCK_POLL_MS, remaining));
+    }
+}

package/dist/workbuddy-loopback.d.ts

@@ -0,0 +1,10 @@
+export type LoopbackListener = {
+    redirectUri: string;
+    completion: Promise<void>;
+    close(): Promise<void>;
+};
+export declare function listenForWorkBuddyCallback(_input: {
+    expectedState: string;
+    timeoutMs: number;
+    onCode(code: string): Promise<void>;
+}): Promise<LoopbackListener>;