@leadfund/lead-mcp 202610.1.0 → 202610.2.0

package/src/http.js

@@ -0,0 +1,224 @@
+import crypto from "node:crypto";
+import http from "node:http";
+import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { createServer } from "./server.js";
+import { logger } from "./logger.js";
+
+/**
+ * HTTP(S) 传输
+ *
+ * <p>为云端 MCP 服务（如阿里云百炼）提供入口。百炼支持两种协议：</p>
+ * <ul>
+ *     <li>{@code sse}  —— {@code GET /sse} 建流，{@code POST /messages?sessionId=} 回传消息</li>
+ *     <li>{@code http} —— Streamable HTTP，{@code POST /mcp} 一站式</li>
+ * </ul>
+ *
+ * <p><b>鉴权</b>：所有业务端点校验 {@code Authorization: Bearer <token>}，
+ * 令牌由 {@code --auth-token} 配置，HTTP 模式下必填。</p>
+ */
+
+/**
+ * 定长安全比较
+ *
+ * @param {string} a
+ * @param {string} b
+ * @returns {boolean} 是否相等
+ */
+function timingSafeEqual(a, b) {
+  const bufA = Buffer.from(a ?? "", "utf8");
+  const bufB = Buffer.from(b ?? "", "utf8");
+  if (bufA.length !== bufB.length) {
+    return false;
+  }
+  return crypto.timingSafeEqual(bufA, bufB);
+}
+
+/**
+ * 校验 Authorization 头
+ *
+ * @param {http.IncomingMessage} req 请求
+ * @param {import("./config.js").LeadMcpConfig} config 配置
+ * @returns {boolean} 是否通过
+ */
+function checkAuth(req, config) {
+  if (!config.authToken) {
+    return true;
+  }
+  const header = req.headers.authorization ?? "";
+  return timingSafeEqual(header, `Bearer ${config.authToken}`);
+}
+
+/**
+ * 读取并解析 JSON 请求体
+ *
+ * @param {http.IncomingMessage} req 请求
+ * @returns {Promise<unknown>} 解析后的 body
+ */
+async function readJsonBody(req) {
+  const chunks = [];
+  for await (const chunk of req) {
+    chunks.push(chunk);
+  }
+  if (chunks.length === 0) {
+    return undefined;
+  }
+  const raw = Buffer.concat(chunks).toString("utf8");
+  if (!raw.trim()) {
+    return undefined;
+  }
+  return JSON.parse(raw);
+}
+
+/**
+ * 启动 HTTP 服务
+ *
+ * @param {import("./config.js").LeadMcpConfig} config 配置
+ * @returns {Promise<http.Server>} HTTP Server
+ */
+export async function startHttpServer(config) {
+  /** @type {Map<string, {transport: any, server: any}>} */
+  const sessions = new Map();
+
+  const server = http.createServer(async (req, res) => {
+    const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+
+    // 健康检查不鉴权，方便探活
+    if (req.method === "GET" && url.pathname === "/health") {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(
+        JSON.stringify({
+          ok: true,
+          transport: config.transport,
+          env: config.env,
+          sessions: sessions.size,
+        }),
+      );
+      return;
+    }
+
+    if (!checkAuth(req, config)) {
+      logger.warn("鉴权失败，已拒绝", { path: url.pathname, ip: req.socket.remoteAddress });
+      res.writeHead(401, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "unauthorized" }));
+      return;
+    }
+
+    try {
+      if (config.transport === "sse") {
+        await handleSse(url, req, res, config, sessions);
+      } else {
+        await handleStreamableHttp(url, req, res, config, sessions);
+      }
+    } catch (error) {
+      logger.error("HTTP 请求处理失败", error);
+      if (!res.headersSent) {
+        res.writeHead(500, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "internal error" }));
+      }
+    }
+  });
+
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(config.httpPort, config.httpHost, resolve);
+  });
+
+  const displayHost =
+    config.httpHost === "0.0.0.0" || config.httpHost === "::" ? "127.0.0.1" : config.httpHost;
+  logger.info(
+    `HTTP 服务已启动，传输=${config.transport}，端点=http://${displayHost}:${config.httpPort}${config.httpPath}` +
+      `，后端环境=${config.env}，地址=${config.baseUrls.join(", ")}`,
+  );
+  if (config.httpHost === "0.0.0.0") {
+    logger.info("已监听所有网卡，可用 ng/隧道工具暴露到公网");
+  }
+
+  return server;
+}
+
+/**
+ * SSE 传输：GET 建流，POST /messages 回传
+ *
+ * @param {URL} url
+ * @param {http.IncomingMessage} req
+ * @param {http.ServerResponse} res
+ * @param {import("./config.js").LeadMcpConfig} config
+ * @param {Map<string, any>} sessions
+ */
+async function handleSse(url, req, res, config, sessions) {
+  if (req.method === "GET" && url.pathname === config.httpPath) {
+    const transport = new SSEServerTransport("/messages", res);
+    const mcpServer = createServer(config);
+    sessions.set(transport.sessionId, { transport, server: mcpServer });
+    res.on("close", () => {
+      sessions.delete(transport.sessionId);
+      logger.info("SSE 连接关闭", { sessionId: transport.sessionId });
+    });
+    await mcpServer.connect(transport);
+    logger.info("SSE 连接建立", { sessionId: transport.sessionId });
+    return;
+  }
+
+  if (req.method === "POST" && url.pathname === "/messages") {
+    const sessionId = url.searchParams.get("sessionId") ?? "";
+    const entry = sessions.get(sessionId);
+    if (!entry) {
+      res.writeHead(404, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "session not found" }));
+      return;
+    }
+    const body = await readJsonBody(req);
+    await entry.transport.handlePostMessage(req, res, body);
+    return;
+  }
+
+  res.writeHead(404, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({ error: "not found" }));
+}
+
+/**
+ * Streamable HTTP 传输
+ *
+ * @param {URL} url
+ * @param {http.IncomingMessage} req
+ * @param {http.ServerResponse} res
+ * @param {import("./config.js").LeadMcpConfig} config
+ * @param {Map<string, any>} sessions
+ */
+async function handleStreamableHttp(url, req, res, config, sessions) {
+  if (url.pathname !== config.httpPath) {
+    res.writeHead(404, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "not found" }));
+    return;
+  }
+
+  const sessionId = req.headers["mcp-session-id"];
+  let entry = sessionId ? sessions.get(sessionId) : undefined;
+
+  if (!entry) {
+    if (req.method !== "POST") {
+      // 没有会话的 GET/DELETE 直接拒绝
+      res.writeHead(400, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "missing mcp-session-id" }));
+      return;
+    }
+    const transport = new StreamableHTTPServerTransport({
+      sessionIdGenerator: () => crypto.randomUUID(),
+      onsessioninitialized: (id) => {
+        sessions.set(id, { transport, server: mcpServer });
+        logger.info("HTTP 会话建立", { sessionId: id });
+      },
+      onsessionclosed: (id) => {
+        sessions.delete(id);
+        logger.info("HTTP 会话关闭", { sessionId: id });
+      },
+    });
+    const mcpServer = createServer(config);
+    await mcpServer.connect(transport);
+    entry = { transport, server: mcpServer };
+  }
+
+  const body = req.method === "POST" ? await readJsonBody(req) : undefined;
+  await entry.transport.handleRequest(req, res, body);
+}

package/test/config.test.mjs

@@ -5,7 +5,16 @@
  */
 
 import assert from "node:assert/strict";
-import { ENVIRONMENTS, loadConfig, normalizeEnv, splitBaseUrls } from "../src/config.js";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import {
+  BUILTIN_ENVIRONMENTS,
+  loadConfig,
+  normalizeTransport,
+  resolveConfigFile,
+  splitBaseUrls,
+} from "../src/config.js";
 
 let passed = 0;
 
@@ -26,38 +35,54 @@ function test(name, fn) {
   }
 }
 
-test("环境名归一化", () => {
-  assert.equal(normalizeEnv("PRD"), "prd");
-  assert.equal(normalizeEnv(" sit "), "sit");
-});
+// 用临时配置文件，避免污染真实环境
+const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "lead-mcp-test-"));
+const configFile = path.join(tmpDir, "config.json");
+fs.writeFileSync(
+  configFile,
+  JSON.stringify({
+    defaultEnvironment: "sit",
+    environments: {
+      sit: ["http://10.1.1.197:8081"],
+      prd: ["http://10.32.30.208:8081", "http://10.32.30.209:8081"],
+    },
+  }),
+);
+process.env.LEAD_MCP_CONFIG = configFile;
 
-test("未知环境名直接报错，不静默回落", () => {
-  assert.throws(() => normalizeEnv("pro"), /未知环境/);
-  assert.throws(() => normalizeEnv(""), /未知环境/);
+test("内置只有 local，功能代码不依赖内网地址", () => {
+  assert.deepEqual(Object.keys(BUILTIN_ENVIRONMENTS), ["local"]);
+  const builtins = JSON.stringify(BUILTIN_ENVIRONMENTS);
+  assert.ok(
+    !/10\.\d+\.\d+\.\d+/.test(builtins),
+    "内置环境表里不应出现内网地址",
+  );
 });
 
-test("默认环境是 local", () => {
-  const config = loadConfig([]);
-  assert.equal(config.env, "local");
-  assert.deepEqual(config.baseUrls, ENVIRONMENTS.local.baseUrls);
+test("配置文件路径可覆盖", () => {
+  assert.equal(resolveConfigFile(), configFile);
 });
 
-test("--env 选择环境", () => {
-  const config = loadConfig(["--env", "sit"]);
+test("默认用配置文件里的 defaultEnvironment", () => {
+  const config = loadConfig([]);
   assert.equal(config.env, "sit");
   assert.deepEqual(config.baseUrls, ["http://10.1.1.197:8081"]);
 });
 
-test("生产环境带两个节点", () => {
+test("--env 从用户配置里取，支持多地址", () => {
   const config = loadConfig(["--env", "prd"]);
   assert.equal(config.env, "prd");
-  assert.equal(config.baseUrls.length, 2);
   assert.deepEqual(config.baseUrls, [
     "http://10.32.30.208:8081",
     "http://10.32.30.209:8081",
   ]);
 });
 
+test("未知环境直接报错并提示怎么配", () => {
+  assert.throws(() => loadConfig(["--env", "pro"]), /未知环境/);
+  assert.throws(() => loadConfig(["--env", "pro"]), /config\.json/);
+});
+
 test("--base-url 优先级高于 --env", () => {
   const config = loadConfig(["--env", "prd", "--base-url", "http://example.com:8081"]);
   assert.deepEqual(config.baseUrls, ["http://example.com:8081"]);
@@ -71,19 +96,51 @@ test("--base-url 支持逗号分隔多节点", () => {
   assert.deepEqual(config.baseUrls, ["http://a:8081", "http://b:8081"]);
 });
 
-test("未指定 --base-url 时环境标识为 custom", () => {
+test("未指定 --base-url 时环境标识跟随实际环境", () => {
   const config = loadConfig(["--base-url", "http://example.com:8081"]);
   assert.equal(config.env, "custom");
 });
 
-test("环境变量优先于默认值", () => {
-  process.env.LEAD_MCP_ENV = "sit";
-  try {
-    const config = loadConfig([]);
-    assert.equal(config.env, "sit");
-  } finally {
-    delete process.env.LEAD_MCP_ENV;
-  }
+test("传输方式归一化", () => {
+  assert.equal(normalizeTransport("SSE"), "sse");
+  assert.equal(normalizeTransport(" http "), "http");
+  assert.throws(() => normalizeTransport("grpc"), /未知传输方式/);
+});
+
+test("默认 stdio 传输", () => {
+  const config = loadConfig([]);
+  assert.equal(config.transport, "stdio");
+});
+
+test("HTTP 模式必须配置访问令牌", () => {
+  assert.throws(
+    () => loadConfig(["--transport", "sse"]),
+    /必须配置访问令牌/,
+  );
+  const config = loadConfig(["--transport", "sse", "--auth-token", "secret"]);
+  assert.equal(config.transport, "sse");
+  assert.equal(config.authToken, "secret");
+  assert.equal(config.httpPath, "/sse");
+});
+
+test("http 传输默认端点是 /mcp", () => {
+  const config = loadConfig(["--transport", "http", "--auth-token", "secret"]);
+  assert.equal(config.httpPath, "/mcp");
+});
+
+test("HTTP 监听参数可覆盖", () => {
+  const config = loadConfig([
+    "--transport",
+    "sse",
+    "--auth-token",
+    "secret",
+    "--http-port",
+    "8088",
+    "--http-host",
+    "0.0.0.0",
+  ]);
+  assert.equal(config.httpPort, 8088);
+  assert.equal(config.httpHost, "0.0.0.0");
 });
 
 test("地址拆分工具", () => {
@@ -91,6 +148,8 @@ test("地址拆分工具", () => {
   assert.deepEqual(splitBaseUrls(" , "), []);
 });
 
+fs.rmSync(tmpDir, { recursive: true, force: true });
+
 if (process.exitCode) {
   console.error("\n有用例失败 ❌");
 } else {

package/test/e2e-published.mjs

@@ -0,0 +1,118 @@
+/**
+ * 已发布包的端到端验证
+ *
+ * <p>用公网 npm 上的 @leadfund/lead-mcp（而不是本地源码）拉起 MCP Server，
+ * 打到 sit 环境，走完整协议握手，确认「公网安装 → MCP → 275 → MES」整条链路通。</p>
+ *
+ * <p>运行：node test/e2e-published.mjs [mobile]</p>
+ */
+
+import { spawn } from "node:child_process";
+import os from "node:os";
+
+const MOBILE = process.argv[2] ?? "13800000000";
+const ENV = process.env.LEAD_MCP_ENV ?? "sit";
+const OPERATOR = process.env.LEAD_MCP_OPERATOR ?? "dhh_6234";
+
+function start() {
+  // 直接用 npx 拉公网上的包，和 Claude Code 实际执行的命令一致
+  const child = spawn(
+    "npx",
+    ["-y", "--registry=https://registry.npmjs.org/", "@leadfund/lead-mcp", "--env", ENV],
+    {
+      stdio: ["pipe", "pipe", "pipe"],
+      // 不能在包自己的源码目录里跑：npx 会把本地 package.json 当作「已安装」，
+      // 直接去找 node_modules/.bin/lead-mcp，而它不是自己的依赖，软链不存在 → exit 127
+      cwd: os.tmpdir(),
+    },
+  );
+
+  const pending = new Map();
+  let buffer = "";
+  let stderr = "";
+
+  child.stdout.on("data", (chunk) => {
+    buffer += chunk.toString();
+    let index;
+    while ((index = buffer.indexOf("\n")) >= 0) {
+      const line = buffer.slice(0, index).trim();
+      buffer = buffer.slice(index + 1);
+      if (!line) continue;
+      const message = JSON.parse(line);
+      const resolver = pending.get(message.id);
+      if (resolver) {
+        pending.delete(message.id);
+        resolver(message);
+      }
+    }
+  });
+  child.stderr.on("data", (chunk) => {
+    stderr += chunk.toString();
+  });
+
+  let nextId = 1;
+  function send(method, params) {
+    const id = nextId++;
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        pending.delete(id);
+        reject(new Error(`超时: ${method}\n${stderr}`));
+      }, 60000);
+      pending.set(id, (response) => {
+        clearTimeout(timer);
+        resolve(response);
+      });
+      child.stdin.write(
+        `${JSON.stringify({ jsonrpc: "2.0", id, method, params })}\n`,
+      );
+    });
+  }
+  function notify(method, params) {
+    child.stdin.write(
+      `${JSON.stringify({ jsonrpc: "2.0", method, params })}\n`,
+    );
+  }
+  return { child, send, notify, getStderr: () => stderr };
+}
+
+const mcp = start();
+try {
+  const init = await mcp.send("initialize", {
+    protocolVersion: "2024-11-05",
+    capabilities: {},
+    clientInfo: { name: "e2e-published", version: "0.0.1" },
+  });
+  console.log("✓ initialize", JSON.stringify(init.result.serverInfo));
+  mcp.notify("notifications/initialized");
+
+  const list = await mcp.send("tools/list", {});
+  console.log(
+    "✓ tools/list",
+    list.result.tools.map((t) => t.name).join(", "),
+  );
+
+  const call = await mcp.send("tools/call", {
+    name: "dmmp_query_account",
+    arguments: { mobile: MOBILE },
+  });
+  console.log("✓ tools/call");
+  console.log(
+    call.result.content
+      .map((c) => c.text)
+      .join("\n")
+      .split("\n")
+      .map((l) => `    ${l}`)
+      .join("\n"),
+  );
+
+  const err = mcp.getStderr();
+  const envLine = err.split("\n").find((l) => l.includes("环境="));
+  if (envLine) {
+    console.log("✓ 启动日志", envLine.replace("[lead-mcp] INFO ", ""));
+  }
+} catch (error) {
+  console.error("端到端验证失败:", error.message);
+  process.exitCode = 1;
+} finally {
+  mcp.child.kill();
+}

package/test/http-curl-demo.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# 用 curl 完整走一遍 MCP over SSE 协议（不依赖任何 MCP 客户端）
+#
+# 用法：
+#   ./test/http-curl-demo.sh [端口] [令牌] [手机号]
+#
+# 默认：端口 3100、令牌 demo-token-abc、手机号 13800000000
+
+set -euo pipefail
+
+PORT="${1:-3100}"
+TOKEN="${2:-demo-token-abc}"
+MOBILE="${3:-13800000000}"
+BASE="http://127.0.0.1:${PORT}"
+STREAM="$(mktemp)"
+trap 'rm -f "$STREAM"' EXIT
+
+echo "▶ 1) 建立 SSE 流并取 sessionId"
+curl -s -N --max-time 20 -H "Authorization: Bearer ${TOKEN}" "${BASE}/sse" > "$STREAM" &
+CURL_PID=$!
+
+SESSION_ID=""
+for _ in $(seq 1 50); do
+  SESSION_ID=$(grep -o 'sessionId=[0-9a-f-]*' "$STREAM" 2>/dev/null | head -1 | cut -d= -f2 || true)
+  [ -n "$SESSION_ID" ] && break
+  sleep 0.2
+done
+[ -z "$SESSION_ID" ] && { echo "✗ 未能取得 sessionId"; kill $CURL_PID 2>/dev/null || true; exit 1; }
+echo "  sessionId=${SESSION_ID}"
+
+echo "▶ 2) initialize"
+curl -s -X POST "${BASE}/messages?sessionId=${SESSION_ID}" \
+  -H "Authorization: Bearer ${TOKEN}" \
+  -H "Content-Type: application/json" \
+  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"curl-demo","version":"0.0.1"}}}' \
+  > /dev/null
+sleep 1
+grep -o '"serverInfo":{[^}]*}' "$STREAM" | head -1 | sed 's/^/  /' || echo "  (未读到 initialize 响应)"
+
+echo "▶ 3) notifications/initialized"
+curl -s -X POST "${BASE}/messages?sessionId=${SESSION_ID}" \
+  -H "Authorization: Bearer ${TOKEN}" \
+  -H "Content-Type: application/json" \
+  -d '{"jsonrpc":"2.0","method":"notifications/initialized"}' > /dev/null
+sleep 1
+
+echo "▶ 4) tools/list"
+curl -s -X POST "${BASE}/messages?sessionId=${SESSION_ID}" \
+  -H "Authorization: Bearer ${TOKEN}" \
+  -H "Content-Type: application/json" \
+  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list"}' > /dev/null
+sleep 1
+grep -o '"name":"dmmp_query_account"' "$STREAM" | head -1 | sed 's/^/  工具: /' || echo "  (未读到 tools/list 响应)"
+
+echo "▶ 5) tools/call  mobile=${MOBILE}"
+curl -s -X POST "${BASE}/messages?sessionId=${SESSION_ID}" \
+  -H "Authorization: Bearer ${TOKEN}" \
+  -H "Content-Type: application/json" \
+  -d "{\"jsonrpc\":\"2.0\",\"id\":3,\"method\":\"tools/call\",\"params\":{\"name\":\"dmmp_query_account\",\"arguments\":{\"mobile\":\"${MOBILE}\"}}}" > /dev/null
+sleep 2
+grep -o '"text":"[^"]*"' "$STREAM" | tail -1 | sed 's/^/  /' || echo "  (未读到 tools/call 响应)"
+echo "  --- 原始帧 ---"
+grep -A1 '"id":3' "$STREAM" | tail -1 | sed 's/^/  /' || true
+
+kill $CURL_PID 2>/dev/null || true
+echo
+echo "✓ 完成"