@lessie/mcp-server 0.1.1 → 0.1.3

package/dist/auth.js

@@ -13,13 +13,24 @@
  * 客户端信息和令牌持久化到 ~/.lessie/oauth.json，进程重启后复用，
  * 避免每次都打开浏览器。
  */
+import { auth } from "@modelcontextprotocol/sdk/client/auth.js";
 import { createServer } from "node:http";
 import { readFileSync, writeFileSync, mkdirSync, chmodSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
+import { REMOTE_MCP_URL } from "./config.js";
 export const DEFAULT_CALLBACK_PORT = 19836;
 export const PORT_SCAN_RANGE = 10;
-const STORAGE_DIR = join(homedir(), ".lessie");
+function getStorageDir() {
+    try {
+        const host = new URL(REMOTE_MCP_URL).hostname;
+        return join(homedir(), ".lessie", host);
+    }
+    catch {
+        return join(homedir(), ".lessie");
+    }
+}
+const STORAGE_DIR = getStorageDir();
 const STORAGE_FILE = join(STORAGE_DIR, "oauth.json");
 const CALLBACK_TIMEOUT_MS = 120_000;
 function tryListenHttp(port) {
@@ -56,6 +67,10 @@ export class LessieAuthProvider {
     _httpServer = null;
     _callbackTimer = null;
     _callbackPort;
+    _authCompletion = null;
+    _authFetchFn;
+    _onAuthorizationComplete = null;
+    _onAuthorizationFailure = null;
     /** 等待用户访问的授权 URL；授权完成后清除 */
     pendingAuthUrl = null;
     /** 回调服务器开始监听的时间戳，用于计算等待时长 */
@@ -68,6 +83,24 @@ export class LessieAuthProvider {
     get callbackPort() {
         return this._callbackPort;
     }
+    /** 注册 completion 成功回调（授权码已换 token） */
+    setOnAuthorizationComplete(cb) {
+        this._onAuthorizationComplete = cb;
+    }
+    /** 注册 completion 失败回调（超时、拒绝授权、回调服务错误等） */
+    setOnAuthorizationFailure(cb) {
+        this._onAuthorizationFailure = cb;
+    }
+    /** 设置 auth() 的可选 fetch 实现（用于调试日志等） */
+    setAuthFetchFn(fetchFn) {
+        this._authFetchFn = fetchFn;
+    }
+    /** 等待 provider 内部 completion 结束（成功或失败） */
+    async waitForAuthorizationCompletion() {
+        if (!this._authCompletion)
+            return;
+        await this._authCompletion.catch(() => { });
+    }
     /**
      * 扫描端口范围，创建 HTTP 服务器占住可用端口。
      * redirectToAuthorization 直接复用该服务器，无需释放重听。
@@ -131,13 +164,26 @@ export class LessieAuthProvider {
     }
     /**
      * SDK 在需要用户授权时调用此方法。
-     * 在 prepareCallbackServer() 已监听的 HTTP 服务器上挂载回调处理逻辑，等待浏览器回调。
+     * 在监听中的 HTTP 服务器上挂载回调处理逻辑，进入 pending 授权状态。
      *
-     * 必须先调用 prepareCallbackServer()，否则抛出异常。
+     * 为兼容 SDK 在普通工具调用路径中触发的重授权，这里会在必要时自动启动回调服务器，
+     * 并启动 provider 内部 completion 任务（等待 code -> 换 token）。
      */
     async redirectToAuthorization(url) {
+        // 并发 auth() 调用可能重复进入 redirect。若已有 pending 授权，复用现有流程，
+        // 避免覆盖 _callbackPromise 导致原 completion 永久等待。
+        if (this._authCompletion) {
+            if (this.pendingAuthUrl && this._callbackPromise) {
+                return;
+            }
+            await this.waitForAuthorizationCompletion();
+        }
         if (!this._httpServer?.listening) {
-            throw new Error("No listening server — prepareCallbackServer() must be called before redirectToAuthorization()");
+            await this.prepareCallbackServer();
+        }
+        const server = this._httpServer;
+        if (!server?.listening) {
+            throw new Error("Callback server is not listening");
         }
         this._expectedState = url.searchParams.get("state") || "";
         this.waitingSince = null;
@@ -147,13 +193,15 @@ export class LessieAuthProvider {
             resolveCode = resolve;
             rejectCode = reject;
         });
-        this._httpServer.removeAllListeners("request");
-        this._httpServer.removeAllListeners("error");
-        this._httpServer.on("error", (err) => {
+        server.removeAllListeners("request");
+        server.removeAllListeners("error");
+        server.on("error", (err) => {
             this._cleanupServer();
-            rejectCode(new Error(`Callback server error: ${err.message}`));
+            this.pendingAuthUrl = null;
+            const authError = new Error(`Callback server error: ${err.message}`);
+            rejectCode(authError);
         });
-        this._httpServer.on("request", (req, res) => {
+        server.on("request", (req, res) => {
             const reqUrl = new URL(req.url, `http://127.0.0.1:${this._callbackPort}`);
             if (reqUrl.pathname !== "/callback") {
                 res.writeHead(404);
@@ -180,21 +228,26 @@ export class LessieAuthProvider {
             }
             else {
                 const error = reqUrl.searchParams.get("error") ?? "unknown_error";
-                rejectCode(new Error(`Authorization denied: ${error}`));
+                const authError = new Error(`Authorization denied: ${error}`);
+                rejectCode(authError);
                 res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
                 res.end("<!DOCTYPE html><html><body>" +
                     "<h1>Authorization Failed</h1>" +
                     `<p>${escapeHtml(error)}</p>` +
                     "</body></html>");
                 this._cleanupServer();
+                this.pendingAuthUrl = null;
             }
         });
         this.waitingSince = Date.now();
         this._callbackTimer = setTimeout(() => {
             this._cleanupServer();
-            rejectCode(new Error("Authorization timed out — no callback received within 2 minutes"));
+            this.pendingAuthUrl = null;
+            const timeoutError = new Error("Authorization timed out — no callback received within 2 minutes");
+            rejectCode(timeoutError);
         }, CALLBACK_TIMEOUT_MS);
         this.pendingAuthUrl = url.toString();
+        this._ensureAuthorizationCompletion();
     }
     _cleanupServer() {
         if (this._callbackTimer) {
@@ -208,6 +261,59 @@ export class LessieAuthProvider {
             setTimeout(() => server.close(), 500);
         }
     }
+    /**
+     * provider 内部 completion 状态机：
+     * - 等待浏览器回调 code
+     * - 用 code 交换 token
+     * - 通过 Complete/Error 事件通知外层
+     */
+    _ensureAuthorizationCompletion() {
+        if (this._authCompletion)
+            return;
+        const serverUrl = REMOTE_MCP_URL;
+        if (!serverUrl) {
+            const err = new Error("LESSIE_REMOTE_MCP_URL is not configured");
+            this.pendingAuthUrl = null;
+            this._notifyAuthorizationFailure(err);
+            return;
+        }
+        this._authCompletion = (async () => {
+            try {
+                const code = await this.waitForCallback();
+                await auth(this, { serverUrl, authorizationCode: code, fetchFn: this._authFetchFn });
+                this.pendingAuthUrl = null;
+                this._notifyAuthorizationComplete();
+            }
+            catch (e) {
+                this.pendingAuthUrl = null;
+                const err = e instanceof Error ? e : new Error(String(e));
+                this._notifyAuthorizationFailure(err);
+                throw err;
+            }
+            finally {
+                this._callbackPromise = null;
+                this._authCompletion = null;
+            }
+        })();
+        // completion 主要由外层 wait/event 消费，这里兜底避免未处理拒绝告警
+        void this._authCompletion.catch(() => { });
+    }
+    _notifyAuthorizationComplete() {
+        try {
+            this._onAuthorizationComplete?.();
+        }
+        catch (err) {
+            console.warn("[lessie] onAuthorizationComplete callback failed:", err);
+        }
+    }
+    _notifyAuthorizationFailure(error) {
+        try {
+            this._onAuthorizationFailure?.(error);
+        }
+        catch (err) {
+            console.warn("[lessie] onAuthorizationFailure callback failed:", err);
+        }
+    }
     /**
      * 等待用户在浏览器中完成授权后回调，返回授权码。
      * 必须在 redirectToAuthorization 之后调用。

package/dist/config.js

@@ -16,7 +16,7 @@ function readPkgVersion() {
 }
 export const pkg = { version: readPkgVersion() };
 /** 远程 MCP Server 地址 */
-export const REMOTE_MCP_URL = process.env.LESSIE_REMOTE_MCP_URL || "https://www.lessie.ai/mcp-server/mcp";
+export const REMOTE_MCP_URL = process.env.LESSIE_REMOTE_MCP_URL || "https://app.lessie.ai/mcp-server/mcp";
 /** 读取 SKILL.md 作为 MCP instructions，跳过 YAML front-matter */
 export function loadInstructions() {
     try {

package/dist/index.js

@@ -9,7 +9,7 @@ import "./process-handlers.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { REMOTE_MCP_URL, pkg, loadInstructions } from "./config.js";
-import { connectToRemote, listRemoteTools, isRemoteConnected, setOnAuthComplete, setOnAuthError } from "./remote.js";
+import { connectToRemote, listRemoteTools, setOnAuthComplete, setOnAuthError } from "./remote.js";
 import { registerTools } from "./tools.js";
 console.error("[lessie] Modules loaded");
 const server = new McpServer({ name: "lessie-mcp", version: pkg.version }, {
@@ -45,9 +45,9 @@ setOnAuthError(({ code, message }) => {
 });
 console.error("[lessie] Connecting to remote...");
 try {
-    await connectToRemote();
-    console.error("[lessie] connectToRemote() completed, connected:", isRemoteConnected());
-    if (isRemoteConnected()) {
+    const connected = await connectToRemote();
+    console.error("[lessie] connectToRemote() completed, connected:", connected);
+    if (connected) {
         const remoteTools = await listRemoteTools();
         server.sendLoggingMessage({
             level: "info",

package/dist/remote.js

@@ -34,8 +34,8 @@ const debugFetch = async (input, init) => {
 const fetchFn = DEBUG ? debugFetch : undefined;
 let client = null;
 let cachedTools = [];
-let reconnecting = null;
-let authCompletion = null;
+// 授权码换 token 完成后，remote 侧需要做一次连接同步（重连 + 刷新工具）。
+let postAuthSync = null;
 let onAuthComplete = null;
 let onAuthError = null;
 let lastAuthError = null;
@@ -50,25 +50,36 @@ export function setOnAuthError(cb) {
 export function isRemoteConnected() {
     return client !== null;
 }
-/** 若授权流程正在进行中，等待其完成（成功或失败） */
+/** 等待授权 provider 完成，并等待 remote 侧连接同步完成。 */
 export async function waitForAuthCompletion() {
-    if (authCompletion)
-        await authCompletion;
+    await authProvider.waitForAuthorizationCompletion();
+    if (postAuthSync)
+        await postAuthSync;
+}
+/** 获取当前已连接客户端的工具列表并刷新缓存。 */
+async function listConnectedTools() {
+    if (!client)
+        throw new Error("Remote client is not connected");
+    const { tools } = await client.listTools();
+    cachedTools = tools;
+    return tools;
 }
 /** 启动时静默连接：有缓存令牌才尝试，无令牌或连接失败则跳过 */
 export async function connectToRemote() {
     if (!REMOTE_MCP_URL)
-        return;
+        return false;
     if (!(await authProvider.tokens()))
-        return;
+        return false;
     const url = new URL(REMOTE_MCP_URL);
     try {
         client = await tryConnect(url);
         const { tools } = await client.listTools();
         cachedTools = tools;
+        return true;
     }
     catch {
         client = null;
+        return false;
     }
 }
 /**
@@ -81,15 +92,12 @@ export async function connectToRemote() {
  *   error      — 授权流程出错（附带错误码和引导信息）
  */
 export async function initiateAuth() {
-    if (client) {
-        const tools = await listRemoteTools();
-        return { status: "connected", toolCount: tools.length };
-    }
     if (!REMOTE_MCP_URL) {
         return { status: "error", errorCode: "not_configured", message: "LESSIE_REMOTE_MCP_URL is not configured" };
     }
+    const serverUrl = REMOTE_MCP_URL;
     // 授权流程进行中：告诉 Agent 当前等待状态
-    if (authProvider.pendingAuthUrl && authCompletion) {
+    if (authProvider.pendingAuthUrl) {
         const elapsed = authProvider.waitingSince
             ? Date.now() - authProvider.waitingSince
             : 0;
@@ -99,62 +107,93 @@ export async function initiateAuth() {
             elapsedMs: elapsed,
         };
     }
+    // 若上一次授权流程刚完成，先等待 remote 侧连接同步，避免与当前 authorize 并发竞争。
+    await waitForAuthCompletion();
     // 上次异步错误（超时、授权拒绝等），记录后清除
     const prevError = lastAuthError;
     lastAuthError = null;
-    const serverUrl = REMOTE_MCP_URL;
     try {
-        await authProvider.prepareCallbackServer();
         const result = await auth(authProvider, { serverUrl, fetchFn });
-        if (result === "AUTHORIZED") {
-            const url = new URL(serverUrl);
-            client = await tryConnect(url);
-            const { tools } = await client.listTools();
-            cachedTools = tools;
-            return { status: "connected", toolCount: tools.length };
+        if (result === "REDIRECT") {
+            const authUrl = authProvider.pendingAuthUrl;
+            if (!authUrl) {
+                return { status: "error", errorCode: "no_auth_url", message: "OAuth flow initiated but no authorization URL was generated" };
+            }
+            return {
+                status: "auth_url",
+                authUrl,
+                ...(prevError ? { previousError: prevError.message } : {}),
+            };
         }
-        const authUrl = authProvider.pendingAuthUrl;
-        if (!authUrl) {
-            return { status: "error", errorCode: "no_auth_url", message: "OAuth flow initiated but no authorization URL was generated" };
+        if (result !== "AUTHORIZED") {
+            return { status: "error", errorCode: "unexpected_auth_result", message: `Unexpected auth result: ${result}` };
         }
-        ensureAuthCompletion();
-        return {
-            status: "auth_url",
-            authUrl,
-            ...(prevError ? { previousError: prevError.message } : {}),
-        };
+        // 只有在 auth() 已确认 AUTHORIZED 后，才认为当前会话可用。
+        if (client) {
+            try {
+                const tools = await listConnectedTools();
+                return { status: "connected", toolCount: tools.length };
+            }
+            catch {
+                // 连接对象已失效：清理后重建连接。
+                const old = client;
+                client = null;
+                await old?.close().catch(() => { });
+            }
+        }
+        const nextClient = await tryConnect(new URL(serverUrl));
+        client = nextClient;
+        const tools = await listConnectedTools();
+        return { status: "connected", toolCount: tools.length };
     }
     catch (err) {
         const error = err instanceof Error ? err : new Error(String(err));
         return { status: "error", errorCode: categorizeAuthError(error), message: error.message };
     }
 }
-/** 启动后台任务：等待用户浏览器回调 → 交换令牌 → 连接远程服务器 */
-function ensureAuthCompletion() {
-    if (authCompletion)
+// provider 负责 OAuth completion；remote 只监听完成/失败事件并同步连接状态。
+authProvider.setAuthFetchFn(fetchFn);
+authProvider.setOnAuthorizationComplete(() => {
+    syncRemoteAfterAuthorization();
+});
+authProvider.setOnAuthorizationFailure((error) => {
+    const code = categorizeAuthError(error);
+    lastAuthError = { code, message: error.message };
+    onAuthError?.({ code, message: error.message });
+});
+function syncRemoteAfterAuthorization() {
+    if (postAuthSync)
         return;
-    const serverUrl = REMOTE_MCP_URL;
-    const url = new URL(serverUrl);
-    authCompletion = (async () => {
+    if (!REMOTE_MCP_URL)
+        return;
+    const url = new URL(REMOTE_MCP_URL);
+    postAuthSync = (async () => {
         try {
-            const code = await authProvider.waitForCallback();
-            await auth(authProvider, { serverUrl, authorizationCode: code, fetchFn });
-            client = await tryConnect(url);
-            const { tools } = await client.listTools();
-            cachedTools = tools;
-            authProvider.pendingAuthUrl = null;
+            const old = client;
+            let next = null;
+            try {
+                next = await tryConnect(url);
+                const { tools } = await next.listTools();
+                client = next;
+                next = null;
+                cachedTools = tools;
+            }
+            finally {
+                // 新连接初始化失败时，关闭半初始化连接，避免泄漏。
+                await next?.close().catch(() => { });
+            }
+            await old?.close().catch(() => { });
             onAuthComplete?.(cachedTools.length);
         }
         catch (e) {
-            authProvider.pendingAuthUrl = null;
             const error = e instanceof Error ? e : new Error(String(e));
             const code = categorizeAuthError(error);
             lastAuthError = { code, message: error.message };
             onAuthError?.({ code, message: error.message });
-            console.error("[lessie] Authorization completion failed:", e);
+            console.error("[lessie] Post-authorization sync failed:", e);
         }
         finally {
-            authCompletion = null;
+            postAuthSync = null;
         }
     })();
 }
@@ -191,8 +230,7 @@ export async function listRemoteTools() {
 }
 /** 转发工具调用到远程 MCP Server；失败时引导用户重新授权 */
 export async function callRemoteTool(name, args) {
-    if (authCompletion)
-        await authCompletion;
+    await waitForAuthCompletion();
     if (!client) {
         return {
             content: [
@@ -208,32 +246,65 @@ export async function callRemoteTool(name, args) {
         return (await client.callTool({ name, arguments: args }));
     }
     catch (err) {
-        if (!isAuthError(err)) {
+        if (authProvider.pendingAuthUrl) {
             return {
                 content: [
                     {
                         type: "text",
-                        text: `工具 ${name} 调用失败: ${err instanceof Error ? err.message : String(err)}`,
+                        text: buildReauthPrompt(name),
                     },
                 ],
                 isError: true,
             };
         }
-        await reconnect();
-        if (!client) {
+        if (!isAuthError(err)) {
             return {
                 content: [
                     {
                         type: "text",
-                        text: `工具 ${name} 调用失败（认证过期），请使用 authorize 工具重新登录。`,
+                        text: `工具 ${name} 调用失败: ${err instanceof Error ? err.message : String(err)}`,
                     },
                 ],
                 isError: true,
             };
         }
-        return (await client.callTool({ name, arguments: args }));
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: buildReauthPrompt(name),
+                },
+            ],
+            isError: true,
+        };
     }
 }
+function buildReauthPrompt(toolName) {
+    const authUrl = authProvider.pendingAuthUrl;
+    if (!authUrl) {
+        return [
+            `工具 ${toolName} 需要重新授权。`,
+            "",
+            "请按以下步骤操作：",
+            "1. 调用 authorize 工具，生成新的授权链接",
+            "2. 在浏览器中完成授权流程",
+            "3. 授权完成后，重新调用当前工具",
+        ].join("\n");
+    }
+    return [
+        `工具 ${toolName} 需要重新授权。`,
+        "",
+        "请按以下步骤操作：",
+        "1. 在浏览器中打开并完成以下授权链接：",
+        "",
+        authUrl,
+        "",
+        "2. 完成授权后，调用 authorize 工具确认连接状态",
+        "3. 重新调用当前工具",
+        "",
+        "如果链接失效，请再次调用 authorize 工具生成新链接。",
+    ].join("\n");
+}
 function isAuthError(err) {
     const obj = err;
     const status = obj?.status ?? obj?.statusCode;
@@ -245,23 +316,3 @@ function isAuthError(err) {
     }
     return false;
 }
-/**
- * 重连，关闭旧连接；并发调用共享同一个 Promise 避免竞争。
- * 静默尝试连接，若令牌已失效则 client 保持 null。
- */
-async function reconnect() {
-    if (reconnecting)
-        return reconnecting;
-    reconnecting = (async () => {
-        try {
-            const old = client;
-            client = null;
-            await old?.close().catch(() => { });
-            await connectToRemote();
-        }
-        finally {
-            reconnecting = null;
-        }
-    })();
-    return reconnecting;
-}

package/dist/tools.js

@@ -51,7 +51,7 @@ function formatAuthResult(result) {
             return {
                 content: [{
                         type: "text",
-                        text: `已连接到远程 MCP 服务器，共发现 ${result.toolCount} 个远程工具，无需重新授权。\n\n可通过 use_lessie 工具调用远程功能：不传 tool 参数可列出所有工具，传入 tool 和 arguments 可调用指定工具。`,
+                        text: `已连接到远程 MCP 服务器，共发现 ${result.toolCount} 个远程工具。\n\n可通过 use_lessie 工具调用远程功能：不传 tool 参数可列出所有工具，传入 tool 和 arguments 可调用指定工具。若后续调用提示未授权，请重新执行 authorize。`,
                     }],
             };
         case "auth_url": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lessie/mcp-server",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "type": "module",
   "main": "dist/index.js",
   "bin": {