@memoket-ai/cli 2.0.1

package/src/gateway.js

@@ -0,0 +1,128 @@
+// 网关调用层：tools/call 走新多入口网关(/v1/tools),鉴权用 mtok(由 userToken 现签+缓存)。
+
+import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { apiBaseFromMCPURL } from "./http-integration.js";
+import { authPath, loadUserToken } from "./auth-basic.js";
+import { ensureToken } from "./oauth.js";
+
+// 默认 scope 集（与后端一致，webhooks:write 不默认给）。
+const DEFAULT_SCOPES = [
+  "recordings:read",
+  "summaries:read",
+  "transcripts:read",
+  "tasks:read",
+  "search:read",
+];
+
+async function readAuth() {
+  try {
+    return JSON.parse(await readFile(await authPath(), "utf8"));
+  } catch {
+    return {};
+  }
+}
+
+async function writeAuth(obj) {
+  const p = await authPath();
+  await mkdir(p.replace(/[\\/][^\\/]*$/, ""), { recursive: true });
+  await writeFile(p, JSON.stringify(obj, null, 2), { mode: 0o600 });
+}
+
+// issueApiToken 用 userToken 换一枚 mtok 并缓存到 auth.json（供 CLI 自身 call 复用）。
+// 鉴权优先用密码登录的 userToken；没有时回退浏览器 OAuth 的 access_token
+// （后端 /v1/api-tokens 两者都认）。两者都没有才提示登录。
+export async function issueApiToken(mcpURL, scopes = DEFAULT_SCOPES) {
+  const userTok = await loadUserToken();
+  const oauthTok = await ensureToken(mcpURL);
+  if (!userTok && !oauthTok) throw new Error("not logged in — run `memoket login` first");
+
+  const mint = async (bearer) => {
+    const res = await fetch(`${apiBaseFromMCPURL(mcpURL)}/v1/api-tokens`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${bearer}`, "Content-Type": "application/json" },
+      body: JSON.stringify({ scopes }),
+      signal: AbortSignal.timeout(30_000),
+    });
+    const text = await res.text();
+    let data = {};
+    try {
+      data = JSON.parse(text);
+    } catch {
+      /* non-json */
+    }
+    return { res, data, text };
+  };
+
+  // userToken TTL 仅 1 小时；过期(401)时自动回退浏览器 OAuth token 重试，避免旧 userToken 顶死。
+  let { res, data, text } = await mint(userTok || oauthTok);
+  if (res.status === 401 && userTok && oauthTok && oauthTok !== userTok) {
+    ({ res, data, text } = await mint(oauthTok));
+  }
+  if (!res.ok || !data.token) {
+    if (res.status === 401) {
+      throw new Error(`session expired or invalid — run \`memoket login\` again (server: ${data?.error?.message || text})`);
+    }
+    throw new Error(`token issue failed (${res.status}): ${data?.error?.message || text}`);
+  }
+  const auth = await readAuth();
+  auth.apiToken = data.token;
+  // Track which endpoint this mtok was minted for. ensureApiToken()
+  // invalidates the cached mtok on endpoint mismatch (e.g., after
+  // `memoket endpoints use <other>`), forcing a re-mint.
+  auth.apiTokenEndpoint = mcpURL;
+  await writeAuth(auth);
+  return data.token;
+}
+
+// ensureApiToken：环境变量 > 缓存（endpoint 匹配）> 用 userToken 现签。
+// Cached mtok 不匹配当前 active endpoint 时清掉重签。
+export async function ensureApiToken(mcpURL) {
+  if (process.env.MEMOKET_API_TOKEN) return process.env.MEMOKET_API_TOKEN;
+  const auth = await readAuth();
+  if (auth.apiToken) {
+    if (auth.apiTokenEndpoint === mcpURL) return auth.apiToken;
+    // endpoint mismatch — drop stale mtok, re-mint below
+    delete auth.apiToken;
+    delete auth.apiTokenEndpoint;
+    await writeAuth(auth);
+  }
+  return issueApiToken(mcpURL);
+}
+
+// listGatewayTools GET /v1/tools（免鉴权）。
+export async function listGatewayTools(mcpURL) {
+  const res = await fetch(`${apiBaseFromMCPURL(mcpURL)}/v1/tools`, {
+    signal: AbortSignal.timeout(30_000),
+  });
+  if (!res.ok) throw new Error(`list tools failed (${res.status})`);
+  const data = await res.json();
+  return data.tools || [];
+}
+
+// getGatewayTool 取单个 tool 的完整定义（含 input_schema）；免鉴权，复用 listGatewayTools。
+export async function getGatewayTool(mcpURL, name) {
+  const tools = await listGatewayTools(mcpURL);
+  return tools.find((t) => t.name === name) || null;
+}
+
+// callGatewayTool POST /v1/tools/{name}（Bearer mtok）。
+export async function callGatewayTool(mcpURL, name, args) {
+  const mtok = await ensureApiToken(mcpURL);
+  const res = await fetch(`${apiBaseFromMCPURL(mcpURL)}/v1/tools/${encodeURIComponent(name)}`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${mtok}`, "Content-Type": "application/json" },
+    body: JSON.stringify(args || {}),
+    signal: AbortSignal.timeout(60_000),
+  });
+  const text = await res.text();
+  let data = null;
+  try {
+    data = JSON.parse(text);
+  } catch {
+    data = { raw: text };
+  }
+  if (!res.ok) {
+    throw new Error(`call ${name} failed (${res.status}): ${data?.error?.message || text}`);
+  }
+  return data;
+}

package/src/http-integration.js

@@ -0,0 +1,155 @@
+// REST helpers for Personal API Tokens.
+// These commands target the planned Gateway API surface. They intentionally do
+// not special-case n8n/Make/Zapier; those tools use the same HTTP primitives.
+
+import { ensureToken } from "./oauth.js";
+import { loadUserToken } from "./auth-basic.js";
+
+const DEFAULT_API_SCOPES = [
+  "recordings:read",
+  "summaries:read",
+  "transcripts:read",
+  "search:read",
+];
+
+// apiBaseFromMCPURL returns the API base URL for the current build.
+// The base is baked into the build via config/<env>.json#apiBase (stamped
+// into src/config.local.js by scripts/build.js). Two escape hatches:
+//   - process.env.MEMOKET_API_URL / MEMOKET_GATEWAY_URL override at runtime
+//   - hardcoded fallback in config.js (prod) when config.local.js is missing
+// The mcpURL arg is kept for backward compatibility with callers but is
+// not used to derive the base — the base is build-time, not URL-derived.
+import { apiBase } from "./config.js";
+
+export function apiBaseFromMCPURL(_mcpURL) {
+  const explicit = process.env.MEMOKET_API_URL || process.env.MEMOKET_GATEWAY_URL;
+  if (explicit) return explicit.replace(/\/$/, "");
+  return apiBase;
+}
+
+function parseCSV(values) {
+  return (values || [])
+    .flatMap((v) => String(v || "").split(","))
+    .map((v) => v.trim())
+    .filter(Boolean);
+}
+
+export function parseScopes(values, fallback = DEFAULT_API_SCOPES) {
+  const scopes = parseCSV(values);
+  return scopes.length ? scopes : [...fallback];
+}
+
+export async function gatewayRequest(mcpURL, path, { method = "GET", body } = {}) {
+  const apiBase = apiBaseFromMCPURL(mcpURL);
+
+  const send = async (token) => {
+    const res = await fetch(`${apiBase}${path}`, {
+      method,
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/json",
+        ...(body === undefined ? {} : { "Content-Type": "application/json" }),
+      },
+      body: body === undefined ? undefined : JSON.stringify(body),
+      signal: AbortSignal.timeout(30_000),
+    });
+    const text = await res.text();
+    let data = null;
+    if (text) {
+      try {
+        data = JSON.parse(text);
+      } catch {
+        data = { raw: text };
+      }
+    }
+    return { res, data, text };
+  };
+
+  // 与 gateway.js 的 call 路对齐：先用邮箱密码登录的 userToken，没有再用浏览器 OAuth token。
+  // 后端 /v1/api-tokens 两者都认（oauthserver combinedResolver）。
+  const userTok = await loadUserToken();
+  const oauthTok = await ensureToken(mcpURL);
+  if (!userTok && !oauthTok) {
+    throw new Error("not logged in — run `memoket login` first");
+  }
+
+  // userToken TTL 仅 1 小时；过期/失效时后端回 401 "invalid user token"。
+  // 若手上还有浏览器 OAuth token，则自动回退重试，避免 auth.json 里的旧 userToken 把 api-tokens 路顶死。
+  let { res, data, text } = await send(userTok || oauthTok);
+  if (res.status === 401 && userTok && oauthTok && oauthTok !== userTok) {
+    ({ res, data, text } = await send(oauthTok));
+  }
+
+  if (res.status < 200 || res.status >= 300) {
+    if (res.status === 401) {
+      const raw = data?.error?.message || data?.message || text || res.statusText;
+      throw new Error(`session expired or invalid — run \`memoket login\` again (server: ${raw})`);
+    }
+    const detail = data?.error?.message || data?.message || data?.detail || data?.raw || res.statusText;
+    throw new Error(`${method} ${path} failed (${res.status}): ${detail}`);
+  }
+  return data || {};
+}
+
+function printShownOnce(label, value) {
+  if (!value) return;
+  console.log(`${label}:`);
+  console.log(value);
+  console.log();
+}
+
+export async function createAPIToken(mcpURL, opts = {}) {
+  const name = opts.name || "HTTP integration";
+  const scopes = parseScopes(opts.scope);
+  const expiresInDays = Number(opts.expiresIn || opts.expires || 90);
+
+  const payload = {
+    name,
+    scopes,
+    expires_in_days: expiresInDays,
+  };
+  const out = await gatewayRequest(mcpURL, "/v1/api-tokens", { method: "POST", body: payload });
+  const token = out.token || out.data?.token;
+
+  console.log("API token created.");
+  console.log(`Name: ${out.name || out.data?.name || name}`);
+  console.log(`Scopes: ${(out.scopes || out.data?.scopes || scopes).join(", ")}`);
+  const expiresAt = out.expires_at || out.data?.expires_at;
+  if (expiresAt) console.log(`Expires: ${expiresAt}`);
+  console.log();
+  printShownOnce("API Token (shown once)", token);
+  console.log("Use it as:");
+  console.log("Authorization: Bearer " + (token || "<mk_pat_...>"));
+  return out;
+}
+
+export async function listAPITokens(mcpURL) {
+  const out = await gatewayRequest(mcpURL, "/v1/api-tokens");
+  console.log(JSON.stringify(out, null, 2));
+}
+
+export async function revokeAPIToken(mcpURL, id) {
+  if (!id) throw new Error("token id is required");
+  await gatewayRequest(mcpURL, `/v1/api-tokens/${encodeURIComponent(id)}`, { method: "DELETE" });
+  console.log(`API token revoked: ${id}`);
+}
+
+// rotateAPIToken 旧换新：后端在事务里用旧 token 的 user+scopes 签发新 mtok，
+// 旧的置为 revoked，返回 { token: mtok_live_... }。新 token 一次性打印，旧 id 失效。
+export async function rotateAPIToken(mcpURL, id) {
+  if (!id) throw new Error("token id is required");
+  const out = await gatewayRequest(mcpURL, `/v1/api-tokens/${encodeURIComponent(id)}/rotate`, {
+    method: "POST",
+  });
+  const token = out.token || out.data?.token;
+
+  console.log("API token rotated.");
+  console.log();
+  printShownOnce("New API Token (shown once)", token);
+  console.log("Use it as:");
+  console.log("Authorization: Bearer " + (token || "<mtok_live_...>"));
+  console.log();
+  console.log(`旧 token ${id} 已失效。`);
+  return out;
+}
+

package/src/mcp-client.js

@@ -0,0 +1,134 @@
+// Minimal streamable-HTTP MCP client (initialize / tools/list / tools/call).
+// The server replies as SSE (event: message\ndata: {json}) or plain JSON; both
+// are handled. The tool surface is intentionally NOT modeled here — the CLI is a
+// passthrough so it stays consistent with whatever the live server advertises.
+
+import { protocolVersion, clientName, version as cliVersion } from "./config.js";
+
+// All network calls share this timeout. Some MCP servers can take >30s to
+// respond to well-known discovery under load; bail out instead of hanging
+// the CLI.
+const FETCH_TIMEOUT_MS = 30_000;
+
+function withTimeout(opts = {}) {
+  return { ...opts, signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) };
+}
+
+export class RPCError extends Error {
+  constructor(code, message) {
+    super(`rpc error ${code}: ${message}`);
+    this.code = code;
+  }
+}
+
+async function postRPC(endpoint, { token, sessionID, payload }) {
+  const headers = {
+    "Content-Type": "application/json",
+    Accept: "application/json, text/event-stream",
+  };
+  if (token) headers["Authorization"] = `Bearer ${token}`;
+  if (sessionID) {
+    headers["Mcp-Session-Id"] = sessionID;
+    headers["MCP-Protocol-Version"] = protocolVersion;
+  }
+  const res = await fetch(endpoint, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(payload),
+    ...withTimeout(),
+  });
+  if (res.status === 401) {
+    const err = new Error("unauthorized (401) — please run `memoket login` first");
+    err.response = res;
+    throw err;
+  }
+  const raw = Buffer.from(await res.arrayBuffer());
+  if (res.status === 202 || raw.length === 0) {
+    return { resp: null, headers: res.headers };
+  }
+  const resp = parseRPC(raw, res.headers.get("content-type") || "");
+  if (!resp) return { resp: null, headers: res.headers };
+  if (resp.error) throw new RPCError(resp.error.code, resp.error.message);
+  return { resp, headers: res.headers };
+}
+
+function parseRPC(raw, contentType) {
+  const trimmed = raw.toString("utf8").trim();
+  if (!trimmed) return null;
+  const isSSE =
+    contentType.includes("text/event-stream") ||
+    trimmed.startsWith("event:") ||
+    trimmed.startsWith("data:");
+  let body = trimmed;
+  if (isSSE) {
+    let payload = "";
+    for (const line of trimmed.split("\n")) {
+      const l = line.endsWith("\r") ? line.slice(0, -1) : line;
+      if (l.startsWith("data:")) {
+        payload = l.slice("data:".length).trim();
+      }
+    }
+    if (!payload) throw new Error("empty SSE response");
+    body = payload;
+  }
+  try {
+    return JSON.parse(body);
+  } catch (e) {
+    throw new Error(`decode response: ${e.message}`);
+  }
+}
+
+export async function connect(endpoint, token) {
+  const { resp, headers } = await postRPC(endpoint, {
+    token,
+    payload: {
+      jsonrpc: "2.0",
+      id: 1,
+      method: "initialize",
+      params: {
+        protocolVersion,
+        capabilities: {},
+        clientInfo: { name: clientName, version: cliVersion },
+      },
+    },
+  });
+  if (!resp) throw new Error("empty initialize response");
+  const sessionID = headers.get("mcp-session-id") || "";
+  const info = resp.result || {};
+  // Best-effort initialized notification; server returns 202 with no body.
+  try {
+    await postRPC(endpoint, {
+      token,
+      sessionID,
+      payload: { jsonrpc: "2.0", method: "notifications/initialized" },
+    });
+  } catch {
+    /* ignore */
+  }
+  return { endpoint, token, id: sessionID, info };
+}
+
+export async function listTools(session) {
+  const { resp } = await postRPC(session.endpoint, {
+    token: session.token,
+    sessionID: session.id,
+    payload: { jsonrpc: "2.0", id: 2, method: "tools/list", params: {} },
+  });
+  if (!resp) throw new Error("empty tools/list response");
+  return resp.result?.tools || [];
+}
+
+export async function callTool(session, name, args) {
+  const { resp } = await postRPC(session.endpoint, {
+    token: session.token,
+    sessionID: session.id,
+    payload: {
+      jsonrpc: "2.0",
+      id: 3,
+      method: "tools/call",
+      params: { name, arguments: args },
+    },
+  });
+  if (!resp) throw new Error("empty tools/call response");
+  return resp.result;
+}