@memoket-ai/cli 2.0.1

package/src/oauth.js

@@ -0,0 +1,291 @@
+// OAuth 2.0 + PKCE + Dynamic Client Registration.
+// Flow: discover well-known metadata → DCR (public client, no secret) →
+// browser auth-code → exchange + persist.
+
+import http from "node:http";
+import crypto from "node:crypto";
+import { URL } from "node:url";
+import open from "open";
+import { defaultScope, clientName, callbackPort, credentialsPath } from "./config.js";
+import { apiBaseFromMCPURL } from "./http-integration.js";
+
+// authBase 是中心授权服务器(oauthserver)的对外地址。新架构里登录/发证由独立的 oauthserver
+// 负责，与网关 API 同源；mcp-server 只是
+// 资源服务器(RS)，不再作为 CLI 的授权入口。可用 MEMOKET_AUTH_URL 覆盖。
+function authBase(mcpURL) {
+  const explicit = process.env.MEMOKET_AUTH_URL;
+  if (explicit) return explicit.replace(/\/$/, "");
+  return apiBaseFromMCPURL(mcpURL);
+}
+
+export async function fetchWellKnown(mcpURL) {
+  const base = authBase(mcpURL);
+  const candidates = [
+    `${base}/.well-known/oauth-authorization-server`,
+    `${base}/.well-known/openid-configuration`,
+  ];
+  let lastErr = null;
+  for (const c of candidates) {
+    try {
+      const res = await fetch(c, { signal: AbortSignal.timeout(15_000) });
+      if (res.status !== 200) {
+        lastErr = new Error(`${c} -> ${res.status}`);
+        continue;
+      }
+      const wk = await res.json();
+      if (wk.authorization_endpoint && wk.token_endpoint) return wk;
+      lastErr = new Error(`${c} missing endpoints`);
+    } catch (e) {
+      lastErr = e;
+    }
+  }
+  throw new Error(`oauth discovery failed: ${lastErr?.message || lastErr}`);
+}
+
+async function doDCR(regEndpoint, redirectURI) {
+  const res = await fetch(regEndpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      client_name: clientName,
+      redirect_uris: [redirectURI],
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: "none",
+      scope: defaultScope,
+    }),
+    signal: AbortSignal.timeout(30_000),
+  });
+  if (res.status < 200 || res.status >= 300) {
+    const t = (await res.text()).slice(0, 200);
+    throw new Error(`dynamic client registration failed ${res.status}: ${t}`);
+  }
+  const out = await res.json();
+  if (!out.client_id) throw new Error("registration returned no client_id");
+  return out.client_id;
+}
+
+function pkce() {
+  const verifier = crypto.randomBytes(48).toString("base64url");
+  const challenge = crypto.createHash("sha256").update(verifier).digest("base64url");
+  return { verifier, challenge };
+}
+
+function randState() {
+  return crypto.randomBytes(16).toString("base64url");
+}
+
+function buildAuthURL(authEndpoint, clientID, redirectURI, scope, state, challenge) {
+  const u = new URL(authEndpoint);
+  const sep = u.search ? "&" : "?";
+  const q = new URLSearchParams({
+    response_type: "code",
+    client_id: clientID,
+    redirect_uri: redirectURI,
+    scope,
+    state,
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+  });
+  return `${authEndpoint}${sep}${q.toString()}`;
+}
+
+async function postToken(tokenEndpoint, form) {
+  const res = await fetch(tokenEndpoint, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json",
+    },
+    body: new URLSearchParams(form).toString(),
+    signal: AbortSignal.timeout(30_000),
+  });
+  if (res.status < 200 || res.status >= 300) {
+    const t = (await res.text()).slice(0, 200);
+    throw new Error(`token endpoint ${res.status}: ${t}`);
+  }
+  const t = await res.json();
+  if (!t.access_token) throw new Error("no access_token in token response");
+  return t;
+}
+
+async function awaitCallback(authURL, state) {
+  return new Promise(async (resolve, reject) => {
+    let settled = false;
+    let timer = null;
+    const finish = (fn) => {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
+      fn();
+    };
+
+    const server = http.createServer((req, res) => {
+      const u = new URL(req.url, `http://127.0.0.1:${callbackPort}`);
+      if (u.pathname !== "/callback") {
+        res.writeHead(404);
+        res.end();
+        return;
+      }
+      const q = u.searchParams;
+      if (q.get("state") !== state) {
+        res.writeHead(400, { "Content-Type": "text/plain" });
+        res.end("invalid state");
+        finish(() => {
+          server.close();
+          reject(new Error("state mismatch"));
+        });
+        return;
+      }
+      if (q.get("error")) {
+        res.writeHead(400, { "Content-Type": "text/plain" });
+        res.end(q.get("error"));
+        finish(() => {
+          server.close();
+          reject(new Error(`authorization error: ${q.get("error")}`));
+        });
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+      res.end(
+        "<!doctype html><meta charset=utf-8><body style='font-family:sans-serif;padding:2rem'><h3>Memoket authorized ✓</h3><p>You can close this tab and return to the terminal.</p></body>",
+      );
+      const code = q.get("code");
+      finish(() => {
+        server.close();
+        resolve(code);
+      });
+    });
+
+    try {
+      await new Promise((r, rj) => {
+        server.once("error", rj);
+        server.listen(callbackPort, "127.0.0.1", r);
+      });
+    } catch (e) {
+      finish(() => reject(new Error(`listen callback port ${callbackPort}: ${e.message}`)));
+      return;
+    }
+
+    console.log("Opening browser to sign in…");
+    // Best-effort open. The `open` package handles the Windows & escape for us.
+    open(authURL).catch(() => {});
+
+    timer = setTimeout(
+      () =>
+        finish(() => {
+          server.close();
+          reject(new Error("authorization timed out (5 minutes)"));
+        }),
+      5 * 60 * 1000,
+    );
+    // Don't keep the process alive solely for this timeout once the callback
+    // server has closed.
+    timer.unref();
+  });
+}
+
+export async function login(mcpURL) {
+  const wk = await fetchWellKnown(mcpURL);
+  const redirectURI = `http://127.0.0.1:${callbackPort}/callback`;
+  let clientID = "";
+  if (wk.registration_endpoint) {
+    clientID = await doDCR(wk.registration_endpoint, redirectURI);
+  }
+  if (!clientID) {
+    throw new Error("server has no dynamic client registration; a pre-registered client_id is required");
+  }
+  const { verifier, challenge } = pkce();
+  const state = randState();
+  const authURL = buildAuthURL(
+    wk.authorization_endpoint,
+    clientID,
+    redirectURI,
+    defaultScope,
+    state,
+    challenge,
+  );
+  const code = await awaitCallback(authURL, state);
+
+  const tok = await postToken(wk.token_endpoint, {
+    grant_type: "authorization_code",
+    code,
+    redirect_uri: redirectURI,
+    client_id: clientID,
+    code_verifier: verifier,
+  });
+
+  const creds = {
+    url: mcpURL,
+    access_token: tok.access_token,
+    refresh_token: tok.refresh_token,
+    client_id: clientID,
+    token_endpoint: wk.token_endpoint,
+    updated_at: new Date().toISOString(),
+  };
+  if (tok.expires_in) {
+    creds.expires_at = Math.floor(Date.now() / 1000) + tok.expires_in;
+  }
+  await saveCreds(creds);
+
+  // Invalidate the cached mtok. The new access_token may belong to a
+  // different endpoint / user / scope set; the old mtok can no longer be
+  // trusted. ensureApiToken() will re-mint on the next call.
+  try {
+    const { readAuth, writeAuth } = await import("./auth.js");
+    const auth = await readAuth();
+    if (auth && auth.apiToken) {
+      delete auth.apiToken;
+      await writeAuth(auth);
+    }
+  } catch {
+    // auth.js missing or writeAuth failed — best-effort; safe to ignore.
+  }
+
+  return creds;
+}
+
+export async function saveCreds(c) {
+  const p = await credentialsPath();
+  const { mkdir, writeFile } = await import("node:fs/promises");
+  const { dirname } = await import("node:path");
+  await mkdir(dirname(p), { recursive: true, mode: 0o700 });
+  await writeFile(p, JSON.stringify(c, null, 2), { mode: 0o600 });
+}
+
+export async function loadCreds() {
+  const { readFile } = await import("node:fs/promises");
+  const p = await credentialsPath();
+  try {
+    const raw = await readFile(p, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+
+// ensureToken returns a usable access token, refreshing when near expiry.
+// Returns "" with no error when not logged in (callers may proceed unauth, e.g.
+// tools/list and public product-knowledge tools work without a token).
+export async function ensureToken(mcpURL) {
+  const c = await loadCreds();
+  if (!c) return "";
+  const now = Math.floor(Date.now() / 1000);
+  if (c.expires_at && now > c.expires_at - 30 && c.refresh_token) {
+    try {
+      const t = await postToken(c.token_endpoint, {
+        grant_type: "refresh_token",
+        refresh_token: c.refresh_token,
+        client_id: c.client_id,
+      });
+      c.access_token = t.access_token;
+      if (t.refresh_token) c.refresh_token = t.refresh_token;
+      if (t.expires_in) c.expires_at = Math.floor(Date.now() / 1000) + t.expires_in;
+      c.updated_at = new Date().toISOString();
+      await saveCreds(c);
+    } catch {
+      /* keep old token; caller will see 401 if it really expired */
+    }
+  }
+  return c.access_token || "";
+}

package/src/proxy.js

@@ -0,0 +1,40 @@
+// Proxy support for the Node fetch (undici). Go's net/http honors HTTP_PROXY /
+// HTTPS_PROXY / NO_PROXY env vars by default; undici does not, so we wire them
+// up explicitly. Most users behind the GFW will have these set already.
+
+import { ProxyAgent, Agent, setGlobalDispatcher, getGlobalDispatcher } from "undici";
+
+let installed = false;
+let lastEnv = "";
+
+function getProxyFor(url) {
+  const u = new URL(url);
+  const env = process.env;
+  if (u.protocol === "https:") {
+    return env.HTTPS_PROXY || env.https_proxy || env.HTTP_PROXY || env.http_proxy || env.ALL_PROXY || env.all_proxy || "";
+  }
+  return env.HTTP_PROXY || env.http_proxy || env.HTTPS_PROXY || env.https_proxy || env.ALL_PROXY || env.all_proxy || "";
+}
+
+export function installProxy() {
+  // Read the most permissive env var that could point to a proxy.
+  const proxyURL =
+    process.env.HTTPS_PROXY ||
+    process.env.https_proxy ||
+    process.env.HTTP_PROXY ||
+    process.env.http_proxy ||
+    process.env.ALL_PROXY ||
+    process.env.all_proxy ||
+    "";
+  // If env changed since last install, reinstall.
+  if (installed && lastEnv === proxyURL) return;
+  lastEnv = proxyURL;
+  installed = true;
+  if (proxyURL) {
+    setGlobalDispatcher(new ProxyAgent({ uri: proxyURL }));
+  } else {
+    setGlobalDispatcher(new Agent());
+  }
+}
+
+export { getProxyFor };

package/src/register.js

@@ -0,0 +1,43 @@
+// Registration writers shell out to each client's own MCP-add command. They
+// only register the endpoint — they do NOT authenticate the client (each client
+// runs its own OAuth, e.g. Claude Code's `/mcp`). Every writer also returns the
+// exact command string so the user can run it by hand if the exec fails.
+
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+
+const pexecFile = promisify(execFile);
+
+function trim(s, n = 200) {
+  return s.length > n ? s.slice(0, n) + "…" : s;
+}
+
+export async function registerClaude(name, mcpURL) {
+  const args = ["mcp", "add", "--transport", "http", name, mcpURL];
+  const cmdStr = `claude ${args.join(" ")}`;
+  try {
+    await pexecFile("claude", args);
+    return { ok: true, cmd: cmdStr };
+  } catch (e) {
+    if (e.code === "ENOENT") {
+      return { ok: false, cmd: cmdStr, err: new Error("claude CLI not found on PATH") };
+    }
+    const out = trim((e.stdout || "") + (e.stderr || ""));
+    return { ok: false, cmd: cmdStr, err: new Error(`${e.message}: ${out}`) };
+  }
+}
+
+export async function registerVSCode(name, mcpURL) {
+  const cfg = JSON.stringify({ name, type: "http", url: mcpURL });
+  const cmdStr = `code --add-mcp ${cfg}`;
+  try {
+    await pexecFile("code", ["--add-mcp", cfg]);
+    return { ok: true, cmd: cmdStr };
+  } catch (e) {
+    if (e.code === "ENOENT") {
+      return { ok: false, cmd: cmdStr, err: new Error("code CLI not found on PATH") };
+    }
+    const out = trim((e.stdout || "") + (e.stderr || ""));
+    return { ok: false, cmd: cmdStr, err: new Error(`${e.message}: ${out}`) };
+  }
+}

package/src/utils.js

@@ -0,0 +1,83 @@
+// Misc formatting helpers ported from main.go.
+
+export function tierOf(desc) {
+  const d = (desc || "").trim();
+  if (d.startsWith("[")) {
+    const i = d.indexOf("]");
+    if (i > 0) return d.slice(1, i);
+  }
+  return "other";
+}
+
+export function stripTier(desc) {
+  const d = (desc || "").trim();
+  if (d.startsWith("[")) {
+    const i = d.indexOf("]");
+    if (i > 0) return d.slice(i + 1).trim();
+  }
+  return d;
+}
+
+export function firstLine(s) {
+  const collapsed = (s || "").replace(/\n/g, " ").replace(/\s+/g, " ").trim();
+  return collapsed.length > 88 ? collapsed.slice(0, 88) + "…" : collapsed;
+}
+
+export function short(s) {
+  if (!s) return "-";
+  return s.length > 8 ? s.slice(0, 8) + "…" : s;
+}
+
+export function or(s, fallback) {
+  return (s || "").trim() ? s : fallback;
+}
+
+// schemaType 把一个 JSON Schema 属性节点转成简短类型串："string[]" / "integer" 等。
+function schemaType(p) {
+  if (!p) return "";
+  if (p.type === "array") return `${(p.items && p.items.type) || "any"}[]`;
+  return p.type || "";
+}
+
+// toolParams 从网关 tool 的 input_schema 抽出参数清单：
+//   [{ name, required, type, description }]
+// required 来源：schema 的 required 数组 ∪ 描述里自称必填的（后端有时只在文案里
+// 写 "Required."/"必填" 而没进 required 数组，如 search_recordings 的 query）。
+export function toolParams(tool) {
+  const schema = (tool && tool.input_schema) || {};
+  const props = schema.properties || {};
+  const reqSet = new Set(schema.required || []);
+  return Object.entries(props).map(([name, p]) => {
+    const description = (p && p.description) || "";
+    const declaredReq = /^\s*(required|必填|必须)/i.test(description);
+    return { name, required: reqSet.has(name) || declaredReq, type: schemaType(p), description };
+  });
+}
+
+// requiredParamNames 只返回必填参数名（给列表页/示例挑主参用）。
+export function requiredParamNames(tool) {
+  return toolParams(tool).filter((p) => p.required).map((p) => p.name);
+}
+
+// Coerce CLI k=v args into JSON values: "true"/"false" -> bool, "42" -> number,
+// JSON-shaped strings -> parsed, otherwise string.
+export function coerce(v) {
+  if (v === "true") return true;
+  if (v === "false") return false;
+  if (v === "null") return null;
+  if (/^-?\d+$/.test(v)) {
+    const n = Number(v);
+    if (Number.isSafeInteger(n)) return n;
+  }
+  if (/^-?\d+\.\d+$/.test(v)) return Number(v);
+  if (v.startsWith("[") || v.startsWith("{")) {
+    try {
+      return JSON.parse(v);
+    } catch (e) {
+      throw new Error(
+        `coerce: value looks like JSON array/object but failed to parse: ${v.slice(0, 80)}`
+      );
+    }
+  }
+  return v;
+}