@mkterswingman/5mghost-yonder 0.0.1

package/README.md

@@ -0,0 +1,19 @@
+# 5mghost-yonder
+
+Internal MCP server package for 5mghost workflows.
+
+## Quick Start
+
+```bash
+npx @mkterswingman/5mghost-yonder setup
+```
+
+The setup command configures auth, optional YouTube cookies, and prints MCP config for supported AI clients.
+
+## Commands
+
+- `setup` — first-time setup
+- `serve` — start the stdio MCP server
+- `setup-cookies` — refresh YouTube cookies
+- `update` — update to the latest npm version
+- `version` — print the installed version

package/dist/auth/oauthFlow.d.ts

@@ -0,0 +1,6 @@
+export declare function runOAuthFlow(authUrl: string): Promise<{
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+    clientId: string;
+}>;

package/dist/auth/oauthFlow.js

@@ -0,0 +1,151 @@
+import { createServer } from "node:http";
+import { randomBytes, createHash } from "node:crypto";
+import { URL } from "node:url";
+function base64url(buf) {
+    return buf
+        .toString("base64")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+export async function runOAuthFlow(authUrl) {
+    // 1. Generate PKCE + state
+    const codeVerifier = base64url(randomBytes(32));
+    const codeChallenge = base64url(createHash("sha256").update(codeVerifier).digest());
+    const state = base64url(randomBytes(32));
+    // 2. Start temp HTTP server to get the actual port for redirect_uri
+    const { server: httpServer, port } = await startCallbackServer();
+    const redirectUri = `http://127.0.0.1:${port}`;
+    // 3. DCR register client with actual redirect_uri (including port)
+    let clientId;
+    let clientSecret;
+    try {
+        const dcrRes = await fetch(`${authUrl}/oauth/register`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                client_name: "yt-mcp-cli",
+                redirect_uris: [redirectUri],
+            }),
+        });
+        if (!dcrRes.ok) {
+            const text = await dcrRes.text().catch(() => "");
+            httpServer.close();
+            throw new Error(`DCR registration failed: ${dcrRes.status} ${text}`);
+        }
+        const dcrBody = (await dcrRes.json());
+        clientId = dcrBody.client_id;
+        clientSecret = dcrBody.client_secret;
+    }
+    catch (err) {
+        httpServer.close();
+        throw err;
+    }
+    // 4. Wait for OAuth callback
+    return new Promise((resolve, reject) => {
+        const timeout = setTimeout(() => {
+            httpServer.close();
+            reject(new Error("OAuth flow timed out after 5 minutes"));
+        }, 5 * 60 * 1000);
+        function cleanup() {
+            clearTimeout(timeout);
+            httpServer.close();
+        }
+        httpServer.on("request", async (req, res) => {
+            try {
+                const url = new URL(req.url ?? "/", `http://127.0.0.1`);
+                const code = url.searchParams.get("code");
+                const error = url.searchParams.get("error");
+                const returnedState = url.searchParams.get("state");
+                if (error) {
+                    const safeError = error.replace(/[<>&"']/g, (c) => `&#${c.charCodeAt(0)};`);
+                    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                    res.end(`<h1>Authorization failed</h1><p>${safeError}</p>`);
+                    cleanup();
+                    reject(new Error(`OAuth error: ${error}`));
+                    return;
+                }
+                if (!code) {
+                    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                    res.end("<h1>Waiting for authorization...</h1>");
+                    return;
+                }
+                // Verify state to prevent CSRF
+                if (returnedState !== state) {
+                    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                    res.end("<h1>Authorization failed</h1><p>State mismatch — possible CSRF attack.</p>");
+                    cleanup();
+                    reject(new Error("OAuth state mismatch"));
+                    return;
+                }
+                // Exchange code for tokens
+                const tokenBody = {
+                    grant_type: "authorization_code",
+                    code,
+                    redirect_uri: redirectUri,
+                    client_id: clientId,
+                    code_verifier: codeVerifier,
+                };
+                if (clientSecret) {
+                    tokenBody.client_secret = clientSecret;
+                }
+                const tokenRes = await fetch(`${authUrl}/oauth/token`, {
+                    method: "POST",
+                    headers: { "Content-Type": "application/json" },
+                    body: JSON.stringify(tokenBody),
+                });
+                if (!tokenRes.ok) {
+                    const text = await tokenRes.text().catch(() => "");
+                    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                    res.end(`<h1>Token exchange failed</h1><p>${text}</p>`);
+                    cleanup();
+                    reject(new Error(`Token exchange failed: ${tokenRes.status} ${text}`));
+                    return;
+                }
+                const tokens = (await tokenRes.json());
+                res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                res.end("<h1>Authorization successful!</h1><p>You can close this window.</p>");
+                cleanup();
+                resolve({
+                    accessToken: tokens.access_token,
+                    refreshToken: tokens.refresh_token,
+                    expiresIn: tokens.expires_in,
+                    clientId,
+                });
+            }
+            catch (err) {
+                res.writeHead(500);
+                res.end("Internal error");
+                cleanup();
+                reject(err);
+            }
+        });
+        // Open browser
+        const authorizeUrl = `${authUrl}/oauth/authorize?response_type=code&client_id=${encodeURIComponent(clientId)}&redirect_uri=${encodeURIComponent(redirectUri)}&code_challenge=${encodeURIComponent(codeChallenge)}&code_challenge_method=S256&state=${encodeURIComponent(state)}`;
+        console.log("\n\x1b[1mOpen this URL in your browser to authorize:\x1b[0m");
+        console.log(`\n  ${authorizeUrl}\n`);
+        import("node:child_process").then(({ exec }) => {
+            const cmd = process.platform === "darwin" ? "open" :
+                process.platform === "win32" ? "start" :
+                    "xdg-open";
+            exec(`${cmd} "${authorizeUrl}"`);
+        }).catch(() => {
+            // ignore — user can open manually
+        });
+    });
+}
+/** Start an HTTP server on a random port and return the server + port. */
+async function startCallbackServer() {
+    const server = createServer();
+    return new Promise((resolve, reject) => {
+        server.listen(0, "127.0.0.1", () => {
+            const addr = server.address();
+            if (!addr || typeof addr === "string") {
+                server.close();
+                reject(new Error("Failed to start callback server"));
+                return;
+            }
+            resolve({ server, port: addr.port });
+        });
+    });
+}

package/dist/auth/tokenManager.d.ts

@@ -0,0 +1,9 @@
+export declare class TokenManager {
+    private authUrl;
+    constructor(authUrl: string);
+    getValidToken(): Promise<string | null>;
+    saveTokens(accessToken: string, refreshToken: string, expiresIn: number, clientId?: string): Promise<void>;
+    savePAT(pat: string): Promise<void>;
+    private readAuth;
+    private refreshTokens;
+}

package/dist/auth/tokenManager.js

@@ -0,0 +1,100 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { PATHS, ensureConfigDir } from "../utils/config.js";
+export class TokenManager {
+    authUrl;
+    constructor(authUrl) {
+        this.authUrl = authUrl;
+    }
+    async getValidToken() {
+        // Check env var PAT first
+        const envPat = process.env.YT_MCP_TOKEN;
+        if (envPat)
+            return envPat;
+        const auth = this.readAuth();
+        if (!auth)
+            return null;
+        if (auth.type === "pat" && auth.pat) {
+            return auth.pat;
+        }
+        if (auth.type === "jwt") {
+            if (auth.access_token && auth.expires_at && Date.now() < auth.expires_at) {
+                return auth.access_token;
+            }
+            // Try refresh
+            if (auth.refresh_token) {
+                try {
+                    const refreshed = await this.refreshTokens(auth.refresh_token, auth.client_id);
+                    if (refreshed) {
+                        await this.saveTokens(refreshed.access_token, refreshed.refresh_token, refreshed.expires_in, auth.client_id);
+                        return refreshed.access_token;
+                    }
+                }
+                catch {
+                    // refresh failed → AUTH_EXPIRED
+                }
+            }
+            return null;
+        }
+        return null;
+    }
+    async saveTokens(accessToken, refreshToken, expiresIn, clientId) {
+        ensureConfigDir();
+        const data = {
+            type: "jwt",
+            access_token: accessToken,
+            refresh_token: refreshToken,
+            expires_at: Date.now() + expiresIn * 1000,
+            client_id: clientId,
+        };
+        writeFileSync(PATHS.authJson, JSON.stringify(data, null, 2), {
+            mode: 0o600,
+        });
+    }
+    async savePAT(pat) {
+        ensureConfigDir();
+        const data = {
+            type: "pat",
+            pat,
+        };
+        writeFileSync(PATHS.authJson, JSON.stringify(data, null, 2), {
+            mode: 0o600,
+        });
+    }
+    readAuth() {
+        if (!existsSync(PATHS.authJson))
+            return null;
+        try {
+            const raw = readFileSync(PATHS.authJson, "utf8");
+            return JSON.parse(raw);
+        }
+        catch {
+            return null;
+        }
+    }
+    async refreshTokens(refreshToken, clientId) {
+        const url = `${this.authUrl}/oauth/token`;
+        const body = {
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+        };
+        if (clientId) {
+            body.client_id = clientId;
+        }
+        const res = await fetch(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(body),
+        });
+        if (!res.ok)
+            return null;
+        try {
+            const body = (await res.json());
+            if (!body.access_token)
+                return null;
+            return body;
+        }
+        catch {
+            return null;
+        }
+    }
+}

package/dist/cli/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli/index.js

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+import { execSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const pkgPath = join(__dirname, "..", "..", "package.json");
+function getVersion() {
+    try {
+        const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+        return pkg.version ?? "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+}
+const command = process.argv[2];
+async function main() {
+    switch (command) {
+        case "setup": {
+            const { runSetup } = await import("./setup.js");
+            await runSetup();
+            break;
+        }
+        case "serve": {
+            const { runServe } = await import("./serve.js");
+            await runServe();
+            break;
+        }
+        case "setup-cookies": {
+            const { runSetupCookies } = await import("./setupCookies.js");
+            await runSetupCookies();
+            break;
+        }
+        case "update": {
+            const current = getVersion();
+            console.log(`Current version: ${current}`);
+            console.log("Checking for updates...\n");
+            try {
+                const latest = execSync("npm view @mkterswingman/5mghost-yonder version", {
+                    encoding: "utf8",
+                    stdio: ["ignore", "pipe", "ignore"],
+                }).trim();
+                if (latest === current) {
+                    console.log(`✅ Already on the latest version (${current})`);
+                }
+                else {
+                    console.log(`New version available: ${latest}`);
+                    console.log("Updating...\n");
+                    execSync("npm install -g @mkterswingman/5mghost-yonder@latest", {
+                        stdio: "inherit",
+                    });
+                    console.log(`\n✅ Updated to ${latest}`);
+                }
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                console.error(`❌ Update failed: ${msg}`);
+                console.error("Try manually: npm install -g @mkterswingman/5mghost-yonder@latest");
+                process.exit(1);
+            }
+            break;
+        }
+        case "version":
+        case "--version":
+        case "-v": {
+            console.log(getVersion());
+            break;
+        }
+        default:
+            console.log(`
+yt-mcp v${getVersion()}
+
+Usage: yt-mcp <command>
+
+Commands:
+  setup          Run first-time setup (OAuth + cookies + MCP registration)
+  serve          Start the MCP server (stdio transport)
+  setup-cookies  Refresh YouTube cookies using browser login
+  update         Update to the latest version
+  version        Show current version
+
+Environment variables:
+  YT_MCP_TOKEN   Personal Access Token (skips OAuth)
+`);
+            process.exit(command ? 1 : 0);
+    }
+}
+main().catch((err) => {
+    console.error("Fatal error:", err);
+    process.exit(1);
+});

package/dist/cli/serve.d.ts

@@ -0,0 +1 @@
+export declare function runServe(): Promise<void>;

package/dist/cli/serve.js

@@ -0,0 +1,24 @@
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { loadConfig } from "../utils/config.js";
+import { TokenManager } from "../auth/tokenManager.js";
+import { createServer } from "../server.js";
+export async function runServe() {
+    const config = loadConfig();
+    const tokenManager = new TokenManager(config.auth_url);
+    // PAT mode via env var (don't persist — just keep in memory for this session)
+    const pat = process.env.YT_MCP_TOKEN;
+    if (pat) {
+        await tokenManager.savePAT(pat);
+    }
+    const server = await createServer(config, tokenManager);
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    process.on("SIGINT", async () => {
+        await server.close();
+        process.exit(0);
+    });
+    process.on("SIGTERM", async () => {
+        await server.close();
+        process.exit(0);
+    });
+}

package/dist/cli/setup.d.ts

@@ -0,0 +1 @@
+export declare function runSetup(): Promise<void>;