@nooticr/mcp 1.26.19

package/dist/auth.js

@@ -0,0 +1,170 @@
+/**
+ * Token storage + resolution.
+ *
+ * Priority: env NOOTICR_ACCESS_TOKEN > credentials file (auto-refresh when
+ * expired) > per-session tokens (HTTP OAuth mode only).
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { NooticrClient, NooticrError } from "./nooticr.js";
+const REFRESH_BEFORE_EXPIRY_MS = 30_000;
+export class NooticrAuthError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "NooticrAuthError";
+    }
+}
+export function isTokenExpired(store, nowMs = Date.now()) {
+    if (!store.expiresIn || !store.fetchedAt)
+        return false;
+    const expiresAtMs = store.fetchedAt + store.expiresIn * 1000;
+    return nowMs >= expiresAtMs - REFRESH_BEFORE_EXPIRY_MS;
+}
+export class AuthManager {
+    baseUrl;
+    credentialsFile;
+    client;
+    lastRefreshToken;
+    lastSource;
+    constructor(baseUrl, credentialsFile) {
+        this.baseUrl = baseUrl;
+        this.credentialsFile = credentialsFile;
+        this.client = new NooticrClient(baseUrl, {
+            getAccessToken: async () => undefined,
+        });
+    }
+    getCredentialsFile() {
+        return this.credentialsFile;
+    }
+    async loadStore() {
+        try {
+            const raw = await fs.promises.readFile(this.credentialsFile, "utf8");
+            const parsed = JSON.parse(raw);
+            if (parsed && typeof parsed.accessToken === "string") {
+                return parsed;
+            }
+            return null;
+        }
+        catch {
+            return null;
+        }
+    }
+    async saveStore(store) {
+        const dir = path.dirname(this.credentialsFile);
+        await fs.promises.mkdir(dir, { recursive: true, mode: 0o700 });
+        const tmp = `${this.credentialsFile}.tmp`;
+        await fs.promises.writeFile(tmp, JSON.stringify(store, null, 2), {
+            mode: 0o600,
+        });
+        await fs.promises.chmod(tmp, 0o600);
+        await fs.promises.rename(tmp, this.credentialsFile);
+        await fs.promises.chmod(this.credentialsFile, 0o600);
+    }
+    /**
+     * Resolves the current access token for a request. `session` provides the
+     * per-session tokens issued via our own OAuth /token endpoint (HTTP mode).
+     */
+    async getAccessToken(session) {
+        const envToken = process.env.NOOTICR_ACCESS_TOKEN;
+        if (envToken) {
+            this.lastSource = "env";
+            this.lastRefreshToken = undefined;
+            return envToken;
+        }
+        const store = await this.loadStore();
+        if (store?.accessToken && !isTokenExpired(store)) {
+            this.lastSource = "file";
+            this.lastRefreshToken = store.refreshToken;
+            return store.accessToken;
+        }
+        if (store?.refreshToken) {
+            try {
+                const refreshed = await this.refresh(store.refreshToken);
+                return refreshed;
+            }
+            catch (err) {
+                // Fall through to session/env resolution; the file refresh will be
+                // retried lazily on the next request.
+                const msg = err instanceof Error ? err.message : String(err);
+                process.stderr.write(`[nooticr-mcp] warning: could not refresh stored token: ${msg}\n`);
+            }
+        }
+        if (session?.accessToken) {
+            this.lastSource = "session";
+            this.lastRefreshToken = session.refreshToken;
+            return session.accessToken;
+        }
+        return undefined;
+    }
+    /**
+     * Attempts to refresh using the refresh token of the source that supplied
+     * the current token. Returns true when a new token is available.
+     */
+    async onUnauthorized(session) {
+        let refreshToken = this.lastRefreshToken;
+        if (this.lastSource === "session" && session?.refreshToken) {
+            refreshToken = session.refreshToken;
+        }
+        if (!refreshToken)
+            return false;
+        try {
+            await this.refresh(refreshToken);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Refreshes with the given refresh token, persists, and returns the new access token. */
+    async refresh(refreshToken) {
+        const session = await this.client.refresh(refreshToken);
+        if (!session.accessToken) {
+            throw new NooticrError(500, "Refresh succeeded but returned no access token.");
+        }
+        const store = {
+            accessToken: session.accessToken,
+            refreshToken: session.refreshToken ?? refreshToken,
+            expiresIn: session.expiresIn,
+            fetchedAt: Date.now(),
+            user: session.user,
+        };
+        await this.saveStore(store);
+        this.lastSource = "file";
+        this.lastRefreshToken = store.refreshToken;
+        return store.accessToken;
+    }
+    /**
+     * Persists a session obtained from login/OAuth completion.
+     */
+    async persistSession(session) {
+        const store = {
+            accessToken: session.accessToken,
+            refreshToken: session.refreshToken,
+            expiresIn: session.expiresIn,
+            fetchedAt: Date.now(),
+            user: session.user,
+        };
+        await this.saveStore(store);
+        this.lastSource = "file";
+        this.lastRefreshToken = store.refreshToken;
+    }
+    ensureUnauthenticatedError() {
+        throw new NooticrAuthError("Not authenticated with nooticr. Run `npx nooticr-mcp login` to sign in " +
+            "with Google, or set the NOOTICR_ACCESS_TOKEN environment variable " +
+            "(see `npx nooticr-mcp --help`).");
+    }
+}
+/** Builds a TokenProvider for stdio mode (env + file only). */
+export function createStdioTokenProvider(auth) {
+    return {
+        getAccessToken: async () => auth.getAccessToken(),
+        onUnauthorized: async () => auth.onUnauthorized(),
+    };
+}
+/** Builds a TokenProvider for HTTP mode: env > file > per-session tokens. */
+export function createHttpTokenProvider(auth, session) {
+    return {
+        getAccessToken: async () => auth.getAccessToken(session),
+        onUnauthorized: async () => auth.onUnauthorized(session),
+    };
+}

package/dist/config.js

@@ -0,0 +1,54 @@
+import path from "node:path";
+import os from "node:os";
+export const DEFAULT_BASE_URL = "https://api.nooticr.com";
+export const DEFAULT_PUBLIC_URL = "http://localhost:3457";
+export const DEFAULT_PORT = 3457;
+export function stripTrailingSlash(url) {
+    return url.replace(/\/+$/, "");
+}
+export function getBaseUrl() {
+    const raw = process.env.NOOTICR_BASE_URL || DEFAULT_BASE_URL;
+    const url = stripTrailingSlash(raw);
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new Error(`Invalid NOOTICR_BASE_URL "${raw}": must be a valid http(s) URL.`);
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        throw new Error(`Invalid NOOTICR_BASE_URL "${raw}": only http and https are supported.`);
+    }
+    return url;
+}
+export function getPublicUrl() {
+    const raw = process.env.NOOTICR_PUBLIC_URL || DEFAULT_PUBLIC_URL;
+    const url = stripTrailingSlash(raw);
+    try {
+        new URL(url);
+    }
+    catch {
+        throw new Error(`Invalid NOOTICR_PUBLIC_URL "${raw}": must be a valid http(s) URL.`);
+    }
+    return url;
+}
+export function getPort() {
+    const raw = process.env.NOOTICR_PORT || String(DEFAULT_PORT);
+    const port = Number.parseInt(raw, 10);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new Error(`Invalid NOOTICR_PORT "${raw}": must be a valid port number.`);
+    }
+    return port;
+}
+export function getCredentialsFile() {
+    if (process.env.NOOTICR_CREDENTIALS_FILE) {
+        return process.env.NOOTICR_CREDENTIALS_FILE;
+    }
+    return path.join(os.homedir(), ".config", "nooticr-mcp", "credentials.json");
+}
+export function getTransportMode() {
+    const raw = (process.env.NOOTICR_TRANSPORT || "").toLowerCase();
+    if (raw === "http")
+        return "http";
+    return "stdio";
+}

package/dist/idempotency.js

@@ -0,0 +1,32 @@
+/**
+ * The stdio package's billing key.
+ *
+ * Its own module rather than a function in `index.ts` because `index.ts` calls
+ * `main()` at module scope: importing it to reach one pure function would
+ * start the server, which is not something a test should have to do to check a
+ * string.
+ */
+import { argumentsDigest } from "./shared/tools.js";
+/**
+ * The key the Worker has always sent, which the local package never did.
+ *
+ * `NooticrClient` documents "a retried tool call is billed once" and the
+ * backend implements it — `mcp:<user>:<tool>:<key>` in mcp_tools.rs — but the
+ * guarantee only ever reached the hosted connector. The stdio client was
+ * constructed without a key, so no `idempotency-key` header was sent at all
+ * and a local `npx @nooticr/mcp` user whose call was cut short mid-flight (a
+ * dropped pipe, a client that gave up and re-sent) paid for it twice.
+ *
+ * Same shape as cloudflare/src/endpoint.ts, for the same two reasons: the
+ * request id keeps a genuine second call distinct — two identical searches are
+ * two searches and bill twice, deliberately — while the arguments digest stops
+ * a client that restarts its ids from charging one call for another. There is
+ * no session prefix and none is needed: the backend namespaces the reference
+ * by user and tool before it ever compares keys, so two people can hold the
+ * same string without meeting.
+ */
+export function stdioIdempotencyKey(ctx) {
+    if (ctx.requestId === undefined)
+        return undefined;
+    return `stdio:${String(ctx.requestId)}:${argumentsDigest(ctx.arguments)}`;
+}

package/dist/index.js

@@ -0,0 +1,417 @@
+#!/usr/bin/env node
+/**
+ * nooticr-mcp — MCP server exposing `analyze_post` (analyze any post: video/image/carousel) that runs
+ * AI video analysis through the user's nooticr account.
+ *
+ * Modes:
+ *   nooticr-mcp            stdio transport (default; Claude Desktop, Cursor)
+ *   nooticr-mcp login      browser-based Google sign-in to nooticr
+ *   nooticr-mcp --http     remote HTTP transport with OAuth (OpenAI Agents SDK)
+ */
+import http from "node:http";
+import { randomUUID } from "node:crypto";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { getBaseUrl, getPublicUrl, getPort, getCredentialsFile, getTransportMode, DEFAULT_PORT, } from "./config.js";
+import { AuthManager, NooticrAuthError, createHttpTokenProvider, createStdioTokenProvider } from "./auth.js";
+import { NooticrClient, NooticrError } from "./nooticr.js";
+import { OAuthManager, SCOPES } from "./oauth.js";
+import { createMcpServer } from "./shared/tools.js";
+import { stdioIdempotencyKey } from "./idempotency.js";
+import { FileWatchStore } from "./shared/watchlist.js";
+import path from "node:path";
+/**
+ * The watchlist lives beside the credentials: one machine, one signed-in user,
+ * and it has to outlive the process or "since I last looked" means nothing.
+ */
+function watchStoreForStdio() {
+    return new FileWatchStore(path.join(path.dirname(getCredentialsFile()), "watchlist.json"));
+}
+// ---------------------------------------------------------------------------
+// stdio mode
+// ---------------------------------------------------------------------------
+export async function runStdio() {
+    const auth = new AuthManager(getBaseUrl(), getCredentialsFile());
+    const server = createMcpServer((ctx) => new NooticrClient(getBaseUrl(), createStdioTokenProvider(auth), stdioIdempotencyKey(ctx)), { localWatchStore: watchStoreForStdio() });
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    // Keep the process alive until the transport closes (handled by the SDK).
+}
+function sendJson(res, status, body) {
+    const payload = JSON.stringify(body);
+    res.writeHead(status, {
+        "content-type": "application/json",
+        "content-length": Buffer.byteLength(payload),
+        "cache-control": "no-store",
+    });
+    res.end(payload);
+}
+function readJsonBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        req.on("data", (c) => chunks.push(Buffer.from(c)));
+        req.on("end", () => {
+            if (chunks.length === 0)
+                return resolve(undefined);
+            const text = Buffer.concat(chunks).toString("utf8");
+            try {
+                resolve(JSON.parse(text));
+            }
+            catch {
+                resolve(undefined);
+            }
+        });
+        req.on("error", reject);
+    });
+}
+function sendHtml(res, status, body) {
+    const payload = `<!doctype html><html><head><meta charset="utf-8"><title>nooticr-mcp</title></head><body>${body}</body></html>`;
+    res.writeHead(status, { "content-type": "text/html; charset=utf-8" });
+    res.end(payload);
+}
+function bearerToken(req) {
+    const header = req.headers.authorization;
+    if (!header)
+        return undefined;
+    const match = /^Bearer\s+(.+)$/i.exec(header);
+    return match ? match[1].trim() : undefined;
+}
+/**
+ * A request bearer token is valid when it was issued by our OAuth `/token`
+ * endpoint, or when it matches `NOOTICR_ACCESS_TOKEN` (pre-provisioned
+ * deployments and local testing — no browser OAuth round-trip needed).
+ */
+function validMcpToken(token, oauth) {
+    if (oauth.verifyToken(token))
+        return true;
+    const envToken = process.env.NOOTICR_ACCESS_TOKEN;
+    return typeof envToken === "string" && envToken.length > 0 && token === envToken;
+}
+async function handleMcpRequest(state, req, res) {
+    const token = bearerToken(req);
+    const session = token ? state.oauth.verifyToken(token) : undefined;
+    if (!token || !validMcpToken(token, state.oauth)) {
+        return sendJson(res, 401, {
+            error: "Unauthorized",
+            error_description: "This MCP server requires OAuth authentication. Fetch an access token from " +
+                `${state.oauth.authorizationServerMetadata().authorization_endpoint} first.`,
+        });
+    }
+    // Hand the validated token to the SDK transport, which forwards it to tool
+    // handlers via RequestHandlerExtra.authInfo (see shared/protocol.js).
+    req.auth = {
+        token,
+        clientId: session?.clientId ?? "nooticr-mcp",
+        scopes: session?.scopes ?? [...SCOPES],
+        expiresAt: session
+            ? Math.floor(session.expiresAt / 1000)
+            : Math.floor(Date.now() / 1000) + 3600,
+    };
+    const sessionId = req.headers["mcp-session-id"] ?? "";
+    let transport;
+    let parsedBody;
+    if (sessionId) {
+        transport = state.transports.get(sessionId);
+    }
+    else {
+        // No session id: an "initialize" request always starts a fresh session.
+        // Any other request is routed to the sole active session's transport
+        // (covers naive clients that never send the session id).
+        let isInitialize = false;
+        if (req.method === "POST") {
+            parsedBody = await readJsonBody(req);
+            const messages = Array.isArray(parsedBody) ? parsedBody : [parsedBody];
+            isInitialize = messages.some((m) => m !== null &&
+                typeof m === "object" &&
+                m.method === "initialize");
+        }
+        if (!isInitialize && state.transports.size === 1) {
+            transport = state.transports.values().next().value;
+            if (transport.sessionId) {
+                // The SDK's stateful transport requires the header on non-initialize
+                // requests; hono's node adapter reads req.rawHeaders, so patch both.
+                req.rawHeaders.push("mcp-session-id", transport.sessionId);
+                req.headers["mcp-session-id"] =
+                    transport.sessionId;
+            }
+        }
+    }
+    if (!transport) {
+        transport = new StreamableHTTPServerTransport({
+            sessionIdGenerator: () => randomUUID(),
+            enableJsonResponse: true,
+            onsessioninitialized: (sid) => {
+                state.transports.set(sid, transport);
+            },
+        });
+        // The SDK's McpServer can only attach to one transport, so each MCP
+        // session gets its own server instance (tools are registered per
+        // instance; sessions resolve their nooticr identity via authInfo).
+        const mcpserver = state.serverFactory();
+        state.connections.set(transport, mcpserver);
+        transport.onclose = () => {
+            state.connections.delete(transport);
+            if (transport?.sessionId)
+                state.transports.delete(transport.sessionId);
+        };
+        await mcpserver.connect(transport);
+    }
+    try {
+        // If we already consumed the body to sniff for "initialize", hand the
+        // parsed payload to the transport so it doesn't try to re-read it.
+        if (parsedBody !== undefined) {
+            await transport.handleRequest(req, res, parsedBody);
+        }
+        else {
+            await transport.handleRequest(req, res);
+        }
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (!res.headersSent) {
+            sendJson(res, 500, { error: `Internal error: ${msg}` });
+        }
+    }
+}
+async function handleHttpRequest(state, req, res) {
+    const url = new URL(req.url ?? "/", "http://localhost");
+    const pathname = url.pathname;
+    if (pathname === "/.well-known/oauth-authorization-server" && req.method === "GET") {
+        return sendJson(res, 200, state.oauth.authorizationServerMetadata());
+    }
+    if (pathname === "/.well-known/oauth-protected-resource" && req.method === "GET") {
+        return sendJson(res, 200, state.oauth.protectedResourceMetadata());
+    }
+    if (pathname === "/authorize" && req.method === "GET") {
+        return state.oauth.handleAuthorize(req, res);
+    }
+    if (pathname === "/token" && req.method === "POST") {
+        return state.oauth.handleToken(req, res);
+    }
+    if (pathname === "/oauth/callback" && req.method === "GET") {
+        return state.oauth.handleCallback(req, res);
+    }
+    if (pathname === "/" && req.method === "GET") {
+        const meta = state.oauth.authorizationServerMetadata();
+        return sendHtml(res, 200, `<h1>nooticr-mcp</h1><p>MCP server is running.</p>` +
+            `<p>Authorization endpoint: <code>${meta.authorization_endpoint}</code></p>` +
+            `<p>Token endpoint: <code>${meta.token_endpoint}</code></p>`);
+    }
+    if (pathname === "/mcp" || pathname === "/") {
+        return handleMcpRequest(state, req, res);
+    }
+    return sendJson(res, 404, { error: "Not found" });
+}
+export async function runHttp(port, publicUrl) {
+    const baseUrl = getBaseUrl();
+    const pub = publicUrl ?? getPublicUrl();
+    const auth = new AuthManager(baseUrl, getCredentialsFile());
+    const oauth = new OAuthManager({
+        publicUrl: pub,
+        client: new NooticrClient(baseUrl, {
+            getAccessToken: async () => undefined,
+        }),
+        onSession: async (session) => {
+            await auth.persistSession(session);
+        },
+    });
+    const state = {
+        oauth,
+        auth,
+        transports: new Map(),
+        connections: new Map(),
+        serverFactory: () => createMcpServer((extra) => {
+            const session = extra.authInfo?.token
+                ? oauth.verifyToken(extra.authInfo.token)
+                : undefined;
+            return new NooticrClient(baseUrl, createHttpTokenProvider(auth, session
+                ? {
+                    accessToken: session.nooticrAccessToken,
+                    refreshToken: session.nooticrRefreshToken,
+                }
+                : undefined));
+        }),
+    };
+    const server = http.createServer((req, res) => {
+        handleHttpRequest(state, req, res).catch((err) => {
+            const msg = err instanceof Error ? err.message : String(err);
+            if (!res.headersSent)
+                sendJson(res, 500, { error: `Internal error: ${msg}` });
+            else
+                res.end();
+        });
+    });
+    server.listen(port, () => {
+        process.stdout.write(`[nooticr-mcp] HTTP server listening on ${pub.replace(/:\d+$/, "")}:${port}\n` +
+            `[nooticr-mcp] OAuth metadata: ${pub}/.well-known/oauth-authorization-server\n` +
+            `[nooticr-mcp] MCP endpoint:   ${pub}/mcp\n`);
+    });
+}
+export async function runLogin(opts) {
+    const baseUrl = getBaseUrl();
+    const auth = new AuthManager(baseUrl, getCredentialsFile());
+    const client = new NooticrClient(baseUrl, {
+        getAccessToken: async () => undefined,
+    });
+    if (opts.email && opts.password) {
+        const session = await client.login(opts.email, opts.password);
+        await auth.persistSession(session);
+        process.stdout.write(`Signed in as ${session.user?.email ?? opts.email}. Credentials saved to ${auth.getCredentialsFile()}\n`);
+        return;
+    }
+    // Browser flow: open the nooticr-branded login page (Google + email/password)
+    // at /auth/mcp-login?redirect=<loopback callback>. Both paths converge on a
+    // single ?code= redirect the listener exchanges for JWTs.
+    const callbackPath = "/oauth/callback";
+    const callbackUrl = `http://127.0.0.1:${opts.port}${callbackPath}`;
+    const mcpLoginUrl = new URL("/auth/mcp-login", baseUrl);
+    mcpLoginUrl.searchParams.set("redirect", callbackUrl);
+    const listener = http.createServer((req, res) => {
+        const reqUrl = new URL(req.url ?? "/", "http://127.0.0.1");
+        if (reqUrl.pathname === callbackPath && req.method === "GET") {
+            const code = reqUrl.searchParams.get("code") ?? "";
+            if (code) {
+                client
+                    .exchangeCompletionCode(code)
+                    .then(async (session) => {
+                    await auth.persistSession(session);
+                    res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+                    res.end("<html><body><h1>Signed in!</h1><p>You can close this tab and return to your terminal.</p></body></html>");
+                    process.stdout.write(`Signed in as ${session.user?.email ?? "unknown user"}. Credentials saved to ${auth.getCredentialsFile()}\n`);
+                    process.exit(0);
+                })
+                    .catch((err) => {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    res.writeHead(502, { "content-type": "text/html; charset=utf-8" });
+                    res.end(`<html><body><h1>Sign-in failed</h1><p>${msg}</p></body></html>`);
+                    process.stderr.write(`Sign-in failed: ${msg}\n`);
+                    process.exit(1);
+                });
+            }
+            else {
+                res.writeHead(400, { "content-type": "text/html; charset=utf-8" });
+                res.end("<html><body><h1>Sign-in failed</h1><p>No code returned.</p></body></html>");
+                process.exit(1);
+            }
+            return;
+        }
+        res.writeHead(404).end();
+    });
+    await new Promise((resolve, reject) => {
+        listener.once("error", reject);
+        listener.listen(opts.port, "127.0.0.1", resolve);
+    });
+    process.stdout.write(`Open this URL in your browser to sign in with your nooticr account:\n\n  ${mcpLoginUrl.toString()}\n\n`);
+    try {
+        const { default: open } = await import("open");
+        await open(mcpLoginUrl.toString());
+    }
+    catch {
+        process.stdout.write("Could not open the browser automatically. Copy the URL above into your browser.\n");
+    }
+    // Time out after 5 minutes.
+    setTimeout(() => {
+        process.stderr.write("Timed out waiting for sign-in.\n");
+        process.exit(1);
+    }, 300_000).unref();
+}
+// ---------------------------------------------------------------------------
+// CLI
+// ---------------------------------------------------------------------------
+function printHelp() {
+    process.stdout.write(`nooticr-mcp — MCP server for nooticr AI video analysis
+
+Usage:
+  nooticr-mcp                    Start in stdio mode (default transport)
+  nooticr-mcp --stdio            Same as above
+  nooticr-mcp --http [--port N]    Start the remote HTTP transport with OAuth
+                                (default port ${DEFAULT_PORT}; also NOOTICR_PORT)
+  nooticr-mcp login              Sign in to nooticr via Google in your browser
+  nooticr-mcp login --email me@example.com --password '...'   Password login
+  nooticr-mcp --help             Show this help
+
+Environment variables:
+  NOOTICR_BASE_URL          nooticr server base URL (default http://localhost:8080)
+  NOOTICR_ACCESS_TOKEN      nooticr JWT access token (bypasses login)
+  NOOTICR_CREDENTIALS_FILE  token store path (default ~/.config/nooticr-mcp/credentials.json)
+  NOOTICR_PUBLIC_URL        public base URL for the HTTP mode (default http://localhost:3457)
+  NOOTICR_PORT              port for --http and login (default ${DEFAULT_PORT})
+  NOOTICR_TRANSPORT         "stdio" or "http"
+
+Client setup:
+  Claude Desktop / Cursor (stdio): after "nooticr-mcp login", use
+    "command": "npx", "args": ["nooticr-mcp"]  (plus NOOTICR_ACCESS_TOKEN if needed)
+  OpenAI Agents SDK (remote HTTP): use the RemoteMCPClient with URL
+    <NOOTICR_PUBLIC_URL>/mcp — the OAuth flow will open your browser.
+
+See README.md for full instructions.
+`);
+}
+async function main() {
+    const args = process.argv.slice(2);
+    if (args.includes("--help") || args.includes("-h")) {
+        printHelp();
+        return;
+    }
+    if (args[0] === "login") {
+        const rest = args.slice(1);
+        const valueOf = (flag) => {
+            const idx = rest.indexOf(flag);
+            return idx >= 0 && rest[idx + 1] ? rest[idx + 1] : undefined;
+        };
+        const email = valueOf("--email");
+        const password = valueOf("--password");
+        let port = getPort();
+        const portRaw = valueOf("--port");
+        if (portRaw !== undefined)
+            port = Number.parseInt(portRaw, 10);
+        if (!Number.isInteger(port) || port < 1 || port > 65535) {
+            process.stderr.write("Invalid --port value.\n");
+            process.exit(1);
+        }
+        if (Boolean(email) !== Boolean(password)) {
+            process.stderr.write("Both --email and --password must be provided together.\n");
+            process.exit(1);
+        }
+        try {
+            await runLogin({ email, password, port });
+        }
+        catch (err) {
+            process.stderr.write(`Login failed: ${err instanceof Error ? err.message : String(err)}\n`);
+            process.exit(1);
+        }
+        return;
+    }
+    const isHttp = args.includes("--http") || getTransportMode() === "http";
+    let port = getPort();
+    if (args.includes("--port")) {
+        const idx = args.indexOf("--port");
+        if (args[idx + 1])
+            port = Number.parseInt(args[idx + 1], 10);
+        if (!Number.isInteger(port) || port < 1 || port > 65535) {
+            process.stderr.write("Invalid --port value.\n");
+            process.exit(1);
+        }
+    }
+    try {
+        if (isHttp) {
+            await runHttp(port);
+        }
+        else {
+            await runStdio();
+        }
+    }
+    catch (err) {
+        if (err instanceof NooticrAuthError) {
+            process.stderr.write(`${err.message}\n`);
+        }
+        else if (err instanceof NooticrError) {
+            process.stderr.write(`nooticr API error: ${err.message}\n`);
+        }
+        else {
+            process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}\n`);
+        }
+        process.exit(1);
+    }
+}
+main();

package/dist/nooticr.js

@@ -0,0 +1,6 @@
+/**
+ * The nooticr API client now lives in `shared/nooticr.ts` so the Node package
+ * and the Cloudflare Worker import one implementation. This file re-exports
+ * it for backward compatibility.
+ */
+export * from "./shared/nooticr.js";