npm - @oh-my-tool/cli - Versions diffs - 0.2.0 → 0.3.0 - Mend

@oh-my-tool/cli 0.2.0 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (46) hide show

package/README.md +7 -2
package/assets/skills/oh-my-tool/SKILL.md +11 -3
package/bin/ohmytool.cjs +0 -0
package/package.json +12 -10
package/src/cli/commands/describe.ts +23 -22
package/src/cli/commands/extension.ts +24 -24
package/src/cli/commands/index.ts +7 -6
package/src/cli/commands/integrate.ts +64 -64
package/src/cli/commands/mcp.ts +86 -0
package/src/cli/commands/run.ts +8 -7
package/src/cli/commands/search.ts +14 -13
package/src/cli/commands/secret.ts +68 -68
package/src/cli/context.ts +25 -2
package/src/cli/index.ts +296 -272
package/src/cli/parseArgs.ts +62 -44
package/src/config/config.ts +155 -63
package/src/core/executor.ts +89 -89
package/src/core/registry.ts +31 -31
package/src/core/result.ts +14 -14
package/src/extension/discovery.ts +61 -61
package/src/extension/install.ts +23 -23
package/src/extension/loader.ts +32 -32
package/src/extension/manifest.ts +114 -114
package/src/integration/adapters.ts +98 -98
package/src/integration/index.ts +4 -4
package/src/integration/manager.ts +375 -375
package/src/integration/skill.ts +84 -84
package/src/integration/types.ts +55 -55
package/src/policy/policy.ts +136 -136
package/src/runtime/errors.ts +7 -2
package/src/runtime/executor.ts +6 -1
package/src/runtime/provider.ts +1 -0
package/src/runtime/providers/mcp/normalize.ts +36 -0
package/src/runtime/providers/mcp/oauth-callback.ts +91 -0
package/src/runtime/providers/mcp/oauth-provider.ts +348 -0
package/src/runtime/providers/mcp/oauth-store.ts +106 -0
package/src/runtime/providers/mcp/provider.ts +99 -0
package/src/runtime/providers/mcp/safe-errors.ts +63 -0
package/src/runtime/providers/mcp/session.ts +117 -0
package/src/runtime/providers/mcp/transport.ts +140 -0
package/src/runtime/result.ts +1 -1
package/src/runtime/runtime.ts +38 -12
package/src/runtime/schema.ts +14 -4
package/src/search/search.ts +78 -78
package/src/secrets/secrets.ts +45 -45
package/src/version.ts +1 -1

package/src/runtime/providers/mcp/oauth-callback.ts ADDED Viewed

@@ -0,0 +1,91 @@
+import { timingSafeEqual } from "node:crypto";
+import { RuntimeError } from "../../errors";
+export const DEFAULT_OAUTH_CALLBACK_TIMEOUT_MS = 300_000;
+export interface OAuthCallback {
+  readonly redirectUrl: URL;
+  waitForResult(expectedState: string): Promise<URLSearchParams>;
+  close(): Promise<void>;
+}
+const SUCCESS_PAGE = "<!doctype html><html><body><h1>Authorization complete</h1><p>You can close this window.</p></body></html>";
+const ERROR_PAGE = "<!doctype html><html><body><h1>Authorization failed</h1><p>Return to Oh My Tool for details.</p></body></html>";
+const RESPONSE_HEADERS = { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" };
+function sameState(actual: string | null, expected: string): boolean {
+  if (actual === null) return false;
+  const actualBytes = Buffer.from(actual, "base64url");
+  const expectedBytes = Buffer.from(expected, "base64url");
+  return actualBytes.length === expectedBytes.length && timingSafeEqual(actualBytes, expectedBytes);
+}
+export async function createOAuthCallback(
+  port: number,
+  timeoutMs = DEFAULT_OAUTH_CALLBACK_TIMEOUT_MS,
+): Promise<OAuthCallback> {
+  let expectedState: string | undefined;
+  let result: PromiseWithResolvers<URLSearchParams> | undefined;
+  let timeout: ReturnType<typeof setTimeout> | undefined;
+  let settled = false;
+  let closed = false;
+  const server = Bun.serve({
+    hostname: "127.0.0.1",
+    port,
+    fetch(rawRequest) {
+      const request = rawRequest as unknown as { url: string; method: string };
+      const url = new URL(request.url);
+      if (url.pathname !== "/oauth/callback") return new Response("Not found", { status: 404 });
+      if (request.method !== "GET") return new Response("Method not allowed", { status: 405 });
+      if (settled || result === undefined || expectedState === undefined) return new Response("Conflict", { status: 409 });
+      settled = true;
+      if (timeout !== undefined) clearTimeout(timeout);
+      if (!sameState(url.searchParams.get("state"), expectedState)) {
+        result.reject(new RuntimeError("MCP_OAUTH_STATE_MISMATCH", "OAuth callback state did not match"));
+        return new Response(ERROR_PAGE, { status: 400, headers: RESPONSE_HEADERS });
+      }
+      const oauthError = url.searchParams.get("error");
+      if (oauthError !== null) {
+        const code = oauthError === "access_denied" ? "MCP_OAUTH_ACCESS_DENIED" : "MCP_OAUTH_AUTHORIZATION_FAILED";
+        result.reject(new RuntimeError(code, "OAuth authorization was not completed"));
+        return new Response(ERROR_PAGE, { status: 400, headers: RESPONSE_HEADERS });
+      }
+      if (url.searchParams.get("code") === null) {
+        result.reject(new RuntimeError("MCP_OAUTH_AUTHORIZATION_FAILED", "OAuth authorization was not completed"));
+        return new Response(ERROR_PAGE, { status: 400, headers: RESPONSE_HEADERS });
+      }
+      result.resolve(new URLSearchParams(url.searchParams));
+      return new Response(SUCCESS_PAGE, { status: 200, headers: RESPONSE_HEADERS });
+    },
+  });
+  return {
+    redirectUrl: new URL(`http://127.0.0.1:${server.port}/oauth/callback`),
+    waitForResult(state) {
+      if (result !== undefined) return result.promise;
+      if (closed) {
+        return Promise.reject(new RuntimeError("MCP_OAUTH_CALLBACK_CLOSED", "OAuth callback listener is closed"));
+      }
+      expectedState = state;
+      result = Promise.withResolvers<URLSearchParams>();
+      timeout = setTimeout(() => {
+        if (settled) return;
+        settled = true;
+        result?.reject(new RuntimeError("MCP_OAUTH_TIMEOUT", "OAuth callback timed out"));
+      }, timeoutMs);
+      return result.promise;
+    },
+    async close() {
+      if (closed) return;
+      closed = true;
+      if (timeout !== undefined) clearTimeout(timeout);
+      if (!settled && result !== undefined) {
+        settled = true;
+        result.reject(new RuntimeError("MCP_OAUTH_CALLBACK_CLOSED", "OAuth callback listener is closed"));
+      }
+      await server.stop(true);
+    },
+  };
+}

package/src/runtime/providers/mcp/oauth-provider.ts ADDED Viewed

@@ -0,0 +1,348 @@
+import { randomBytes } from "node:crypto";
+import open from "open";
+import {
+  Client,
+  UnauthorizedError,
+  type OAuthClientInformationContext,
+  type OAuthClientMetadata,
+  type OAuthClientProvider,
+  type OAuthDiscoveryState,
+  type StoredOAuthClientInformation,
+  type StoredOAuthTokens,
+} from "@modelcontextprotocol/client";
+import type {
+  McpHttpServerConfig,
+} from "../../../config/config";
+import { VERSION } from "../../../version";
+import type { SecretStore } from "@oh-my-tool/sdk";
+import { RuntimeError } from "../../errors";
+import {
+  createMcpTransport,
+  type McpTransport,
+  McpTransportSetupError,
+  type OAuthMcpServerConfig,
+} from "./transport";
+import { configuredMcpValues, normalizeMcpError } from "./safe-errors";
+import { createMcpOAuthStore, type SecretMcpOAuthStore } from "./oauth-store";
+import {
+  createOAuthCallback,
+  DEFAULT_OAUTH_CALLBACK_TIMEOUT_MS,
+  type OAuthCallback,
+} from "./oauth-callback";
+export interface McpOAuthProviderOptions {
+  readonly redirectUrl?: URL;
+  readonly interactive?: boolean;
+}
+export interface McpOAuthClientProvider extends OAuthClientProvider {
+  readonly redirectUrl: URL;
+  readonly secretValues: readonly string[];
+  authorizationUrl(): URL | undefined;
+  authorizationState(): string | undefined;
+  clearVerifier(): Promise<void>;
+}
+export interface InteractiveOAuthDeps {
+  readonly openBrowser: (url: string) => Promise<unknown>;
+  readonly createCallback: (port: number) => Promise<OAuthCallback>;
+  readonly callbackTimeoutMs: number;
+  readonly createClient: (info: { name: string; version: string }) => InteractiveOAuthClient;
+  readonly createTransport: typeof createMcpTransport;
+}
+export interface InteractiveOAuthClient {
+  connect(transport: McpTransport): Promise<void>;
+  close(): Promise<void>;
+}
+function oauthAuthRequired(serverId: string): RuntimeError {
+  return new RuntimeError(
+    "MCP_AUTH_REQUIRED",
+    `MCP server '${serverId}' requires user authorization; run 'ohmytool mcp auth ${serverId}'`,
+  );
+}
+class PersistentMcpOAuthProvider implements McpOAuthClientProvider {
+  readonly clientMetadata: OAuthClientMetadata;
+  private pendingAuthorizationUrl: URL | undefined;
+  private pendingState: string | undefined;
+  constructor(
+    private readonly serverId: string,
+    config: OAuthMcpServerConfig,
+    private readonly store: SecretMcpOAuthStore,
+    readonly redirectUrl: URL,
+    private readonly preRegisteredClient: StoredOAuthClientInformation | undefined,
+    readonly secretValues: readonly string[],
+    private readonly interactive: boolean,
+  ) {
+    this.clientMetadata = {
+      redirect_uris: [redirectUrl.toString()],
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: config.auth.tokenEndpointAuthMethod,
+      client_name: "Oh My Tool",
+      ...(config.auth.scopes.length === 0 ? {} : { scope: config.auth.scopes.join(" ") }),
+    };
+  }
+  state(): string {
+    this.pendingState = randomBytes(32).toString("base64url");
+    return this.pendingState;
+  }
+  async clientInformation(_ctx?: OAuthClientInformationContext): Promise<StoredOAuthClientInformation | undefined> {
+    if (this.preRegisteredClient !== undefined) return Promise.resolve(this.preRegisteredClient);
+    const stored = await this.store.clientInformation();
+    if (!this.interactive && stored === undefined) throw oauthAuthRequired(this.serverId);
+    return stored;
+  }
+  saveClientInformation(info: StoredOAuthClientInformation, ctx?: OAuthClientInformationContext): Promise<void> {
+    return this.store.saveClientInformation(ctx === undefined ? info : { ...info, issuer: ctx.issuer });
+  }
+  tokens(_ctx?: OAuthClientInformationContext): Promise<StoredOAuthTokens | undefined> {
+    return this.store.tokens();
+  }
+  saveTokens(tokens: StoredOAuthTokens, ctx?: OAuthClientInformationContext): Promise<void> {
+    return this.store.saveTokens(ctx === undefined ? tokens : { ...tokens, issuer: ctx.issuer });
+  }
+  async redirectToAuthorization(url: URL): Promise<void> {
+    if (!this.interactive) {
+      await this.store.clearVerifier();
+      throw oauthAuthRequired(this.serverId);
+    }
+    this.pendingAuthorizationUrl = new URL(url);
+  }
+  authorizationUrl(): URL | undefined {
+    return this.pendingAuthorizationUrl === undefined ? undefined : new URL(this.pendingAuthorizationUrl);
+  }
+  authorizationState(): string | undefined {
+    return this.pendingState;
+  }
+  saveCodeVerifier(value: string): Promise<void> {
+    return this.store.saveCodeVerifier(value);
+  }
+  async codeVerifier(): Promise<string> {
+    const value = await this.store.codeVerifier();
+    if (value === undefined) {
+      throw new RuntimeError(
+        "MCP_OAUTH_VERIFIER_MISSING",
+        `OAuth PKCE verifier for MCP server '${this.serverId}' is missing`,
+      );
+    }
+    return value;
+  }
+  saveDiscoveryState(value: OAuthDiscoveryState): Promise<void> {
+    return this.store.saveDiscoveryState(value);
+  }
+  discoveryState(): Promise<OAuthDiscoveryState | undefined> {
+    return this.store.discoveryState();
+  }
+  invalidateCredentials(scope: "all" | "client" | "tokens" | "verifier" | "discovery"): Promise<void> {
+    return scope === "all" ? this.store.clearAll() : this.store.clear(scope);
+  }
+  clearVerifier(): Promise<void> {
+    return this.store.clearVerifier();
+  }
+}
+function defaultRedirectUrl(config: OAuthMcpServerConfig): URL {
+  return new URL(`http://127.0.0.1:${config.auth.callbackPort}/oauth/callback`);
+}
+export async function createMcpOAuthProvider(
+  serverId: string,
+  config: OAuthMcpServerConfig,
+  secrets: SecretStore,
+  options: McpOAuthProviderOptions = {},
+): Promise<McpOAuthClientProvider> {
+  const interactive = options.interactive ?? false;
+  const store = createMcpOAuthStore(serverId, secrets);
+  if (!interactive && await store.tokens() === undefined) throw oauthAuthRequired(serverId);
+  let preRegisteredClient: StoredOAuthClientInformation | undefined;
+  const secretValues: string[] = [];
+  if (config.auth.clientId !== undefined) {
+    let clientSecret: string | undefined;
+    if (config.auth.clientSecretSecret !== undefined) {
+      clientSecret = await secrets.get(config.auth.clientSecretSecret);
+      if (clientSecret === undefined) {
+        throw new RuntimeError(
+          "MCP_SECRET_NOT_FOUND",
+          `MCP server '${serverId}' requires missing secret '${config.auth.clientSecretSecret}'`,
+        );
+      }
+      secretValues.push(clientSecret);
+    }
+    preRegisteredClient = {
+      client_id: config.auth.clientId,
+      client_secret: clientSecret,
+    };
+  }
+  return new PersistentMcpOAuthProvider(
+    serverId,
+    config,
+    store,
+    options.redirectUrl ?? defaultRedirectUrl(config),
+    preRegisteredClient,
+    secretValues,
+    interactive,
+  );
+}
+function oauthConfig(serverId: string, config: McpHttpServerConfig): OAuthMcpServerConfig {
+  if (!config.enabled || config.transport !== "streamable-http" || config.auth.type !== "oauth") {
+    throw new RuntimeError("MCP_OAUTH_NOT_CONFIGURED", `MCP server '${serverId}' is not an enabled OAuth Streamable HTTP server`);
+  }
+  return config as OAuthMcpServerConfig;
+}
+function safeAuthorizationUrl(url: URL): boolean {
+  return url.protocol === "https:" || (
+    url.protocol === "http:" && (url.hostname === "127.0.0.1" || url.hostname === "::1" || url.hostname === "[::1]" || url.hostname === "localhost")
+  );
+}
+async function waitForCallback(callback: OAuthCallback, state: string, timeoutMs: number): Promise<URLSearchParams> {
+  let timeout: ReturnType<typeof setTimeout> | undefined;
+  try {
+    return await Promise.race([
+      callback.waitForResult(state),
+      new Promise<never>((_, reject) => {
+        timeout = setTimeout(() => reject(new RuntimeError("MCP_OAUTH_TIMEOUT", "OAuth callback timed out")), timeoutMs);
+      }),
+    ]);
+  } finally {
+    if (timeout !== undefined) clearTimeout(timeout);
+  }
+}
+async function closeClient(client: InteractiveOAuthClient | undefined): Promise<void> {
+  if (client === undefined) return;
+  try {
+    await client.close();
+  } catch {
+    // Cleanup must not mask the authorization result or its original error.
+  }
+}
+async function oauthCredentialValues(provider: McpOAuthClientProvider | undefined): Promise<string[]> {
+  if (provider === undefined) return [];
+  const values = [...provider.secretValues];
+  try {
+    const storedTokens = await provider.tokens();
+    if (storedTokens !== undefined) {
+      for (const [key, value] of Object.entries(storedTokens)) {
+        if ((key === "access_token" || key === "refresh_token" || key === "id_token") && typeof value === "string") {
+          values.push(value);
+        }
+      }
+    }
+  } catch {
+    // Preserve the original failure; malformed stored credentials already use a secret-free error.
+  }
+  try {
+    const storedClient = await provider.clientInformation();
+    if (typeof storedClient?.client_secret === "string") values.push(storedClient.client_secret);
+  } catch {
+    // Preserve the original failure.
+  }
+  return values;
+}
+type FinishableTransport = McpTransport & { finishAuth(callbackParams: URLSearchParams): Promise<void> };
+export async function authorizeMcpServer(
+  serverId: string,
+  config: McpHttpServerConfig,
+  secrets: SecretStore,
+  deps: Partial<InteractiveOAuthDeps> = {},
+): Promise<{ serverId: string; authorized: true }> {
+  const validated = oauthConfig(serverId, config);
+  const secretValues = configuredMcpValues(validated);
+  const callbackTimeoutMs = deps.callbackTimeoutMs ?? DEFAULT_OAUTH_CALLBACK_TIMEOUT_MS;
+  const openBrowser = deps.openBrowser ?? (async (url: string) => open(url));
+  const createClient = deps.createClient ?? ((info) => new Client(info));
+  const createTransport = deps.createTransport ?? createMcpTransport;
+  let callback: OAuthCallback | undefined;
+  let provider: McpOAuthClientProvider | undefined;
+  let firstClient: InteractiveOAuthClient | undefined;
+  let secondClient: InteractiveOAuthClient | undefined;
+  try {
+    callback = deps.createCallback === undefined
+      ? await createOAuthCallback(validated.auth.callbackPort, callbackTimeoutMs)
+      : await deps.createCallback(validated.auth.callbackPort);
+    const activeProvider = await createMcpOAuthProvider(serverId, validated, secrets, {
+      redirectUrl: callback.redirectUrl,
+      interactive: true,
+    });
+    provider = activeProvider;
+    firstClient = createClient({ name: "oh-my-tool", version: VERSION });
+    const firstConnection = await createTransport(serverId, validated, secrets, async () => activeProvider);
+    secretValues.push(...firstConnection.secretValues);
+    try {
+      await firstClient.connect(firstConnection.transport);
+      return { serverId, authorized: true };
+    } catch (cause) {
+      if (!(cause instanceof UnauthorizedError)) throw cause;
+    }
+    const authorizationUrl = activeProvider.authorizationUrl();
+    const state = activeProvider.authorizationState();
+    if (authorizationUrl === undefined || state === undefined) {
+      throw new RuntimeError("MCP_OAUTH_AUTHORIZATION_FAILED", `MCP server '${serverId}' did not provide an authorization URL`);
+    }
+    if (!safeAuthorizationUrl(authorizationUrl)) {
+      throw new RuntimeError("MCP_OAUTH_AUTHORIZATION_URL_UNSAFE", `MCP server '${serverId}' returned an unsafe authorization URL`);
+    }
+    try {
+      await openBrowser(authorizationUrl.toString());
+    } catch {
+      console.error(authorizationUrl.toString());
+    }
+    const callbackParams = await waitForCallback(callback, state, callbackTimeoutMs);
+    await (firstConnection.transport as FinishableTransport).finishAuth(callbackParams);
+    await closeClient(firstClient);
+    firstClient = undefined;
+    secondClient = createClient({ name: "oh-my-tool", version: VERSION });
+    const secondConnection = await createTransport(serverId, validated, secrets, async () => activeProvider);
+    secretValues.push(...secondConnection.secretValues);
+    await secondClient.connect(secondConnection.transport);
+    return { serverId, authorized: true };
+  } catch (cause) {
+    secretValues.push(...await oauthCredentialValues(provider));
+    if (cause instanceof McpTransportSetupError) {
+      secretValues.push(...cause.secretValues);
+      throw normalizeMcpError(serverId, cause.cause, secretValues);
+    }
+    throw normalizeMcpError(serverId, cause, secretValues);
+  } finally {
+    await closeClient(firstClient);
+    await closeClient(secondClient);
+    await callback?.close();
+    await provider?.clearVerifier();
+  }
+}
+export async function logoutMcpServer(
+  serverId: string,
+  config: McpHttpServerConfig,
+  secrets: SecretStore,
+): Promise<{ serverId: string; loggedOut: true }> {
+  oauthConfig(serverId, config);
+  await createMcpOAuthStore(serverId, secrets).clearAll();
+  return { serverId, loggedOut: true };
+}

package/src/runtime/providers/mcp/oauth-store.ts ADDED Viewed

@@ -0,0 +1,106 @@
+import type {
+  OAuthDiscoveryState,
+  StoredOAuthClientInformation,
+  StoredOAuthTokens,
+} from "@modelcontextprotocol/client";
+import type { SecretStore } from "@oh-my-tool/sdk";
+import { RuntimeError } from "../../errors";
+export interface McpOAuthStore {
+  tokens(): Promise<StoredOAuthTokens | undefined>;
+  saveTokens(tokens: StoredOAuthTokens): Promise<void>;
+  clientInformation(): Promise<StoredOAuthClientInformation | undefined>;
+  saveClientInformation(info: StoredOAuthClientInformation): Promise<void>;
+  codeVerifier(): Promise<string | undefined>;
+  saveCodeVerifier(value: string): Promise<void>;
+  discoveryState(): Promise<OAuthDiscoveryState | undefined>;
+  saveDiscoveryState(value: OAuthDiscoveryState): Promise<void>;
+  clearVerifier(): Promise<void>;
+  clearAll(): Promise<void>;
+}
+type CredentialScope = "tokens" | "client" | "verifier" | "discovery";
+function credentialNames(serverId: string): Record<CredentialScope, string> {
+  const prefix = `mcp:${serverId}:oauth`;
+  return {
+    tokens: `${prefix}:tokens`,
+    client: `${prefix}:client`,
+    verifier: `${prefix}:verifier`,
+    discovery: `${prefix}:discovery`,
+  };
+}
+export class SecretMcpOAuthStore implements McpOAuthStore {
+  private readonly names: Record<CredentialScope, string>;
+  constructor(
+    private readonly serverId: string,
+    private readonly secrets: SecretStore,
+  ) {
+    this.names = credentialNames(serverId);
+  }
+  private async object<T extends object>(scope: CredentialScope): Promise<T | undefined> {
+    const stored = await this.secrets.get(this.names[scope]);
+    if (stored === undefined) return undefined;
+    try {
+      const parsed: unknown = JSON.parse(stored);
+      if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("not an object");
+      return parsed as T;
+    } catch {
+      throw new RuntimeError(
+        "MCP_OAUTH_CREDENTIALS_INVALID",
+        `Stored OAuth ${scope} credentials for MCP server '${this.serverId}' are invalid`,
+      );
+    }
+  }
+  tokens(): Promise<StoredOAuthTokens | undefined> {
+    return this.object<StoredOAuthTokens>("tokens");
+  }
+  saveTokens(tokens: StoredOAuthTokens): Promise<void> {
+    return this.secrets.set(this.names.tokens, JSON.stringify(tokens));
+  }
+  clientInformation(): Promise<StoredOAuthClientInformation | undefined> {
+    return this.object<StoredOAuthClientInformation>("client");
+  }
+  saveClientInformation(info: StoredOAuthClientInformation): Promise<void> {
+    return this.secrets.set(this.names.client, JSON.stringify(info));
+  }
+  codeVerifier(): Promise<string | undefined> {
+    return this.secrets.get(this.names.verifier);
+  }
+  saveCodeVerifier(value: string): Promise<void> {
+    return this.secrets.set(this.names.verifier, value);
+  }
+  discoveryState(): Promise<OAuthDiscoveryState | undefined> {
+    return this.object<OAuthDiscoveryState>("discovery");
+  }
+  saveDiscoveryState(value: OAuthDiscoveryState): Promise<void> {
+    return this.secrets.set(this.names.discovery, JSON.stringify(value));
+  }
+  clear(scope: CredentialScope): Promise<void> {
+    return this.secrets.delete(this.names[scope]);
+  }
+  clearVerifier(): Promise<void> {
+    return this.clear("verifier");
+  }
+  async clearAll(): Promise<void> {
+    await Promise.all(Object.values(this.names).map((name) => this.secrets.delete(name)));
+  }
+}
+export function createMcpOAuthStore(serverId: string, secrets: SecretStore): SecretMcpOAuthStore {
+  return new SecretMcpOAuthStore(serverId, secrets);
+}

package/src/runtime/providers/mcp/provider.ts ADDED Viewed

@@ -0,0 +1,99 @@
+import type { CallToolResult } from "@modelcontextprotocol/client";
+import type { McpEnabledServerConfig } from "../../../config/config";
+import type { SecretStore } from "@oh-my-tool/sdk";
+import type { ExecutionContext, ToolDescriptor, ToolProvider } from "../../provider";
+import type { ToolResult } from "../../result";
+import { RuntimeError } from "../../errors";
+import { createMcpSession, type McpSession, type McpSessionFactory } from "./session";
+import { normalizeMcpTool } from "./normalize";
+export interface McpProviderOptions {
+  readonly serverId: string;
+  readonly config: McpEnabledServerConfig;
+  readonly secrets: SecretStore;
+  readonly createSession?: McpSessionFactory;
+}
+export class McpProvider implements ToolProvider {
+  readonly id: string;
+  readonly kind = "mcp";
+  private session?: McpSession;
+  private descriptors?: readonly ToolDescriptor[];
+  private readonly routes = new Map<string, string>();
+  private closePromise?: Promise<void>;
+  constructor(private readonly options: McpProviderOptions) {
+    this.id = `mcp:${options.serverId}`;
+  }
+  async listTools(): Promise<readonly ToolDescriptor[]> {
+    if (this.descriptors) return this.descriptors;
+    if (this.closePromise) await this.closePromise;
+    const createSession = this.options.createSession ?? createMcpSession;
+    const session = await createSession(this.options.serverId, this.options.config, this.options.secrets);
+    try {
+      const normalized: ToolDescriptor[] = [];
+      const routes = new Map<string, string>();
+      const seenCursors = new Set<string>();
+      let cursor: string | undefined;
+      do {
+        const page = await session.listTools(cursor);
+        for (const tool of page.tools) {
+          const item = normalizeMcpTool(this.options.serverId, this.options.config.namespace, this.id, tool);
+          if (routes.has(item.descriptor.id)) {
+            throw new RuntimeError("MCP_DUPLICATE_TOOL_ID", `duplicate MCP tool '${item.descriptor.id}'`);
+          }
+          routes.set(item.descriptor.id, item.remoteName);
+          normalized.push(item.descriptor);
+        }
+        if (page.nextCursor !== undefined) {
+          if (seenCursors.has(page.nextCursor) || page.nextCursor === cursor) {
+            throw new RuntimeError("MCP_PAGINATION_LOOP", `MCP server '${this.options.serverId}' returned a pagination loop`);
+          }
+          seenCursors.add(page.nextCursor);
+        }
+        cursor = page.nextCursor;
+      } while (cursor !== undefined);
+      this.session = session;
+      this.routes.clear();
+      for (const [id, remote] of routes) this.routes.set(id, remote);
+      this.descriptors = Object.freeze(normalized);
+      return this.descriptors;
+    } catch (error) {
+      try { await session.close(); } catch { /* preserve discovery failure */ }
+      throw error;
+    }
+  }
+  async execute(toolId: string, input: unknown, _context: ExecutionContext): Promise<ToolResult> {
+    if (!this.descriptors || !this.session) await this.listTools();
+    const remoteName = this.routes.get(toolId);
+    if (!remoteName || !this.session) {
+      throw new RuntimeError("MCP_TOOL_NOT_FOUND", `MCP tool '${toolId}' was not discovered`);
+    }
+    if (input === null || typeof input !== "object" || Array.isArray(input)) {
+      throw new RuntimeError("INVALID_INPUT", `input for MCP tool '${toolId}' must be an object`);
+    }
+    const result = await this.session.callTool(remoteName, input as Record<string, unknown>);
+    if (result.isError) {
+      const details: Record<string, unknown> = { content: result.content };
+      if (result.structuredContent !== undefined) details.structuredContent = result.structuredContent;
+      throw new RuntimeError("MCP_TOOL_ERROR", `MCP tool '${toolId}' reported an error`, details);
+    }
+    const data: Record<string, unknown> = { content: result.content };
+    if (result.structuredContent !== undefined) data.structuredContent = result.structuredContent;
+    return { data, meta: { mcpServer: this.options.serverId, remoteTool: remoteName } };
+  }
+  close(): Promise<void> {
+    if (this.closePromise) return this.closePromise;
+    this.closePromise = (async () => {
+      const session = this.session;
+      this.session = undefined;
+      this.descriptors = undefined;
+      this.routes.clear();
+      if (session) await session.close();
+    })();
+    return this.closePromise;
+  }
+}