@phuetz/code-buddy 2.0.0 → 2.2.0

package/dist/mcp/mcp-oauth.d.ts

@@ -18,6 +18,19 @@ export interface MCPOAuthToken {
     expiresAt: number;
     scopes: string[];
 }
+/** Client id + optional DCR metadata persisted next to the token (encrypted store). */
+export interface StoredClientInformation {
+    client_id: string;
+    client_secret?: string;
+    client_id_issued_at?: number;
+    client_secret_expires_at?: number;
+    redirect_uris?: string[];
+    token_endpoint_auth_method?: string;
+    grant_types?: string[];
+    response_types?: string[];
+    client_name?: string;
+    scope?: string;
+}
 /**
  * Generate a cryptographically random code verifier (43-128 chars, URL-safe)
  */
@@ -26,6 +39,35 @@ export declare function generateCodeVerifier(): string;
  * Generate code challenge from verifier using S256 method
  */
 export declare function generateCodeChallenge(verifier: string): string;
+interface AuthorizationResult {
+    code: string;
+    state: string;
+}
+export declare class OAuthCallbackCancelledError extends Error {
+    constructor(message?: string);
+}
+export interface CallbackSession {
+    /** Resolves only after listen() succeeded. Rejects on bind failure or abort-before-listen. */
+    listening: Promise<void>;
+    /** Resolves with the authorization code after a valid callback. */
+    result: Promise<AuthorizationResult>;
+    abort: (reason?: Error) => void;
+}
+/**
+ * Bind the loopback callback server. Callers must await `listening` before
+ * opening a browser: a bind failure must not leave an unhandled rejection
+ * nor launch a flow that can never complete.
+ */
+export declare function startCallbackSession(redirectUri: string, expectedState: string, timeoutMs?: number, signal?: AbortSignal): CallbackSession;
+/**
+ * Start a temporary local HTTP server to receive the OAuth callback.
+ * Awaits a successful listen before waiting for the code.
+ */
+export declare function startCallbackServer(redirectUri: string, expectedState: string, timeoutMs?: number, signal?: AbortSignal): Promise<AuthorizationResult>;
+/**
+ * Open a URL in the default browser (cross-platform)
+ */
+export declare function openBrowser(url: string): Promise<void>;
 export declare class MCPOAuthManager {
     private tokenCache;
     /**
@@ -48,17 +90,34 @@ export declare class MCPOAuthManager {
      */
     getValidToken(serverId: string): Promise<string | null>;
     /**
-     * Store a token encrypted on disk and in memory cache
+     * Store a token encrypted on disk and in memory cache.
+     * Preserves any previously persisted client metadata for the same server.
      */
     storeToken(serverId: string, token: MCPOAuthToken, config: MCPOAuthConfig): void;
+    /**
+     * Persist client registration (client_id and optional DCR metadata) in the
+     * encrypted store, even before a token exists. Never writes plaintext.
+     */
+    storeClientInformation(serverId: string, info: StoredClientInformation): void;
     /**
      * Remove a stored token
      */
     removeToken(serverId: string): void;
+    /** Drop access/refresh tokens only; keep client_id and DCR metadata. */
+    clearTokens(serverId: string): void;
     /**
      * Check if a token exists for a server (may be expired)
      */
+    /** Stored token and client id for a server, without refresh side effects. */
+    getStoredToken(serverId: string): {
+        token: MCPOAuthToken;
+        clientId: string;
+        client?: StoredClientInformation;
+    } | null;
+    /** Persisted client id / DCR metadata, independent of whether a token exists. */
+    getStoredClientInformation(serverId: string): StoredClientInformation | null;
     hasToken(serverId: string): boolean;
 }
 export declare function getMCPOAuthManager(): MCPOAuthManager;
 export declare function resetMCPOAuthManager(): void;
+export {};

package/dist/mcp/mcp-oauth.js

@@ -11,6 +11,29 @@ import * as path from 'path';
 import { URL } from 'url';
 import { logger } from '../utils/logger.js';
 import { readTextAtomicSync, writeFileAtomicSync } from '../utils/atomic-write.js';
+import { SDK_MANAGED_TOKEN_URL } from './mcp-oauth-constants.js';
+function storedClientFrom(info) {
+    const client = { client_id: info.client_id };
+    if (info.client_secret)
+        client.client_secret = info.client_secret;
+    if (info.client_id_issued_at !== undefined)
+        client.client_id_issued_at = info.client_id_issued_at;
+    if (info.client_secret_expires_at !== undefined)
+        client.client_secret_expires_at = info.client_secret_expires_at;
+    if (info.redirect_uris?.length)
+        client.redirect_uris = [...info.redirect_uris];
+    if (info.token_endpoint_auth_method)
+        client.token_endpoint_auth_method = info.token_endpoint_auth_method;
+    if (info.grant_types?.length)
+        client.grant_types = [...info.grant_types];
+    if (info.response_types?.length)
+        client.response_types = [...info.response_types];
+    if (info.client_name)
+        client.client_name = info.client_name;
+    if (info.scope)
+        client.scope = info.scope;
+    return client;
+}
 // ============================================================================
 // PKCE (RFC 7636)
 // ============================================================================
@@ -35,7 +58,9 @@ export function generateCodeChallenge(verifier) {
 const ALGORITHM = 'aes-256-gcm';
 const SALT_LENGTH = 32;
 function getEncryptionKey() {
-    // Use CODEBUDDY_VAULT_KEY if available, otherwise derive from machine ID
+    // Prefer CODEBUDDY_VAULT_KEY or CODEBUDDY_MCP_KEY. The USER+platform fallback
+    // is derivable by anyone on the same account: AES-GCM still runs, but that is
+    // not a strong vault. Set an explicit key for real confidentiality.
     return process.env.CODEBUDDY_VAULT_KEY
         || process.env.CODEBUDDY_MCP_KEY
         || `mcp-oauth-${process.env.USER || process.env.USERNAME || 'default'}-${process.platform}`;
@@ -101,63 +126,153 @@ function saveTokenStore(store) {
     const encrypted = encryptData(JSON.stringify(store));
     writeFileAtomicSync(filePath, encrypted, { mode: 0o600 });
 }
+export class OAuthCallbackCancelledError extends Error {
+    constructor(message = 'OAuth authorization cancelled') {
+        super(message);
+        this.name = 'OAuthCallbackCancelledError';
+    }
+}
 /**
- * Start a temporary local HTTP server to receive the OAuth callback.
- * Returns a promise that resolves with the authorization code.
+ * Bind the loopback callback server. Callers must await `listening` before
+ * opening a browser: a bind failure must not leave an unhandled rejection
+ * nor launch a flow that can never complete.
  */
-function startCallbackServer(redirectUri, expectedState, timeoutMs = 120_000) {
-    return new Promise((resolve, reject) => {
-        const url = new URL(redirectUri);
-        const port = parseInt(url.port || '19836', 10);
-        const pathname = url.pathname || '/callback';
-        const server = http.createServer((req, res) => {
-            const reqUrl = new URL(req.url || '/', `http://localhost:${port}`);
-            if (reqUrl.pathname !== pathname) {
-                res.writeHead(404);
-                res.end('Not found');
-                return;
-            }
-            const code = reqUrl.searchParams.get('code');
-            const state = reqUrl.searchParams.get('state');
-            const error = reqUrl.searchParams.get('error');
-            if (error) {
-                res.writeHead(200, { 'Content-Type': 'text/html' });
-                res.end('<html><body><h1>Authorization Failed</h1><p>You can close this window.</p></body></html>');
-                server.close();
-                reject(new Error(`OAuth authorization error: ${error}`));
-                return;
-            }
-            if (!code) {
-                res.writeHead(400, { 'Content-Type': 'text/html' });
-                res.end('<html><body><h1>Missing authorization code</h1></body></html>');
-                return;
-            }
-            if (state !== expectedState) {
-                res.writeHead(400, { 'Content-Type': 'text/html' });
-                res.end('<html><body><h1>State mismatch — possible CSRF attack</h1></body></html>');
-                server.close();
-                reject(new Error('OAuth state mismatch'));
-                return;
-            }
+export function startCallbackSession(redirectUri, expectedState, timeoutMs = 120_000, signal) {
+    const url = new URL(redirectUri);
+    const port = parseInt(url.port || '19836', 10);
+    const pathname = url.pathname || '/callback';
+    let listenResolve;
+    let listenReject;
+    let resultResolve;
+    let resultReject;
+    let listeningSettled = false;
+    let resultSettled = false;
+    let timer;
+    let server;
+    const listening = new Promise((resolve, reject) => {
+        listenResolve = resolve;
+        listenReject = reject;
+    });
+    const result = new Promise((resolve, reject) => {
+        resultResolve = resolve;
+        resultReject = reject;
+    });
+    // Attach observers at construction so a pre-aborted signal cannot leave an
+    // unhandledRejection on the public startCallbackServer wrapper (the early
+    // return used to skip the .catch() that lived after listen()).
+    listening.catch(() => undefined);
+    result.catch(() => undefined);
+    const settleListen = (err) => {
+        if (listeningSettled)
+            return;
+        listeningSettled = true;
+        if (err)
+            listenReject(err);
+        else
+            listenResolve();
+    };
+    const settleResult = (value, err) => {
+        if (resultSettled)
+            return;
+        resultSettled = true;
+        if (timer)
+            clearTimeout(timer);
+        if (err)
+            resultReject(err);
+        else
+            resultResolve(value);
+    };
+    let abort;
+    const onAbort = () => abort(new OAuthCallbackCancelledError());
+    const detachAbort = () => signal?.removeEventListener('abort', onAbort);
+    abort = (reason) => {
+        detachAbort();
+        const fail = reason ?? new OAuthCallbackCancelledError();
+        if (!listeningSettled)
+            settleListen(fail);
+        if (!resultSettled)
+            settleResult(undefined, fail);
+        if (timer) {
+            clearTimeout(timer);
+            timer = undefined;
+        }
+        if (server) {
+            server.removeAllListeners('error');
+            const closing = server;
+            server = undefined;
+            closing.close();
+        }
+    };
+    if (signal?.aborted) {
+        abort(new OAuthCallbackCancelledError());
+        return { listening, result, abort };
+    }
+    signal?.addEventListener('abort', onAbort, { once: true });
+    timer = setTimeout(() => {
+        abort(new Error('OAuth callback timed out (120s)'));
+        detachAbort();
+    }, timeoutMs);
+    server = http.createServer((req, res) => {
+        const reqUrl = new URL(req.url || '/', `http://127.0.0.1:${port}`);
+        if (reqUrl.pathname !== pathname) {
+            res.writeHead(404);
+            res.end('Not found');
+            return;
+        }
+        const code = reqUrl.searchParams.get('code');
+        const state = reqUrl.searchParams.get('state');
+        const error = reqUrl.searchParams.get('error');
+        if (error) {
             res.writeHead(200, { 'Content-Type': 'text/html' });
-            res.end('<html><body><h1>Authorization Successful</h1><p>You can close this window and return to the terminal.</p></body></html>');
-            server.close();
-            resolve({ code, state });
-        });
-        // Set timeout
-        const timer = setTimeout(() => {
-            server.close();
-            reject(new Error('OAuth callback timed out (120s)'));
-        }, timeoutMs);
-        server.on('close', () => clearTimeout(timer));
-        server.on('error', (err) => {
+            res.end('<html><body><h1>Authorization Failed</h1><p>You can close this window.</p></body></html>');
+            detachAbort();
+            abort(new Error(`OAuth authorization error: ${error}`));
+            return;
+        }
+        if (!code) {
+            res.writeHead(400, { 'Content-Type': 'text/html' });
+            res.end('<html><body><h1>Missing authorization code</h1></body></html>');
+            return;
+        }
+        if (state !== expectedState) {
+            res.writeHead(400, { 'Content-Type': 'text/html' });
+            res.end('<html><body><h1>State mismatch — possible CSRF attack</h1></body></html>');
+            detachAbort();
+            abort(new Error('OAuth state mismatch'));
+            return;
+        }
+        res.writeHead(200, { 'Content-Type': 'text/html' });
+        res.end('<html><body><h1>Authorization Successful</h1><p>You can close this window and return to the terminal.</p></body></html>');
+        detachAbort();
+        if (timer) {
             clearTimeout(timer);
-            reject(new Error(`Failed to start callback server: ${err.message}`));
-        });
-        server.listen(port, '127.0.0.1', () => {
-            logger.debug(`OAuth callback server listening on port ${port}`);
-        });
+            timer = undefined;
+        }
+        const closing = server;
+        server = undefined;
+        closing?.removeAllListeners('error');
+        closing?.close();
+        settleListen();
+        settleResult({ code, state });
+    });
+    server.on('error', (err) => {
+        detachAbort();
+        abort(new Error(`Failed to start callback server: ${err.message}`));
     });
+    server.listen(port, '127.0.0.1', () => {
+        logger.debug(`OAuth callback server listening on port ${port}`);
+        settleListen();
+    });
+    return { listening, result, abort };
+}
+/**
+ * Start a temporary local HTTP server to receive the OAuth callback.
+ * Awaits a successful listen before waiting for the code.
+ */
+export async function startCallbackServer(redirectUri, expectedState, timeoutMs = 120_000, signal) {
+    const session = startCallbackSession(redirectUri, expectedState, timeoutMs, signal);
+    await session.listening;
+    return session.result;
 }
 // ============================================================================
 // Browser Opener
@@ -165,7 +280,7 @@ function startCallbackServer(redirectUri, expectedState, timeoutMs = 120_000) {
 /**
  * Open a URL in the default browser (cross-platform)
  */
-async function openBrowser(url) {
+export async function openBrowser(url) {
     const { exec } = await import('child_process');
     const command = process.platform === 'win32'
         ? `start "" "${url}"`
@@ -244,9 +359,11 @@ export class MCPOAuthManager {
         authUrl.searchParams.set('state', state);
         authUrl.searchParams.set('code_challenge', codeChallenge);
         authUrl.searchParams.set('code_challenge_method', 'S256');
-        // Start callback server
-        const callbackPromise = startCallbackServer(redirectUri, state);
-        // Open browser
+        // Bind the loopback callback before opening the browser: a listen failure
+        // must not launch a flow that can never complete (same contract as the SDK
+        // provider path). Keep the manual URL if the opener fails.
+        const session = startCallbackSession(redirectUri, state);
+        await session.listening;
         logger.info('Opening browser for OAuth authorization...');
         try {
             await openBrowser(authUrl.toString());
@@ -254,8 +371,7 @@ export class MCPOAuthManager {
         catch {
             logger.info(`Please open this URL in your browser:\n${authUrl.toString()}`);
         }
-        // Wait for callback
-        const { code } = await callbackPromise;
+        const { code } = await session.result;
         // Exchange code for token
         const token = await exchangeCodeForToken(config, code, codeVerifier, redirectUri);
         // Store token
@@ -306,14 +422,20 @@ export class MCPOAuthManager {
         // Load from disk
         const store = loadTokenStore();
         const entry = store[serverId];
-        if (!entry)
+        const token = entry?.token;
+        if (!token?.accessToken || !entry)
             return null;
-        const { token, config } = entry;
+        const { config } = entry;
         // If token is still valid (with 60s buffer), return it
         if (token.expiresAt > Date.now() + 60_000) {
             this.tokenCache.set(serverId, token);
             return token.accessToken;
         }
+        // Entries written by the SDK-backed provider are refreshed by the SDK itself.
+        if (config.tokenUrl === SDK_MANAGED_TOKEN_URL) {
+            logger.debug(`MCP OAuth token for ${serverId} is SDK-managed; refresh happens on the next transport connection`);
+            return null;
+        }
         // Try to refresh
         if (token.refreshToken) {
             try {
@@ -340,17 +462,42 @@ export class MCPOAuthManager {
         return null;
     }
     /**
-     * Store a token encrypted on disk and in memory cache
+     * Store a token encrypted on disk and in memory cache.
+     * Preserves any previously persisted client metadata for the same server.
      */
     storeToken(serverId, token, config) {
         this.tokenCache.set(serverId, token);
         const store = loadTokenStore();
+        const prev = store[serverId];
+        const clientId = config.clientId || prev?.config.clientId || prev?.client?.client_id || '';
+        const client = prev?.client
+            ? storedClientFrom({ ...prev.client, ...(clientId ? { client_id: clientId } : {}) })
+            : (clientId ? storedClientFrom({ client_id: clientId }) : undefined);
         store[serverId] = {
             token,
             config: {
-                clientId: config.clientId,
-                tokenUrl: config.tokenUrl,
+                clientId,
+                tokenUrl: config.tokenUrl || prev?.config.tokenUrl || SDK_MANAGED_TOKEN_URL,
+            },
+            ...(client ? { client } : {}),
+        };
+        saveTokenStore(store);
+    }
+    /**
+     * Persist client registration (client_id and optional DCR metadata) in the
+     * encrypted store, even before a token exists. Never writes plaintext.
+     */
+    storeClientInformation(serverId, info) {
+        const client = storedClientFrom(info);
+        const store = loadTokenStore();
+        const prev = store[serverId];
+        store[serverId] = {
+            ...(prev?.token ? { token: prev.token } : {}),
+            config: {
+                clientId: client.client_id,
+                tokenUrl: prev?.config.tokenUrl ?? SDK_MANAGED_TOKEN_URL,
             },
+            client,
         };
         saveTokenStore(store);
     }
@@ -363,12 +510,41 @@ export class MCPOAuthManager {
         delete store[serverId];
         saveTokenStore(store);
     }
+    /** Drop access/refresh tokens only; keep client_id and DCR metadata. */
+    clearTokens(serverId) {
+        this.tokenCache.delete(serverId);
+        const store = loadTokenStore();
+        const prev = store[serverId];
+        if (!prev)
+            return;
+        const { token: _dropped, ...rest } = prev;
+        store[serverId] = rest;
+        if (!rest.client && !rest.config?.clientId)
+            delete store[serverId];
+        saveTokenStore(store);
+    }
     /**
      * Check if a token exists for a server (may be expired)
      */
+    /** Stored token and client id for a server, without refresh side effects. */
+    getStoredToken(serverId) {
+        const entry = loadTokenStore()[serverId];
+        if (!entry?.token?.accessToken)
+            return null;
+        return { token: entry.token, clientId: entry.config.clientId, ...(entry.client ? { client: entry.client } : {}) };
+    }
+    /** Persisted client id / DCR metadata, independent of whether a token exists. */
+    getStoredClientInformation(serverId) {
+        const entry = loadTokenStore()[serverId];
+        if (entry?.client?.client_id)
+            return entry.client;
+        if (entry?.config.clientId)
+            return { client_id: entry.config.clientId };
+        return null;
+    }
     hasToken(serverId) {
         const store = loadTokenStore();
-        return serverId in store;
+        return Boolean(store[serverId]?.token?.accessToken);
     }
 }
 // ============================================================================

package/dist/mcp/transports.d.ts

@@ -1,13 +1,19 @@
 import { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
+import { type MCPTransportOAuthConfig } from "./mcp-oauth-provider.js";
 import { EventEmitter } from "events";
-export type TransportType = 'stdio' | 'http' | 'sse' | 'streamable_http';
+export type TransportType = 'stdio' | 'http' | 'sse' | 'sse_sdk' | 'legacy_rpc' | 'streamable_http';
 export interface TransportConfig {
     type: TransportType;
     command?: string;
+    cwd?: string;
+    /** Imported stdio servers receive SDK baseline env plus explicit declarations only. */
+    inheritEnv?: boolean;
     args?: string[];
     env?: Record<string, string>;
     url?: string;
     headers?: Record<string, string>;
+    /** OAuth bearer for HTTP transports (SDK discovery + PKCE, tokens in .codebuddy/mcp-tokens.json). */
+    auth?: MCPTransportOAuthConfig;
 }
 export interface MCPTransport {
     connect(): Promise<Transport>;
@@ -31,9 +37,9 @@ export declare class HttpTransport extends EventEmitter implements MCPTransport
     disconnect(): Promise<void>;
     getType(): TransportType;
 }
-export declare class SSETransport extends EventEmitter implements MCPTransport {
+export declare class SSETransport implements MCPTransport {
     private config;
-    private connected;
+    private transport?;
     constructor(config: TransportConfig);
     connect(): Promise<Transport>;
     disconnect(): Promise<void>;
@@ -41,10 +47,13 @@ export declare class SSETransport extends EventEmitter implements MCPTransport {
 }
 export declare class StreamableHttpTransport extends EventEmitter implements MCPTransport {
     private config;
-    private connected;
+    private transport?;
+    private oauthProvider?;
     constructor(config: TransportConfig);
     connect(): Promise<Transport>;
     disconnect(): Promise<void>;
     getType(): TransportType;
 }
-export declare function createTransport(config: TransportConfig): MCPTransport;
+/** Resolve references only at connection time; missing credentials fail closed. */
+export declare function resolveMCPTransport(config: TransportConfig): TransportConfig;
+export declare function createTransport(input: TransportConfig): MCPTransport;