@platless/axom-cli 0.1.0

package/dist/mcp.js

@@ -0,0 +1,152 @@
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { AuthError } from './config.js';
+import { accessTokenFor } from './credentials.js';
+import { CLIENT_VERSION } from './workstation/version.js';
+export async function callAxomTool(server, toolName, args) {
+    const normalizedServer = normalizeServerUrl(server);
+    const token = await ensureFreshToken(normalizedServer);
+    try {
+        return await callAxomToolOnce(normalizedServer, token, toolName, args);
+    }
+    catch (error) {
+        if (isInsufficientScope(error))
+            throw insufficientScopeError(normalizedServer);
+        if (!isUnauthorized(error))
+            throw error;
+        // An env token cannot be refreshed: `accessTokenFor` returns the same literal whatever
+        // `forceRefresh` says (credentials.ts's env branch returns before any store lookup), so the
+        // retry below would repeat the identical request, land on the identical 401, and then advise
+        // `axom auth` — a browser login, inside a container that has no browser and gets its credential
+        // from the environment. Say what is actually wrong instead, and skip the pointless second call.
+        if (usesEnvAccessToken())
+            throw envAccessTokenRejectedError(normalizedServer);
+    }
+    const refreshedToken = await refreshTokens(normalizedServer);
+    try {
+        return await callAxomToolOnce(normalizedServer, refreshedToken, toolName, args);
+    }
+    catch (error) {
+        if (isInsufficientScope(error))
+            throw insufficientScopeError(normalizedServer);
+        if (isUnauthorized(error)) {
+            throw new AuthError(`MCP authentication failed with ${normalizedServer}. Run: axom auth --server ${normalizedServer}`);
+        }
+        throw error;
+    }
+}
+async function callAxomToolOnce(server, token, toolName, args) {
+    const client = new Client({ name: 'axom-cli', version: CLIENT_VERSION });
+    const transport = new StreamableHTTPClientTransport(new URL(`${server}/mcp`), {
+        requestInit: {
+            headers: { Authorization: `Bearer ${token}` },
+        },
+    });
+    try {
+        await client.connect(transport);
+        const result = await client.callTool({ name: toolName, arguments: args });
+        return toToolOutcome(result);
+    }
+    finally {
+        try {
+            await transport.terminateSession();
+        }
+        catch {
+            // Best-effort cleanup: command execution should not fail on session teardown.
+        }
+        try {
+            await client.close();
+        }
+        catch {
+            // Best-effort cleanup: command execution should not fail on transport close.
+        }
+    }
+}
+function toToolOutcome(result) {
+    const value = result;
+    const content = Array.isArray(value.content) ? value.content : [];
+    const text = content
+        .flatMap((item) => {
+        if (item && typeof item === 'object' && 'type' in item && item.type === 'text' && 'text' in item) {
+            return typeof item.text === 'string' ? [item.text] : [];
+        }
+        return [];
+    })
+        .join('\n');
+    return {
+        text,
+        structuredContent: isRecord(value.structuredContent) ? value.structuredContent : undefined,
+        isError: value.isError === true,
+    };
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function isUnauthorized(error) {
+    const candidate = error;
+    if (candidate.status === 401 || candidate.code === 401 || candidate.response?.status === 401)
+        return true;
+    const message = error instanceof Error ? error.message : String(error);
+    return /\b401\b/.test(message);
+}
+/**
+ * `/mcp` returns 403 (not 401) when the bearer token is valid but lacks the `mcp` scope — this is
+ * how a `workstation`-only access token (the default for a token minted without `--scope mcp`)
+ * looks from the client. Retrying with a refreshed token would not help, since the new token would
+ * carry the same scopes, so this is checked before the 401/refresh path, not folded into it.
+ */
+export function isInsufficientScope(error) {
+    const candidate = error;
+    if (candidate.status === 403 || candidate.code === 403 || candidate.response?.status === 403)
+        return true;
+    const message = error instanceof Error ? error.message : String(error);
+    return /\b403\b/.test(message);
+}
+export function insufficientScopeError(server) {
+    const hint = usesEnvAccessToken()
+        ? ' Set AXOM_ACCESS_TOKEN to a token that includes the "mcp" scope, or run axom auth.'
+        : '';
+    return new AuthError(`MCP token is missing the "mcp" scope for ${server}.${hint}`);
+}
+/**
+ * Is this process authenticating with `AXOM_ACCESS_TOKEN` rather than a stored login? Mirrors
+ * `accessTokenFor`'s own env branch exactly, blank-as-unset included, so the two cannot disagree
+ * about which credential is in play.
+ */
+function usesEnvAccessToken() {
+    return Boolean(process.env.AXOM_ACCESS_TOKEN?.trim());
+}
+/**
+ * The 401 counterpart of [insufficientScopeError]. A rejected env token is not a stale session that
+ * a re-login fixes -- the literal in the environment is invalid, expired, or revoked -- so the
+ * remedy is a new token in the environment, not `axom auth` on a machine with a browser.
+ */
+export function envAccessTokenRejectedError(server) {
+    return new AuthError(`AXOM_ACCESS_TOKEN was rejected by ${server}: the token is invalid, expired, or revoked. ` +
+        'Create a new one under Settings → Security → Access Tokens and set AXOM_ACCESS_TOKEN to it.');
+}
+function normalizeServerUrl(value) {
+    return value.trim().replace(/\/+$/, '');
+}
+/**
+ * Gets a usable access token from the credential layer, refreshing when its in-memory cache is
+ * absent or near expiry. The refresh token is stored in the OS credential store; config.ts's
+ * ServerCredentials is only a non-secret authenticated marker and is not consumed here.
+ */
+export async function ensureFreshToken(server) {
+    const normalizedServer = normalizeServerUrl(server);
+    const accessToken = await accessTokenFor(normalizedServer);
+    if (!accessToken)
+        throw notAuthenticated(normalizedServer);
+    return accessToken;
+}
+export async function refreshTokens(server) {
+    const normalizedServer = normalizeServerUrl(server);
+    const accessToken = await accessTokenFor(normalizedServer, true);
+    if (!accessToken)
+        throw notAuthenticated(normalizedServer);
+    return accessToken;
+}
+function notAuthenticated(server) {
+    return new AuthError(`Not authenticated with ${server}. Run: axom auth --server ${server}`);
+}

package/dist/output.js

@@ -0,0 +1,37 @@
+import { AuthError, UsageError } from './config.js';
+export function printOutcome(outcome) {
+    if (outcome.isError) {
+        console.error(outcome.structuredContent === undefined ? outcome.text : JSON.stringify(outcome.structuredContent, null, 2));
+        process.exitCode = 1;
+        return;
+    }
+    if (outcome.structuredContent !== undefined) {
+        console.log(JSON.stringify(outcome.structuredContent, null, 2));
+        return;
+    }
+    try {
+        console.log(JSON.stringify(JSON.parse(outcome.text), null, 2));
+    }
+    catch {
+        console.log(outcome.text);
+    }
+}
+export async function runCommand(fn) {
+    try {
+        await fn();
+    }
+    catch (error) {
+        if (error instanceof UsageError) {
+            console.error(error.message);
+            process.exitCode = 2;
+            return;
+        }
+        if (error instanceof AuthError) {
+            console.error(error.message);
+            process.exitCode = 3;
+            return;
+        }
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exitCode = 1;
+    }
+}