@ruifung/codemode-bridge 1.0.3-1

package/dist/mcp/mcp-client.js

@@ -0,0 +1,441 @@
+/**
+ * MCP Client - Wrapper around official MCP SDK for connecting to upstream MCP servers
+ *
+ * This client:
+ * 1. Uses the official @modelcontextprotocol/sdk Client API
+ * 2. Supports stdio, HTTP (Streamable HTTP), and SSE transports
+ * 3. Returns tools in native MCP format (JSON Schema for inputSchema)
+ * 4. Provides tool execution via callTool()
+ */
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
+import { tokenPersistence } from "./token-persistence.js";
+import { OAuthCallbackServer } from "./oauth-handler.js";
+import { logDebug, logInfo } from "../utils/logger.js";
+/**
+ * Simple in-memory OAuth provider implementation for basic OAuth flows
+ * Supports both pre-registered clients and dynamic client registration (RFC 7591)
+ */
+class SimpleOAuthProvider {
+    constructor(config, serverUrl) {
+        this.config = config;
+        this.serverUrl = serverUrl;
+        logDebug(`Creating provider for ${serverUrl}`, { component: 'OAuth' });
+        // Load tokens from persistence on initialization
+        const persistedTokens = tokenPersistence.getTokens(serverUrl);
+        if (persistedTokens) {
+            this._tokens = persistedTokens;
+            logDebug(`Loaded persisted tokens for ${serverUrl}`, { component: 'OAuth' });
+        }
+        else {
+            logDebug(`No persisted tokens found for ${serverUrl}`, { component: 'OAuth' });
+        }
+        // Load client information from persistence
+        const persistedClientInfo = tokenPersistence.getClientInformation(serverUrl);
+        if (persistedClientInfo) {
+            this._clientInfo = persistedClientInfo;
+            logDebug(`Loaded persisted client info for ${serverUrl}`, { component: 'OAuth' });
+        }
+        else {
+            logDebug(`No persisted client info found for ${serverUrl}`, { component: 'OAuth' });
+        }
+    }
+    /**
+     * Set the callback to be invoked when authorization code is received.
+     * This should be called by MCPClient with the transport's finishAuth method.
+     */
+    setFinishAuthCallback(callback) {
+        this._finishAuthCallback = callback;
+    }
+    get redirectUrl() {
+        // If using dynamic port assignment, return the server's actual URL
+        if (this._callbackServer) {
+            return this._callbackServer.getRedirectUrl();
+        }
+        // Otherwise use config or default
+        return this.config.redirectUrl || SimpleOAuthProvider.DEFAULT_REDIRECT_URL;
+    }
+    get clientMetadata() {
+        const redirectUrl = this.redirectUrl || SimpleOAuthProvider.DEFAULT_REDIRECT_URL;
+        const metadata = {
+            redirect_uris: [String(redirectUrl)],
+            client_name: 'CodeMode Bridge',
+        };
+        if (this.config.grantType) {
+            metadata.grant_types = [this.config.grantType];
+        }
+        return metadata;
+    }
+    clientInformation() {
+        // If client info was dynamically registered and saved, return it
+        if (this._clientInfo) {
+            return this._clientInfo;
+        }
+        // If clientId was provided in config (pre-registered), return static info
+        if (this.config.clientId) {
+            const info = {
+                client_id: this.config.clientId,
+            };
+            if (this.config.clientSecret) {
+                info.client_secret = this.config.clientSecret;
+            }
+            return info;
+        }
+        // Return undefined to trigger dynamic registration
+        return undefined;
+    }
+    saveClientInformation(clientInformation) {
+        // Save dynamically registered client information in memory
+        this._clientInfo = clientInformation;
+        // Also persist to disk
+        tokenPersistence.saveClientInformation(this.serverUrl, clientInformation);
+        logDebug(`Client dynamically registered: ${clientInformation.client_id}`, { component: 'OAuth' });
+    }
+    tokens() {
+        // First try in-memory tokens
+        if (this._tokens) {
+            logDebug('tokens() returning in-memory tokens', { component: 'OAuth' });
+            return this._tokens;
+        }
+        // Fallback to persistence if memory is empty
+        logDebug('tokens() checking persistence...', { component: 'OAuth' });
+        const persistedTokens = tokenPersistence.getTokens(this.serverUrl);
+        if (persistedTokens) {
+            this._tokens = persistedTokens;
+            logDebug(`tokens() returning persisted tokens for ${this.serverUrl}`, { component: 'OAuth' });
+            return persistedTokens;
+        }
+        logDebug('tokens() returning undefined - no tokens available', { component: 'OAuth' });
+        return undefined;
+    }
+    saveTokens(tokens) {
+        logDebug(`saveTokens() called for ${this.serverUrl}`, { component: 'OAuth' });
+        this._tokens = tokens;
+        // Also persist tokens to disk
+        tokenPersistence.saveTokens(this.serverUrl, tokens);
+        logDebug('Tokens saved to persistence', { component: 'OAuth' });
+    }
+    async redirectToAuthorization(authorizationUrl) {
+        logDebug('=== OAuth Authorization Required ===', { component: 'OAuth' });
+        logDebug(`Server: ${this.serverUrl}`, { component: 'OAuth' });
+        logDebug('Opening browser for authorization...', { component: 'OAuth' });
+        logDebug(`URL: ${authorizationUrl.toString()}`, { component: 'OAuth' });
+        // Start the callback server to listen for the authorization code
+        const redirectUrl = this.config.redirectUrl || SimpleOAuthProvider.DEFAULT_REDIRECT_URL;
+        this._callbackServer = new OAuthCallbackServer(redirectUrl);
+        try {
+            // Start listening for callback in the background
+            // Don't await this - it will resolve when code is received
+            const authCodePromise = this._callbackServer.waitForAuthorizationCode(300000); // 5 min timeout
+            // Open in default browser using dynamic import
+            import('open').then((module) => {
+                const open = module.default;
+                open(authorizationUrl.toString()).catch((err) => {
+                    logDebug('Could not open browser automatically.', { component: 'OAuth' });
+                    logDebug('Please visit this URL to authorize:', { component: 'OAuth' });
+                    logDebug(authorizationUrl.toString(), { component: 'OAuth' });
+                });
+            }).catch((err) => {
+                logDebug('Could not import open module.', { component: 'OAuth' });
+                logDebug('Please visit this URL to authorize:', { component: 'OAuth' });
+                logDebug(authorizationUrl.toString(), { component: 'OAuth' });
+            });
+            // Wait for the authorization code
+            const authorizationCode = await authCodePromise;
+            logDebug(`Authorization code received: ${authorizationCode.substring(0, 10)}...`, { component: 'OAuth' });
+            // Call the finish auth callback if set
+            if (this._finishAuthCallback) {
+                logDebug('Calling finishAuth with authorization code', { component: 'OAuth' });
+                await this._finishAuthCallback(authorizationCode);
+            }
+            else {
+                logDebug('WARNING: finishAuthCallback not set - authorization code cannot be exchanged', { component: 'OAuth' });
+            }
+        }
+        catch (error) {
+            const errorMsg = error instanceof Error ? error.message : String(error);
+            logDebug(`OAuth authorization failed: ${errorMsg}`, { component: 'OAuth' });
+            throw error;
+        }
+        finally {
+            // Clean up callback server
+            if (this._callbackServer) {
+                await this._callbackServer.stop();
+                this._callbackServer = undefined;
+            }
+        }
+    }
+    saveCodeVerifier(codeVerifier) {
+        this._codeVerifier = codeVerifier;
+    }
+    codeVerifier() {
+        if (!this._codeVerifier) {
+            throw new Error('Code verifier not available');
+        }
+        return this._codeVerifier;
+    }
+    saveDiscoveryState(state) {
+        this._discoveryState = state;
+    }
+    discoveryState() {
+        return this._discoveryState;
+    }
+    // Prepare token request for client_credentials grant
+    prepareTokenRequest(scope) {
+        if (this.config.grantType === 'client_credentials') {
+            const params = new URLSearchParams({
+                grant_type: 'client_credentials',
+            });
+            if (scope || this.config.scope) {
+                params.set('scope', scope || this.config.scope);
+            }
+            return params;
+        }
+        return undefined;
+    }
+}
+SimpleOAuthProvider.DEFAULT_REDIRECT_URL = 'http://localhost:3000/oauth/callback';
+/**
+ * MCP Client wrapper using official SDK
+ */
+export class MCPClient {
+    constructor(config) {
+        this.config = config;
+        this.transport = null;
+        this.connected = false;
+        this.client = new Client({
+            name: `codemode-bridge-client-${config.name}`,
+            version: "1.0.0",
+        }, {
+            capabilities: {},
+        });
+        // Create OAuth provider if config is present
+        if (config.oauth && config.url) {
+            this.oauthProvider = new SimpleOAuthProvider(config.oauth, config.url);
+        }
+    }
+    /**
+     * Authenticate with OAuth server and obtain tokens without connecting the full client.
+     * This is useful for CLI auth flows where we just want to get tokens without initializing
+     * the full MCP client.
+     */
+    async authenticateOAuth() {
+        if (!this.config.oauth || !this.config.url) {
+            throw new Error("OAuth not configured for this server");
+        }
+        if (this.config.type !== "http") {
+            throw new Error("OAuth is only supported for HTTP servers");
+        }
+        // Create OAuth provider if not already created
+        if (!this.oauthProvider) {
+            this.oauthProvider = new SimpleOAuthProvider(this.config.oauth, this.config.url);
+        }
+        const provider = this.oauthProvider;
+        const currentTokens = provider.tokens();
+        if (currentTokens) {
+            logDebug('OAuth tokens already available, skipping OAuth flow', { component: 'HTTP' });
+            return;
+        }
+        logDebug('No tokens available, initiating OAuth flow', { component: 'OAuth' });
+        // Create HTTP transport for OAuth flow
+        const httpTransport = new StreamableHTTPClientTransport(new URL(this.config.url), { authProvider: provider });
+        try {
+            // Set up the callback for OAuth code exchange BEFORE connecting
+            provider.setFinishAuthCallback(async (authorizationCode) => {
+                logDebug('Exchanging authorization code for tokens...', { component: 'OAuth' });
+                logDebug(`Authorization code: ${authorizationCode.substring(0, 20)}...`, { component: 'OAuth' });
+                try {
+                    await httpTransport.finishAuth(authorizationCode);
+                    logDebug('Authorization code exchanged successfully', { component: 'OAuth' });
+                }
+                catch (error) {
+                    logDebug(`Token exchange failed: ${error instanceof Error ? error.message : String(error)}`, { component: 'OAuth' });
+                    throw error;
+                }
+            });
+            // Try to make a request to trigger OAuth
+            // This will fail with 401, which should trigger the auth provider's OAuth flow
+            try {
+                await httpTransport.send({
+                    jsonrpc: '2.0',
+                    id: 1,
+                    method: 'initialize',
+                    params: {
+                        protocolVersion: '2024-11-05',
+                        capabilities: {},
+                        clientInfo: {
+                            name: `codemode-bridge-oauth-${this.config.name}`,
+                            version: '1.0.0',
+                        },
+                    },
+                });
+            }
+            catch (error) {
+                // Expected - will trigger OAuth or be a real error
+                logDebug(`Initial request result: ${error instanceof Error ? error.message : String(error)}`, { component: 'OAuth' });
+                // Don't rethrow - the OAuth flow may have been triggered
+            }
+            // Wait a moment for OAuth flow to complete
+            // If tokens were saved, we're done
+            const tokensAfterOAuth = provider.tokens();
+            if (tokensAfterOAuth) {
+                logDebug('Tokens obtained successfully via OAuth', { component: 'OAuth' });
+                return;
+            }
+            throw new Error('OAuth authentication did not produce tokens');
+        }
+        finally {
+            // Clean up the transport
+            if (httpTransport) {
+                try {
+                    await httpTransport.close();
+                }
+                catch (e) {
+                    logDebug(`Error closing transport: ${e instanceof Error ? e.message : String(e)}`, { component: 'OAuth' });
+                }
+            }
+        }
+    }
+    /**
+     * Connect to the upstream MCP server
+     */
+    async connect() {
+        if (this.connected) {
+            return;
+        }
+        if (this.config.type === "stdio") {
+            if (!this.config.command) {
+                throw new Error(`stdio type requires "command" field`);
+            }
+            // Merge provided env vars with current process env, filtering out undefined values
+            const baseEnv = Object.fromEntries(Object.entries(process.env).filter(([, v]) => v !== undefined));
+            const env = this.config.env ? { ...baseEnv, ...this.config.env } : baseEnv;
+            // Create stdio transport with stderr piped so we can capture and log it
+            const stdioTransport = new StdioClientTransport({
+                command: this.config.command,
+                args: this.config.args || [],
+                env,
+                stderr: 'pipe',
+            });
+            // Attach stderr handler to capture tool output and pass through logger
+            if (stdioTransport.stderr) {
+                stdioTransport.stderr.on('data', (data) => {
+                    const lines = data.toString().split('\n').filter(line => line.trim());
+                    for (const line of lines) {
+                        logInfo(line, { component: this.config.name, suppressEarly: true });
+                    }
+                });
+                stdioTransport.stderr.on('error', (error) => {
+                    logDebug(`stderr error from ${this.config.name}: ${error.message}`, {
+                        component: this.config.name
+                    });
+                });
+            }
+            this.transport = stdioTransport;
+            await this.client.connect(this.transport);
+            this.connected = true;
+        }
+        else if (this.config.type === "http") {
+            if (!this.config.url) {
+                throw new Error(`http type requires "url" field`);
+            }
+            // Create HTTP transport using Streamable HTTP with optional OAuth
+            if (this.oauthProvider) {
+                logDebug(`Connecting with OAuth provider to ${this.config.url}`, { component: 'HTTP' });
+                const currentTokens = this.oauthProvider.tokens();
+                if (currentTokens) {
+                    logDebug('OAuth tokens available', { component: 'HTTP' });
+                }
+                else {
+                    logDebug('WARNING: No OAuth tokens available', { component: 'HTTP' });
+                }
+            }
+            else {
+                logDebug(`Connecting without OAuth to ${this.config.url}`, { component: 'HTTP' });
+            }
+            // Create HTTP transport
+            const httpTransport = new StreamableHTTPClientTransport(new URL(this.config.url), this.oauthProvider ? { authProvider: this.oauthProvider } : undefined);
+            // Set up the callback for OAuth code exchange
+            if (this.oauthProvider) {
+                this.oauthProvider.setFinishAuthCallback(async (authorizationCode) => {
+                    logDebug('Exchanging authorization code for tokens...', { component: 'OAuth' });
+                    await httpTransport.finishAuth(authorizationCode);
+                    logDebug('Authorization code exchanged successfully', { component: 'OAuth' });
+                });
+            }
+            this.transport = httpTransport;
+            await this.client.connect(this.transport);
+            this.connected = true;
+        }
+        else if (this.config.type === "sse") {
+            if (!this.config.url) {
+                throw new Error(`sse type requires "url" field`);
+            }
+            // Create SSE transport (deprecated but still supported) with optional OAuth
+            this.transport = new SSEClientTransport(new URL(this.config.url), this.oauthProvider ? { authProvider: this.oauthProvider } : undefined);
+            await this.client.connect(this.transport);
+            this.connected = true;
+        }
+        else {
+            throw new Error(`Unsupported transport type: ${this.config.type}`);
+        }
+    }
+    /**
+     * List all tools from the upstream server
+     * Returns tools in native MCP format with JSON Schema
+     */
+    async listTools() {
+        if (!this.connected) {
+            throw new Error("Client not connected. Call connect() first.");
+        }
+        const response = await this.client.listTools();
+        return response.tools;
+    }
+    /**
+     * Call a tool on the upstream server
+     */
+    async callTool(name, args) {
+        if (!this.connected) {
+            throw new Error("Client not connected. Call connect() first.");
+        }
+        logDebug(`Invoking upstream tool: ${name}`, {
+            component: 'MCP Client',
+            transport: this.config.type,
+            server: this.config.name,
+            argsSize: JSON.stringify(args).length
+        });
+        try {
+            const response = await this.client.callTool({
+                name,
+                arguments: args,
+            });
+            logDebug(`Upstream tool completed: ${name}`, {
+                component: 'MCP Client',
+                transport: this.config.type,
+                server: this.config.name,
+                resultType: typeof response
+            });
+            return response;
+        }
+        catch (error) {
+            logDebug(`Upstream tool failed: ${name}`, {
+                component: 'MCP Client',
+                transport: this.config.type,
+                server: this.config.name,
+                error: error instanceof Error ? error.message : String(error)
+            });
+            throw error;
+        }
+    }
+    /**
+     * Close the connection to the upstream server
+     */
+    async close() {
+        if (this.connected && this.client) {
+            await this.client.close();
+            this.connected = false;
+        }
+    }
+}

package/dist/mcp/oauth-handler.d.ts

@@ -0,0 +1,33 @@
+/**
+ * OAuth2 Authorization Handler
+ *
+ * Implements a loopback HTTP server to handle OAuth2 redirect callbacks.
+ * When user completes authorization on the OAuth provider, the browser redirects
+ * to our loopback server with the authorization code, which we capture and use
+ * to complete the authorization flow.
+ */
+/**
+ * Loopback HTTP server that listens for OAuth2 redirect callbacks
+ */
+export declare class OAuthCallbackServer {
+    private server?;
+    private port;
+    private host;
+    private pendingAuthorization?;
+    constructor(redirectUrl?: string);
+    /**
+     * Start the callback server and wait for authorization code
+     * Returns a promise that resolves when the authorization code is received
+     * or rejects if timeout occurs or server fails to start
+     */
+    waitForAuthorizationCode(timeoutMs?: number): Promise<string>;
+    /**
+     * Stop the callback server
+     */
+    stop(): Promise<void>;
+    /**
+     * Get the redirect URL for this server
+     * After waitForAuthorizationCode is called, returns the actual URL with the assigned port
+     */
+    getRedirectUrl(): string;
+}

package/dist/mcp/oauth-handler.js

@@ -0,0 +1,138 @@
+/**
+ * OAuth2 Authorization Handler
+ *
+ * Implements a loopback HTTP server to handle OAuth2 redirect callbacks.
+ * When user completes authorization on the OAuth provider, the browser redirects
+ * to our loopback server with the authorization code, which we capture and use
+ * to complete the authorization flow.
+ */
+import { createServer } from 'http';
+import { URL } from 'url';
+/**
+ * Loopback HTTP server that listens for OAuth2 redirect callbacks
+ */
+export class OAuthCallbackServer {
+    constructor(redirectUrl) {
+        this.port = 0; // 0 means OS will assign an available port
+        this.host = 'localhost';
+        // Parse redirect URL to extract host and port
+        if (redirectUrl) {
+            try {
+                const url = new URL(redirectUrl);
+                this.host = url.hostname || 'localhost';
+                // If a specific port is provided in the URL, use it
+                // Otherwise use 0 (OS will assign available port)
+                this.port = url.port ? parseInt(url.port) : 0;
+            }
+            catch {
+                this.port = 0;
+            }
+        }
+        else {
+            this.port = 0;
+        }
+    }
+    /**
+     * Start the callback server and wait for authorization code
+     * Returns a promise that resolves when the authorization code is received
+     * or rejects if timeout occurs or server fails to start
+     */
+    async waitForAuthorizationCode(timeoutMs = 300000) {
+        return new Promise((resolve, reject) => {
+            // Create HTTP server
+            this.server = createServer((req, res) => {
+                const url = new URL(req.url || '', `http://${req.headers.host}`);
+                const code = url.searchParams.get('code');
+                const error = url.searchParams.get('error');
+                const errorDescription = url.searchParams.get('error_description');
+                if (error) {
+                    // OAuth error from authorization server
+                    const errorMsg = errorDescription
+                        ? `${error}: ${errorDescription}`
+                        : `OAuth error: ${error}`;
+                    res.writeHead(400, { 'Content-Type': 'text/html' });
+                    res.end(`
+            <html>
+              <body style="font-family: sans-serif; text-align: center; padding: 50px;">
+                <h1>Authorization Failed</h1>
+                <p>${errorMsg}</p>
+                <p>You can close this window.</p>
+              </body>
+            </html>
+          `);
+                    if (this.pendingAuthorization) {
+                        this.pendingAuthorization.reject(new Error(errorMsg));
+                    }
+                    return;
+                }
+                if (code) {
+                    // Success - authorization code received
+                    res.writeHead(200, { 'Content-Type': 'text/html' });
+                    res.end(`
+            <html>
+              <body style="font-family: sans-serif; text-align: center; padding: 50px;">
+                <h1>Authorization Successful</h1>
+                <p>You have successfully authorized the Code Mode Bridge.</p>
+                <p>You can close this window and return to your terminal.</p>
+              </body>
+            </html>
+          `);
+                    if (this.pendingAuthorization) {
+                        this.pendingAuthorization.resolve(code);
+                    }
+                    return;
+                }
+                // Unknown request
+                res.writeHead(400, { 'Content-Type': 'text/plain' });
+                res.end('Invalid OAuth callback request');
+            });
+            // Set up timeout
+            const timeout = setTimeout(() => {
+                reject(new Error(`Authorization timeout after ${timeoutMs}ms`));
+                this.stop();
+            }, timeoutMs);
+            // Start listening on available port
+            this.server.listen(this.port, this.host, () => {
+                // Get the actual port assigned by the OS (in case we used 0)
+                const addr = this.server.address();
+                if (addr && typeof addr === 'object') {
+                    this.port = addr.port;
+                }
+                // Store the promise handlers for when request arrives
+                this.pendingAuthorization = {
+                    resolve,
+                    reject: (error) => {
+                        clearTimeout(timeout);
+                        reject(error);
+                        this.stop();
+                    },
+                    timeout,
+                };
+            });
+            this.server.on('error', (error) => {
+                clearTimeout(timeout);
+                reject(error);
+            });
+        });
+    }
+    /**
+     * Stop the callback server
+     */
+    async stop() {
+        if (this.server) {
+            return new Promise((resolve) => {
+                this.server.close(() => {
+                    this.server = undefined;
+                    resolve();
+                });
+            });
+        }
+    }
+    /**
+     * Get the redirect URL for this server
+     * After waitForAuthorizationCode is called, returns the actual URL with the assigned port
+     */
+    getRedirectUrl() {
+        return `http://${this.host}:${this.port}/oauth/callback`;
+    }
+}

package/dist/mcp/server.d.ts

@@ -0,0 +1,25 @@
+/**
+ * MCP Server - Exposes the Code Mode bridge as an MCP server
+ *
+ * Architecture:
+ * - Upstream: Use official MCP SDK's Client to connect to and collect tools from other MCP servers
+ * - Orchestration: Pass collected tools to codemode SDK's createCodeTool()
+ * - Downstream: Use MCP SDK to expose the codemode tool via MCP protocol (stdio transport)
+ *
+ * This server:
+ * 1. Connects to upstream MCP servers using official MCP SDK Client
+ * 2. Collects tools from all upstream servers in native MCP format (JSON Schema)
+ * 3. Converts tools to ToolDescriptor format (with Zod schemas)
+ * 4. Uses @cloudflare/codemode SDK to create the "codemode" tool with those tools
+ * 5. Adapts the codemode SDK's AI SDK Tool to MCP protocol using a shim layer
+ * 6. Exposes the "codemode" tool via MCP protocol downstream
+ */
+import { z } from "zod";
+import { type MCPServerConfig } from "./mcp-client.js";
+export type { MCPServerConfig };
+/**
+ * Convert JSON Schema to Zod schema
+ * MCP tools use JSON Schema, but createCodeTool expects Zod schemas
+ */
+export declare function jsonSchemaToZod(schema: any): z.ZodType<any>;
+export declare function startCodeModeBridgeServer(serverConfigs: MCPServerConfig[]): Promise<void>;