@scorehub/mcp-server 0.2.13 → 0.2.14

package/dist/auth.js

@@ -1,4 +1,7 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.loadTokens = loadTokens;
 exports.saveTokens = saveTokens;
@@ -17,7 +20,7 @@ const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const node_os_1 = require("node:os");
 const node_crypto_1 = require("node:crypto");
-const node_child_process_1 = require("node:child_process");
+const open_1 = __importDefault(require("open"));
 const callback_pages_js_1 = require("./pages/callback-pages.js");
 class CallbackError extends Error {
     page;
@@ -204,35 +207,14 @@ function generateState(length = 16) {
 }
 // ── Browser Launch ───────────────────────────────────────────
 function openBrowser(url) {
-    try {
-        const platform = process.platform;
-        if (platform === "darwin") {
-            (0, node_child_process_1.execFileSync)("open", [url], { stdio: "ignore", timeout: 3000 });
-        }
-        else if (platform === "win32") {
-            try {
-                (0, node_child_process_1.execFileSync)("powershell.exe", [
-                    "-NoProfile",
-                    "-NonInteractive",
-                    "-ExecutionPolicy",
-                    "Bypass",
-                    "-Command",
-                    "Start-Process -FilePath ([string]$args[0])",
-                    url,
-                ], { stdio: "ignore", timeout: 3000 });
-            }
-            catch {
-                (0, node_child_process_1.execFileSync)("cmd.exe", ["/c", "start", "", `"${url}"`], { stdio: "ignore", timeout: 3000 });
-            }
-        }
-        else {
-            (0, node_child_process_1.execFileSync)("xdg-open", [url], { stdio: "ignore", timeout: 3000 });
-        }
-    }
-    catch {
+    // Delegate to `open`, which spawns the platform launcher with the URL as a
+    // single argument. This avoids shell interpretation of `&`/`?` — the source
+    // of the earlier Windows bugs (cmd `start` truncating at `&`, PowerShell
+    // `$args` not populating under -Command and treating the URL as a file path).
+    void (0, open_1.default)(url).catch(() => {
         console.error("[scorehub] Could not open browser automatically.");
         console.error(`[scorehub] Please visit this URL manually:\n  ${url}`);
-    }
+    });
 }
 // ── Full OAuth Flow ──────────────────────────────────────────
 async function authorize(params) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scorehub/mcp-server",
-  "version": "0.2.13",
+  "version": "0.2.14",
   "description": "ScoreHub local MCP proxy — OAuth login, token caching, and tool forwarding to remote MCP endpoint",
   "engines": {
     "node": ">=18"
@@ -30,7 +30,8 @@
   ],
   "license": "MIT",
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0"
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "open": "^8.4.2"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",