@scorehub/mcp-server 0.2.13 → 0.3.0

package/README.en.md

@@ -120,9 +120,9 @@ OAuth tokens are stored under the current user's home directory:
 
 Tokens persist in a local file. When calling the default ScoreHub production endpoint, mcp-server sends the access token to the remote MCP server in an HTTPS `Authorization` header. Do not share or commit files under `~/.scorehub/`.
 
-To sign out or switch accounts, delete the directory for the relevant endpoint, or all of `~/.scorehub/`, then invoke `authorize` again. On Windows, delete the directory in File Explorer; on macOS and Linux, you can also delete it from a terminal.
+To sign out, delete the directory for the relevant endpoint, or all of `~/.scorehub/`, then invoke `authorize` again. On Windows, delete the directory in File Explorer; on macOS and Linux, you can also delete it from a terminal.
 
-By default, `authorize` reuses a valid access token or refresh token and does not open a browser again. Only an explicit `force: true` clears the cached token for the current endpoint and starts a new login.
+By default, `authorize` reuses a valid access token or refresh token and does not open a browser again. Pass `force: true` to clear the current cache and log in as another account. Pass `switch_shop: true` to open the current account's shop picker; confirming a shop replaces the local token without another ScoreHub login. The arguments are mutually exclusive, and a cancelled or failed shop switch keeps the original shop token.
 
 ## Available Tools
 
@@ -130,8 +130,8 @@ By default, `authorize` reuses a valid access token or refresh token and does no
 
 | Tool | Description |
 |---|---|
-| `authorize` | Checks the ScoreHub OAuth state. Reuses the cache by default; passing `force: true` opens the browser for a new login. |
-| `status` | Returns the remote address, authorization state, and current number of available tools. |
+| `authorize` | Checks ScoreHub OAuth. Use `force: true` to log in as another account or `switch_shop: true` to open the current account's shop picker. |
+| `status` | Returns the remote address, authorization state, current account/shop, and available tool count. |
 
 ### Remote Tools
 

package/README.md

@@ -12,7 +12,7 @@ English version: [README.en.md](./README.en.md)
 
 `@scorehub/mcp-server` 运行在你的电脑上，位于 Claude Code、Claude Desktop、WorkBuddy 等 MCP 客户端与 ScoreHub 远程 MCP 之间，负责：
 
-- **OAuth 登录**：首次需要授权时打开浏览器，登录 ScoreHub 后将 Token 缓存到本机。
+- **账号与店铺切换**：`authorize(force=true)` 可重新登录切换账号；`authorize(switch_shop=true)` 可在当前账号下切换店铺，无需重新登录。
 - **Token 生命周期**：调用前检查 Token 有效期；距过期不足 5 分钟时自动刷新，并为长会话每 4 小时主动保活一次。
 - **工具转发**：通过 Streamable HTTP 将 TikTok Shop 达人建联相关工具请求转发到 ScoreHub 远程 MCP。
 
@@ -120,9 +120,9 @@ OAuth Token 保存在当前用户目录下：
 
 Token 持久化在本机文件中；调用默认 ScoreHub 生产端点时，mcp-server 会通过 HTTPS 的 `Authorization` 请求头将访问 Token 提供给远程 MCP。不要共享或提交 `~/.scorehub/` 下的文件。
 
-如需退出登录或切换账号，删除对应端点目录或整个 `~/.scorehub/` 目录，然后重新调用 `authorize`。在 Windows 资源管理器中删除该目录即可；macOS/Linux 也可用终端删除。
+如需退出登录，删除对应端点目录或整个 `~/.scorehub/` 目录，然后重新调用 `authorize`。在 Windows 资源管理器中删除该目录即可；macOS/Linux 也可用终端删除。
 
-`authorize` 默认复用有效的 access token 或 refresh token，不会重复打开浏览器。只有显式传入 `force: true` 时，才会清除当前端点缓存并要求重新登录。
+`authorize` 默认复用有效的 access token 或 refresh token，不会重复打开浏览器。传入 `force: true` 会清除当前端点缓存并要求重新登录，可用于切换账号；传入 `switch_shop: true` 会打开当前账号的店铺选择页，确认后直接替换本地 token，不要求再次登录。两个参数不能同时使用；店铺切换取消或失败时会保留原店铺 token。
 
 ## 可用工具
 
@@ -130,8 +130,8 @@ Token 持久化在本机文件中；调用默认 ScoreHub 生产端点时，mcp-
 
 | 工具 | 说明 |
 |---|---|
-| `authorize` | 检查 ScoreHub OAuth 状态；默认复用缓存，传入 `force: true` 才重新打开浏览器登录。 |
-| `status` | 返回远程地址、授权状态和当前可用工具数量。 |
+| `authorize` | 检查 ScoreHub OAuth 状态；`force: true` 重新登录以切换账号，`switch_shop: true` 打开当前账号的店铺选择页。 |
+| `status` | 返回远程地址、授权状态、当前账号/店铺和当前可用工具数量。 |
 
 ### 远程工具
 

package/dist/auth.d.ts

@@ -3,12 +3,26 @@ export interface OAuthTokens {
     refresh_token: string;
     expires_in: number;
     scope?: string;
+    account?: OAuthAccount;
+    selected_shop?: OAuthShop;
+}
+export interface OAuthAccount {
+    id: string;
+    email: string;
+}
+export interface OAuthShop {
+    id: string;
+    name: string;
+    code: string;
+    region: string;
 }
 export interface TokenStore {
     access_token: string;
     refresh_token: string;
     expires_at: number;
     updated_at: string;
+    account?: OAuthAccount;
+    selected_shop?: OAuthShop;
 }
 export interface AuthorizeParams {
     authEndpoint: string;
@@ -21,12 +35,24 @@ export interface AuthorizeParams {
     host?: string;
     callbackHost?: string;
     callbackPath?: string;
+    preserveExistingTokensOnFailure?: boolean;
+    authorizationUrlFactory?: (request: AuthorizationRequest) => Promise<string>;
+}
+export interface AuthorizationRequest {
+    clientId: string;
+    redirectUri: string;
+    state: string;
+    codeChallenge: string;
+    codeChallengeMethod: "S256";
+    scope?: string;
 }
 export interface AuthorizeResult {
     accessToken: string;
     refreshToken: string;
     expiresIn: number;
     scope?: string;
+    account?: OAuthAccount;
+    selectedShop?: OAuthShop;
 }
 export declare function loadTokens(host: string): TokenStore | null;
 export declare function saveTokens(host: string, tokens: TokenStore): void;

package/dist/auth.js

@@ -1,4 +1,7 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.loadTokens = loadTokens;
 exports.saveTokens = saveTokens;
@@ -17,7 +20,7 @@ const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const node_os_1 = require("node:os");
 const node_crypto_1 = require("node:crypto");
-const node_child_process_1 = require("node:child_process");
+const open_1 = __importDefault(require("open"));
 const callback_pages_js_1 = require("./pages/callback-pages.js");
 class CallbackError extends Error {
     page;
@@ -93,16 +96,48 @@ function parseOAuthTokens(payload) {
         if (typeof record.access_token === "string"
             && typeof record.refresh_token === "string"
             && typeof record.expires_in === "number") {
+            const account = parseOAuthAccount(record.account);
+            const selectedShop = parseOAuthShop(record.selected_shop);
             return {
                 access_token: record.access_token,
                 refresh_token: record.refresh_token,
                 expires_in: record.expires_in,
                 ...(typeof record.scope === "string" ? { scope: record.scope } : {}),
+                ...(account ? { account } : {}),
+                ...(selectedShop ? { selected_shop: selectedShop } : {}),
             };
         }
     }
     throw new Error(getTokenErrorMessage(payload));
 }
+function parseOAuthAccount(value) {
+    if (value && typeof value === "object"
+        && typeof value.id === "string"
+        && typeof value.email === "string") {
+        return value;
+    }
+    return undefined;
+}
+function parseOAuthShop(value) {
+    if (value && typeof value === "object"
+        && typeof value.id === "string"
+        && typeof value.name === "string"
+        && typeof value.code === "string"
+        && typeof value.region === "string") {
+        return value;
+    }
+    return undefined;
+}
+function tokenStoreFromOAuthTokens(tokens, previous) {
+    return {
+        access_token: tokens.access_token,
+        refresh_token: tokens.refresh_token ?? previous?.refresh_token ?? "",
+        expires_at: Date.now() + (tokens.expires_in ?? 3600) * 1000,
+        updated_at: new Date().toISOString(),
+        ...(tokens.account ? { account: tokens.account } : previous?.account ? { account: previous.account } : {}),
+        ...(tokens.selected_shop ? { selected_shop: tokens.selected_shop } : previous?.selected_shop ? { selected_shop: previous.selected_shop } : {}),
+    };
+}
 function createCallbackPageModel(input) {
     return {
         tone: input.tone,
@@ -177,12 +212,7 @@ async function getValidAccessToken(host, tokenEndpoint, clientId) {
         try {
             const result = await refreshAccessToken(tokenEndpoint, cached.refresh_token, clientId);
             if (result.access_token) {
-                saveTokens(host, {
-                    access_token: result.access_token,
-                    refresh_token: result.refresh_token ?? cached.refresh_token,
-                    expires_at: Date.now() + (result.expires_in ?? 3600) * 1000,
-                    updated_at: new Date().toISOString(),
-                });
+                saveTokens(host, tokenStoreFromOAuthTokens(result, cached));
                 return { access_token: result.access_token, source: "refresh" };
             }
         }
@@ -204,39 +234,18 @@ function generateState(length = 16) {
 }
 // ── Browser Launch ───────────────────────────────────────────
 function openBrowser(url) {
-    try {
-        const platform = process.platform;
-        if (platform === "darwin") {
-            (0, node_child_process_1.execFileSync)("open", [url], { stdio: "ignore", timeout: 3000 });
-        }
-        else if (platform === "win32") {
-            try {
-                (0, node_child_process_1.execFileSync)("powershell.exe", [
-                    "-NoProfile",
-                    "-NonInteractive",
-                    "-ExecutionPolicy",
-                    "Bypass",
-                    "-Command",
-                    "Start-Process -FilePath ([string]$args[0])",
-                    url,
-                ], { stdio: "ignore", timeout: 3000 });
-            }
-            catch {
-                (0, node_child_process_1.execFileSync)("cmd.exe", ["/c", "start", "", `"${url}"`], { stdio: "ignore", timeout: 3000 });
-            }
-        }
-        else {
-            (0, node_child_process_1.execFileSync)("xdg-open", [url], { stdio: "ignore", timeout: 3000 });
-        }
-    }
-    catch {
+    // Delegate to `open`, which spawns the platform launcher with the URL as a
+    // single argument. This avoids shell interpretation of `&`/`?` — the source
+    // of the earlier Windows bugs (cmd `start` truncating at `&`, PowerShell
+    // `$args` not populating under -Command and treating the URL as a file path).
+    void (0, open_1.default)(url).catch(() => {
         console.error("[scorehub] Could not open browser automatically.");
         console.error(`[scorehub] Please visit this URL manually:\n  ${url}`);
-    }
+    });
 }
 // ── Full OAuth Flow ──────────────────────────────────────────
 async function authorize(params) {
-    const { authEndpoint, tokenEndpoint, clientId, redirectUri, scope, timeoutMs = 120_000, host, } = params;
+    const { authEndpoint, tokenEndpoint, clientId, redirectUri, scope, timeoutMs = 120_000, host, preserveExistingTokensOnFailure = false, authorizationUrlFactory, } = params;
     const redirectUrl = redirectUri ? new URL(redirectUri) : null;
     const callbackHost = params.callbackHost ?? redirectUrl?.hostname ?? DEFAULT_CALLBACK_HOST;
     const callbackPath = normalizeCallbackPath(params.callbackPath ?? redirectUrl?.pathname ?? DEFAULT_CALLBACK_PATH);
@@ -342,12 +351,7 @@ async function authorize(params) {
                     }
                     const actualRedirectUri = redirectUri ?? callbackUrl;
                     const tokens = await exchangeCodeForTokens(tokenEndpoint, code, codeVerifier, clientId, actualRedirectUri);
-                    saveTokens(storageHost, {
-                        access_token: tokens.access_token,
-                        refresh_token: tokens.refresh_token,
-                        expires_at: Date.now() + (tokens.expires_in ?? 3600) * 1000,
-                        updated_at: new Date().toISOString(),
-                    });
+                    saveTokens(storageHost, tokenStoreFromOAuthTokens(tokens));
                     settled = true;
                     res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
                     res.end((0, callback_pages_js_1.buildCallbackPage)(createCallbackPageModel({
@@ -370,11 +374,14 @@ async function authorize(params) {
                         refreshToken: tokens.refresh_token,
                         expiresIn: tokens.expires_in,
                         scope: tokens.scope,
+                        account: tokens.account,
+                        selectedShop: tokens.selected_shop,
                     });
                 }
                 catch (error) {
                     settled = true;
-                    clearTokens(storageHost);
+                    if (!preserveExistingTokensOnFailure)
+                        clearTokens(storageHost);
                     const err = error instanceof CallbackError
                         ? error
                         : new CallbackError(error instanceof Error ? error.message : String(error), createCallbackPageModel({
@@ -403,7 +410,8 @@ async function authorize(params) {
             if (settled)
                 return;
             settled = true;
-            clearTokens(storageHost);
+            if (!preserveExistingTokensOnFailure)
+                clearTokens(storageHost);
             stopServer(server);
             reject(err);
         });
@@ -411,25 +419,54 @@ async function authorize(params) {
             server.unref();
             const actualPort = server.address().port;
             const actualRedirectUri = redirectUri ?? buildLocalRedirectUri(callbackHost, actualPort, callbackPath);
-            const authUrl = new URL(authEndpoint);
-            authUrl.searchParams.set("client_id", clientId);
-            authUrl.searchParams.set("redirect_uri", actualRedirectUri);
-            authUrl.searchParams.set("code_challenge", codeChallenge);
-            authUrl.searchParams.set("code_challenge_method", "S256");
-            authUrl.searchParams.set("state", state);
-            authUrl.searchParams.set("response_type", "code");
-            if (scope)
-                authUrl.searchParams.set("scope", scope);
-            console.error(`[scorehub] Opening authorization URL: endpoint=${authEndpoint}, redirect_uri=${actualRedirectUri}`);
-            openBrowser(authUrl.toString());
-            timeoutId = setTimeout(() => {
-                if (settled)
-                    return;
-                settled = true;
-                clearTokens(storageHost);
-                stopServer(server);
-                reject(new Error(`Authorization timed out after ${timeoutMs / 1000}s. Please try again.`));
-            }, timeoutMs);
+            void (async () => {
+                try {
+                    const authorizationRequest = {
+                        clientId,
+                        redirectUri: actualRedirectUri,
+                        state,
+                        codeChallenge,
+                        codeChallengeMethod: "S256",
+                        ...(scope ? { scope } : {}),
+                    };
+                    let authorizationUrl;
+                    if (authorizationUrlFactory) {
+                        authorizationUrl = await authorizationUrlFactory(authorizationRequest);
+                    }
+                    else {
+                        const authUrl = new URL(authEndpoint);
+                        authUrl.searchParams.set("client_id", clientId);
+                        authUrl.searchParams.set("redirect_uri", actualRedirectUri);
+                        authUrl.searchParams.set("code_challenge", codeChallenge);
+                        authUrl.searchParams.set("code_challenge_method", "S256");
+                        authUrl.searchParams.set("state", state);
+                        authUrl.searchParams.set("response_type", "code");
+                        if (scope)
+                            authUrl.searchParams.set("scope", scope);
+                        authorizationUrl = authUrl.toString();
+                    }
+                    console.error(`[scorehub] Opening authorization URL: ${authorizationUrl}`);
+                    openBrowser(authorizationUrl);
+                    timeoutId = setTimeout(() => {
+                        if (settled)
+                            return;
+                        settled = true;
+                        if (!preserveExistingTokensOnFailure)
+                            clearTokens(storageHost);
+                        stopServer(server);
+                        reject(new Error(`Authorization timed out after ${timeoutMs / 1000}s. Please try again.`));
+                    }, timeoutMs);
+                }
+                catch (error) {
+                    if (settled)
+                        return;
+                    settled = true;
+                    if (!preserveExistingTokensOnFailure)
+                        clearTokens(storageHost);
+                    stopServer(server);
+                    reject(error);
+                }
+            })();
         });
     });
 }

package/dist/index.js

@@ -28,6 +28,7 @@ const SCOREHUB_BASE_URL = normalizeBaseUrl(process.env.SCOREHUB_REMOTE_MCP_URL |
 // OAuth endpoints are at the root path
 const TOKEN_ENDPOINT = joinUrl(SCOREHUB_BASE_URL, "/token");
 const AUTHORIZE_URL = joinUrl(SCOREHUB_BASE_URL, "/authorize");
+const SHOP_SWITCH_ENDPOINT = joinUrl(SCOREHUB_BASE_URL, "/authorize/switch-shop");
 // MCP Streamable HTTP transport endpoints are at /mcp
 const REMOTE_MCP_URL = joinUrl(SCOREHUB_BASE_URL, "/mcp");
 function normalizeBaseUrl(value) {
@@ -140,6 +141,26 @@ async function callRemoteTool(name, args, token) {
         await client.close();
     }
 }
+async function startShopSwitch(accessToken, request) {
+    const response = await fetch(SHOP_SWITCH_ENDPOINT, {
+        method: "POST",
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+            client_id: request.clientId,
+            redirect_uri: request.redirectUri,
+            state: request.state,
+        }),
+    });
+    const payload = await response.json().catch(() => null);
+    if (!response.ok || typeof payload?.redirect !== "string") {
+        const message = typeof payload?.error === "string" ? payload.error : `远端返回 HTTP ${response.status}`;
+        throw new Error(`无法发起店铺切换：${message}`);
+    }
+    return payload.redirect;
+}
 // ── Fetch remote tools on startup ───────────────────────────
 let remoteTools = [];
 let lastFetchError = null;
@@ -162,7 +183,7 @@ server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => {
     const tools = [
         {
             name: "authorize",
-            description: "检查 ScoreHub OAuth 授权。已有有效授权时直接返回；仅在传入 force=true 时重新打开浏览器登录。",
+            description: "检查 ScoreHub OAuth 授权。force=true 重新登录以切换账号；switch_shop=true 打开当前账号的店铺选择页，无需重新登录。",
             inputSchema: {
                 type: "object",
                 properties: {
@@ -170,6 +191,10 @@ server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => {
                         type: "boolean",
                         description: "是否强制清除当前端点的本地 token 并重新登录",
                     },
+                    switch_shop: {
+                        type: "boolean",
+                        description: "在当前已登录账号下打开店铺选择页；成功后切换本地 token 绑定的店铺，不要求重新登录",
+                    },
                 },
                 required: [],
             },
@@ -196,6 +221,42 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
     switch (name) {
         case "authorize": {
             const force = args.force === true;
+            const switchShop = args.switch_shop === true;
+            if (force && switchShop) {
+                return {
+                    content: [{ type: "text", text: "⚠️ 参数冲突：切换账号请只传 force=true；切换当前账号的店铺请只传 switch_shop=true。" }],
+                };
+            }
+            if (switchShop) {
+                const tokenResult = await (0, auth_js_1.getValidAccessToken)(TOKEN_STORE_KEY, TOKEN_ENDPOINT, CLIENT_ID);
+                if (!tokenResult) {
+                    return {
+                        content: [{ type: "text", text: "⚠️ 当前没有有效授权，无法切换店铺。请先调用 authorize 完成 ScoreHub 登录。" }],
+                    };
+                }
+                try {
+                    const result = await (0, auth_js_1.authorize)({
+                        authEndpoint: AUTHORIZE_URL,
+                        tokenEndpoint: TOKEN_ENDPOINT,
+                        clientId: CLIENT_ID,
+                        host: TOKEN_STORE_KEY,
+                        port: 0,
+                        preserveExistingTokensOnFailure: true,
+                        authorizationUrlFactory: (request) => startShopSwitch(tokenResult.access_token, request),
+                    });
+                    return {
+                        content: [{
+                                type: "text",
+                                text: `✅ 已切换到店铺${result.selectedShop ? `「${result.selectedShop.name}」` : ""}，可以继续使用 ScoreHub 工具。`,
+                            }],
+                    };
+                }
+                catch (error) {
+                    return {
+                        content: [{ type: "text", text: `❌ 店铺切换未完成，已保留原店铺授权：${error instanceof Error ? error.message : String(error)}` }],
+                    };
+                }
+            }
             if (!force) {
                 const tokenResult = await (0, auth_js_1.getValidAccessToken)(TOKEN_STORE_KEY, TOKEN_ENDPOINT, CLIENT_ID);
                 if (tokenResult) {
@@ -227,6 +288,7 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
         }
         case "status": {
             const tokenResult = await (0, auth_js_1.getValidAccessToken)(TOKEN_STORE_KEY, TOKEN_ENDPOINT, CLIENT_ID);
+            const tokenStore = (0, auth_js_1.loadTokens)(TOKEN_STORE_KEY);
             return {
                 content: [
                     {
@@ -235,6 +297,8 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
                             remote_url: REMOTE_MCP_URL,
                             token_store_key: TOKEN_STORE_KEY,
                             authorized: !!tokenResult,
+                            ...(tokenStore?.account ? { account: tokenStore.account } : {}),
+                            ...(tokenStore?.selected_shop ? { selected_shop: tokenStore.selected_shop } : {}),
                             tools_count: remoteTools.length,
                             ...(lastFetchError ? { error: lastFetchError } : {}),
                         }, null, 2),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scorehub/mcp-server",
-  "version": "0.2.13",
+  "version": "0.3.0",
   "description": "ScoreHub local MCP proxy — OAuth login, token caching, and tool forwarding to remote MCP endpoint",
   "engines": {
     "node": ">=18"
@@ -20,7 +20,8 @@
   "scripts": {
     "build": "tsc && node -e \"const fs=require('fs');const f='dist/index.js';fs.writeFileSync(f,'#!/usr/bin/env node\\n'+fs.readFileSync(f,'utf8'));fs.chmodSync(f,0o755)\"",
     "dev": "tsx src/index.ts",
-    "start": "node dist/index.js"
+    "start": "node dist/index.js",
+    "test": "tsx --test test/*.test.ts"
   },
   "keywords": [
     "mcp",
@@ -30,7 +31,8 @@
   ],
   "license": "MIT",
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0"
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "open": "^8.4.2"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",