@scorehub/mcp-server 0.2.2 → 0.2.4

package/dist/auth.d.ts

@@ -13,6 +13,7 @@ export interface TokenStore {
 export interface AuthorizationCodeResult {
     code: string;
     state: string;
+    port: number;
 }
 export interface AuthorizeParams {
     authEndpoint: string;

package/dist/auth.js

@@ -137,8 +137,9 @@ function startCallbackServer(port, timeoutMs = 120_000) {
     return new Promise((resolve, reject) => {
         let timeoutId;
         const server = (0, node_http_2.createServer)((req, res) => {
+            const actualPort = server.address()?.port || port;
             const requestUrl = req.url ?? "/";
-            const url = new URL(requestUrl, `http://127.0.0.1:${port}`);
+            const url = new URL(requestUrl, `http://127.0.0.1:${actualPort}`);
             const code = url.searchParams.get("code");
             const state = url.searchParams.get("state");
             if (code) {
@@ -161,7 +162,7 @@ function startCallbackServer(port, timeoutMs = 120_000) {
                 clearTimeout(timeoutId);
             server.close();
             if (code) {
-                resolve({ code, state: state ?? "" });
+                resolve({ code, state: state ?? "", port: actualPort });
             }
             else {
                 reject(new Error("No authorization code in callback"));

package/dist/index.js

@@ -24,10 +24,8 @@ const AUTHORIZE_URL = `${SCOREHUB_BASE_URL}/authorize`;
 const REMOTE_MCP_URL = `${SCOREHUB_BASE_URL}/mcp`;
 // ── Auth State ──────────────────────────────────────────────
 const auth_js_1 = require("./auth.js");
+const node_http_1 = require("node:http");
 const node_child_process_1 = require("node:child_process");
-const node_os_1 = require("node:os");
-const node_path_1 = require("node:path");
-const node_fs_1 = require("node:fs");
 const HOST = new URL(REMOTE_MCP_URL).host;
 const CLIENT_ID = "scorehub-mcp";
 // ── Remote Tool Proxy (MCP Streamable HTTP) ─────────────────
@@ -68,10 +66,10 @@ async function callRemoteTool(name, args, token) {
     }
 }
 // ── OAuth authorize helper ──────────────────────────────────
-function generateAuthUrl() {
+function generateAuthUrl(port = 19836) {
     // Generate random state for CSRF protection
     const state = Math.random().toString(36).substring(2);
-    return `${AUTHORIZE_URL}?client_id=scorehub-mcp&redirect_uri=http://127.0.0.1:19836/callback&state=${state}`;
+    return `${AUTHORIZE_URL}?client_id=scorehub-mcp&redirect_uri=http://127.0.0.1:${port}/callback&state=${state}`;
 }
 // ── Fetch remote tools on startup ───────────────────────────
 let remoteTools = [];
@@ -125,44 +123,98 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
         case "authorize": {
             // Always force fresh OAuth flow when user explicitly authorizes
             (0, auth_js_1.clearTokens)(HOST);
-            const authUrl = generateAuthUrl();
-            const os = process.platform;
-            const cmd = os === "darwin" ? "open" : os === "win32" ? "start" : "xdg-open";
-            // Start callback server BEFORE opening browser
-            const callbackPromise = (0, auth_js_1.startCallbackServer)(19836);
-            try {
-                (0, node_child_process_1.execSync)(`${cmd} "${authUrl}"`);
-            }
-            catch { /* headless env: user opens manually */ }
-            try {
-                const { code } = await callbackPromise;
-                const baseUrl = new URL(REMOTE_MCP_URL).origin;
-                const tokenResp = await fetch(`${baseUrl}/token`, {
-                    method: "POST",
-                    headers: { "Content-Type": "application/json" },
-                    body: JSON.stringify({ grant_type: "authorization_code", code }),
+            // Port 0 lets the OS assign a random available port,
+            // avoiding conflicts when multiple MCP clients run simultaneously
+            let actualPort = 0;
+            return new Promise((resolve) => {
+                let timeoutId;
+                const callbackServer = (0, node_http_1.createServer)((req, res) => {
+                    const requestUrl = req.url ?? "/";
+                    const url = new URL(requestUrl, `http://127.0.0.1:${actualPort}`);
+                    // 只处理 /callback 路径的请求，忽略浏览器探测请求（favicon、安全检查等）
+                    if (url.pathname !== "/callback") {
+                        res.writeHead(204);
+                        res.end();
+                        return;
+                    }
+                    if (timeoutId)
+                        clearTimeout(timeoutId);
+                    const code = url.searchParams.get("code");
+                    if (code) {
+                        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                        res.end("<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Authorization Complete</title></head>" +
+                            "<body style=\"font-family:sans-serif;text-align:center;padding-top:80px;\">" +
+                            "<h2>✅ Authorization Successful</h2>" +
+                            "<p>You may close this window and return to the terminal.</p>" +
+                            "</body></html>");
+                        callbackServer.close();
+                        const baseUrl = new URL(REMOTE_MCP_URL).origin;
+                        fetch(`${baseUrl}/token`, {
+                            method: "POST",
+                            headers: { "Content-Type": "application/json" },
+                            body: JSON.stringify({ grant_type: "authorization_code", code }),
+                        })
+                            .then((r) => r.json())
+                            .then((tokenData) => {
+                            if (!tokenData.access_token) {
+                                resolve({
+                                    content: [{ type: "text", text: `❌ Token 获取失败: ${JSON.stringify(tokenData)}` }],
+                                });
+                                return;
+                            }
+                            (0, auth_js_1.saveTokens)(HOST, {
+                                access_token: tokenData.access_token,
+                                refresh_token: tokenData.refresh_token ?? "",
+                                expires_at: Date.now() + (tokenData.expires_in ?? 3600) * 1000,
+                                updated_at: new Date().toISOString(),
+                            });
+                            resolve({
+                                content: [{ type: "text", text: "✅ 授权成功！可以开始使用工具了。" }],
+                            });
+                        })
+                            .catch((e) => resolve({
+                            content: [{ type: "text", text: `❌ Token 获取失败: ${String(e)}` }],
+                        }));
+                    }
+                    else {
+                        // 到达 /callback 但没有 code —— 真正的错误
+                        res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+                        res.end("<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Authorization Failed</title></head>" +
+                            "<body style=\"font-family:sans-serif;text-align:center;padding-top:80px;\">" +
+                            "<h2>❌ Authorization Failed</h2>" +
+                            "<p>No authorization code received from the provider.</p>" +
+                            "</body></html>");
+                        callbackServer.close();
+                        resolve({
+                            content: [{ type: "text", text: "❌ 授权失败: No authorization code in callback" }],
+                        });
+                    }
                 });
-                const tokenData = await tokenResp.json();
-                if (!tokenData.access_token) {
-                    return {
-                        content: [{ type: "text", text: `❌ Token 获取失败: ${JSON.stringify(tokenData)}` }],
-                    };
-                }
-                (0, auth_js_1.saveTokens)(HOST, {
-                    access_token: tokenData.access_token,
-                    refresh_token: tokenData.refresh_token ?? "",
-                    expires_at: Date.now() + (tokenData.expires_in ?? 3600) * 1000,
-                    updated_at: new Date().toISOString(),
+                callbackServer.on("error", (err) => {
+                    if (timeoutId)
+                        clearTimeout(timeoutId);
+                    resolve({
+                        content: [{ type: "text", text: `❌ 授权失败: ${String(err)}` }],
+                    });
                 });
-                return {
-                    content: [{ type: "text", text: "✅ 授权成功！可以开始使用工具了。" }],
-                };
-            }
-            catch (e) {
-                return {
-                    content: [{ type: "text", text: `❌ 授权失败: ${String(e)}` }],
-                };
-            }
+                callbackServer.listen(0, "127.0.0.1", () => {
+                    actualPort = callbackServer.address().port;
+                    callbackServer.unref();
+                    const authUrl = generateAuthUrl(actualPort);
+                    const os = process.platform;
+                    const cmd = os === "darwin" ? "open" : os === "win32" ? "start" : "xdg-open";
+                    try {
+                        (0, node_child_process_1.execSync)(`${cmd} "${authUrl}"`);
+                    }
+                    catch { /* headless env: user opens manually */ }
+                    timeoutId = setTimeout(() => {
+                        callbackServer.close();
+                        resolve({
+                            content: [{ type: "text", text: "❌ 授权超时 (120s)。请重试。" }],
+                        });
+                    }, 120_000);
+                });
+            });
         }
         case "status": {
             const tokenResult = await (0, auth_js_1.getValidAccessToken)(HOST, TOKEN_ENDPOINT, CLIENT_ID);
@@ -208,29 +260,16 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
 });
 // ── Start ───────────────────────────────────────────────────
 async function main() {
-    // ── Clean up orphaned previous instance ────────────────────
-    const pidFile = (0, node_path_1.join)((0, node_os_1.homedir)(), ".scorehub", HOST, "pid");
-    try {
-        if ((0, node_fs_1.existsSync)(pidFile)) {
-            const oldPid = parseInt((0, node_fs_1.readFileSync)(pidFile, "utf-8").trim(), 10);
-            if (oldPid && oldPid !== process.pid) {
-                try {
-                    process.kill(oldPid, 0); // check if process exists (cross-platform)
-                    process.kill(oldPid); // SIGTERM on POSIX, TerminateProcess on Windows
-                }
-                catch { /* process already dead */ }
-            }
-        }
-    }
-    catch { /* ignore PID file read errors */ }
-    // Write current PID
-    try {
-        const dir = (0, node_path_1.dirname)(pidFile);
-        if (!(0, node_fs_1.existsSync)(dir))
-            (0, node_fs_1.mkdirSync)(dir, { recursive: true });
-        (0, node_fs_1.writeFileSync)(pidFile, String(process.pid), "utf-8");
-    }
-    catch { /* ignore PID file write errors */ }
+    // Set process title for easy identification in ps/task manager
+    process.title = 'scorehub-mcp';
+    // Gracefully exit when parent AI agent closes stdin (normal shutdown or crash).
+    // stdio transport ties the child lifecycle to the parent — when the parent exits,
+    // the OS closes the pipe, stdin emits 'end', and we exit cleanly.
+    // This replaces the previous shared-PID-file approach which killed other instances.
+    process.stdin.on('end', () => {
+        console.error('ScoreHub MCP Server: stdin closed, exiting');
+        process.exit(0);
+    });
     try {
         const tokenResult = await (0, auth_js_1.getValidAccessToken)(HOST, TOKEN_ENDPOINT, CLIENT_ID);
         remoteTools = await fetchRemoteTools(tokenResult?.access_token);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scorehub/mcp-server",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "ScoreHub local MCP proxy — OAuth login, token caching, and tool forwarding to remote MCP endpoint",
   "main": "dist/index.js",
   "bin": {