@scorehub/mcp-server 0.2.6 → 0.2.7

package/README.md

@@ -116,6 +116,8 @@ The `<endpoint>` is derived from the `SCOREHUB_REMOTE_MCP_URL` host and path (fo
 
 To log out or switch accounts, delete the `~/.scorehub/` directory or just the host-specific subdirectory.
 
+The `authorize` tool reuses cached credentials by default. If the cached access token is still valid, or the refresh token can renew it, `authorize` returns without opening the browser. To force a new browser login, call `authorize` with `force: true`.
+
 ## Available Tools
 
 ### Local tools
@@ -124,7 +126,7 @@ These tools run locally on your machine — they do not call the remote endpoint
 
 | Tool | Description |
 |---|---|
-| `authorize` | Opens your browser for ScoreHub OAuth login. Forces a fresh authorization flow every time. |
+| `authorize` | Checks ScoreHub OAuth status. Reuses cached credentials by default; pass `force: true` to open the browser for a fresh login. |
 | `status` | Returns connection status: remote URL, authorization state, and count of available tools. |
 
 ### Remote tools

package/dist/auth.js

@@ -51,6 +51,9 @@ function clearTokens(host) {
         (0, node_fs_1.writeFileSync)(file, JSON.stringify({}), "utf-8");
     }
 }
+function hasSignedTokenShape(token) {
+    return token.split(".").length === 3;
+}
 // ── Token Exchange ───────────────────────────────────────────
 function tokenPostRequest(tokenEndpoint, body) {
     const url = new URL(tokenEndpoint);
@@ -100,7 +103,7 @@ async function refreshAccessToken(tokenEndpoint, refreshToken, clientId) {
 }
 async function getValidAccessToken(host, tokenEndpoint, clientId) {
     const cached = loadTokens(host);
-    if (cached && cached.access_token && cached.expires_at > Date.now() + 5 * 60 * 1000) {
+    if (cached && cached.access_token && hasSignedTokenShape(cached.access_token) && cached.expires_at > Date.now() + 5 * 60 * 1000) {
         return { access_token: cached.access_token, source: "cache" };
     }
     if (cached?.refresh_token) {

package/dist/index.js

@@ -108,10 +108,15 @@ server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => {
     const tools = [
         {
             name: "authorize",
-            description: "通过浏览器 OAuth 登录 ScoreHub。首次连接时自动调用，打开浏览器引导登录。已登录时可直接使用其他工具。",
+            description: "检查 ScoreHub OAuth 授权。已有有效授权时直接返回；仅在传入 force=true 时重新打开浏览器登录。",
             inputSchema: {
                 type: "object",
-                properties: {},
+                properties: {
+                    force: {
+                        type: "boolean",
+                        description: "是否强制清除当前端点的本地 token 并重新登录",
+                    },
+                },
                 required: [],
             },
         },
@@ -136,8 +141,18 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
     const { name, arguments: args = {} } = request.params;
     switch (name) {
         case "authorize": {
-            // Always force fresh OAuth flow when user explicitly authorizes
-            (0, auth_js_1.clearTokens)(TOKEN_STORE_KEY);
+            const force = args.force === true;
+            if (!force) {
+                const tokenResult = await (0, auth_js_1.getValidAccessToken)(TOKEN_STORE_KEY, TOKEN_ENDPOINT, CLIENT_ID);
+                if (tokenResult) {
+                    return {
+                        content: [{ type: "text", text: `✅ 已授权（${tokenResult.source === "cache" ? "使用本地缓存" : "已自动刷新"}），可以直接使用 ScoreHub 工具。` }],
+                    };
+                }
+            }
+            else {
+                (0, auth_js_1.clearTokens)(TOKEN_STORE_KEY);
+            }
             // Port 0 lets the OS assign a random available port,
             // avoiding conflicts when multiple MCP clients run simultaneously
             let actualPort = 0;
@@ -263,6 +278,18 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
             }
             try {
                 const result = await callRemoteTool(name, args, tokenResult.access_token);
+                if (result.includes("ScoreHub OAuth 授权已过期或无效")) {
+                    (0, auth_js_1.clearTokens)(TOKEN_STORE_KEY);
+                    const authUrl = generateAuthUrl();
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `⚠️ 授权已失效，已清除本地缓存。请调用 "authorize" 工具重新登录 ScoreHub。\n授权地址: ${authUrl}`,
+                            },
+                        ],
+                    };
+                }
                 return { content: [{ type: "text", text: result }] };
             }
             catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scorehub/mcp-server",
-  "version": "0.2.6",
+  "version": "0.2.7",
   "description": "ScoreHub local MCP proxy — OAuth login, token caching, and tool forwarding to remote MCP endpoint",
   "main": "dist/index.js",
   "bin": {