@scorehub/mcp-server 0.2.6 → 0.2.8

package/README.md

@@ -116,6 +116,8 @@ The `<endpoint>` is derived from the `SCOREHUB_REMOTE_MCP_URL` host and path (fo
 
 To log out or switch accounts, delete the `~/.scorehub/` directory or just the host-specific subdirectory.
 
+The `authorize` tool reuses cached credentials by default. If the cached access token is still valid, or the refresh token can renew it, `authorize` returns without opening the browser. To force a new browser login, call `authorize` with `force: true`.
+
 ## Available Tools
 
 ### Local tools
@@ -124,7 +126,7 @@ These tools run locally on your machine — they do not call the remote endpoint
 
 | Tool | Description |
 |---|---|
-| `authorize` | Opens your browser for ScoreHub OAuth login. Forces a fresh authorization flow every time. |
+| `authorize` | Checks ScoreHub OAuth status. Reuses cached credentials by default; pass `force: true` to open the browser for a fresh login. |
 | `status` | Returns connection status: remote URL, authorization state, and count of available tools. |
 
 ### Remote tools

package/dist/auth.js

@@ -51,6 +51,9 @@ function clearTokens(host) {
         (0, node_fs_1.writeFileSync)(file, JSON.stringify({}), "utf-8");
     }
 }
+function hasSignedTokenShape(token) {
+    return token.split(".").length === 3;
+}
 // ── Token Exchange ───────────────────────────────────────────
 function tokenPostRequest(tokenEndpoint, body) {
     const url = new URL(tokenEndpoint);
@@ -100,7 +103,7 @@ async function refreshAccessToken(tokenEndpoint, refreshToken, clientId) {
 }
 async function getValidAccessToken(host, tokenEndpoint, clientId) {
     const cached = loadTokens(host);
-    if (cached && cached.access_token && cached.expires_at > Date.now() + 5 * 60 * 1000) {
+    if (cached && cached.access_token && hasSignedTokenShape(cached.access_token) && cached.expires_at > Date.now() + 5 * 60 * 1000) {
         return { access_token: cached.access_token, source: "cache" };
     }
     if (cached?.refresh_token) {

package/dist/index.js

@@ -43,6 +43,53 @@ const TOKEN_STORE_KEY = endpointTokenKey(SCOREHUB_BASE_URL);
 const CLIENT_ID = "scorehub-mcp";
 // Proactively refresh token every 4 hours to prevent expiry during long sessions
 const TOKEN_KEEPALIVE_INTERVAL = 4 * 60 * 60 * 1000;
+function isRemoteToolErrorType(value) {
+    return value === "oauth_invalid"
+        || value === "shop_auth_invalid"
+        || value === "rate_limited"
+        || value === "quota_exhausted"
+        || value === "invalid_input"
+        || value === "permission_denied"
+        || value === "upstream_error";
+}
+function parseRemoteToolEnvelope(text) {
+    try {
+        const parsed = JSON.parse(text);
+        if (parsed.ok === true && Object.prototype.hasOwnProperty.call(parsed, "data")) {
+            return { ok: true, data: parsed.data };
+        }
+        if (parsed.ok === false
+            && isRemoteToolErrorType(parsed.error_type)
+            && typeof parsed.user_message === "string"
+            && typeof parsed.retryable === "boolean") {
+            return {
+                ok: false,
+                error_type: parsed.error_type,
+                user_message: parsed.user_message,
+                retryable: parsed.retryable,
+                ...(Object.prototype.hasOwnProperty.call(parsed, "upstream") ? { upstream: parsed.upstream } : {}),
+            };
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+function extractRemoteTextContent(content) {
+    if (!Array.isArray(content)) {
+        return [];
+    }
+    return content.flatMap((item) => {
+        if (item
+            && typeof item === "object"
+            && item.type === "text"
+            && typeof item.text === "string") {
+            return [item.text];
+        }
+        return [];
+    });
+}
 // ── Remote Tool Proxy (MCP Streamable HTTP) ─────────────────
 async function fetchRemoteTools(token) {
     try {
@@ -74,7 +121,15 @@ async function callRemoteTool(name, args, token) {
     try {
         await client.connect(transport);
         const result = await client.callTool({ name, arguments: args });
-        return JSON.stringify(result.content, null, 2);
+        const textBlocks = extractRemoteTextContent(result.content);
+        const rawText = textBlocks.length > 0
+            ? textBlocks.join("\n\n")
+            : JSON.stringify(result.content, null, 2);
+        const envelope = textBlocks
+            .map((text) => parseRemoteToolEnvelope(text))
+            .find((candidate) => candidate !== null)
+            ?? parseRemoteToolEnvelope(rawText);
+        return { rawText, envelope };
     }
     finally {
         await client.close();
@@ -108,10 +163,15 @@ server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => {
     const tools = [
         {
             name: "authorize",
-            description: "通过浏览器 OAuth 登录 ScoreHub。首次连接时自动调用，打开浏览器引导登录。已登录时可直接使用其他工具。",
+            description: "检查 ScoreHub OAuth 授权。已有有效授权时直接返回；仅在传入 force=true 时重新打开浏览器登录。",
             inputSchema: {
                 type: "object",
-                properties: {},
+                properties: {
+                    force: {
+                        type: "boolean",
+                        description: "是否强制清除当前端点的本地 token 并重新登录",
+                    },
+                },
                 required: [],
             },
         },
@@ -136,8 +196,18 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
     const { name, arguments: args = {} } = request.params;
     switch (name) {
         case "authorize": {
-            // Always force fresh OAuth flow when user explicitly authorizes
-            (0, auth_js_1.clearTokens)(TOKEN_STORE_KEY);
+            const force = args.force === true;
+            if (!force) {
+                const tokenResult = await (0, auth_js_1.getValidAccessToken)(TOKEN_STORE_KEY, TOKEN_ENDPOINT, CLIENT_ID);
+                if (tokenResult) {
+                    return {
+                        content: [{ type: "text", text: `✅ 已授权（${tokenResult.source === "cache" ? "使用本地缓存" : "已自动刷新"}），可以直接使用 ScoreHub 工具。` }],
+                    };
+                }
+            }
+            else {
+                (0, auth_js_1.clearTokens)(TOKEN_STORE_KEY);
+            }
             // Port 0 lets the OS assign a random available port,
             // avoiding conflicts when multiple MCP clients run simultaneously
             let actualPort = 0;
@@ -262,8 +332,32 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
                 };
             }
             try {
-                const result = await callRemoteTool(name, args, tokenResult.access_token);
-                return { content: [{ type: "text", text: result }] };
+                const remoteResult = await callRemoteTool(name, args, tokenResult.access_token);
+                if (remoteResult.envelope?.ok === false && remoteResult.envelope.error_type === "oauth_invalid") {
+                    (0, auth_js_1.clearTokens)(TOKEN_STORE_KEY);
+                    const authUrl = generateAuthUrl();
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `⚠️ 授权已失效，已清除本地缓存。请调用 "authorize" 工具重新登录 ScoreHub。\n授权地址: ${authUrl}`,
+                            },
+                        ],
+                    };
+                }
+                if (remoteResult.rawText.includes("ScoreHub OAuth 授权已过期或无效")) {
+                    (0, auth_js_1.clearTokens)(TOKEN_STORE_KEY);
+                    const authUrl = generateAuthUrl();
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `⚠️ 授权已失效，已清除本地缓存。请调用 "authorize" 工具重新登录 ScoreHub。\n授权地址: ${authUrl}`,
+                            },
+                        ],
+                    };
+                }
+                return { content: [{ type: "text", text: remoteResult.rawText }] };
             }
             catch (e) {
                 return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scorehub/mcp-server",
-  "version": "0.2.6",
+  "version": "0.2.8",
   "description": "ScoreHub local MCP proxy — OAuth login, token caching, and tool forwarding to remote MCP endpoint",
   "main": "dist/index.js",
   "bin": {