@scorehub/mcp-server 0.4.0 → 0.4.2

package/README.en.md

@@ -62,7 +62,7 @@ Common configuration locations are:
 | Other MCP clients | The MCP configuration file used by that client |
 | WorkBuddy | `mcp.json` |
 
-On the first launch, `npx` downloads `@scorehub/mcp-server` and connects it to the remote endpoint. When you first call a remote tool, invoke `authorize` when prompted by your client. A browser opens the ScoreHub login page; after authorization it returns to a random `127.0.0.1` port and stores the token locally. Later calls reuse the cached token and do not require another login.
+On the first launch, `npx` downloads `@scorehub/mcp-server` and connects it to the remote endpoint. When you first call a remote tool, invoke `authorize` when prompted by your client. A browser opens the ScoreHub login page; after authorization it returns to a random `127.0.0.1` port and stores the token locally. In WorkBuddy, the successful callback page can launch Tiky through “Return to WorkBuddy.” Later calls reuse the cached token and do not require another login.
 
 > After you install Tiky through the WorkBuddy share link, Tiky's first-turn bootstrap gate writes or repairs this MCP configuration after the user's one-time confirmation. Manual editing is not required.
 
@@ -78,7 +78,7 @@ The command reports the package version, Node.js version, and executable entrypo
 
 ## Windows
 
-Windows uses the same MCP JSON configuration as macOS and Linux. You do not need `npx.cmd` or a separate global installation.
+For manually configured MCP clients, Windows uses the same `"command": "npx"` configuration shown above as macOS and Linux; you do not need to switch it to `npx.cmd` or install the package globally. Tiky's public WorkBuddy installation path generates a managed configuration instead: it uses WorkBuddy's bundled `node.exe` to load the matching npm `npx-cli.js` directly, avoiding host process-launch compatibility problems with `.cmd` / `.bat` files.
 
 1. After installing Node.js 18+, reopen PowerShell or Windows Terminal and run the three version commands from the prerequisites section.
 2. If `node`, `npm`, or `npx` cannot be found, Node.js is not available on the current process PATH. Close and reopen the client and terminal; if the problem remains, verify the Node.js installation.
@@ -86,7 +86,7 @@ Windows uses the same MCP JSON configuration as macOS and Linux. You do not need
 4. Authorization uses PowerShell `Start-Process` to open your default browser, so OAuth URL parameters such as `redirect_uri` are preserved. If system policy blocks it, copy the authorization URL printed in the terminal and open it on the **same Windows computer that runs mcp-server**.
 5. The callback always uses a random `127.0.0.1` port. Do not open the authorization URL on another computer. If local security software blocks the loopback callback, allow local loopback connections and try again.
 
-If WorkBuddy uses its bundled Node.js, install Tiky through the share link first, then let Tiky run `npx -y @scorehub/creator-outreach@latest` to complete the local bootstrap. That flow handles `npx` / `npx.cmd` and PATH differences for each platform.
+If WorkBuddy uses its bundled Node.js, install Tiky through the share link first, then let Tiky run `npx -y @scorehub/creator-outreach@latest` to complete the local bootstrap. That flow resolves the managed `node.exe`, `npx-cli.js`, and PATH automatically; no wrapper script or manual `mcp.json` edit is required.
 
 ## Optional: Global Installation
 
@@ -183,7 +183,7 @@ Local mcp-server                         ScoreHub Remote MCP
 | `rate_limited` / `quota_exhausted` | Wait, split the operation into batches, or narrow the request. Do not reauthorize for rate limits. |
 | `invalid_input` | Correct the tool parameters; do not start authorization. |
 | Browser does not open automatically | Use the authorization URL printed in the terminal and complete the callback on the same machine that runs mcp-server. |
-| The authorization page says the link is invalid, or the browser URL has no `redirect_uri` | Fully quit and restart WorkBuddy, and confirm `~/.workbuddy/mcp.json` still uses `npx -y @scorehub/mcp-server@latest`. Newer versions open the OAuth URL through PowerShell to avoid truncating query parameters. |
+| The authorization page says the link is invalid, or the browser URL has no `redirect_uri` | Fully quit and restart WorkBuddy, then confirm the `scorehub` entry in `~/.workbuddy/mcp.json` still includes `@scorehub/mcp-server@latest` and is managed by `@scorehub/creator-outreach`. If not, rerun Tiky's bootstrap repair. Newer versions open the OAuth URL through PowerShell to avoid truncating query parameters. |
 
 Key `status` fields:
 

package/README.md

@@ -62,7 +62,7 @@ npx --version
 | 其他 MCP 客户端 | 该客户端使用的 MCP 配置文件 |
 | WorkBuddy | `mcp.json` |
 
-首次启动时，`npx` 会下载 `@scorehub/mcp-server` 并连接远程端点。首次调用远程工具时，按客户端提示调用 `authorize`：浏览器会打开 ScoreHub 登录页，授权完成后回调到 `127.0.0.1` 的随机端口并写入本地 Token。之后会复用缓存，不需要每次登录。
+首次启动时，`npx` 会下载 `@scorehub/mcp-server` 并连接远程端点。首次调用远程工具时，按客户端提示调用 `authorize`：浏览器会打开 ScoreHub 登录页，授权完成后回调到 `127.0.0.1` 的随机端口并写入本地 Token。在 WorkBuddy 中，成功回调页可通过“切换到终端继续”唤起 Tiky；之后会复用缓存，不需要每次登录。
 
 > 通过 WorkBuddy 分享链接安装 Tiky 后，Tiky 会在首轮 bootstrap 门禁中经用户首次确认后自动写入或修复这份 MCP 配置；无需手动编辑。
 
@@ -78,7 +78,7 @@ npx -y @scorehub/mcp-server@latest --self-check --json
 
 ## Windows 使用说明
 
-Windows 与 macOS、Linux 使用同一份 MCP JSON 配置，不需要改成 `npx.cmd` 或另行全局安装。
+手工配置普通 MCP 客户端时，Windows 与 macOS、Linux 一样使用前文的 `"command": "npx"`，不需要手工改成 `npx.cmd` 或另行全局安装。WorkBuddy 的公开安装路径由 Tiky 自动生成配置：它会使用 WorkBuddy 托管的 `node.exe` 直接加载同版本 npm 的 `npx-cli.js`，避免宿主原生进程 API 直接启动 `.cmd` / `.bat` 的兼容问题。
 
 1. 安装 Node.js 18+ 后，重新打开 PowerShell 或 Windows Terminal，运行前置条件中的三个版本命令。
 2. 如果提示找不到 `node`、`npm` 或 `npx`，说明 Node.js 尚未加入当前进程的 PATH：关闭并重新打开客户端和终端；仍无法识别时，检查 Node.js 安装是否完成。
@@ -86,7 +86,7 @@ Windows 与 macOS、Linux 使用同一份 MCP JSON 配置，不需要改成 `npx
 4. 授权时会优先使用 `cmd.exe /c start` 打开默认浏览器。被系统策略拦截时，复制终端输出的授权 URL，在**运行 mcp-server 的同一台 Windows 电脑**上打开并完成授权。
 5. 回调固定使用 `127.0.0.1` 随机端口。不要在另一台电脑打开授权 URL；本机安全软件若拦截回环回调，应允许本地回环连接后重试。
 
-WorkBuddy 若使用其捆绑的 Node.js，建议先通过分享链接安装 Tiky，再由 Tiky 执行 `npx -y @scorehub/creator-outreach@latest` 完成本地引导；该流程会按平台处理 `npx` / `npx.cmd` 与 PATH。
+WorkBuddy 若使用其捆绑的 Node.js，建议先通过分享链接安装 Tiky，再由 Tiky 执行 `npx -y @scorehub/creator-outreach@latest` 完成本地引导；该流程会自动解析托管的 `node.exe`、`npx-cli.js` 与 PATH，不需要创建包装脚本或手工编辑 `mcp.json`。
 
 ## 可选：全局安装
 
@@ -183,7 +183,7 @@ Token 持久化在本机文件中；调用默认 ScoreHub 生产端点时，mcp-
 | `rate_limited` / `quota_exhausted` | 等待、分批执行或缩小请求范围；不要为了限流重新授权。 |
 | `invalid_input` | 修正工具参数，不走授权流程。 |
 | 浏览器无法自动打开 | 使用终端输出的授权 URL，并在运行 mcp-server 的同一台机器上完成回调。 |
-| Windows 授权页提示授权链接无效，或浏览器地址栏缺少 `redirect_uri` | 完全退出并重启 WorkBuddy，确认 `~/.workbuddy/mcp.json` 仍使用 `npx -y @scorehub/mcp-server@latest`；新版会通过 PowerShell 打开授权 URL，避免 `cmd.exe start` 截断带 `&` 的参数。 |
+| Windows 授权页提示授权链接无效，或浏览器地址栏缺少 `redirect_uri` | 完全退出并重启 WorkBuddy，确认 `~/.workbuddy/mcp.json` 的 `scorehub` 参数仍包含 `@scorehub/mcp-server@latest`，且配置由 `@scorehub/creator-outreach` 托管；若不符合，重新运行 Tiky bootstrap 修复。新版会通过 PowerShell 打开授权 URL，避免 `cmd.exe start` 截断带 `&` 的参数。 |
 
 `status` 的关键字段说明：
 

package/dist/index.js

@@ -14,11 +14,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const index_js_1 = require("@modelcontextprotocol/sdk/server/index.js");
 const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");
 const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
-const index_js_2 = require("@modelcontextprotocol/sdk/client/index.js");
-const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/client/streamableHttp.js");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const self_check_js_1 = require("./self-check.js");
+const proxy_js_1 = require("./proxy.js");
 function readPackageMetadata() {
     return JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(__dirname, "../package.json"), "utf-8"));
 }
@@ -51,68 +50,11 @@ const TOKEN_STORE_KEY = endpointTokenKey(SCOREHUB_BASE_URL);
 const CLIENT_ID = "scorehub-mcp";
 // Proactively refresh token every 4 hours to prevent expiry during long sessions
 const TOKEN_KEEPALIVE_INTERVAL = 4 * 60 * 60 * 1000;
-function isRemoteToolErrorType(value) {
-    return value === "oauth_invalid"
-        || value === "shop_auth_invalid"
-        || value === "rate_limited"
-        || value === "quota_exhausted"
-        || value === "invalid_input"
-        || value === "permission_denied"
-        || value === "upstream_error";
-}
-function parseRemoteToolEnvelope(text) {
-    try {
-        const parsed = JSON.parse(text);
-        if (parsed.ok === true && Object.prototype.hasOwnProperty.call(parsed, "data")) {
-            return { ok: true, data: parsed.data };
-        }
-        if (parsed.ok === false
-            && isRemoteToolErrorType(parsed.error_type)
-            && typeof parsed.user_message === "string"
-            && typeof parsed.retryable === "boolean") {
-            return {
-                ok: false,
-                error_type: parsed.error_type,
-                user_message: parsed.user_message,
-                retryable: parsed.retryable,
-                ...(Object.prototype.hasOwnProperty.call(parsed, "upstream") ? { upstream: parsed.upstream } : {}),
-            };
-        }
-        return null;
-    }
-    catch {
-        return null;
-    }
-}
-function extractRemoteTextContent(content) {
-    if (!Array.isArray(content)) {
-        return [];
-    }
-    return content.flatMap((item) => {
-        if (item
-            && typeof item === "object"
-            && item.type === "text"
-            && typeof item.text === "string") {
-            return [item.text];
-        }
-        return [];
-    });
-}
 // ── Remote Tool Proxy (MCP Streamable HTTP) ─────────────────
+const remoteProxy = new proxy_js_1.RemoteToolProxy(new URL(REMOTE_MCP_URL), SERVER_VERSION);
 async function fetchRemoteTools(token) {
     try {
-        const transport = new streamableHttp_js_1.StreamableHTTPClientTransport(new URL(REMOTE_MCP_URL), {
-            requestInit: token ? { headers: { Authorization: `Bearer ${token}` } } : undefined,
-        });
-        const client = new index_js_2.Client({ name: "scorehub-mcp", version: SERVER_VERSION }, { capabilities: {} });
-        try {
-            await client.connect(transport);
-            const result = await client.listTools();
-            return result.tools;
-        }
-        finally {
-            await client.close();
-        }
+        return await remoteProxy.listTools(token);
     }
     catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
@@ -121,27 +63,8 @@ async function fetchRemoteTools(token) {
         return [];
     }
 }
-async function callRemoteTool(name, args, token) {
-    const transport = new streamableHttp_js_1.StreamableHTTPClientTransport(new URL(REMOTE_MCP_URL), {
-        requestInit: { headers: { Authorization: `Bearer ${token}` } },
-    });
-    const client = new index_js_2.Client({ name: "scorehub-mcp", version: SERVER_VERSION }, { capabilities: {} });
-    try {
-        await client.connect(transport);
-        const result = await client.callTool({ name, arguments: args });
-        const textBlocks = extractRemoteTextContent(result.content);
-        const rawText = textBlocks.length > 0
-            ? textBlocks.join("\n\n")
-            : JSON.stringify(result.content, null, 2);
-        const envelope = textBlocks
-            .map((text) => parseRemoteToolEnvelope(text))
-            .find((candidate) => candidate !== null)
-            ?? parseRemoteToolEnvelope(rawText);
-        return { rawText, envelope };
-    }
-    finally {
-        await client.close();
-    }
+function callRemoteTool(name, args, token) {
+    return remoteProxy.callTool(name, args, token);
 }
 async function startShopSwitch(accessToken, request) {
     const response = await fetch(SHOP_SWITCH_ENDPOINT, {
@@ -182,7 +105,7 @@ server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => {
         }
     }
     catch { /* keep stale tools and lastError */ }
-    const tools = [
+    const localTools = [
         {
             name: "authorize",
             description: "检查 ScoreHub OAuth 授权。force=true 重新登录以切换账号；switch_shop=true 打开当前账号的店铺选择页，无需重新登录。",
@@ -210,13 +133,8 @@ server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => {
                 required: [],
             },
         },
-        ...remoteTools.map((t) => ({
-            name: t.name,
-            description: t.description,
-            inputSchema: t.inputSchema,
-        })),
     ];
-    return { tools };
+    return { tools: (0, proxy_js_1.mergeRemoteTools)(localTools, remoteTools) };
 });
 server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
     const { name, arguments: args = {} } = request.params;

package/dist/pages/callback-pages.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildCallbackPage = buildCallbackPage;
 const logo_data_js_1 = require("./logo-data.js");
+const WORKBUDDY_LAUNCH_URL = "workbuddy://launch?expertname=Tiky%20%C2%B7%20TikTok%E8%BE%BE%E4%BA%BA%E8%90%A5%E9%94%80%E4%B8%93%E5%AE%B6&buddy_type=workbuddy";
 const CALLBACK_BASE_STYLES = `
     * { margin:0; padding:0; box-sizing:border-box; }
     body {
@@ -191,6 +192,9 @@ const CALLBACK_BASE_STYLES = `
       margin-top:22px;
     }
     .btn {
+      display:flex;
+      align-items:center;
+      justify-content:center;
       min-height:44px;
       padding:10px 16px;
       border-radius:12px;
@@ -198,6 +202,7 @@ const CALLBACK_BASE_STYLES = `
       font-weight:800;
       cursor:pointer;
       border:1px solid transparent;
+      text-decoration:none;
       transition:background 0.15s, border-color 0.15s, box-shadow 0.15s, transform 0.15s;
     }
     .btn:hover { transform:translateY(-1px); }
@@ -267,6 +272,19 @@ function escapeHtml(value) {
 }
 function buildCallbackPage(page) {
     const statusClass = page.tone === "success" ? "status-badge-success" : "status-badge-error";
+    const primaryAction = page.tone === "success"
+        ? `<a class="btn btn-primary" id="workbuddy-launch-link" href="${WORKBUDDY_LAUNCH_URL}">切换到终端继续</a>`
+        : `<button class="btn btn-primary" type="button" id="focus-button">切回终端继续</button>`;
+    const focusScript = page.tone === "success"
+        ? ""
+        : `
+    const focusButton = document.getElementById('focus-button');
+    focusButton?.addEventListener('click', function() {
+      window.close();
+      setTimeout(function() {
+        window.focus();
+      }, 60);
+    });`;
     const detailBlock = page.detail
         ? `<div class="detail-card">
         <span class="section-title">错误详情</span>
@@ -326,7 +344,7 @@ function buildCallbackPage(page) {
       </div>
 
       <div class="actions">
-        <button class="btn btn-primary" type="button" id="focus-button">切回终端继续</button>
+        ${primaryAction}
         <button class="btn btn-secondary" type="button" id="close-button">${escapeHtml(page.closeLabel ?? "关闭当前页面")}</button>
       </div>
       <div class="helper-note">${escapeHtml(page.helperText ?? "如果浏览器无法自动关闭，请手动切回终端继续。")}</div>
@@ -334,18 +352,11 @@ function buildCallbackPage(page) {
   </div>
   <script>
     const closeButton = document.getElementById('close-button');
-    const focusButton = document.getElementById('focus-button');
 
     closeButton?.addEventListener('click', function() {
       window.close();
     });
-
-    focusButton?.addEventListener('click', function() {
-      window.close();
-      setTimeout(function() {
-        window.focus();
-      }, 60);
-    });
+${focusScript}
   </script>
 </body>
 </html>`;

package/dist/proxy.d.ts

@@ -0,0 +1,59 @@
+export interface RemoteToolDescriptor {
+    name: string;
+    description?: string;
+    inputSchema: Record<string, unknown>;
+}
+export type RemoteToolErrorType = "oauth_invalid" | "shop_auth_invalid" | "rate_limited" | "quota_exhausted" | "invalid_input" | "permission_denied" | "upstream_error";
+export type RemoteToolEnvelope = {
+    ok: true;
+    data: unknown;
+} | {
+    ok: false;
+    error_type: RemoteToolErrorType;
+    user_message: string;
+    retryable: boolean;
+    upstream?: unknown;
+};
+export interface RemoteToolCallResult {
+    rawText: string;
+    envelope: RemoteToolEnvelope | null;
+}
+export interface RemoteClientLike {
+    connect(): Promise<void>;
+    listTools(): Promise<{
+        tools: RemoteToolDescriptor[];
+    }>;
+    callTool(request: {
+        name: string;
+        arguments: Record<string, unknown>;
+    }): Promise<{
+        content: unknown;
+    }>;
+    close(): Promise<void>;
+}
+export type RemoteClientFactory = (endpoint: URL, token: string | undefined, serverVersion: string) => RemoteClientLike;
+/** Parse the public QueryData/error envelope without interpreting business data. */
+export declare function parseRemoteToolEnvelope(text: string): RemoteToolEnvelope | null;
+/** Extract text blocks in remote order; non-text blocks are left untouched. */
+export declare function extractRemoteTextContent(content: unknown): string[];
+/** Build the same raw text and envelope the proxy returns to the MCP client. */
+export declare function buildRemoteToolCallResult(content: unknown): RemoteToolCallResult;
+/**
+ * Merge local tools with the remote list without filtering, renaming or
+ * rewriting schemas. Remote order is preserved after the two local tools.
+ */
+export declare function mergeRemoteTools(localTools: readonly RemoteToolDescriptor[], remoteTools: readonly RemoteToolDescriptor[]): RemoteToolDescriptor[];
+/** Default SDK-backed client factory. Tests inject a fake factory instead. */
+export declare function createSdkRemoteClient(endpoint: URL, token: string | undefined, serverVersion: string): RemoteClientLike;
+/**
+ * One short-lived remote client per list/call, matching the existing proxy
+ * lifecycle. The factory seam is the only test-specific difference.
+ */
+export declare class RemoteToolProxy {
+    private readonly endpoint;
+    private readonly serverVersion;
+    private readonly factory;
+    constructor(endpoint: URL, serverVersion: string, factory?: RemoteClientFactory);
+    listTools(token?: string): Promise<RemoteToolDescriptor[]>;
+    callTool(name: string, args: Record<string, unknown>, token: string): Promise<RemoteToolCallResult>;
+}

package/dist/proxy.js

@@ -0,0 +1,155 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RemoteToolProxy = void 0;
+exports.parseRemoteToolEnvelope = parseRemoteToolEnvelope;
+exports.extractRemoteTextContent = extractRemoteTextContent;
+exports.buildRemoteToolCallResult = buildRemoteToolCallResult;
+exports.mergeRemoteTools = mergeRemoteTools;
+exports.createSdkRemoteClient = createSdkRemoteClient;
+/**
+ * mcp-server remote-tool proxy.
+ *
+ * The local MCP server is intentionally a transparent proxy: it discovers every
+ * tool from the remote /mcp endpoint and forwards calls without a local
+ * allowlist. This module keeps that behavior testable without starting stdio,
+ * connecting to the network, or touching OAuth state.
+ */
+const index_js_1 = require("@modelcontextprotocol/sdk/client/index.js");
+const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/client/streamableHttp.js");
+function isRemoteToolErrorType(value) {
+    return value === "oauth_invalid"
+        || value === "shop_auth_invalid"
+        || value === "rate_limited"
+        || value === "quota_exhausted"
+        || value === "invalid_input"
+        || value === "permission_denied"
+        || value === "upstream_error";
+}
+/** Parse the public QueryData/error envelope without interpreting business data. */
+function parseRemoteToolEnvelope(text) {
+    try {
+        const parsed = JSON.parse(text);
+        if (parsed.ok === true && Object.prototype.hasOwnProperty.call(parsed, "data")) {
+            return { ok: true, data: parsed.data };
+        }
+        if (parsed.ok === false
+            && isRemoteToolErrorType(parsed.error_type)
+            && typeof parsed.user_message === "string"
+            && typeof parsed.retryable === "boolean") {
+            return {
+                ok: false,
+                error_type: parsed.error_type,
+                user_message: parsed.user_message,
+                retryable: parsed.retryable,
+                ...(Object.prototype.hasOwnProperty.call(parsed, "upstream") ? { upstream: parsed.upstream } : {}),
+            };
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Extract text blocks in remote order; non-text blocks are left untouched. */
+function extractRemoteTextContent(content) {
+    if (!Array.isArray(content))
+        return [];
+    return content.flatMap((item) => {
+        if (item
+            && typeof item === "object"
+            && item.type === "text"
+            && typeof item.text === "string") {
+            return [item.text];
+        }
+        return [];
+    });
+}
+/** Build the same raw text and envelope the proxy returns to the MCP client. */
+function buildRemoteToolCallResult(content) {
+    const textBlocks = extractRemoteTextContent(content);
+    const rawText = textBlocks.length > 0
+        ? textBlocks.join("\n\n")
+        : JSON.stringify(content, null, 2);
+    const envelope = textBlocks
+        .map((text) => parseRemoteToolEnvelope(text))
+        .find((candidate) => candidate !== null)
+        ?? parseRemoteToolEnvelope(rawText);
+    return { rawText, envelope };
+}
+function toDescriptor(tool) {
+    return {
+        name: tool.name,
+        ...(tool.description !== undefined ? { description: tool.description } : {}),
+        inputSchema: tool.inputSchema,
+    };
+}
+/**
+ * Merge local tools with the remote list without filtering, renaming or
+ * rewriting schemas. Remote order is preserved after the two local tools.
+ */
+function mergeRemoteTools(localTools, remoteTools) {
+    return [
+        ...localTools.map((tool) => ({ ...tool })),
+        ...remoteTools.map((tool) => ({ ...tool })),
+    ];
+}
+/** Default SDK-backed client factory. Tests inject a fake factory instead. */
+function createSdkRemoteClient(endpoint, token, serverVersion) {
+    const transport = new streamableHttp_js_1.StreamableHTTPClientTransport(endpoint, {
+        requestInit: token ? { headers: { Authorization: `Bearer ${token}` } } : undefined,
+    });
+    const client = new index_js_1.Client({ name: "scorehub-mcp", version: serverVersion }, { capabilities: {} });
+    return {
+        connect: () => client.connect(transport),
+        listTools: async () => {
+            const result = await client.listTools();
+            return { tools: result.tools.map(toDescriptor) };
+        },
+        callTool: async (request) => {
+            const result = await client.callTool(request);
+            return { content: "content" in result ? result.content : result };
+        },
+        close: () => client.close(),
+    };
+}
+/**
+ * One short-lived remote client per list/call, matching the existing proxy
+ * lifecycle. The factory seam is the only test-specific difference.
+ */
+class RemoteToolProxy {
+    endpoint;
+    serverVersion;
+    factory;
+    constructor(endpoint, serverVersion, factory = createSdkRemoteClient) {
+        this.endpoint = endpoint;
+        this.serverVersion = serverVersion;
+        this.factory = factory;
+    }
+    async listTools(token) {
+        const client = this.factory(this.endpoint, token, this.serverVersion);
+        try {
+            await client.connect();
+            const result = await client.listTools();
+            return result.tools.map((tool) => ({
+                name: tool.name,
+                ...(tool.description !== undefined ? { description: tool.description } : {}),
+                inputSchema: tool.inputSchema,
+            }));
+        }
+        finally {
+            await client.close();
+        }
+    }
+    async callTool(name, args, token) {
+        const client = this.factory(this.endpoint, token, this.serverVersion);
+        try {
+            await client.connect();
+            const result = await client.callTool({ name, arguments: args });
+            return buildRemoteToolCallResult(result.content);
+        }
+        finally {
+            await client.close();
+        }
+    }
+}
+exports.RemoteToolProxy = RemoteToolProxy;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scorehub/mcp-server",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "ScoreHub local MCP proxy — OAuth login, token caching, and tool forwarding to remote MCP endpoint",
   "engines": {
     "node": ">=18"