@scorehub/mcp-server 0.4.1 → 0.4.2

package/dist/index.js

@@ -14,11 +14,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const index_js_1 = require("@modelcontextprotocol/sdk/server/index.js");
 const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");
 const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
-const index_js_2 = require("@modelcontextprotocol/sdk/client/index.js");
-const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/client/streamableHttp.js");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const self_check_js_1 = require("./self-check.js");
+const proxy_js_1 = require("./proxy.js");
 function readPackageMetadata() {
     return JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(__dirname, "../package.json"), "utf-8"));
 }
@@ -51,68 +50,11 @@ const TOKEN_STORE_KEY = endpointTokenKey(SCOREHUB_BASE_URL);
 const CLIENT_ID = "scorehub-mcp";
 // Proactively refresh token every 4 hours to prevent expiry during long sessions
 const TOKEN_KEEPALIVE_INTERVAL = 4 * 60 * 60 * 1000;
-function isRemoteToolErrorType(value) {
-    return value === "oauth_invalid"
-        || value === "shop_auth_invalid"
-        || value === "rate_limited"
-        || value === "quota_exhausted"
-        || value === "invalid_input"
-        || value === "permission_denied"
-        || value === "upstream_error";
-}
-function parseRemoteToolEnvelope(text) {
-    try {
-        const parsed = JSON.parse(text);
-        if (parsed.ok === true && Object.prototype.hasOwnProperty.call(parsed, "data")) {
-            return { ok: true, data: parsed.data };
-        }
-        if (parsed.ok === false
-            && isRemoteToolErrorType(parsed.error_type)
-            && typeof parsed.user_message === "string"
-            && typeof parsed.retryable === "boolean") {
-            return {
-                ok: false,
-                error_type: parsed.error_type,
-                user_message: parsed.user_message,
-                retryable: parsed.retryable,
-                ...(Object.prototype.hasOwnProperty.call(parsed, "upstream") ? { upstream: parsed.upstream } : {}),
-            };
-        }
-        return null;
-    }
-    catch {
-        return null;
-    }
-}
-function extractRemoteTextContent(content) {
-    if (!Array.isArray(content)) {
-        return [];
-    }
-    return content.flatMap((item) => {
-        if (item
-            && typeof item === "object"
-            && item.type === "text"
-            && typeof item.text === "string") {
-            return [item.text];
-        }
-        return [];
-    });
-}
 // ── Remote Tool Proxy (MCP Streamable HTTP) ─────────────────
+const remoteProxy = new proxy_js_1.RemoteToolProxy(new URL(REMOTE_MCP_URL), SERVER_VERSION);
 async function fetchRemoteTools(token) {
     try {
-        const transport = new streamableHttp_js_1.StreamableHTTPClientTransport(new URL(REMOTE_MCP_URL), {
-            requestInit: token ? { headers: { Authorization: `Bearer ${token}` } } : undefined,
-        });
-        const client = new index_js_2.Client({ name: "scorehub-mcp", version: SERVER_VERSION }, { capabilities: {} });
-        try {
-            await client.connect(transport);
-            const result = await client.listTools();
-            return result.tools;
-        }
-        finally {
-            await client.close();
-        }
+        return await remoteProxy.listTools(token);
     }
     catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
@@ -121,27 +63,8 @@ async function fetchRemoteTools(token) {
         return [];
     }
 }
-async function callRemoteTool(name, args, token) {
-    const transport = new streamableHttp_js_1.StreamableHTTPClientTransport(new URL(REMOTE_MCP_URL), {
-        requestInit: { headers: { Authorization: `Bearer ${token}` } },
-    });
-    const client = new index_js_2.Client({ name: "scorehub-mcp", version: SERVER_VERSION }, { capabilities: {} });
-    try {
-        await client.connect(transport);
-        const result = await client.callTool({ name, arguments: args });
-        const textBlocks = extractRemoteTextContent(result.content);
-        const rawText = textBlocks.length > 0
-            ? textBlocks.join("\n\n")
-            : JSON.stringify(result.content, null, 2);
-        const envelope = textBlocks
-            .map((text) => parseRemoteToolEnvelope(text))
-            .find((candidate) => candidate !== null)
-            ?? parseRemoteToolEnvelope(rawText);
-        return { rawText, envelope };
-    }
-    finally {
-        await client.close();
-    }
+function callRemoteTool(name, args, token) {
+    return remoteProxy.callTool(name, args, token);
 }
 async function startShopSwitch(accessToken, request) {
     const response = await fetch(SHOP_SWITCH_ENDPOINT, {
@@ -182,7 +105,7 @@ server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => {
         }
     }
     catch { /* keep stale tools and lastError */ }
-    const tools = [
+    const localTools = [
         {
             name: "authorize",
             description: "检查 ScoreHub OAuth 授权。force=true 重新登录以切换账号；switch_shop=true 打开当前账号的店铺选择页，无需重新登录。",
@@ -210,13 +133,8 @@ server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => {
                 required: [],
             },
         },
-        ...remoteTools.map((t) => ({
-            name: t.name,
-            description: t.description,
-            inputSchema: t.inputSchema,
-        })),
     ];
-    return { tools };
+    return { tools: (0, proxy_js_1.mergeRemoteTools)(localTools, remoteTools) };
 });
 server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
     const { name, arguments: args = {} } = request.params;

package/dist/proxy.d.ts

@@ -0,0 +1,59 @@
+export interface RemoteToolDescriptor {
+    name: string;
+    description?: string;
+    inputSchema: Record<string, unknown>;
+}
+export type RemoteToolErrorType = "oauth_invalid" | "shop_auth_invalid" | "rate_limited" | "quota_exhausted" | "invalid_input" | "permission_denied" | "upstream_error";
+export type RemoteToolEnvelope = {
+    ok: true;
+    data: unknown;
+} | {
+    ok: false;
+    error_type: RemoteToolErrorType;
+    user_message: string;
+    retryable: boolean;
+    upstream?: unknown;
+};
+export interface RemoteToolCallResult {
+    rawText: string;
+    envelope: RemoteToolEnvelope | null;
+}
+export interface RemoteClientLike {
+    connect(): Promise<void>;
+    listTools(): Promise<{
+        tools: RemoteToolDescriptor[];
+    }>;
+    callTool(request: {
+        name: string;
+        arguments: Record<string, unknown>;
+    }): Promise<{
+        content: unknown;
+    }>;
+    close(): Promise<void>;
+}
+export type RemoteClientFactory = (endpoint: URL, token: string | undefined, serverVersion: string) => RemoteClientLike;
+/** Parse the public QueryData/error envelope without interpreting business data. */
+export declare function parseRemoteToolEnvelope(text: string): RemoteToolEnvelope | null;
+/** Extract text blocks in remote order; non-text blocks are left untouched. */
+export declare function extractRemoteTextContent(content: unknown): string[];
+/** Build the same raw text and envelope the proxy returns to the MCP client. */
+export declare function buildRemoteToolCallResult(content: unknown): RemoteToolCallResult;
+/**
+ * Merge local tools with the remote list without filtering, renaming or
+ * rewriting schemas. Remote order is preserved after the two local tools.
+ */
+export declare function mergeRemoteTools(localTools: readonly RemoteToolDescriptor[], remoteTools: readonly RemoteToolDescriptor[]): RemoteToolDescriptor[];
+/** Default SDK-backed client factory. Tests inject a fake factory instead. */
+export declare function createSdkRemoteClient(endpoint: URL, token: string | undefined, serverVersion: string): RemoteClientLike;
+/**
+ * One short-lived remote client per list/call, matching the existing proxy
+ * lifecycle. The factory seam is the only test-specific difference.
+ */
+export declare class RemoteToolProxy {
+    private readonly endpoint;
+    private readonly serverVersion;
+    private readonly factory;
+    constructor(endpoint: URL, serverVersion: string, factory?: RemoteClientFactory);
+    listTools(token?: string): Promise<RemoteToolDescriptor[]>;
+    callTool(name: string, args: Record<string, unknown>, token: string): Promise<RemoteToolCallResult>;
+}

package/dist/proxy.js

@@ -0,0 +1,155 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RemoteToolProxy = void 0;
+exports.parseRemoteToolEnvelope = parseRemoteToolEnvelope;
+exports.extractRemoteTextContent = extractRemoteTextContent;
+exports.buildRemoteToolCallResult = buildRemoteToolCallResult;
+exports.mergeRemoteTools = mergeRemoteTools;
+exports.createSdkRemoteClient = createSdkRemoteClient;
+/**
+ * mcp-server remote-tool proxy.
+ *
+ * The local MCP server is intentionally a transparent proxy: it discovers every
+ * tool from the remote /mcp endpoint and forwards calls without a local
+ * allowlist. This module keeps that behavior testable without starting stdio,
+ * connecting to the network, or touching OAuth state.
+ */
+const index_js_1 = require("@modelcontextprotocol/sdk/client/index.js");
+const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/client/streamableHttp.js");
+function isRemoteToolErrorType(value) {
+    return value === "oauth_invalid"
+        || value === "shop_auth_invalid"
+        || value === "rate_limited"
+        || value === "quota_exhausted"
+        || value === "invalid_input"
+        || value === "permission_denied"
+        || value === "upstream_error";
+}
+/** Parse the public QueryData/error envelope without interpreting business data. */
+function parseRemoteToolEnvelope(text) {
+    try {
+        const parsed = JSON.parse(text);
+        if (parsed.ok === true && Object.prototype.hasOwnProperty.call(parsed, "data")) {
+            return { ok: true, data: parsed.data };
+        }
+        if (parsed.ok === false
+            && isRemoteToolErrorType(parsed.error_type)
+            && typeof parsed.user_message === "string"
+            && typeof parsed.retryable === "boolean") {
+            return {
+                ok: false,
+                error_type: parsed.error_type,
+                user_message: parsed.user_message,
+                retryable: parsed.retryable,
+                ...(Object.prototype.hasOwnProperty.call(parsed, "upstream") ? { upstream: parsed.upstream } : {}),
+            };
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Extract text blocks in remote order; non-text blocks are left untouched. */
+function extractRemoteTextContent(content) {
+    if (!Array.isArray(content))
+        return [];
+    return content.flatMap((item) => {
+        if (item
+            && typeof item === "object"
+            && item.type === "text"
+            && typeof item.text === "string") {
+            return [item.text];
+        }
+        return [];
+    });
+}
+/** Build the same raw text and envelope the proxy returns to the MCP client. */
+function buildRemoteToolCallResult(content) {
+    const textBlocks = extractRemoteTextContent(content);
+    const rawText = textBlocks.length > 0
+        ? textBlocks.join("\n\n")
+        : JSON.stringify(content, null, 2);
+    const envelope = textBlocks
+        .map((text) => parseRemoteToolEnvelope(text))
+        .find((candidate) => candidate !== null)
+        ?? parseRemoteToolEnvelope(rawText);
+    return { rawText, envelope };
+}
+function toDescriptor(tool) {
+    return {
+        name: tool.name,
+        ...(tool.description !== undefined ? { description: tool.description } : {}),
+        inputSchema: tool.inputSchema,
+    };
+}
+/**
+ * Merge local tools with the remote list without filtering, renaming or
+ * rewriting schemas. Remote order is preserved after the two local tools.
+ */
+function mergeRemoteTools(localTools, remoteTools) {
+    return [
+        ...localTools.map((tool) => ({ ...tool })),
+        ...remoteTools.map((tool) => ({ ...tool })),
+    ];
+}
+/** Default SDK-backed client factory. Tests inject a fake factory instead. */
+function createSdkRemoteClient(endpoint, token, serverVersion) {
+    const transport = new streamableHttp_js_1.StreamableHTTPClientTransport(endpoint, {
+        requestInit: token ? { headers: { Authorization: `Bearer ${token}` } } : undefined,
+    });
+    const client = new index_js_1.Client({ name: "scorehub-mcp", version: serverVersion }, { capabilities: {} });
+    return {
+        connect: () => client.connect(transport),
+        listTools: async () => {
+            const result = await client.listTools();
+            return { tools: result.tools.map(toDescriptor) };
+        },
+        callTool: async (request) => {
+            const result = await client.callTool(request);
+            return { content: "content" in result ? result.content : result };
+        },
+        close: () => client.close(),
+    };
+}
+/**
+ * One short-lived remote client per list/call, matching the existing proxy
+ * lifecycle. The factory seam is the only test-specific difference.
+ */
+class RemoteToolProxy {
+    endpoint;
+    serverVersion;
+    factory;
+    constructor(endpoint, serverVersion, factory = createSdkRemoteClient) {
+        this.endpoint = endpoint;
+        this.serverVersion = serverVersion;
+        this.factory = factory;
+    }
+    async listTools(token) {
+        const client = this.factory(this.endpoint, token, this.serverVersion);
+        try {
+            await client.connect();
+            const result = await client.listTools();
+            return result.tools.map((tool) => ({
+                name: tool.name,
+                ...(tool.description !== undefined ? { description: tool.description } : {}),
+                inputSchema: tool.inputSchema,
+            }));
+        }
+        finally {
+            await client.close();
+        }
+    }
+    async callTool(name, args, token) {
+        const client = this.factory(this.endpoint, token, this.serverVersion);
+        try {
+            await client.connect();
+            const result = await client.callTool({ name, arguments: args });
+            return buildRemoteToolCallResult(result.content);
+        }
+        finally {
+            await client.close();
+        }
+    }
+}
+exports.RemoteToolProxy = RemoteToolProxy;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scorehub/mcp-server",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "ScoreHub local MCP proxy — OAuth login, token caching, and tool forwarding to remote MCP endpoint",
   "engines": {
     "node": ">=18"