@scorehub/mcp-server 0.4.1 → 0.4.4

package/dist/auth.d.ts

@@ -43,6 +43,11 @@ export interface AuthorizeParams {
     callbackPath?: string;
     preserveExistingTokensOnFailure?: boolean;
     authorizationUrlFactory?: (request: AuthorizationRequest) => Promise<string>;
+    /**
+     * CLI 前置认证（preAuth: "cli"）模式：把授权 URL 交给调用方打开浏览器，
+     * 本进程只保留本地回环回调监听。未传时保持原有自动开浏览器行为。
+     */
+    onAuthorizationUrl?: (url: string) => void;
 }
 export interface AuthorizationRequest {
     clientId: string;

package/dist/auth.js

@@ -285,7 +285,7 @@ function openBrowser(url) {
 }
 // ── Full OAuth Flow ──────────────────────────────────────────
 async function authorize(params) {
-    const { authEndpoint, tokenEndpoint, clientId, redirectUri, scope, timeoutMs = 120_000, host, preserveExistingTokensOnFailure = false, authorizationUrlFactory, } = params;
+    const { authEndpoint, tokenEndpoint, clientId, redirectUri, scope, timeoutMs = 120_000, host, preserveExistingTokensOnFailure = false, authorizationUrlFactory, onAuthorizationUrl, } = params;
     const redirectUrl = redirectUri ? new URL(redirectUri) : null;
     const callbackHost = params.callbackHost ?? redirectUrl?.hostname ?? DEFAULT_CALLBACK_HOST;
     const callbackPath = normalizeCallbackPath(params.callbackPath ?? redirectUrl?.pathname ?? DEFAULT_CALLBACK_PATH);
@@ -485,8 +485,13 @@ async function authorize(params) {
                             authUrl.searchParams.set("scope", scope);
                         authorizationUrl = authUrl.toString();
                     }
-                    console.error(`[scorehub] Opening authorization URL: ${authorizationUrl}`);
-                    openBrowser(authorizationUrl);
+                    if (onAuthorizationUrl) {
+                        onAuthorizationUrl(authorizationUrl);
+                    }
+                    else {
+                        console.error(`[scorehub] Opening authorization URL: ${authorizationUrl}`);
+                        openBrowser(authorizationUrl);
+                    }
                     timeoutId = setTimeout(() => {
                         if (settled)
                             return;

package/dist/cli.d.ts

@@ -0,0 +1,32 @@
+/**
+ * CLI authentication commands used by connector/cli.json (preAuth: "cli").
+ *
+ * WorkBuddy runs these before starting the stdio MCP server. The authorization
+ * URL is printed to stdout for WorkBuddy to open the browser; this process keeps
+ * the 127.0.0.1 callback listener alive until the flow completes.
+ *
+ * See packages/mcp-server/docs/PREAUTH_CLI.md for the full contract.
+ */
+import { type AuthorizeParams, type AuthorizeResult, type TokenStore } from "./auth.js";
+export interface TokenStorage {
+    load(host: string): TokenStore | null;
+    clear(host: string): void;
+}
+export interface CliContext {
+    tokenStoreKey: string;
+    tokenEndpoint: string;
+    authorizeUrl: string;
+    clientId: string;
+    /** Injectable so tests never touch the real ~/.scorehub token file. */
+    storage?: TokenStorage;
+    authorizeFn?: (params: AuthorizeParams) => Promise<AuthorizeResult>;
+}
+export interface CliIO {
+    stdout(text: string): void;
+    stderr(text: string): void;
+}
+/** Only these argv forms are CLI commands; everything else keeps the MCP server behaviour. */
+export declare function isCliInvocation(args: string[]): boolean;
+/** Pure, side-effect-free authorization check for the status command. */
+export declare function isAuthorized(tokens: TokenStore | null, now?: number): boolean;
+export declare function runCli(args: string[], ctx: CliContext, io?: CliIO): Promise<number>;

package/dist/cli.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isCliInvocation = isCliInvocation;
+exports.isAuthorized = isAuthorized;
+exports.runCli = runCli;
+/**
+ * CLI authentication commands used by connector/cli.json (preAuth: "cli").
+ *
+ * WorkBuddy runs these before starting the stdio MCP server. The authorization
+ * URL is printed to stdout for WorkBuddy to open the browser; this process keeps
+ * the 127.0.0.1 callback listener alive until the flow completes.
+ *
+ * See packages/mcp-server/docs/PREAUTH_CLI.md for the full contract.
+ */
+const auth_js_1 = require("./auth.js");
+/** Matches authWaitForExit: WorkBuddy waits up to 5 minutes for the CLI to exit. */
+const AUTH_TIMEOUT_MS = 300_000;
+/** Treat a token expiring within a minute as unauthenticated. */
+const EXPIRY_SKEW_MS = 60_000;
+const defaultStorage = { load: auth_js_1.loadTokens, clear: auth_js_1.clearTokens };
+const defaultIO = {
+    stdout: (text) => { process.stdout.write(text); },
+    stderr: (text) => { process.stderr.write(text); },
+};
+const USAGE = `ScoreHub MCP Server - CLI authentication commands
+
+Usage:
+  scorehub-mcp auth login            Start browser authorization (prints URL, waits for callback)
+  scorehub-mcp auth status           Check persisted authorization (exit 0 = logged in)
+  scorehub-mcp auth status --json    Machine-readable status
+  scorehub-mcp auth logout           Clear persisted authorization
+  scorehub-mcp --help                Show this help
+
+With no recognized command the process starts the stdio MCP server as usual.
+`;
+/** Only these argv forms are CLI commands; everything else keeps the MCP server behaviour. */
+function isCliInvocation(args) {
+    const first = args[0];
+    return first === "auth" || first === "--help" || first === "-h";
+}
+/** Pure, side-effect-free authorization check for the status command. */
+function isAuthorized(tokens, now = Date.now()) {
+    if (!tokens || !tokens.access_token)
+        return false;
+    return typeof tokens.expires_at === "number" && tokens.expires_at > now + EXPIRY_SKEW_MS;
+}
+async function runCli(args, ctx, io = defaultIO) {
+    const [group, sub, ...rest] = args;
+    if (group === "--help" || group === "-h" || sub === "--help" || sub === "-h") {
+        io.stdout(USAGE);
+        return 0;
+    }
+    const storage = ctx.storage ?? defaultStorage;
+    switch (sub) {
+        case "login": {
+            const authorizeFn = ctx.authorizeFn ?? auth_js_1.authorize;
+            try {
+                const result = await authorizeFn({
+                    authEndpoint: ctx.authorizeUrl,
+                    tokenEndpoint: ctx.tokenEndpoint,
+                    clientId: ctx.clientId,
+                    host: ctx.tokenStoreKey,
+                    port: 0,
+                    timeoutMs: AUTH_TIMEOUT_MS,
+                    // WorkBuddy extracts this URL from stdout and opens the browser itself.
+                    // Must be a bare URL line: no quotes, no angle brackets, whitespace-delimited.
+                    onAuthorizationUrl: (url) => { io.stdout(`${url}\n`); },
+                });
+                io.stderr(`[scorehub] Authorization complete\n${(0, auth_js_1.formatAuthorizationDetails)(result.account, result.selectedShop)}\n`);
+                return 0;
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                io.stderr(`[scorehub] Authorization failed: ${message}\n`);
+                return 1;
+            }
+        }
+        case "status": {
+            // Deliberately read-only: never call getValidAccessToken (it refreshes tokens).
+            const tokens = storage.load(ctx.tokenStoreKey);
+            const ok = isAuthorized(tokens);
+            if (rest.includes("--json")) {
+                io.stdout(`${JSON.stringify({
+                    authenticated: ok,
+                    account: tokens?.account?.phone ?? null,
+                    shop: tokens?.selected_shop?.name ?? null,
+                    expires_at: tokens?.expires_at ?? null,
+                })}\n`);
+            }
+            else if (ok && tokens) {
+                io.stdout(`Logged in as ${tokens.account?.phone ?? "ScoreHub account"} ` +
+                    `(shop: ${tokens.selected_shop?.name ?? "unknown"})\n`);
+            }
+            else {
+                io.stdout("Not logged in\n");
+            }
+            return ok ? 0 : 1;
+        }
+        case "logout": {
+            storage.clear(ctx.tokenStoreKey);
+            io.stdout("Logged out\n");
+            return 0;
+        }
+        default: {
+            io.stderr(`[scorehub] Unknown auth command: ${sub ?? "(none)"}\n`);
+            io.stdout(USAGE);
+            return 1;
+        }
+    }
+}

package/dist/index.js

@@ -14,11 +14,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const index_js_1 = require("@modelcontextprotocol/sdk/server/index.js");
 const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");
 const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
-const index_js_2 = require("@modelcontextprotocol/sdk/client/index.js");
-const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/client/streamableHttp.js");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const self_check_js_1 = require("./self-check.js");
+const proxy_js_1 = require("./proxy.js");
 function readPackageMetadata() {
     return JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(__dirname, "../package.json"), "utf-8"));
 }
@@ -47,72 +46,16 @@ function endpointTokenKey(baseUrl) {
 // ── Auth State ──────────────────────────────────────────────
 const auth_js_1 = require("./auth.js");
 const status_js_1 = require("./status.js");
+const cli_js_1 = require("./cli.js");
 const TOKEN_STORE_KEY = endpointTokenKey(SCOREHUB_BASE_URL);
 const CLIENT_ID = "scorehub-mcp";
 // Proactively refresh token every 4 hours to prevent expiry during long sessions
 const TOKEN_KEEPALIVE_INTERVAL = 4 * 60 * 60 * 1000;
-function isRemoteToolErrorType(value) {
-    return value === "oauth_invalid"
-        || value === "shop_auth_invalid"
-        || value === "rate_limited"
-        || value === "quota_exhausted"
-        || value === "invalid_input"
-        || value === "permission_denied"
-        || value === "upstream_error";
-}
-function parseRemoteToolEnvelope(text) {
-    try {
-        const parsed = JSON.parse(text);
-        if (parsed.ok === true && Object.prototype.hasOwnProperty.call(parsed, "data")) {
-            return { ok: true, data: parsed.data };
-        }
-        if (parsed.ok === false
-            && isRemoteToolErrorType(parsed.error_type)
-            && typeof parsed.user_message === "string"
-            && typeof parsed.retryable === "boolean") {
-            return {
-                ok: false,
-                error_type: parsed.error_type,
-                user_message: parsed.user_message,
-                retryable: parsed.retryable,
-                ...(Object.prototype.hasOwnProperty.call(parsed, "upstream") ? { upstream: parsed.upstream } : {}),
-            };
-        }
-        return null;
-    }
-    catch {
-        return null;
-    }
-}
-function extractRemoteTextContent(content) {
-    if (!Array.isArray(content)) {
-        return [];
-    }
-    return content.flatMap((item) => {
-        if (item
-            && typeof item === "object"
-            && item.type === "text"
-            && typeof item.text === "string") {
-            return [item.text];
-        }
-        return [];
-    });
-}
 // ── Remote Tool Proxy (MCP Streamable HTTP) ─────────────────
+const remoteProxy = new proxy_js_1.RemoteToolProxy(new URL(REMOTE_MCP_URL), SERVER_VERSION);
 async function fetchRemoteTools(token) {
     try {
-        const transport = new streamableHttp_js_1.StreamableHTTPClientTransport(new URL(REMOTE_MCP_URL), {
-            requestInit: token ? { headers: { Authorization: `Bearer ${token}` } } : undefined,
-        });
-        const client = new index_js_2.Client({ name: "scorehub-mcp", version: SERVER_VERSION }, { capabilities: {} });
-        try {
-            await client.connect(transport);
-            const result = await client.listTools();
-            return result.tools;
-        }
-        finally {
-            await client.close();
-        }
+        return await remoteProxy.listTools(token);
     }
     catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
@@ -121,27 +64,8 @@ async function fetchRemoteTools(token) {
         return [];
     }
 }
-async function callRemoteTool(name, args, token) {
-    const transport = new streamableHttp_js_1.StreamableHTTPClientTransport(new URL(REMOTE_MCP_URL), {
-        requestInit: { headers: { Authorization: `Bearer ${token}` } },
-    });
-    const client = new index_js_2.Client({ name: "scorehub-mcp", version: SERVER_VERSION }, { capabilities: {} });
-    try {
-        await client.connect(transport);
-        const result = await client.callTool({ name, arguments: args });
-        const textBlocks = extractRemoteTextContent(result.content);
-        const rawText = textBlocks.length > 0
-            ? textBlocks.join("\n\n")
-            : JSON.stringify(result.content, null, 2);
-        const envelope = textBlocks
-            .map((text) => parseRemoteToolEnvelope(text))
-            .find((candidate) => candidate !== null)
-            ?? parseRemoteToolEnvelope(rawText);
-        return { rawText, envelope };
-    }
-    finally {
-        await client.close();
-    }
+function callRemoteTool(name, args, token) {
+    return remoteProxy.callTool(name, args, token);
 }
 async function startShopSwitch(accessToken, request) {
     const response = await fetch(SHOP_SWITCH_ENDPOINT, {
@@ -182,7 +106,7 @@ server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => {
         }
     }
     catch { /* keep stale tools and lastError */ }
-    const tools = [
+    const localTools = [
         {
             name: "authorize",
             description: "检查 ScoreHub OAuth 授权。force=true 重新登录以切换账号；switch_shop=true 打开当前账号的店铺选择页，无需重新登录。",
@@ -210,13 +134,8 @@ server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => {
                 required: [],
             },
         },
-        ...remoteTools.map((t) => ({
-            name: t.name,
-            description: t.description,
-            inputSchema: t.inputSchema,
-        })),
     ];
-    return { tools };
+    return { tools: (0, proxy_js_1.mergeRemoteTools)(localTools, remoteTools) };
 });
 server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
     const { name, arguments: args = {} } = request.params;
@@ -396,6 +315,17 @@ async function main() {
             process.exitCode = 1;
         return;
     }
+    // CLI 前置认证命令（cli.json 的 auth / status / unAuth）。未命中时仍是原 stdio MCP 服务。
+    const cliArgs = process.argv.slice(2);
+    if ((0, cli_js_1.isCliInvocation)(cliArgs)) {
+        process.exitCode = await (0, cli_js_1.runCli)(cliArgs, {
+            tokenStoreKey: TOKEN_STORE_KEY,
+            tokenEndpoint: TOKEN_ENDPOINT,
+            authorizeUrl: AUTHORIZE_URL,
+            clientId: CLIENT_ID,
+        });
+        return;
+    }
     // Set process title for easy identification in ps/task manager
     process.title = 'scorehub-mcp';
     // Gracefully exit when parent AI agent closes stdin (normal shutdown or crash).

package/dist/proxy.d.ts

@@ -0,0 +1,59 @@
+export interface RemoteToolDescriptor {
+    name: string;
+    description?: string;
+    inputSchema: Record<string, unknown>;
+}
+export type RemoteToolErrorType = "oauth_invalid" | "shop_auth_invalid" | "rate_limited" | "quota_exhausted" | "invalid_input" | "permission_denied" | "upstream_error";
+export type RemoteToolEnvelope = {
+    ok: true;
+    data: unknown;
+} | {
+    ok: false;
+    error_type: RemoteToolErrorType;
+    user_message: string;
+    retryable: boolean;
+    upstream?: unknown;
+};
+export interface RemoteToolCallResult {
+    rawText: string;
+    envelope: RemoteToolEnvelope | null;
+}
+export interface RemoteClientLike {
+    connect(): Promise<void>;
+    listTools(): Promise<{
+        tools: RemoteToolDescriptor[];
+    }>;
+    callTool(request: {
+        name: string;
+        arguments: Record<string, unknown>;
+    }): Promise<{
+        content: unknown;
+    }>;
+    close(): Promise<void>;
+}
+export type RemoteClientFactory = (endpoint: URL, token: string | undefined, serverVersion: string) => RemoteClientLike;
+/** Parse the public QueryData/error envelope without interpreting business data. */
+export declare function parseRemoteToolEnvelope(text: string): RemoteToolEnvelope | null;
+/** Extract text blocks in remote order; non-text blocks are left untouched. */
+export declare function extractRemoteTextContent(content: unknown): string[];
+/** Build the same raw text and envelope the proxy returns to the MCP client. */
+export declare function buildRemoteToolCallResult(content: unknown): RemoteToolCallResult;
+/**
+ * Merge local tools with the remote list without filtering, renaming or
+ * rewriting schemas. Remote order is preserved after the two local tools.
+ */
+export declare function mergeRemoteTools(localTools: readonly RemoteToolDescriptor[], remoteTools: readonly RemoteToolDescriptor[]): RemoteToolDescriptor[];
+/** Default SDK-backed client factory. Tests inject a fake factory instead. */
+export declare function createSdkRemoteClient(endpoint: URL, token: string | undefined, serverVersion: string): RemoteClientLike;
+/**
+ * One short-lived remote client per list/call, matching the existing proxy
+ * lifecycle. The factory seam is the only test-specific difference.
+ */
+export declare class RemoteToolProxy {
+    private readonly endpoint;
+    private readonly serverVersion;
+    private readonly factory;
+    constructor(endpoint: URL, serverVersion: string, factory?: RemoteClientFactory);
+    listTools(token?: string): Promise<RemoteToolDescriptor[]>;
+    callTool(name: string, args: Record<string, unknown>, token: string): Promise<RemoteToolCallResult>;
+}

package/dist/proxy.js

@@ -0,0 +1,155 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RemoteToolProxy = void 0;
+exports.parseRemoteToolEnvelope = parseRemoteToolEnvelope;
+exports.extractRemoteTextContent = extractRemoteTextContent;
+exports.buildRemoteToolCallResult = buildRemoteToolCallResult;
+exports.mergeRemoteTools = mergeRemoteTools;
+exports.createSdkRemoteClient = createSdkRemoteClient;
+/**
+ * mcp-server remote-tool proxy.
+ *
+ * The local MCP server is intentionally a transparent proxy: it discovers every
+ * tool from the remote /mcp endpoint and forwards calls without a local
+ * allowlist. This module keeps that behavior testable without starting stdio,
+ * connecting to the network, or touching OAuth state.
+ */
+const index_js_1 = require("@modelcontextprotocol/sdk/client/index.js");
+const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/client/streamableHttp.js");
+function isRemoteToolErrorType(value) {
+    return value === "oauth_invalid"
+        || value === "shop_auth_invalid"
+        || value === "rate_limited"
+        || value === "quota_exhausted"
+        || value === "invalid_input"
+        || value === "permission_denied"
+        || value === "upstream_error";
+}
+/** Parse the public QueryData/error envelope without interpreting business data. */
+function parseRemoteToolEnvelope(text) {
+    try {
+        const parsed = JSON.parse(text);
+        if (parsed.ok === true && Object.prototype.hasOwnProperty.call(parsed, "data")) {
+            return { ok: true, data: parsed.data };
+        }
+        if (parsed.ok === false
+            && isRemoteToolErrorType(parsed.error_type)
+            && typeof parsed.user_message === "string"
+            && typeof parsed.retryable === "boolean") {
+            return {
+                ok: false,
+                error_type: parsed.error_type,
+                user_message: parsed.user_message,
+                retryable: parsed.retryable,
+                ...(Object.prototype.hasOwnProperty.call(parsed, "upstream") ? { upstream: parsed.upstream } : {}),
+            };
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Extract text blocks in remote order; non-text blocks are left untouched. */
+function extractRemoteTextContent(content) {
+    if (!Array.isArray(content))
+        return [];
+    return content.flatMap((item) => {
+        if (item
+            && typeof item === "object"
+            && item.type === "text"
+            && typeof item.text === "string") {
+            return [item.text];
+        }
+        return [];
+    });
+}
+/** Build the same raw text and envelope the proxy returns to the MCP client. */
+function buildRemoteToolCallResult(content) {
+    const textBlocks = extractRemoteTextContent(content);
+    const rawText = textBlocks.length > 0
+        ? textBlocks.join("\n\n")
+        : JSON.stringify(content, null, 2);
+    const envelope = textBlocks
+        .map((text) => parseRemoteToolEnvelope(text))
+        .find((candidate) => candidate !== null)
+        ?? parseRemoteToolEnvelope(rawText);
+    return { rawText, envelope };
+}
+function toDescriptor(tool) {
+    return {
+        name: tool.name,
+        ...(tool.description !== undefined ? { description: tool.description } : {}),
+        inputSchema: tool.inputSchema,
+    };
+}
+/**
+ * Merge local tools with the remote list without filtering, renaming or
+ * rewriting schemas. Remote order is preserved after the two local tools.
+ */
+function mergeRemoteTools(localTools, remoteTools) {
+    return [
+        ...localTools.map((tool) => ({ ...tool })),
+        ...remoteTools.map((tool) => ({ ...tool })),
+    ];
+}
+/** Default SDK-backed client factory. Tests inject a fake factory instead. */
+function createSdkRemoteClient(endpoint, token, serverVersion) {
+    const transport = new streamableHttp_js_1.StreamableHTTPClientTransport(endpoint, {
+        requestInit: token ? { headers: { Authorization: `Bearer ${token}` } } : undefined,
+    });
+    const client = new index_js_1.Client({ name: "scorehub-mcp", version: serverVersion }, { capabilities: {} });
+    return {
+        connect: () => client.connect(transport),
+        listTools: async () => {
+            const result = await client.listTools();
+            return { tools: result.tools.map(toDescriptor) };
+        },
+        callTool: async (request) => {
+            const result = await client.callTool(request);
+            return { content: "content" in result ? result.content : result };
+        },
+        close: () => client.close(),
+    };
+}
+/**
+ * One short-lived remote client per list/call, matching the existing proxy
+ * lifecycle. The factory seam is the only test-specific difference.
+ */
+class RemoteToolProxy {
+    endpoint;
+    serverVersion;
+    factory;
+    constructor(endpoint, serverVersion, factory = createSdkRemoteClient) {
+        this.endpoint = endpoint;
+        this.serverVersion = serverVersion;
+        this.factory = factory;
+    }
+    async listTools(token) {
+        const client = this.factory(this.endpoint, token, this.serverVersion);
+        try {
+            await client.connect();
+            const result = await client.listTools();
+            return result.tools.map((tool) => ({
+                name: tool.name,
+                ...(tool.description !== undefined ? { description: tool.description } : {}),
+                inputSchema: tool.inputSchema,
+            }));
+        }
+        finally {
+            await client.close();
+        }
+    }
+    async callTool(name, args, token) {
+        const client = this.factory(this.endpoint, token, this.serverVersion);
+        try {
+            await client.connect();
+            const result = await client.callTool({ name, arguments: args });
+            return buildRemoteToolCallResult(result.content);
+        }
+        finally {
+            await client.close();
+        }
+    }
+}
+exports.RemoteToolProxy = RemoteToolProxy;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scorehub/mcp-server",
-  "version": "0.4.1",
+  "version": "0.4.4",
   "description": "ScoreHub local MCP proxy — OAuth login, token caching, and tool forwarding to remote MCP endpoint",
   "engines": {
     "node": ">=18"