@scorehub/mcp-server 0.4.2 → 0.4.4

package/dist/auth.d.ts

@@ -43,6 +43,11 @@ export interface AuthorizeParams {
     callbackPath?: string;
     preserveExistingTokensOnFailure?: boolean;
     authorizationUrlFactory?: (request: AuthorizationRequest) => Promise<string>;
+    /**
+     * CLI 前置认证（preAuth: "cli"）模式：把授权 URL 交给调用方打开浏览器，
+     * 本进程只保留本地回环回调监听。未传时保持原有自动开浏览器行为。
+     */
+    onAuthorizationUrl?: (url: string) => void;
 }
 export interface AuthorizationRequest {
     clientId: string;

package/dist/auth.js

@@ -285,7 +285,7 @@ function openBrowser(url) {
 }
 // ── Full OAuth Flow ──────────────────────────────────────────
 async function authorize(params) {
-    const { authEndpoint, tokenEndpoint, clientId, redirectUri, scope, timeoutMs = 120_000, host, preserveExistingTokensOnFailure = false, authorizationUrlFactory, } = params;
+    const { authEndpoint, tokenEndpoint, clientId, redirectUri, scope, timeoutMs = 120_000, host, preserveExistingTokensOnFailure = false, authorizationUrlFactory, onAuthorizationUrl, } = params;
     const redirectUrl = redirectUri ? new URL(redirectUri) : null;
     const callbackHost = params.callbackHost ?? redirectUrl?.hostname ?? DEFAULT_CALLBACK_HOST;
     const callbackPath = normalizeCallbackPath(params.callbackPath ?? redirectUrl?.pathname ?? DEFAULT_CALLBACK_PATH);
@@ -485,8 +485,13 @@ async function authorize(params) {
                             authUrl.searchParams.set("scope", scope);
                         authorizationUrl = authUrl.toString();
                     }
-                    console.error(`[scorehub] Opening authorization URL: ${authorizationUrl}`);
-                    openBrowser(authorizationUrl);
+                    if (onAuthorizationUrl) {
+                        onAuthorizationUrl(authorizationUrl);
+                    }
+                    else {
+                        console.error(`[scorehub] Opening authorization URL: ${authorizationUrl}`);
+                        openBrowser(authorizationUrl);
+                    }
                     timeoutId = setTimeout(() => {
                         if (settled)
                             return;

package/dist/cli.d.ts

@@ -0,0 +1,32 @@
+/**
+ * CLI authentication commands used by connector/cli.json (preAuth: "cli").
+ *
+ * WorkBuddy runs these before starting the stdio MCP server. The authorization
+ * URL is printed to stdout for WorkBuddy to open the browser; this process keeps
+ * the 127.0.0.1 callback listener alive until the flow completes.
+ *
+ * See packages/mcp-server/docs/PREAUTH_CLI.md for the full contract.
+ */
+import { type AuthorizeParams, type AuthorizeResult, type TokenStore } from "./auth.js";
+export interface TokenStorage {
+    load(host: string): TokenStore | null;
+    clear(host: string): void;
+}
+export interface CliContext {
+    tokenStoreKey: string;
+    tokenEndpoint: string;
+    authorizeUrl: string;
+    clientId: string;
+    /** Injectable so tests never touch the real ~/.scorehub token file. */
+    storage?: TokenStorage;
+    authorizeFn?: (params: AuthorizeParams) => Promise<AuthorizeResult>;
+}
+export interface CliIO {
+    stdout(text: string): void;
+    stderr(text: string): void;
+}
+/** Only these argv forms are CLI commands; everything else keeps the MCP server behaviour. */
+export declare function isCliInvocation(args: string[]): boolean;
+/** Pure, side-effect-free authorization check for the status command. */
+export declare function isAuthorized(tokens: TokenStore | null, now?: number): boolean;
+export declare function runCli(args: string[], ctx: CliContext, io?: CliIO): Promise<number>;

package/dist/cli.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isCliInvocation = isCliInvocation;
+exports.isAuthorized = isAuthorized;
+exports.runCli = runCli;
+/**
+ * CLI authentication commands used by connector/cli.json (preAuth: "cli").
+ *
+ * WorkBuddy runs these before starting the stdio MCP server. The authorization
+ * URL is printed to stdout for WorkBuddy to open the browser; this process keeps
+ * the 127.0.0.1 callback listener alive until the flow completes.
+ *
+ * See packages/mcp-server/docs/PREAUTH_CLI.md for the full contract.
+ */
+const auth_js_1 = require("./auth.js");
+/** Matches authWaitForExit: WorkBuddy waits up to 5 minutes for the CLI to exit. */
+const AUTH_TIMEOUT_MS = 300_000;
+/** Treat a token expiring within a minute as unauthenticated. */
+const EXPIRY_SKEW_MS = 60_000;
+const defaultStorage = { load: auth_js_1.loadTokens, clear: auth_js_1.clearTokens };
+const defaultIO = {
+    stdout: (text) => { process.stdout.write(text); },
+    stderr: (text) => { process.stderr.write(text); },
+};
+const USAGE = `ScoreHub MCP Server - CLI authentication commands
+
+Usage:
+  scorehub-mcp auth login            Start browser authorization (prints URL, waits for callback)
+  scorehub-mcp auth status           Check persisted authorization (exit 0 = logged in)
+  scorehub-mcp auth status --json    Machine-readable status
+  scorehub-mcp auth logout           Clear persisted authorization
+  scorehub-mcp --help                Show this help
+
+With no recognized command the process starts the stdio MCP server as usual.
+`;
+/** Only these argv forms are CLI commands; everything else keeps the MCP server behaviour. */
+function isCliInvocation(args) {
+    const first = args[0];
+    return first === "auth" || first === "--help" || first === "-h";
+}
+/** Pure, side-effect-free authorization check for the status command. */
+function isAuthorized(tokens, now = Date.now()) {
+    if (!tokens || !tokens.access_token)
+        return false;
+    return typeof tokens.expires_at === "number" && tokens.expires_at > now + EXPIRY_SKEW_MS;
+}
+async function runCli(args, ctx, io = defaultIO) {
+    const [group, sub, ...rest] = args;
+    if (group === "--help" || group === "-h" || sub === "--help" || sub === "-h") {
+        io.stdout(USAGE);
+        return 0;
+    }
+    const storage = ctx.storage ?? defaultStorage;
+    switch (sub) {
+        case "login": {
+            const authorizeFn = ctx.authorizeFn ?? auth_js_1.authorize;
+            try {
+                const result = await authorizeFn({
+                    authEndpoint: ctx.authorizeUrl,
+                    tokenEndpoint: ctx.tokenEndpoint,
+                    clientId: ctx.clientId,
+                    host: ctx.tokenStoreKey,
+                    port: 0,
+                    timeoutMs: AUTH_TIMEOUT_MS,
+                    // WorkBuddy extracts this URL from stdout and opens the browser itself.
+                    // Must be a bare URL line: no quotes, no angle brackets, whitespace-delimited.
+                    onAuthorizationUrl: (url) => { io.stdout(`${url}\n`); },
+                });
+                io.stderr(`[scorehub] Authorization complete\n${(0, auth_js_1.formatAuthorizationDetails)(result.account, result.selectedShop)}\n`);
+                return 0;
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                io.stderr(`[scorehub] Authorization failed: ${message}\n`);
+                return 1;
+            }
+        }
+        case "status": {
+            // Deliberately read-only: never call getValidAccessToken (it refreshes tokens).
+            const tokens = storage.load(ctx.tokenStoreKey);
+            const ok = isAuthorized(tokens);
+            if (rest.includes("--json")) {
+                io.stdout(`${JSON.stringify({
+                    authenticated: ok,
+                    account: tokens?.account?.phone ?? null,
+                    shop: tokens?.selected_shop?.name ?? null,
+                    expires_at: tokens?.expires_at ?? null,
+                })}\n`);
+            }
+            else if (ok && tokens) {
+                io.stdout(`Logged in as ${tokens.account?.phone ?? "ScoreHub account"} ` +
+                    `(shop: ${tokens.selected_shop?.name ?? "unknown"})\n`);
+            }
+            else {
+                io.stdout("Not logged in\n");
+            }
+            return ok ? 0 : 1;
+        }
+        case "logout": {
+            storage.clear(ctx.tokenStoreKey);
+            io.stdout("Logged out\n");
+            return 0;
+        }
+        default: {
+            io.stderr(`[scorehub] Unknown auth command: ${sub ?? "(none)"}\n`);
+            io.stdout(USAGE);
+            return 1;
+        }
+    }
+}

package/dist/index.js

@@ -46,6 +46,7 @@ function endpointTokenKey(baseUrl) {
 // ── Auth State ──────────────────────────────────────────────
 const auth_js_1 = require("./auth.js");
 const status_js_1 = require("./status.js");
+const cli_js_1 = require("./cli.js");
 const TOKEN_STORE_KEY = endpointTokenKey(SCOREHUB_BASE_URL);
 const CLIENT_ID = "scorehub-mcp";
 // Proactively refresh token every 4 hours to prevent expiry during long sessions
@@ -314,6 +315,17 @@ async function main() {
             process.exitCode = 1;
         return;
     }
+    // CLI 前置认证命令（cli.json 的 auth / status / unAuth）。未命中时仍是原 stdio MCP 服务。
+    const cliArgs = process.argv.slice(2);
+    if ((0, cli_js_1.isCliInvocation)(cliArgs)) {
+        process.exitCode = await (0, cli_js_1.runCli)(cliArgs, {
+            tokenStoreKey: TOKEN_STORE_KEY,
+            tokenEndpoint: TOKEN_ENDPOINT,
+            authorizeUrl: AUTHORIZE_URL,
+            clientId: CLIENT_ID,
+        });
+        return;
+    }
     // Set process title for easy identification in ps/task manager
     process.title = 'scorehub-mcp';
     // Gracefully exit when parent AI agent closes stdin (normal shutdown or crash).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scorehub/mcp-server",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "ScoreHub local MCP proxy — OAuth login, token caching, and tool forwarding to remote MCP endpoint",
   "engines": {
     "node": ">=18"