@softtechai/quickmcp 1.0.16 → 1.1.0

package/quickmcp-direct-stdio.js

@@ -4,11 +4,63 @@ const path = require('path');
 const fs = require('fs');
 const os = require('os');
 const net = require('net');
+const dotenv = require('dotenv');
+
+// Load .env from script directory first (works with Claude Desktop custom CWD),
+// then fallback to process CWD.
+dotenv.config({ path: path.join(__dirname, '.env') });
+dotenv.config();
+
+let logger;
+try {
+  ({ logger } = require('./dist/utils/logger.js'));
+} catch (_) {
+  logger = {
+    trace: (...args) => console.error(...args),
+    debug: (...args) => console.error(...args),
+    info: (...args) => console.error(...args),
+    warn: (...args) => console.error(...args),
+    error: (...args) => console.error(...args)
+  };
+}
+
+// Secure default for direct-stdio: if caller does not provide auth/deploy mode,
+// enforce ONPREM semantics (AUTH_MODE=LITE) so MCP token checks are active.
+if (!process.env.AUTH_MODE && !process.env.DEPLOY_MODE) {
+  process.env.DEPLOY_MODE = 'ONPREM';
+  logger.error('[QuickMCP] AUTH_MODE/DEPLOY_MODE not provided, defaulting DEPLOY_MODE=ONPREM (AUTH_MODE=LITE)');
+}
 
 // Use the current working directory provided by the caller.
 // Do not change directories; keep paths relative to this script.
 
-const { SQLiteManager } = require('./dist/database/sqlite-manager.js');
+let safeCreateDataStore;
+try {
+  ({ safeCreateDataStore } = require('./dist/database/database-utils.js'));
+} catch (_) {
+  throw new Error('[QuickMCP] Missing dist/database/database-utils.js. Run `npm run build` before starting quickmcp-direct-stdio.js');
+}
+
+let resolveAuthMode;
+try {
+  ({ resolveAuthMode } = require('./dist/config/auth-config.js'));
+} catch (_) {
+  throw new Error('[QuickMCP] Missing dist/config/auth-config.js. Run `npm run build` before starting quickmcp-direct-stdio.js');
+}
+
+let DynamicMCPExecutor;
+try {
+  ({ DynamicMCPExecutor } = require('./dist/server/dynamic-mcp-executor.js'));
+} catch (_) {
+  throw new Error('[QuickMCP] Missing dist/server/dynamic-mcp-executor.js. Run `npm run build` before starting quickmcp-direct-stdio.js');
+}
+
+let McpCoreService;
+try {
+  ({ McpCoreService } = require('./dist/mcp-core/McpCoreService.js'));
+} catch (_) {
+  throw new Error('[QuickMCP] Missing dist/mcp-core/McpCoreService.js. Run `npm run build` before starting quickmcp-direct-stdio.js');
+}
 
 // Parse CLI flags for convenience
 // Supported flags:
@@ -36,14 +88,44 @@ if (dataDirArg) {
   if (val) process.env.QUICKMCP_DATA_DIR = val;
 }
 
-// Create SQLite manager
-const sqliteManager = new SQLiteManager();
+const dataStore = safeCreateDataStore({ logger: (...args) => logger.error(...args) });
+const executor = new DynamicMCPExecutor();
+
+const mcpAuthMode = resolveAuthMode();
+const mcpTokenSecret = process.env.QUICKMCP_TOKEN_SECRET || process.env.AUTH_COOKIE_SECRET || 'change-me';
+const mcpToken = (process.env.QUICKMCP_TOKEN || '').trim();
+let startupAuthError = null;
+let mcpCore;
+try {
+  mcpCore = new McpCoreService({
+    executor,
+    authStore: dataStore,
+    authMode: mcpAuthMode,
+    tokenSecret: mcpTokenSecret,
+    defaultToken: mcpToken
+  });
+} catch (error) {
+  startupAuthError = error && error.message ? String(error.message) : 'Invalid MCP token';
+  mcpCore = new McpCoreService({
+    executor,
+    authStore: dataStore,
+    authMode: mcpAuthMode,
+    tokenSecret: mcpTokenSecret,
+    defaultToken: ''
+  });
+}
+
+logger.error(`[QuickMCP] MCP auth mode: ${mcpAuthMode}`);
+logger.error(`[QuickMCP] MCP token present: ${mcpToken ? 'yes' : 'no'}`);
+if (startupAuthError) {
+  logger.error('[QuickMCP] Provided MCP token is invalid/revoked/expired for current workspace.');
+}
 
 // Optionally start the Web UI (Express) like `npm run dev`
 // Enable by setting QUICKMCP_ENABLE_WEB=1 (and optionally PORT, QUICKMCP_DATA_DIR)
 if (process.env.QUICKMCP_ENABLE_WEB === '1') {
   try {
-    console.error('[QuickMCP] QUICKMCP_ENABLE_WEB=1 -> starting Web UI server...');
+    logger.error('[QuickMCP] QUICKMCP_ENABLE_WEB=1 -> starting Web UI server...');
     // Ensure we run from a writable directory when invoked via npx (CWD may be '/')
     const canWrite = (dir) => {
       try { fs.accessSync(dir, fs.constants.W_OK); return true; } catch { return false; }
@@ -53,7 +135,10 @@ if (process.env.QUICKMCP_ENABLE_WEB === '1') {
       const home = os.homedir() || os.tmpdir();
       runDir = path.join(home, '.quickmcp');
       try { fs.mkdirSync(runDir, { recursive: true }); } catch {}
-      try { process.chdir(runDir); } catch {}
+      // NOTE: Disabled intentionally.
+      // Do not change process CWD here; changing CWD causes SQLite/database path drift
+      // between different launch modes (dev, npx, stdio).
+      // try { process.chdir(runDir); } catch {}
     }
     // Prepare uploads directory and expose as env for newer builds
     const uploadsDir = path.join(runDir, 'uploads');
@@ -74,39 +159,39 @@ if (process.env.QUICKMCP_ENABLE_WEB === '1') {
       process.once('SIGTERM', () => { cleanup(); process.exit(0); });
     } catch (e) {
       if (e && e.code !== 'EEXIST') {
-        console.error('[QuickMCP] UI lock error (continuing without UI):', e.message || e);
+        logger.error('[QuickMCP] UI lock error (continuing without UI):', e.message || e);
       }
       // Another process holds the UI lock; skip starting UI in this process
     }
 
     if (!hasLock) {
-      return; // do not try to start UI
-    }
-
-    // Only start Web UI if preferred port is actually free.
-    const probe = net.createServer();
-    probe.once('error', (err) => {
-      if (err && (err.code === 'EADDRINUSE' || err.code === 'EACCES')) {
-        // Port is busy or not permitted; skip starting Web UI to avoid crashing Claude session
-        try { fs.unlinkSync(lockPath); } catch {}
-        return;
-      }
-      // For other errors, still try starting server; better to attempt than silently skip for unknown cases
-      safeStartWebServer();
-    });
-    probe.once('listening', () => {
-      probe.close(() => {
+      logger.error('[QuickMCP] UI lock held by another process; skipping Web UI in this process');
+    } else {
+      // Only start Web UI if preferred port is actually free.
+      const probe = net.createServer();
+      probe.once('error', (err) => {
+        if (err && (err.code === 'EADDRINUSE' || err.code === 'EACCES')) {
+          // Port is busy or not permitted; skip starting Web UI to avoid crashing Claude session
+          try { fs.unlinkSync(lockPath); } catch {}
+          return;
+        }
+        // For other errors, still try starting server; better to attempt than silently skip for unknown cases
         safeStartWebServer();
       });
-    });
-    try {
-      // Probe on IPv6 unspecified to mirror Express default, falling back to IPv4 if needed
-      probe.listen(preferredPort, '::');
-    } catch (_e) {
-      // If probing throws synchronously (rare), just skip UI
+      probe.once('listening', () => {
+        probe.close(() => {
+          safeStartWebServer();
+        });
+      });
+      try {
+        // Probe on IPv6 unspecified to mirror Express default, falling back to IPv4 if needed
+        probe.listen(preferredPort, '::');
+      } catch (_e) {
+        // If probing throws synchronously (rare), just skip UI
+      }
     }
   } catch (e) {
-    console.error('[QuickMCP] Failed to start Web UI:', e && e.message);
+    logger.error('[QuickMCP] Failed to start Web UI:', e && e.message);
   }
 }
 
@@ -127,11 +212,11 @@ function safeStartWebServer() {
   // Install one-time handler to catch immediate async throw from Express
   process.prependOnceListener('uncaughtException', handler);
   try {
-    require('./dist/web/server.js');
+    require('./dist/server/server.js');
   } catch (e) {
     // Synchronous load error
     process.removeListener('uncaughtException', handler);
-    console.error('[QuickMCP] Failed to start Web UI:', e && e.message);
+    logger.error('[QuickMCP] Failed to start Web UI:', e && e.message);
   }
   // Remove handler on next tick if nothing happened, to avoid swallowing unrelated errors later
   setImmediate(() => {
@@ -143,21 +228,21 @@ function safeStartWebServer() {
 
 // Diagnostics: print environment and mssql details to help debug Claude Desktop
 try {
-  const resolvedDynExec = require.resolve('./dist/dynamic-mcp-executor.js');
+  const resolvedDynExec = require.resolve('./dist/server/dynamic-mcp-executor.js');
   const mssql = require('mssql');
   const mssqlVersion = require('mssql/package.json').version;
-  console.error('[QuickMCP] Node:', process.version);
-  console.error('[QuickMCP] CWD:', process.cwd());
-  console.error('[QuickMCP] Dynamic executor path:', resolvedDynExec);
-  console.error('[QuickMCP] mssql version:', mssqlVersion);
-  console.error('[QuickMCP] mssql exports:', {
+  logger.error('[QuickMCP] Node:', process.version);
+  logger.error('[QuickMCP] CWD:', process.cwd());
+  logger.error('[QuickMCP] Dynamic executor path:', resolvedDynExec);
+  logger.error('[QuickMCP] mssql version:', mssqlVersion);
+  logger.error('[QuickMCP] mssql exports:', {
     hasDefault: !!mssql.default,
     hasConnect: typeof mssql.connect,
     typeofConnectionPool: typeof (mssql.ConnectionPool),
     keys: Object.keys(mssql).slice(0, 10)
   });
 } catch (e) {
-  console.error('[QuickMCP] Diagnostic init error:', e && e.message);
+  logger.error('[QuickMCP] Diagnostic init error:', e && e.message);
 }
 
 // Direct STDIO MCP implementation with LSP-style framing support
@@ -176,150 +261,51 @@ function sendMessage(message) {
       process.stdout.write(json + '\n');
     }
   } catch (e) {
-    console.error('[QuickMCP] Failed to send message:', e && e.message);
+    logger.error('[QuickMCP] Failed to send message:', e && e.message);
   }
 }
 
 async function handleMessage(message) {
-  console.error(`[QuickMCP] Received: ${message.method} (id: ${message.id})`);
-
-  let response;
-
-  switch (message.method) {
-    case 'initialize':
-      response = {
-        jsonrpc: '2.0',
-        id: message.id,
-        result: {
-          protocolVersion: '2024-11-05',
-          serverInfo: { name: 'quickmcp-direct', version: '1.0.0' },
-          capabilities: {
-            tools: { listChanged: true },
-            resources: { listChanged: true },
-            prompts: { listChanged: true }
-          }
-        }
-      };
-      break;
-
-    case 'tools/list':
-      try {
-        const tools = sqliteManager.getAllTools();
-        console.error(`[QuickMCP] Got ${tools.length} tools from SQLite`);
-        const formattedTools = tools.map(tool => ({
-          name: `${tool.server_id}__${tool.name}`,
-          description: `[${tool.server_id}] ${tool.description}`,
-          inputSchema: typeof tool.inputSchema === 'string' ? JSON.parse(tool.inputSchema) : tool.inputSchema
-        }));
-        console.error(`[QuickMCP] Formatted ${formattedTools.length} tools`);
-
-        response = {
-          jsonrpc: '2.0',
-          id: message.id,
-          result: { tools: formattedTools }
-        };
-      } catch (error) {
-        console.error('[QuickMCP] Error getting tools:', error);
-        response = {
-          jsonrpc: '2.0',
-          id: message.id,
-          result: { tools: [] }
-        };
-      }
-      break;
-
-    case 'resources/list':
-      try {
-        const resources = sqliteManager.getAllResources();
-        const formattedResources = resources.map(resource => ({
-          name: `${resource.server_id}__${resource.name}`,
-          description: `[${resource.server_id}] ${resource.description}`,
-          uri: resource.uri_template
-        }));
-
-        response = {
-          jsonrpc: '2.0',
-          id: message.id,
-          result: { resources: formattedResources }
-        };
-      } catch (error) {
-        console.error('[QuickMCP] Error getting resources:', error);
-        response = {
-          jsonrpc: '2.0',
-          id: message.id,
-          result: { resources: [] }
-        };
-      }
-      break;
-
-    case 'prompts/list':
-      // Return empty prompts list for now
-      response = {
-        jsonrpc: '2.0',
-        id: message.id,
-        result: { prompts: [] }
-      };
-      break;
-
-    case 'tools/call':
-      try {
-        console.error(`[QuickMCP] Executing tool: ${message.params.name}`);
-        console.error(`[QuickMCP] Arguments:`, JSON.stringify(message.params.arguments));
-
-        const { DynamicMCPExecutor } = require('./dist/dynamic-mcp-executor.js');
-        const executor = new DynamicMCPExecutor();
-
-        const timeoutPromise = new Promise((_, reject) => {
-          setTimeout(() => reject(new Error('Tool execution timeout')), 10000);
-        });
-
-        const toolResult = await Promise.race([
-          executor.executeTool(message.params.name, message.params.arguments || {}),
-          timeoutPromise
-        ]);
-
-        console.error(`[QuickMCP] Tool result:`, JSON.stringify(toolResult, null, 2));
-
-        response = {
-          jsonrpc: '2.0',
-          id: message.id,
-          result: {
-            content: [{
-              type: 'text',
-              text: JSON.stringify(toolResult, null, 2)
-            }]
-          }
-        };
-      } catch (error) {
-        console.error(`[QuickMCP] Tool execution error:`, error);
-        response = {
-          jsonrpc: '2.0',
-          id: message.id,
-          error: {
-            code: -32603,
-            message: `Tool execution failed: ${error.message}`
-          }
-        };
-      }
-      break;
-
-    case 'notifications/initialized':
-      console.error('[QuickMCP] Client initialized');
-      break;
-
-    default:
-      if (message.id) {
-        response = {
-          jsonrpc: '2.0',
-          id: message.id,
-          error: { code: -32601, message: `Method not found: ${message.method}` }
-        };
+  logger.error(`[QuickMCP] Received: ${message.method} (id: ${message.id})`);
+
+  if (startupAuthError && message.method !== 'initialize' && message.method !== 'notifications/initialized') {
+    const authErrorResponse = {
+      jsonrpc: '2.0',
+      id: message.id,
+      error: {
+        code: -32001,
+        message: startupAuthError
       }
+    };
+    logger.error('[QuickMCP] Sending: auth-error');
+    sendMessage(authErrorResponse);
+    return;
   }
 
-  if (response) {
-    console.error(`[QuickMCP] Sending: ${response.result ? 'success' : 'error'}`);
-    sendMessage(response);
+  try {
+    let authContext;
+    try {
+      authContext = await mcpCore.resolveAuthContextFromSources({});
+    } catch (authError) {
+      logger.error('[QuickMCP] Failed to resolve auth context:', authError && authError.message ? authError.message : String(authError));
+      authContext = { identity: null, tokenRecord: null };
+    }
+    const response = await mcpCore.processJsonRpcMessage(message, authContext);
+    if (response) {
+      logger.error(`[QuickMCP] Sending: ${response.result ? 'success' : 'error'}`);
+      sendMessage(response);
+    }
+  } catch (error) {
+    const errorResponse = {
+      jsonrpc: '2.0',
+      id: message.id,
+      error: {
+        code: -32603,
+        message: `Internal error: ${error && error.message ? error.message : 'Unknown error'}`
+      }
+    };
+    logger.error('[QuickMCP] Sending: error');
+    sendMessage(errorResponse);
   }
 }
 
@@ -353,7 +339,7 @@ process.stdin.on('data', async (data) => {
       const match = /Content-Length:\s*(\d+)/i.exec(header);
       if (!match) {
         // Invalid header; drop up to headerEnd+4
-        console.error('[QuickMCP] Invalid header, dropping bytes');
+        logger.error('[QuickMCP] Invalid header, dropping bytes');
         stdinBuffer = Buffer.from(str.slice(headerEnd + 4), 'utf8');
         continue;
       }
@@ -367,12 +353,12 @@ process.stdin.on('data', async (data) => {
       try {
         if (useLspFraming === null) {
           useLspFraming = true;
-          console.error('[QuickMCP] Detected LSP framing (Content-Length)');
+          logger.error('[QuickMCP] Detected LSP framing (Content-Length)');
         }
         const message = JSON.parse(body);
         await handleMessage(message);
       } catch (e) {
-        console.error('[QuickMCP] Error parsing framed JSON:', e && e.message);
+        logger.error('[QuickMCP] Error parsing framed JSON:', e && e.message);
       }
       stdinBuffer = stdinBuffer.slice(totalLength);
       continue;
@@ -386,13 +372,13 @@ process.stdin.on('data', async (data) => {
     }
     if (useLspFraming === null) {
       useLspFraming = false;
-      console.error('[QuickMCP] Detected newline-delimited JSON framing');
+      logger.error('[QuickMCP] Detected newline-delimited JSON framing');
     }
     for (const msg of messages) {
       try {
         await handleMessage(msg);
       } catch (e) {
-        console.error('[QuickMCP] Error handling message:', e && e.message);
+        logger.error('[QuickMCP] Error handling message:', e && e.message);
       }
     }
     stdinBuffer = Buffer.from(str.slice(consumed), 'utf8');
@@ -400,22 +386,25 @@ process.stdin.on('data', async (data) => {
 });
 
 process.stdin.on('end', () => {
-  console.error('[QuickMCP] STDIN ended');
-  sqliteManager.close();
+  logger.error('[QuickMCP] STDIN ended');
+  try { executor.close && executor.close(); } catch (_) {}
+  try { dataStore.close && dataStore.close(); } catch (_) {}
   process.exit(0);
 });
 
 process.on('SIGINT', () => {
-  console.error('[QuickMCP] Interrupted');
-  sqliteManager.close();
+  logger.error('[QuickMCP] Interrupted');
+  try { executor.close && executor.close(); } catch (_) {}
+  try { dataStore.close && dataStore.close(); } catch (_) {}
   process.exit(0);
 });
 
 process.on('SIGTERM', () => {
-  console.error('[QuickMCP] Terminated');
-  sqliteManager.close();
+  logger.error('[QuickMCP] Terminated');
+  try { executor.close && executor.close(); } catch (_) {}
+  try { dataStore.close && dataStore.close(); } catch (_) {}
   process.exit(0);
 });
 
 process.stdin.resume();
-console.error('QuickMCP Direct STDIO Server started...');
+logger.error('QuickMCP Direct STDIO Server started...');