@wukongcrm/mcp-server 0.1.3 → 0.2.0

package/dist/fc-entry.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/fc-entry.js

@@ -0,0 +1,7 @@
+// Aliyun Function Compute custom runtimes require the HTTP server to listen on
+// 0.0.0.0 and use port 9000 by default. Explicit function environment values
+// still take precedence when a different listener port is configured.
+process.env.MCP_HOST ||= "0.0.0.0";
+process.env.MCP_PORT ||= process.env.PORT || "9000";
+await import("./http-entry.js");
+export {};

package/dist/http-entry.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/http-entry.js

@@ -0,0 +1,51 @@
+import { createWukongHttpApp, loadRemoteServerEnvironment } from "./http.js";
+const environment = loadRemoteServerEnvironment();
+const { app, provider, resourceUrl } = createWukongHttpApp({
+    publicUrl: environment.publicUrl,
+    oauthSecret: environment.oauthSecret,
+    dataDirectory: environment.dataDirectory,
+    redisUrl: environment.redisUrl,
+    redisKeyPrefix: environment.redisKeyPrefix,
+    crmBaseUrl: environment.crmBaseUrl,
+    crmBindingAuthorizeUrl: environment.crmBindingAuthorizeUrl,
+    crmBindingExchangeUrl: environment.crmBindingExchangeUrl,
+    crmBindingExchangeAllowHttp: environment.crmBindingExchangeAllowHttp,
+    crmBindingCallbackUrl: environment.crmBindingCallbackUrl,
+    crmBindingClientId: environment.crmBindingClientId,
+    crmBindingClientSecret: environment.crmBindingClientSecret,
+    host: environment.host,
+    allowedHosts: environment.allowedHosts,
+    trustProxy: environment.trustProxy
+});
+try {
+    await provider.initialize();
+}
+catch (error) {
+    console.error("Failed to initialize OAuth state store:", error instanceof Error ? error.message : "unknown error");
+    process.exit(1);
+}
+const httpServer = app.listen(environment.port, environment.host, () => {
+    console.log(`WukongCRM remote MCP listening on ${environment.host}:${environment.port}`);
+    console.log(`Public MCP URL: ${resourceUrl.href}`);
+    console.log(`Express trust proxy: ${String(environment.trustProxy)}`);
+    console.log(`OAuth state store: ${provider.clientsStore.kind === "redis" ? "Redis" : "JSON file"}`);
+});
+// Function Compute may keep a request or connection alive for much longer than
+// Node.js defaults. The function-level execution timeout remains the hard limit.
+httpServer.timeout = 0;
+httpServer.keepAliveTimeout = 0;
+httpServer.headersTimeout = 0;
+httpServer.on("error", (error) => {
+    console.error("Failed to start remote MCP server:", error.message);
+    process.exitCode = 1;
+});
+for (const signal of ["SIGINT", "SIGTERM"]) {
+    process.on(signal, () => {
+        httpServer.close(async () => {
+            await provider.close().catch((error) => {
+                console.error("Failed to close OAuth state store:", error instanceof Error ? error.message : "unknown error");
+            });
+            process.exit(0);
+        });
+    });
+}

package/dist/http.d.ts

@@ -0,0 +1,47 @@
+import { Express } from "express";
+import { WukongOAuthProvider } from "./oauth.js";
+export type TrustProxySetting = boolean | number | string;
+export interface WukongHttpAppOptions {
+    publicUrl: string | URL;
+    oauthSecret: string;
+    dataDirectory: string;
+    redisUrl?: string;
+    redisKeyPrefix?: string;
+    crmBaseUrl?: string;
+    crmBindingAuthorizeUrl: string | URL;
+    crmBindingExchangeUrl: string | URL;
+    crmBindingExchangeAllowHttp?: boolean;
+    crmBindingCallbackUrl?: string | URL;
+    crmBindingClientId: string;
+    crmBindingClientSecret: string;
+    fetchImpl?: typeof fetch;
+    host?: string;
+    allowedHosts?: string[];
+    trustProxy?: TrustProxySetting;
+}
+export interface WukongHttpApp {
+    app: Express;
+    provider: WukongOAuthProvider;
+    resourceUrl: URL;
+    resourceMetadataUrl: string;
+}
+export declare function createWukongHttpApp(options: WukongHttpAppOptions): WukongHttpApp;
+export interface RemoteServerEnvironment {
+    publicUrl: string;
+    oauthSecret: string;
+    dataDirectory: string;
+    redisUrl?: string;
+    redisKeyPrefix: string;
+    crmBaseUrl?: string;
+    crmBindingAuthorizeUrl: string;
+    crmBindingExchangeUrl: string;
+    crmBindingExchangeAllowHttp: boolean;
+    crmBindingCallbackUrl: string;
+    crmBindingClientId: string;
+    crmBindingClientSecret: string;
+    host: string;
+    allowedHosts: string[];
+    trustProxy: TrustProxySetting;
+    port: number;
+}
+export declare function loadRemoteServerEnvironment(env?: NodeJS.ProcessEnv): RemoteServerEnvironment;

package/dist/http.js

@@ -0,0 +1,550 @@
+import path from "node:path";
+import { authorizationHandler } from "@modelcontextprotocol/sdk/server/auth/handlers/authorize.js";
+import { metadataHandler } from "@modelcontextprotocol/sdk/server/auth/handlers/metadata.js";
+import { clientRegistrationHandler } from "@modelcontextprotocol/sdk/server/auth/handlers/register.js";
+import { revocationHandler } from "@modelcontextprotocol/sdk/server/auth/handlers/revoke.js";
+import { tokenHandler } from "@modelcontextprotocol/sdk/server/auth/handlers/token.js";
+import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
+import { getOAuthProtectedResourceMetadataUrl } from "@modelcontextprotocol/sdk/server/auth/router.js";
+import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import express from "express";
+import { WukongOAuthProvider } from "./oauth.js";
+import { MCP_RESOURCE_SCOPES, OAUTH_SCOPES, createWukongMcpServer } from "./server.js";
+export function createWukongHttpApp(options) {
+    const resourceUrl = validatePublicUrl(options.publicUrl);
+    const issuerUrl = new URL("/", resourceUrl);
+    const resourcePath = resourceUrl.pathname;
+    const oauthBasePath = `${resourcePath}/oauth`;
+    const bindingCallbackUrl = options.crmBindingCallbackUrl
+        ? new URL(options.crmBindingCallbackUrl.toString())
+        : new URL(`${oauthBasePath}/72crm/callback`, resourceUrl);
+    if (bindingCallbackUrl.origin !== resourceUrl.origin) {
+        throw new Error("CRM_BINDING_CALLBACK_URL 必须与 MCP_PUBLIC_URL 使用相同域名。");
+    }
+    const resourceMetadataUrl = getOAuthProtectedResourceMetadataUrl(resourceUrl);
+    const resourceMetadataPath = new URL(resourceMetadataUrl).pathname;
+    const serviceDocumentationUrl = new URL("/", resourceUrl);
+    const host = options.host ?? "127.0.0.1";
+    const allowedHosts = options.allowedHosts ?? uniqueStrings([
+        resourceUrl.hostname,
+        "localhost",
+        "127.0.0.1",
+        "[::1]"
+    ]);
+    const provider = new WukongOAuthProvider({
+        resourceUrl,
+        crmBaseUrl: options.crmBaseUrl,
+        crmBindingAuthorizeUrl: new URL(options.crmBindingAuthorizeUrl.toString()),
+        crmBindingExchangeUrl: new URL(options.crmBindingExchangeUrl.toString()),
+        crmBindingExchangeAllowHttp: options.crmBindingExchangeAllowHttp,
+        crmBindingCallbackUrl: bindingCallbackUrl,
+        crmBindingClientId: options.crmBindingClientId,
+        crmBindingClientSecret: options.crmBindingClientSecret,
+        secret: options.oauthSecret,
+        dataDirectory: options.dataDirectory,
+        redisUrl: options.redisUrl,
+        redisKeyPrefix: options.redisKeyPrefix,
+        fetchImpl: options.fetchImpl
+    });
+    const app = createMcpExpressApp({ host, allowedHosts });
+    app.set("trust proxy", options.trustProxy ?? false);
+    const protectedResourceMetadata = {
+        resource: resourceUrl.href,
+        authorization_servers: [issuerUrl.href],
+        scopes_supported: [...MCP_RESOURCE_SCOPES],
+        resource_name: "WukongCRM MCP",
+        resource_documentation: serviceDocumentationUrl.href
+    };
+    const oauthMetadata = {
+        issuer: issuerUrl.href,
+        service_documentation: serviceDocumentationUrl.href,
+        authorization_endpoint: new URL(`${oauthBasePath}/authorize`, resourceUrl).href,
+        token_endpoint: new URL(`${oauthBasePath}/token`, resourceUrl).href,
+        registration_endpoint: new URL(`${oauthBasePath}/register`, resourceUrl).href,
+        revocation_endpoint: new URL(`${oauthBasePath}/revoke`, resourceUrl).href,
+        response_types_supported: ["code"],
+        code_challenge_methods_supported: ["S256"],
+        token_endpoint_auth_methods_supported: ["none"],
+        grant_types_supported: ["authorization_code", "refresh_token"],
+        scopes_supported: [...OAUTH_SCOPES],
+        revocation_endpoint_auth_methods_supported: ["none"]
+    };
+    app.use(express.urlencoded({ extended: false, limit: "16kb" }));
+    app.get(`${resourcePath}/healthz`, (_req, res) => {
+        res.status(200).json({ ok: true, service: "wukong-mcp" });
+    });
+    app.get(bindingCallbackUrl.pathname, async (req, res) => {
+        setSensitiveResponseHeaders(res);
+        try {
+            const requestId = typeof req.query.state === "string" ? req.query.state : "";
+            const bindingCode = typeof req.query.code === "string" ? req.query.code : "";
+            const redirectUrl = await provider.completeBindingAuthorization(requestId, bindingCode);
+            res.redirect(302, redirectUrl);
+        }
+        catch (error) {
+            console.warn("72CRM binding callback failed:", error instanceof Error ? error.message : "unknown error");
+            res.status(400).type("text").send("授权失败，请返回 ChatGPT 重新发起连接。");
+        }
+    });
+    app.use("/.well-known/oauth-protected-resource", metadataHandler(protectedResourceMetadata));
+    app.use(resourceMetadataPath, metadataHandler(protectedResourceMetadata));
+    app.use("/.well-known/oauth-authorization-server", metadataHandler(oauthMetadata));
+    app.use("/.well-known/openid-configuration", metadataHandler(oauthMetadata));
+    app.use(`${oauthBasePath}/authorize`, authorizationHandler({ provider }));
+    app.use(`${oauthBasePath}/token`, tokenHandler({ provider }));
+    app.use(`${oauthBasePath}/register`, clientRegistrationHandler({ clientsStore: provider.clientsStore }));
+    app.use(`${oauthBasePath}/revoke`, revocationHandler({ provider }));
+    const bearerAuth = requireBearerAuth({
+        verifier: provider,
+        requiredScopes: [...MCP_RESOURCE_SCOPES],
+        resourceMetadataUrl
+    });
+    app.post(resourceUrl.pathname, bearerAuth, async (req, res) => {
+        await handleMcpPost(req, res, options, resourceMetadataUrl);
+    });
+    app.get(resourceUrl.pathname, (req, res, next) => {
+        if (!req.accepts("html")) {
+            next();
+            return;
+        }
+        sendMcpLandingPage(res, resourceUrl, resourceMetadataUrl);
+    }, bearerAuth, (_req, res) => {
+        sendMethodNotAllowed(res);
+    });
+    app.delete(resourceUrl.pathname, bearerAuth, (_req, res) => {
+        sendMethodNotAllowed(res);
+    });
+    return { app, provider, resourceUrl, resourceMetadataUrl };
+}
+async function handleMcpPost(req, res, options, resourceMetadataUrl) {
+    const apiKey = req.auth?.extra?.crmApiKey;
+    if (typeof apiKey !== "string" || !apiKey) {
+        res.setHeader("WWW-Authenticate", `Bearer resource_metadata="${resourceMetadataUrl}"`);
+        res.status(401).json({
+            jsonrpc: "2.0",
+            error: { code: -32001, message: "Unauthorized" },
+            id: null
+        });
+        return;
+    }
+    const server = createWukongMcpServer({
+        baseUrl: options.crmBaseUrl,
+        apiKey,
+        fetchImpl: options.fetchImpl,
+        oauth: {
+            scopes: req.auth?.scopes ?? [],
+            resourceMetadataUrl
+        }
+    });
+    const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+    try {
+        await server.connect(transport);
+        await transport.handleRequest(req, res, req.body);
+    }
+    catch (error) {
+        console.error("MCP request failed:", error instanceof Error ? error.message : "unknown error");
+        if (!res.headersSent) {
+            res.status(500).json({
+                jsonrpc: "2.0",
+                error: { code: -32603, message: "Internal server error" },
+                id: null
+            });
+        }
+    }
+    finally {
+        await transport.close().catch(() => undefined);
+        await server.close().catch(() => undefined);
+    }
+}
+function validatePublicUrl(value) {
+    const url = new URL(value.toString());
+    if (url.search || url.hash) {
+        throw new Error("MCP_PUBLIC_URL 不能包含查询参数或片段。");
+    }
+    const isLoopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopback)) {
+        throw new Error("MCP_PUBLIC_URL 必须使用 HTTPS；只有本地开发地址可以使用 HTTP。");
+    }
+    const normalizedPath = url.pathname.replace(/\/+$/, "");
+    if (!normalizedPath) {
+        throw new Error("MCP_PUBLIC_URL 必须包含 MCP 路径，例如 https://mcp.example.com/mcp。");
+    }
+    url.pathname = normalizedPath;
+    url.hash = "";
+    return url;
+}
+function setSensitiveResponseHeaders(res) {
+    res.setHeader("Cache-Control", "no-store");
+    res.setHeader("Pragma", "no-cache");
+    res.setHeader("X-Frame-Options", "DENY");
+    res.setHeader("Referrer-Policy", "no-referrer");
+    res.setHeader("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'");
+}
+function sendMcpLandingPage(res, resourceUrl, resourceMetadataUrl) {
+    const endpoint = escapeHtml(resourceUrl.href);
+    const healthUrl = escapeHtml(new URL(`${resourceUrl.pathname}/healthz`, resourceUrl).href);
+    const metadataUrl = escapeHtml(resourceMetadataUrl);
+    const authorizationMetadataUrl = escapeHtml(new URL("/.well-known/oauth-authorization-server", resourceUrl).href);
+    setSensitiveResponseHeaders(res);
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    res.status(200).type("html").send(`<!doctype html>
+<html lang="zh-CN">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="color-scheme" content="light">
+  <title>WukongCRM MCP · 服务说明</title>
+  <style>
+    :root {
+      --ink: #16332b;
+      --muted: #60736d;
+      --paper: #f6f4ec;
+      --panel: #fffdf7;
+      --line: #d7ded6;
+      --green: #19865c;
+      --green-soft: #dff3e9;
+      --orange: #e86637;
+      --shadow: 0 28px 80px rgba(18, 51, 42, .16);
+    }
+    * { box-sizing: border-box; }
+    body {
+      margin: 0;
+      min-height: 100vh;
+      color: var(--ink);
+      background:
+        radial-gradient(circle at 85% 12%, rgba(232, 102, 55, .13), transparent 28rem),
+        linear-gradient(rgba(22, 51, 43, .045) 1px, transparent 1px),
+        linear-gradient(90deg, rgba(22, 51, 43, .045) 1px, transparent 1px),
+        var(--paper);
+      background-size: auto, 32px 32px, 32px 32px, auto;
+      font-family: "Aptos", "PingFang SC", "Microsoft YaHei", sans-serif;
+    }
+    main {
+      width: min(1080px, calc(100% - 36px));
+      min-height: 100vh;
+      margin: 0 auto;
+      display: grid;
+      place-items: center;
+      padding: 48px 0;
+    }
+    .shell {
+      width: 100%;
+      overflow: hidden;
+      display: grid;
+      grid-template-columns: 11rem 1fr;
+      background: var(--panel);
+      border: 1px solid rgba(22, 51, 43, .16);
+      border-radius: 28px;
+      box-shadow: var(--shadow);
+      animation: arrive .55s cubic-bezier(.2, .8, .2, 1) both;
+    }
+    .rail {
+      position: relative;
+      padding: 34px 28px;
+      color: #f8fff9;
+      background: var(--ink);
+      display: flex;
+      flex-direction: column;
+      justify-content: space-between;
+      gap: 80px;
+    }
+    .rail::after {
+      content: "";
+      position: absolute;
+      width: 130px;
+      height: 130px;
+      right: -78px;
+      bottom: 62px;
+      border: 1px solid rgba(255, 255, 255, .17);
+      border-radius: 50%;
+    }
+    .mark {
+      width: 58px;
+      height: 58px;
+      border: 1px solid rgba(255, 255, 255, .45);
+      border-radius: 50%;
+      display: grid;
+      place-items: center;
+      font: 700 22px/1 Georgia, "Noto Serif SC", serif;
+      letter-spacing: -.08em;
+    }
+    .rail-label {
+      writing-mode: vertical-rl;
+      transform: rotate(180deg);
+      font-size: 12px;
+      letter-spacing: .18em;
+      text-transform: uppercase;
+      opacity: .7;
+    }
+    .content { padding: clamp(34px, 6vw, 72px); }
+    .status {
+      display: inline-flex;
+      align-items: center;
+      gap: 9px;
+      padding: 7px 11px;
+      color: #126544;
+      background: var(--green-soft);
+      border-radius: 999px;
+      font-size: 13px;
+      font-weight: 700;
+      letter-spacing: .04em;
+    }
+    .status::before {
+      content: "";
+      width: 8px;
+      height: 8px;
+      background: var(--green);
+      border-radius: 50%;
+      box-shadow: 0 0 0 4px rgba(25, 134, 92, .13);
+    }
+    h1 {
+      max-width: 700px;
+      margin: 25px 0 18px;
+      font: 700 clamp(38px, 7vw, 72px)/.98 Georgia, "Noto Serif SC", serif;
+      letter-spacing: -.055em;
+    }
+    h1 span { color: var(--orange); }
+    .lead {
+      max-width: 720px;
+      margin: 0;
+      color: var(--muted);
+      font-size: clamp(16px, 2vw, 19px);
+      line-height: 1.75;
+    }
+    .endpoint {
+      margin: 32px 0;
+      padding: 17px 19px;
+      display: grid;
+      grid-template-columns: auto 1fr;
+      gap: 14px;
+      align-items: center;
+      background: #eef1eb;
+      border: 1px solid var(--line);
+      border-left: 4px solid var(--orange);
+      border-radius: 12px;
+    }
+    .endpoint strong {
+      color: var(--muted);
+      font-size: 11px;
+      letter-spacing: .14em;
+      text-transform: uppercase;
+    }
+    code {
+      overflow-wrap: anywhere;
+      font-family: "Cascadia Mono", "SFMono-Regular", Consolas, monospace;
+      font-size: 14px;
+    }
+    .steps {
+      margin: 0;
+      padding: 0;
+      list-style: none;
+      display: grid;
+      grid-template-columns: repeat(3, 1fr);
+      border-top: 1px solid var(--line);
+      border-bottom: 1px solid var(--line);
+    }
+    .steps li {
+      min-height: 124px;
+      padding: 22px 20px 22px 0;
+      color: var(--muted);
+      font-size: 14px;
+      line-height: 1.65;
+    }
+    .steps li + li {
+      padding-left: 20px;
+      border-left: 1px solid var(--line);
+    }
+    .steps b {
+      display: block;
+      margin-bottom: 8px;
+      color: var(--ink);
+      font: 700 18px/1.2 Georgia, "Noto Serif SC", serif;
+    }
+    .steps em {
+      display: inline-block;
+      margin-right: 6px;
+      color: var(--orange);
+      font: normal 700 12px/1 "Cascadia Mono", monospace;
+    }
+    nav {
+      margin-top: 24px;
+      display: flex;
+      flex-wrap: wrap;
+      gap: 10px 24px;
+    }
+    nav a {
+      color: var(--ink);
+      font-size: 13px;
+      font-weight: 700;
+      text-decoration-color: rgba(232, 102, 55, .65);
+      text-underline-offset: 5px;
+    }
+    nav a:hover { color: var(--orange); }
+    footer {
+      margin-top: 38px;
+      color: #85948f;
+      font-size: 12px;
+      letter-spacing: .04em;
+    }
+    @keyframes arrive {
+      from { opacity: 0; transform: translateY(14px); }
+      to { opacity: 1; transform: translateY(0); }
+    }
+    @media (max-width: 720px) {
+      main { width: min(100% - 22px, 680px); padding: 18px 0; }
+      .shell { grid-template-columns: 1fr; border-radius: 20px; }
+      .rail { padding: 18px 22px; flex-direction: row; align-items: center; gap: 20px; }
+      .mark { width: 44px; height: 44px; font-size: 17px; }
+      .rail-label { writing-mode: horizontal-tb; transform: none; }
+      .content { padding: 30px 22px 34px; }
+      h1 { letter-spacing: -.04em; }
+      .endpoint { grid-template-columns: 1fr; gap: 8px; }
+      .steps { grid-template-columns: 1fr; }
+      .steps li { min-height: auto; padding: 18px 0; }
+      .steps li + li { padding-left: 0; border-left: 0; border-top: 1px solid var(--line); }
+    }
+    @media (prefers-reduced-motion: reduce) {
+      .shell { animation: none; }
+    }
+  </style>
+</head>
+<body>
+  <main>
+    <section class="shell" aria-labelledby="page-title">
+      <aside class="rail" aria-label="WukongCRM MCP">
+        <div class="mark" aria-hidden="true">72</div>
+        <div class="rail-label">Model Context Protocol</div>
+      </aside>
+      <div class="content">
+        <div class="status">服务在线</div>
+        <h1 id="page-title">WukongCRM <span>MCP</span></h1>
+        <p class="lead">这是一个受 OAuth 2.0 保护的远程 MCP 端点。请在支持远程 MCP 的客户端中添加服务地址，由客户端发起授权；直接打开本页不会创建授权会话。</p>
+
+        <div class="endpoint">
+          <strong>服务地址</strong>
+          <code>${endpoint}</code>
+        </div>
+
+        <ol class="steps" aria-label="接入步骤">
+          <li><b><em>01</em>添加服务</b>在客户端的 MCP 设置中填写上方地址。</li>
+          <li><b><em>02</em>完成授权</b>按客户端提示登录 72CRM 并确认 OAuth 授权。</li>
+          <li><b><em>03</em>开始使用</b>返回客户端，调用只读工具验证连接状态。</li>
+        </ol>
+
+        <nav aria-label="服务诊断">
+          <a href="${healthUrl}">健康检查</a>
+          <a href="${metadataUrl}">MCP 资源元数据</a>
+          <a href="${authorizationMetadataUrl}">OAuth 服务元数据</a>
+        </nav>
+        <footer>WukongCRM MCP · Streamable HTTP · OAuth 2.0</footer>
+      </div>
+    </section>
+  </main>
+</body>
+</html>`);
+}
+function escapeHtml(value) {
+    return value.replace(/[&<>"']/g, (character) => {
+        switch (character) {
+            case "&": return "&amp;";
+            case "<": return "&lt;";
+            case ">": return "&gt;";
+            case '"': return "&quot;";
+            case "'": return "&#39;";
+            default: return character;
+        }
+    });
+}
+function sendMethodNotAllowed(res) {
+    res.status(405).json({
+        jsonrpc: "2.0",
+        error: { code: -32000, message: "Method not allowed" },
+        id: null
+    });
+}
+function uniqueStrings(values) {
+    return [...new Set(values.filter(Boolean))];
+}
+export function loadRemoteServerEnvironment(env = process.env) {
+    const publicUrl = requiredEnvironment(env, "MCP_PUBLIC_URL");
+    const oauthSecret = requiredEnvironment(env, "MCP_OAUTH_SECRET");
+    const parsedPublicUrl = validatePublicUrl(publicUrl);
+    const crmBindingAuthorizeUrl = requiredEnvironment(env, "CRM_BINDING_AUTHORIZE_URL");
+    const crmBindingExchangeUrl = requiredEnvironment(env, "CRM_BINDING_EXCHANGE_URL");
+    const crmBindingClientId = requiredEnvironment(env, "CRM_BINDING_CLIENT_ID");
+    const crmBindingClientSecret = requiredEnvironment(env, "CRM_BINDING_CLIENT_SECRET");
+    const resourcePath = parsedPublicUrl.pathname;
+    const crmBindingCallbackUrl = env.CRM_BINDING_CALLBACK_URL?.trim() ||
+        new URL(`${resourcePath}/oauth/72crm/callback`, parsedPublicUrl).href;
+    const portText = env.MCP_PORT ?? env.PORT ?? "3000";
+    const port = Number.parseInt(portText, 10);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new Error("MCP_PORT/PORT 必须是 1 到 65535 之间的整数。");
+    }
+    const configuredHosts = (env.MCP_ALLOWED_HOSTS ?? "")
+        .split(",")
+        .map((value) => value.trim())
+        .filter(Boolean);
+    return {
+        publicUrl,
+        oauthSecret,
+        dataDirectory: path.resolve(env.MCP_DATA_DIR ?? ".wukong-mcp-data"),
+        redisUrl: env.MCP_REDIS_URL?.trim() || undefined,
+        redisKeyPrefix: env.MCP_REDIS_PREFIX?.trim() || "wukong-mcp:oauth",
+        crmBaseUrl: env.CRM_BASE_URL,
+        crmBindingAuthorizeUrl,
+        crmBindingExchangeUrl,
+        crmBindingExchangeAllowHttp: parseBooleanEnvironment(env.CRM_BINDING_EXCHANGE_ALLOW_HTTP ?? "false", "CRM_BINDING_EXCHANGE_ALLOW_HTTP"),
+        crmBindingCallbackUrl,
+        crmBindingClientId,
+        crmBindingClientSecret,
+        host: env.MCP_HOST ?? "127.0.0.1",
+        allowedHosts: uniqueStrings([
+            ...configuredHosts,
+            parsedPublicUrl.hostname,
+            "localhost",
+            "127.0.0.1",
+            "[::1]"
+        ]),
+        trustProxy: parseTrustProxy(env.MCP_TRUST_PROXY ?? "1"),
+        port
+    };
+}
+function parseTrustProxy(value) {
+    const normalized = value.trim();
+    if (!normalized) {
+        throw new Error("MCP_TRUST_PROXY 不能为空。");
+    }
+    if (normalized === "true") {
+        return true;
+    }
+    if (normalized === "false") {
+        return false;
+    }
+    if (/^-?\d+$/.test(normalized)) {
+        const hops = Number.parseInt(normalized, 10);
+        if (!Number.isSafeInteger(hops) || hops < 0) {
+            throw new Error("MCP_TRUST_PROXY 的代理层数必须是非负整数。");
+        }
+        return hops;
+    }
+    return normalized;
+}
+function parseBooleanEnvironment(value, name) {
+    const normalized = value.trim().toLowerCase();
+    if (normalized === "true") {
+        return true;
+    }
+    if (normalized === "false") {
+        return false;
+    }
+    throw new Error(`${name} 必须为 true 或 false。`);
+}
+function requiredEnvironment(env, name) {
+    const value = env[name]?.trim();
+    if (!value) {
+        throw new Error(`远程模式必须配置 ${name}。`);
+    }
+    return value;
+}

package/dist/modules.js

@@ -41,9 +41,9 @@ export const CRM_MODULES = [
         basePath: "/crmProduct",
         primaryKey: "productId",
         aliases: ["产品", "crmProduct", "4"],
-        supportedOperations: [...COMMON_READ, "简要实体", "销售产品列表"],
-        unsupportedOperations: ["新增", "更新", "删除", "上下架", "负责人转移", "导入导出"],
-        writable: false
+        supportedOperations: [...COMMON_READ, "简要实体", "销售产品列表", "新增", "更新", "字段更新", "上下架", "负责人转移", "删除"],
+        unsupportedOperations: ["导入导出", "文件流下载", "multipart 文件上传代理"],
+        writable: true
     },
     {
         key: "business",
@@ -167,7 +167,7 @@ export const CRM_MODULES = [
         writable: false
     }
 ];
-export const WRITE_MODULES = new Set(["leads", "customer", "contacts", "business"]);
+export const WRITE_MODULES = new Set(["leads", "customer", "contacts", "product", "business"]);
 const MODULE_LOOKUP = new Map();
 for (const moduleDefinition of CRM_MODULES) {
     MODULE_LOOKUP.set(moduleDefinition.key.toLowerCase(), moduleDefinition);