modality-ai 0.7.5 → 0.8.1

package/dist/index.js

@@ -129458,7 +129458,7 @@ var setupStdioToHttpTools = async (client, mcpServer) => {
   return setupAITools(aiTools, mcpServer);
 };
 // src/mcp-oauth-provider.ts
-import { createHash } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join as join9 } from "node:path";
@@ -129474,11 +129474,16 @@ class CLIBrowserOAuthProvider {
   _serverIdentity;
   _noOpen;
   _cachePath;
+  _callbackPath;
+  _callbackHost;
+  _state;
+  _onAuthorizationUrl;
   _port;
   _server;
   _resolveCode;
   _rejectCode;
   _pendingCode;
+  _codeSettled = false;
   _codeVerifier;
   _clientInfo;
   _tokens;
@@ -129486,6 +129491,10 @@ class CLIBrowserOAuthProvider {
   constructor(options = {}) {
     this._clientName = options.clientName ?? "mcp-cli";
     this._noOpen = options.noOpen ?? false;
+    this._onAuthorizationUrl = options.onAuthorizationUrl;
+    this._state = randomBytes(16).toString("hex");
+    this._callbackPath = options.externalCallback?.path ?? "/callback";
+    this._callbackHost = options.externalCallback?.host ?? "127.0.0.1";
     this._serverIdentity = options.serverUrl ? resolveServerIdentity(options.serverUrl) : null;
     if (options.serverUrl === null) {
       this._cachePath = null;
@@ -129505,11 +129514,15 @@ class CLIBrowserOAuthProvider {
       this._resolveCode = resolve2;
       this._rejectCode = reject3;
     });
-    this._server = Bun.serve({
-      port: options.callbackPort ?? 9876,
-      fetch: (req) => this._handleCallback(req)
-    });
-    this._port = this._server.port ?? 9876;
+    if (options.externalCallback) {
+      this._port = options.externalCallback.port;
+    } else {
+      this._server = Bun.serve({
+        port: options.callbackPort ?? 9876,
+        fetch: (req) => this._handleCallback(req)
+      });
+      this._port = this._server.port ?? 9876;
+    }
     if (this._clientInfo) {
       const uris = this._clientInfo.redirect_uris ?? [];
       if (!uris.includes(this.redirectUrl)) {
@@ -129518,7 +129531,7 @@ class CLIBrowserOAuthProvider {
     }
   }
   get redirectUrl() {
-    return `http://127.0.0.1:${this._port}/callback`;
+    return `http://${this._callbackHost}:${this._port}${this._callbackPath}`;
   }
   get clientMetadata() {
     const identity7 = this._serverIdentity;
@@ -129569,7 +129582,11 @@ class CLIBrowserOAuthProvider {
       params.set("client_secret", secret3);
     }
   };
+  state() {
+    return this._state;
+  }
   async redirectToAuthorization(authorizationUrl) {
+    this._onAuthorizationUrl?.(authorizationUrl);
     const url5 = authorizationUrl.toString();
     if (this._noOpen) {
       console.error(`
@@ -129592,6 +129609,15 @@ class CLIBrowserOAuthProvider {
   waitForCode() {
     return this._pendingCode;
   }
+  get oauthState() {
+    return this.state();
+  }
+  get callbackPath() {
+    return this._callbackPath;
+  }
+  handleCallback(req) {
+    return this._handleCallback(req);
+  }
   getDiscoveryState() {
     return this._discoveryState;
   }
@@ -129600,7 +129626,7 @@ class CLIBrowserOAuthProvider {
     this._persistCache();
   }
   stop() {
-    this._server.stop(true);
+    this._server?.stop(true);
   }
   _loadCache() {
     if (!this._cachePath)
@@ -129626,20 +129652,32 @@ class CLIBrowserOAuthProvider {
   }
   _handleCallback(req) {
     const url5 = new URL(req.url);
-    if (url5.pathname !== "/callback") {
+    if (url5.pathname !== this._callbackPath) {
       return new Response("Not found", { status: 404 });
     }
+    if (this._codeSettled) {
+      return errorPage("already_completed", "Authorization code was already received.");
+    }
+    const returnedState = url5.searchParams.get("state");
+    if (returnedState !== null && returnedState !== this._state) {
+      this._codeSettled = true;
+      this._rejectCode?.(new Error("OAuth state mismatch"));
+      return errorPage("state_mismatch", "State parameter did not match.");
+    }
     const error54 = url5.searchParams.get("error");
     if (error54) {
       const description = url5.searchParams.get("error_description") ?? "";
+      this._codeSettled = true;
       this._rejectCode?.(new Error(`OAuth error: ${error54} — ${description}`));
       return errorPage(error54, description);
     }
     const code = url5.searchParams.get("code");
     if (!code) {
+      this._codeSettled = true;
       this._rejectCode?.(new Error("OAuth callback missing authorization code"));
       return errorPage("no_code", "No authorization code received.");
     }
+    this._codeSettled = true;
     this._resolveCode?.(code);
     return successPage();
   }
@@ -129686,6 +129724,9 @@ function successPage() {
 </html>`;
   return new Response(body, { status: 200, headers: { "Content-Type": "text/html" } });
 }
+function escapeHtml2(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
 function errorPage(error54, description) {
   const body = `<!DOCTYPE html>
 <html lang="en">
@@ -129723,7 +129764,7 @@ function errorPage(error54, description) {
   <div class="card">
     <span class="icon">❌</span>
     <h1>Authentication failed</h1>
-    <p><code>${error54}</code>${description ? `: ${description}` : ""}</p>
+    <p><code>${escapeHtml2(error54)}</code>${description ? `: ${escapeHtml2(description)}` : ""}</p>
   </div>
 </body>
 </html>`;

package/dist/types/__tests__/CLIBrowserOAuthProvider.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/mcp-oauth-provider.d.ts

@@ -11,8 +11,28 @@ interface CLIBrowserOAuthProviderOptions {
     /**
      * Port for the local callback server.
      * Defaults to 9876 for a stable redirect_uri across runs.
+     * Ignored when `externalCallback` is set.
      */
     callbackPort?: number;
+    /**
+     * Route the OAuth redirect through an existing HTTP server instead of
+     * starting a local Bun.serve. When set, the provider binds no port of its
+     * own — the host app must forward the redirect request to `handleCallback()`.
+     * `port`/`path`/`host` define the advertised redirect_uri and must match the
+     * host server (defaults: host "127.0.0.1", path "/callback").
+     * Correlate the inbound callback to this provider via `oauthState`.
+     */
+    externalCallback?: {
+        port: number;
+        path?: string;
+        host?: string;
+    };
+    /**
+     * Invoked with the full authorization URL just before the browser opens.
+     * Lets the host correlate the later callback to this provider (e.g. by
+     * reading the `state` query param, which equals `oauthState`).
+     */
+    onAuthorizationUrl?: (url: URL) => void;
     /**
      * Skip opening the system browser automatically.
      * When true the authorization URL is printed but not launched.
@@ -58,11 +78,16 @@ export declare class CLIBrowserOAuthProvider implements OAuthClientProvider {
     private readonly _serverIdentity;
     private readonly _noOpen;
     private readonly _cachePath;
+    private readonly _callbackPath;
+    private readonly _callbackHost;
+    private readonly _state;
+    private readonly _onAuthorizationUrl?;
     private _port;
-    private _server;
+    private _server?;
     private _resolveCode?;
     private _rejectCode?;
     private _pendingCode;
+    private _codeSettled;
     private _codeVerifier?;
     private _clientInfo?;
     private _tokens?;
@@ -89,16 +114,36 @@ export declare class CLIBrowserOAuthProvider implements OAuthClientProvider {
      * auth-method string the registration response contained.
      */
     readonly addClientAuthentication: AddClientAuthentication;
+    /**
+     * CSRF `state` echoed back on the redirect. The SDK reads this via the
+     * optional `state()` hook and appends it to the authorization request; the
+     * callback validates it. Also used by host apps to correlate an external
+     * callback to this provider instance.
+     */
+    state(): string;
     redirectToAuthorization(authorizationUrl: URL): Promise<void>;
     /**
      * Resolves with the authorization code once the browser redirect completes.
      */
     waitForCode(): Promise<string>;
+    /** CSRF state for this flow — key an external callback route by this value. */
+    get oauthState(): string;
+    /** Advertised redirect path — the route an external host server must expose. */
+    get callbackPath(): string;
+    /**
+     * Handle an OAuth redirect request forwarded from an external host server
+     * (externalCallback mode). Resolves waitForCode() and returns the page to
+     * render in the browser tab.
+     */
+    handleCallback(req: Request): Response;
     /** Discovery state captured before registration — available even when registration fails. */
     getDiscoveryState(): OAuthDiscoveryState | undefined;
     /** Clear cached tokens only — forces browser re-auth on next run while keeping client registration. */
     clearCache(): void;
-    /** Stop the local callback HTTP server. Call once auth is complete. */
+    /**
+     * Stop the local callback HTTP server. Call once auth is complete.
+     * No-op in externalCallback mode, where the host owns the server.
+     */
     stop(): void;
     private _loadCache;
     private _persistCache;

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.7.5",
+  "version": "0.8.1",
   "name": "modality-ai",
   "repository": {
     "type": "git",