snow-flow 2.9.0 → 2.9.5

package/dist/utils/deployment-auth-fix.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Deployment Authentication Fix
+ * Ensures OAuth tokens are properly refreshed and validated before deployment operations
+ */
+export interface AuthValidationResult {
+    isValid: boolean;
+    hasWriteScope: boolean;
+    tokenAge?: number;
+    expiresIn?: number;
+    error?: string;
+    recommendations?: string[];
+}
+export declare class DeploymentAuthManager {
+    private oauth;
+    private lastTokenRefresh;
+    constructor();
+    /**
+     * Ensure we have valid tokens for deployment operations
+     * This is MORE strict than regular authentication
+     */
+    ensureDeploymentAuth(): Promise<AuthValidationResult>;
+    /**
+     * Validate token by making a simple API call
+     */
+    private validateTokenWithAPI;
+    /**
+     * Check if token has write permissions by attempting to read widget table
+     */
+    private checkWritePermissions;
+    /**
+     * Force a fresh token for deployment operations
+     */
+    forceTokenRefresh(): Promise<{
+        success: boolean;
+        accessToken?: string;
+        error?: string;
+    }>;
+    /**
+     * Get fresh access token for deployment
+     */
+    getDeploymentToken(): Promise<string | null>;
+}
+//# sourceMappingURL=deployment-auth-fix.d.ts.map

package/dist/utils/deployment-auth-fix.js

@@ -0,0 +1,272 @@
+"use strict";
+/**
+ * Deployment Authentication Fix
+ * Ensures OAuth tokens are properly refreshed and validated before deployment operations
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeploymentAuthManager = void 0;
+const snow_oauth_js_1 = require("./snow-oauth.js");
+const unified_auth_store_js_1 = require("./unified-auth-store.js");
+const logger_js_1 = require("./logger.js");
+const logger = new logger_js_1.Logger('DeploymentAuthFix');
+class DeploymentAuthManager {
+    constructor() {
+        this.lastTokenRefresh = 0;
+        this.oauth = new snow_oauth_js_1.ServiceNowOAuth();
+    }
+    /**
+     * Ensure we have valid tokens for deployment operations
+     * This is MORE strict than regular authentication
+     */
+    async ensureDeploymentAuth() {
+        try {
+            logger.info('🔐 Validating deployment authentication...');
+            // Step 1: Check if we have any auth at all
+            const isAuth = await this.oauth.isAuthenticated();
+            if (!isAuth) {
+                return {
+                    isValid: false,
+                    hasWriteScope: false,
+                    error: 'Not authenticated',
+                    recommendations: [
+                        'Run: snow-flow auth login',
+                        'Ensure OAuth app has write/admin scopes'
+                    ]
+                };
+            }
+            // Step 2: Get current tokens
+            let tokens = await this.oauth.loadTokens();
+            if (!tokens || !tokens.accessToken) {
+                // Try unified auth store as fallback
+                tokens = await unified_auth_store_js_1.unifiedAuthStore.getTokens();
+                if (!tokens || !tokens.accessToken) {
+                    return {
+                        isValid: false,
+                        hasWriteScope: false,
+                        error: 'No access token found',
+                        recommendations: [
+                            'Run: snow-flow auth login',
+                            'Check .env configuration'
+                        ]
+                    };
+                }
+            }
+            // Step 3: Check token age and expiry
+            const now = Date.now();
+            const tokenAge = tokens.issuedAt ? now - tokens.issuedAt : null;
+            const expiresIn = tokens.expiresAt ? tokens.expiresAt - now : null;
+            // If token expires in less than 5 minutes, refresh it
+            if (expiresIn && expiresIn < 300000) { // 5 minutes
+                logger.info('⚠️ Token expires soon, refreshing...');
+                try {
+                    const refreshResult = await this.oauth.refreshAccessToken();
+                    if (refreshResult.success && refreshResult.accessToken) {
+                        logger.info('✅ Token refreshed successfully');
+                        tokens = {
+                            ...tokens,
+                            accessToken: refreshResult.accessToken,
+                            expiresAt: refreshResult.expiresIn ? now + refreshResult.expiresIn * 1000 : undefined,
+                            issuedAt: now
+                        };
+                        // Update unified auth store
+                        await unified_auth_store_js_1.unifiedAuthStore.saveTokens(tokens);
+                    }
+                    else {
+                        logger.warn('Failed to refresh token:', refreshResult.error);
+                    }
+                }
+                catch (error) {
+                    logger.error('Token refresh error:', error);
+                }
+            }
+            // Step 4: Validate token by making a test API call
+            try {
+                const testResponse = await this.validateTokenWithAPI(tokens.accessToken);
+                if (!testResponse.success) {
+                    // Token is invalid, try to refresh
+                    logger.warn('Token validation failed, attempting refresh...');
+                    const refreshResult = await this.oauth.refreshAccessToken();
+                    if (refreshResult.success && refreshResult.accessToken) {
+                        tokens.accessToken = refreshResult.accessToken;
+                        await unified_auth_store_js_1.unifiedAuthStore.saveTokens(tokens);
+                        // Validate again
+                        const retryResponse = await this.validateTokenWithAPI(tokens.accessToken);
+                        if (!retryResponse.success) {
+                            return {
+                                isValid: false,
+                                hasWriteScope: false,
+                                error: 'Token validation failed after refresh',
+                                recommendations: [
+                                    'Run: snow-flow auth login',
+                                    'Check ServiceNow OAuth app configuration',
+                                    'Verify API access is enabled for your user'
+                                ]
+                            };
+                        }
+                    }
+                    else {
+                        return {
+                            isValid: false,
+                            hasWriteScope: false,
+                            error: 'Failed to refresh invalid token',
+                            recommendations: [
+                                'Run: snow-flow auth login',
+                                'Your session may have expired'
+                            ]
+                        };
+                    }
+                }
+            }
+            catch (error) {
+                logger.error('Token validation error:', error);
+                return {
+                    isValid: false,
+                    hasWriteScope: false,
+                    error: `Token validation failed: ${error.message}`,
+                    recommendations: [
+                        'Check network connectivity',
+                        'Verify ServiceNow instance is accessible',
+                        'Run: snow-flow auth login'
+                    ]
+                };
+            }
+            // Step 5: Check for write permissions
+            const hasWriteScope = await this.checkWritePermissions(tokens.accessToken);
+            return {
+                isValid: true,
+                hasWriteScope,
+                tokenAge: tokenAge ? Math.round(tokenAge / 1000) : undefined,
+                expiresIn: expiresIn ? Math.round(expiresIn / 1000) : undefined,
+                recommendations: hasWriteScope ? [] : [
+                    'OAuth token is valid but may lack write permissions',
+                    'Check OAuth app scopes in ServiceNow',
+                    'Ensure user has sp_admin or admin role'
+                ]
+            };
+        }
+        catch (error) {
+            logger.error('Deployment auth validation error:', error);
+            return {
+                isValid: false,
+                hasWriteScope: false,
+                error: error.message,
+                recommendations: [
+                    'Unexpected error during authentication',
+                    'Run: snow-flow auth login',
+                    'Check error logs for details'
+                ]
+            };
+        }
+    }
+    /**
+     * Validate token by making a simple API call
+     */
+    async validateTokenWithAPI(accessToken) {
+        try {
+            const axios = require('axios');
+            const credentials = await this.oauth.loadCredentials();
+            if (!credentials?.instance) {
+                return { success: false, error: 'No instance configured' };
+            }
+            const response = await axios.get(`https://${credentials.instance}/api/now/table/sys_user?sysparm_limit=1`, {
+                headers: {
+                    'Authorization': `Bearer ${accessToken}`,
+                    'Accept': 'application/json'
+                },
+                timeout: 10000
+            });
+            return { success: response.status === 200 };
+        }
+        catch (error) {
+            if (error.response?.status === 401) {
+                return { success: false, error: 'Token is invalid or expired' };
+            }
+            return { success: false, error: error.message };
+        }
+    }
+    /**
+     * Check if token has write permissions by attempting to read widget table
+     */
+    async checkWritePermissions(accessToken) {
+        try {
+            const axios = require('axios');
+            const credentials = await this.oauth.loadCredentials();
+            if (!credentials?.instance) {
+                return false;
+            }
+            // Try to read from sp_widget table (requires portal access)
+            const response = await axios.get(`https://${credentials.instance}/api/now/table/sp_widget?sysparm_limit=1`, {
+                headers: {
+                    'Authorization': `Bearer ${accessToken}`,
+                    'Accept': 'application/json'
+                },
+                timeout: 10000
+            });
+            // If we can read widgets, we likely have portal access
+            return response.status === 200;
+        }
+        catch (error) {
+            // 403 means we don't have permission
+            if (error.response?.status === 403) {
+                logger.warn('No write permissions for Service Portal');
+                return false;
+            }
+            // Other errors we'll assume no permission
+            return false;
+        }
+    }
+    /**
+     * Force a fresh token for deployment operations
+     */
+    async forceTokenRefresh() {
+        try {
+            logger.info('🔄 Forcing token refresh for deployment...');
+            const refreshResult = await this.oauth.refreshAccessToken();
+            if (refreshResult.success && refreshResult.accessToken) {
+                // Store in unified auth store
+                const tokens = await this.oauth.loadTokens();
+                if (tokens) {
+                    tokens.accessToken = refreshResult.accessToken;
+                    tokens.expiresAt = refreshResult.expiresIn ? Date.now() + refreshResult.expiresIn * 1000 : undefined;
+                    tokens.issuedAt = Date.now();
+                    await unified_auth_store_js_1.unifiedAuthStore.saveTokens(tokens);
+                }
+                logger.info('✅ Token refreshed successfully');
+                return {
+                    success: true,
+                    accessToken: refreshResult.accessToken
+                };
+            }
+            return {
+                success: false,
+                error: refreshResult.error || 'Failed to refresh token'
+            };
+        }
+        catch (error) {
+            logger.error('Force refresh error:', error);
+            return {
+                success: false,
+                error: error.message
+            };
+        }
+    }
+    /**
+     * Get fresh access token for deployment
+     */
+    async getDeploymentToken() {
+        // First ensure we have valid auth
+        const authResult = await this.ensureDeploymentAuth();
+        if (!authResult.isValid) {
+            logger.error('Invalid authentication for deployment:', authResult.error);
+            throw new Error(authResult.error || 'Authentication failed');
+        }
+        if (!authResult.hasWriteScope) {
+            logger.warn('⚠️ Token may lack write permissions, deployment might fail');
+        }
+        // Get the token
+        const tokens = await this.oauth.loadTokens();
+        return tokens?.accessToken || null;
+    }
+}
+exports.DeploymentAuthManager = DeploymentAuthManager;
+//# sourceMappingURL=deployment-auth-fix.js.map

package/dist/utils/mcp-on-demand-manager.d.ts

@@ -0,0 +1,69 @@
+/**
+ * MCP On-Demand Manager
+ * Starts MCP servers only when needed and stops them after inactivity
+ */
+import { ChildProcess } from 'child_process';
+export declare class MCPOnDemandManager {
+    private static instance;
+    private servers;
+    private inactivityTimeout;
+    private cleanupInterval?;
+    private constructor();
+    static getInstance(): MCPOnDemandManager;
+    /**
+     * Get or start an MCP server on demand
+     */
+    getServer(serverName: string): Promise<ChildProcess>;
+    /**
+     * Start an MCP server
+     */
+    private startServer;
+    /**
+     * Wait for a server to finish starting
+     */
+    private waitForServer;
+    /**
+     * Stop a specific server
+     */
+    stopServer(serverName: string): Promise<void>;
+    /**
+     * Stop least recently used servers to free resources
+     */
+    private stopLeastRecentlyUsed;
+    /**
+     * Stop all inactive servers
+     */
+    private stopInactiveServers;
+    /**
+     * Start monitoring for inactive servers
+     */
+    private startInactivityMonitor;
+    /**
+     * Stop the inactivity monitor
+     */
+    stopInactivityMonitor(): void;
+    /**
+     * Get the script path for a server
+     */
+    private getScriptPath;
+    /**
+     * Get status of all servers
+     */
+    getStatus(): {
+        total: number;
+        running: number;
+        stopped: number;
+        servers: Array<{
+            name: string;
+            status: string;
+            lastUsed: string;
+            useCount: number;
+            uptime?: string;
+        }>;
+    };
+    /**
+     * Stop all servers
+     */
+    stopAll(): Promise<void>;
+}
+//# sourceMappingURL=mcp-on-demand-manager.d.ts.map

package/dist/utils/mcp-on-demand-manager.js

@@ -0,0 +1,309 @@
+"use strict";
+/**
+ * MCP On-Demand Manager
+ * Starts MCP servers only when needed and stops them after inactivity
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MCPOnDemandManager = void 0;
+const child_process_1 = require("child_process");
+const logger_js_1 = require("./logger.js");
+const mcp_process_manager_js_1 = require("./mcp-process-manager.js");
+const unified_auth_store_js_1 = require("./unified-auth-store.js");
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+const logger = new logger_js_1.Logger('MCPOnDemand');
+class MCPOnDemandManager {
+    constructor() {
+        this.servers = new Map();
+        this.inactivityTimeout = parseInt(process.env.SNOW_MCP_INACTIVITY_TIMEOUT || '300000'); // 5 minutes default
+        this.startInactivityMonitor();
+    }
+    static getInstance() {
+        if (!MCPOnDemandManager.instance) {
+            MCPOnDemandManager.instance = new MCPOnDemandManager();
+        }
+        return MCPOnDemandManager.instance;
+    }
+    /**
+     * Get or start an MCP server on demand
+     */
+    async getServer(serverName) {
+        let server = this.servers.get(serverName);
+        if (!server) {
+            server = {
+                name: serverName,
+                lastUsed: Date.now(),
+                useCount: 0,
+                status: 'stopped'
+            };
+            this.servers.set(serverName, server);
+        }
+        // Update last used time
+        server.lastUsed = Date.now();
+        server.useCount++;
+        // If server is running, return it
+        if (server.status === 'running' && server.process) {
+            logger.debug(`✅ Reusing existing ${serverName} (used ${server.useCount} times)`);
+            return server.process;
+        }
+        // If server is starting, wait for it
+        if (server.status === 'starting') {
+            logger.debug(`⏳ Waiting for ${serverName} to start...`);
+            return this.waitForServer(serverName);
+        }
+        // Start the server
+        return this.startServer(serverName);
+    }
+    /**
+     * Start an MCP server
+     */
+    async startServer(serverName) {
+        const server = this.servers.get(serverName);
+        if (!server) {
+            throw new Error(`Server ${serverName} not found`);
+        }
+        // Check resource limits
+        const processManager = mcp_process_manager_js_1.MCPProcessManager.getInstance();
+        if (!processManager.canSpawnServer()) {
+            // Try to free up resources by stopping least recently used servers
+            await this.stopLeastRecentlyUsed();
+            if (!processManager.canSpawnServer()) {
+                throw new Error('Cannot start server: resource limits exceeded');
+            }
+        }
+        server.status = 'starting';
+        logger.info(`🚀 Starting ${serverName} on demand...`);
+        try {
+            // Get the script path
+            const scriptPath = this.getScriptPath(serverName);
+            // Get auth tokens
+            await unified_auth_store_js_1.unifiedAuthStore.bridgeToMCP();
+            const tokens = await unified_auth_store_js_1.unifiedAuthStore.getTokens();
+            const authEnv = {};
+            if (tokens) {
+                authEnv.SNOW_OAUTH_TOKENS = JSON.stringify(tokens);
+                authEnv.SNOW_INSTANCE = tokens.instance;
+                authEnv.SNOW_CLIENT_ID = tokens.clientId;
+                authEnv.SNOW_CLIENT_SECRET = tokens.clientSecret;
+                if (tokens.accessToken) {
+                    authEnv.SNOW_ACCESS_TOKEN = tokens.accessToken;
+                }
+                if (tokens.refreshToken) {
+                    authEnv.SNOW_REFRESH_TOKEN = tokens.refreshToken;
+                }
+            }
+            // Start the process
+            const childProcess = (0, child_process_1.spawn)('node', [scriptPath], {
+                stdio: ['pipe', 'pipe', 'pipe'],
+                env: {
+                    ...process.env,
+                    ...authEnv,
+                    SNOW_MCP_ON_DEMAND: 'true' // Flag to indicate on-demand mode
+                }
+            });
+            // Handle process events
+            childProcess.on('error', (error) => {
+                logger.error(`${serverName} error:`, error);
+                server.status = 'stopped';
+            });
+            childProcess.on('exit', (code) => {
+                logger.info(`${serverName} exited with code ${code}`);
+                server.status = 'stopped';
+                server.process = undefined;
+            });
+            // Log output for debugging
+            childProcess.stdout?.on('data', (data) => {
+                logger.debug(`${serverName} stdout:`, data.toString());
+            });
+            childProcess.stderr?.on('data', (data) => {
+                logger.debug(`${serverName} stderr:`, data.toString());
+            });
+            server.process = childProcess;
+            server.status = 'running';
+            server.startTime = Date.now();
+            logger.info(`✅ ${serverName} started (PID: ${childProcess.pid})`);
+            return childProcess;
+        }
+        catch (error) {
+            server.status = 'stopped';
+            throw error;
+        }
+    }
+    /**
+     * Wait for a server to finish starting
+     */
+    async waitForServer(serverName, timeout = 30000) {
+        const startTime = Date.now();
+        while (Date.now() - startTime < timeout) {
+            const server = this.servers.get(serverName);
+            if (server?.status === 'running' && server.process) {
+                return server.process;
+            }
+            if (server?.status === 'stopped') {
+                throw new Error(`Server ${serverName} failed to start`);
+            }
+            await new Promise(resolve => setTimeout(resolve, 100));
+        }
+        throw new Error(`Timeout waiting for ${serverName} to start`);
+    }
+    /**
+     * Stop a specific server
+     */
+    async stopServer(serverName) {
+        const server = this.servers.get(serverName);
+        if (!server || !server.process) {
+            return;
+        }
+        server.status = 'stopping';
+        logger.info(`🛑 Stopping ${serverName} (was used ${server.useCount} times)`);
+        try {
+            server.process.kill('SIGTERM');
+            // Wait for graceful shutdown
+            await new Promise((resolve) => {
+                const timeout = setTimeout(() => {
+                    if (server.process) {
+                        server.process.kill('SIGKILL');
+                    }
+                    resolve(undefined);
+                }, 5000);
+                server.process?.once('exit', () => {
+                    clearTimeout(timeout);
+                    resolve(undefined);
+                });
+            });
+        }
+        catch (error) {
+            logger.error(`Error stopping ${serverName}:`, error);
+        }
+        server.status = 'stopped';
+        server.process = undefined;
+        server.startTime = undefined;
+    }
+    /**
+     * Stop least recently used servers to free resources
+     */
+    async stopLeastRecentlyUsed() {
+        const runningServers = Array.from(this.servers.values())
+            .filter(s => s.status === 'running')
+            .sort((a, b) => a.lastUsed - b.lastUsed);
+        if (runningServers.length > 0) {
+            const oldest = runningServers[0];
+            logger.info(`📦 Stopping least recently used server: ${oldest.name}`);
+            await this.stopServer(oldest.name);
+        }
+    }
+    /**
+     * Stop all inactive servers
+     */
+    async stopInactiveServers() {
+        const now = Date.now();
+        const promises = [];
+        for (const [name, server] of this.servers) {
+            if (server.status === 'running' &&
+                now - server.lastUsed > this.inactivityTimeout) {
+                const inactiveMinutes = Math.round((now - server.lastUsed) / 60000);
+                logger.info(`⏰ Stopping ${name} due to inactivity (${inactiveMinutes} minutes)`);
+                promises.push(this.stopServer(name));
+            }
+        }
+        await Promise.all(promises);
+    }
+    /**
+     * Start monitoring for inactive servers
+     */
+    startInactivityMonitor() {
+        // Check every minute
+        this.cleanupInterval = setInterval(() => {
+            this.stopInactiveServers().catch(error => {
+                logger.error('Error during inactivity cleanup:', error);
+            });
+        }, 60000);
+        // Don't block process exit
+        this.cleanupInterval.unref();
+    }
+    /**
+     * Stop the inactivity monitor
+     */
+    stopInactivityMonitor() {
+        if (this.cleanupInterval) {
+            clearInterval(this.cleanupInterval);
+            this.cleanupInterval = undefined;
+        }
+    }
+    /**
+     * Get the script path for a server
+     */
+    getScriptPath(serverName) {
+        // Map server names to script files
+        const serverMap = {
+            'servicenow-operations': 'servicenow-operations-mcp.js',
+            'servicenow-deployment': 'servicenow-deployment-mcp.js',
+            'servicenow-machine-learning': 'servicenow-machine-learning-mcp.js',
+            'servicenow-update-set': 'servicenow-update-set-mcp.js',
+            'servicenow-platform-development': 'servicenow-platform-development-mcp.js',
+            'servicenow-integration': 'servicenow-integration-mcp.js',
+            'servicenow-automation': 'servicenow-automation-mcp.js',
+            'servicenow-security-compliance': 'servicenow-security-compliance-mcp.js',
+            'servicenow-reporting-analytics': 'servicenow-reporting-analytics-mcp.js',
+            'servicenow-flow-composer': 'servicenow-flow-composer-mcp.js',
+            'servicenow-intelligent': 'servicenow-intelligent-mcp.js',
+            'servicenow-development-assistant': 'servicenow-development-assistant-mcp.js',
+            'servicenow-graph-memory': 'servicenow-graph-memory-mcp.js',
+            'snow-flow': 'snow-flow-mcp.js'
+        };
+        const scriptFile = serverMap[serverName];
+        if (!scriptFile) {
+            throw new Error(`Unknown server: ${serverName}`);
+        }
+        // Check different possible locations
+        const possiblePaths = [
+            path_1.default.join(__dirname, '..', 'mcp', scriptFile),
+            path_1.default.join(process.cwd(), 'dist', 'mcp', scriptFile),
+            path_1.default.join('/Users/nielsvanderwerf/.nvm/versions/node/v20.15.0/lib/node_modules/snow-flow/dist/mcp', scriptFile)
+        ];
+        for (const scriptPath of possiblePaths) {
+            if (fs_1.default.existsSync(scriptPath)) {
+                return scriptPath;
+            }
+        }
+        throw new Error(`Script not found for ${serverName}: ${scriptFile}`);
+    }
+    /**
+     * Get status of all servers
+     */
+    getStatus() {
+        const servers = Array.from(this.servers.values()).map(server => {
+            const lastUsedMinutes = Math.round((Date.now() - server.lastUsed) / 60000);
+            const uptime = server.startTime ?
+                Math.round((Date.now() - server.startTime) / 60000) + ' minutes' :
+                undefined;
+            return {
+                name: server.name,
+                status: server.status,
+                lastUsed: `${lastUsedMinutes} minutes ago`,
+                useCount: server.useCount,
+                uptime
+            };
+        });
+        return {
+            total: servers.length,
+            running: servers.filter(s => s.status === 'running').length,
+            stopped: servers.filter(s => s.status === 'stopped').length,
+            servers
+        };
+    }
+    /**
+     * Stop all servers
+     */
+    async stopAll() {
+        logger.info('🛑 Stopping all MCP servers...');
+        const promises = Array.from(this.servers.keys()).map(name => this.stopServer(name));
+        await Promise.all(promises);
+        this.stopInactivityMonitor();
+    }
+}
+exports.MCPOnDemandManager = MCPOnDemandManager;
+//# sourceMappingURL=mcp-on-demand-manager.js.map