tyc-cli 0.3.4 → 0.3.6

package/dist/oauth.js

@@ -0,0 +1,430 @@
+import { spawn } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+function trimRightSlash(v) {
+    return v.replace(/\/+$/, "");
+}
+function joinURL(base, path) {
+    const normalizedBase = base.endsWith("/") ? base : `${base}/`;
+    return new URL(path.replace(/^\/+/, ""), normalizedBase).toString();
+}
+async function fetchJSON(url, init) {
+    const resp = await fetch(url, {
+        ...init,
+        headers: {
+            Accept: "application/json",
+            ...(init?.headers || {}),
+        },
+    });
+    const text = await resp.text();
+    if (resp.status < 200 || resp.status >= 300) {
+        throw new Error(`HTTP ${resp.status} from ${url}: ${text.slice(0, 300)}`);
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`Invalid JSON from ${url}: ${msg}`);
+    }
+}
+function protectedResourceMetadataCandidates(mcpURL) {
+    const u = new URL(mcpURL);
+    const path = trimRightSlash(u.pathname);
+    const out = [
+        `${u.origin}/.well-known/oauth-protected-resource${path === "" ? "" : path}`,
+        `${u.origin}/.well-known/oauth-protected-resource`,
+    ];
+    return Array.from(new Set(out));
+}
+function authServerMetadataCandidates(issuer) {
+    const u = new URL(issuer);
+    const path = trimRightSlash(u.pathname);
+    const pathSuffix = path === "" ? "" : path;
+    const out = [
+        `${u.origin}/.well-known/oauth-authorization-server${pathSuffix}`,
+        `${u.origin}/.well-known/openid-configuration${pathSuffix}`,
+        joinURL(issuer, ".well-known/oauth-authorization-server"),
+        joinURL(issuer, ".well-known/openid-configuration"),
+    ];
+    return Array.from(new Set(out));
+}
+function parseWWWAuthenticateParam(header, key) {
+    if (!header)
+        return undefined;
+    const re = new RegExp(`${key}\\s*=\\s*"((?:[^"\\\\]|\\\\.)*)"`, "i");
+    const quoted = header.match(re);
+    if (quoted)
+        return quoted[1].replace(/\\"/g, '"').replace(/\\\\/g, "\\");
+    const bare = header.match(new RegExp(`${key}\\s*=\\s*([^,\\s]+)`, "i"));
+    return bare?.[1];
+}
+async function discoverMetadataURLFromChallenge(mcpURL) {
+    const resp = await fetch(mcpURL, {
+        method: "POST",
+        headers: {
+            Accept: "application/json",
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+            jsonrpc: "2.0",
+            id: 1,
+            method: "tools/call",
+            params: { name: "search_companies", arguments: { searchKey: "test" } },
+        }),
+    });
+    return parseWWWAuthenticateParam(resp.headers.get("www-authenticate"), "resource_metadata");
+}
+export async function discoverProtectedResourceMetadata(mcpURL, overrideURL) {
+    const candidates = overrideURL
+        ? [overrideURL]
+        : protectedResourceMetadataCandidates(mcpURL);
+    const errors = [];
+    for (const url of candidates) {
+        try {
+            return { metadata: await fetchJSON(url), metadataURL: url };
+        }
+        catch (err) {
+            errors.push(err instanceof Error ? err.message : String(err));
+        }
+    }
+    if (!overrideURL) {
+        try {
+            const challengedURL = await discoverMetadataURLFromChallenge(mcpURL);
+            if (challengedURL) {
+                return {
+                    metadata: await fetchJSON(challengedURL),
+                    metadataURL: challengedURL,
+                };
+            }
+        }
+        catch (err) {
+            errors.push(err instanceof Error ? err.message : String(err));
+        }
+    }
+    throw new Error(`无法发现 OAuth protected resource metadata。请确认 MCP Server 已部署该端点，或使用 --resource-metadata-url 指定。\n${errors.join("\n")}`);
+}
+export async function discoverAuthorizationServer(issuer) {
+    const errors = [];
+    for (const url of authServerMetadataCandidates(issuer)) {
+        try {
+            const metadata = await fetchJSON(url);
+            // RFC 8414 §3.3：metadata 的 issuer 必须与发现所用 issuer 一致，
+            // 不一致说明文档不属于这个授权服务器，不能采信。
+            if (trimRightSlash(metadata.issuer || "") !== trimRightSlash(issuer)) {
+                errors.push(`metadata issuer mismatch: got ${metadata.issuer || "(empty)"} from ${url}`);
+                continue;
+            }
+            if (metadata.authorization_endpoint && metadata.token_endpoint) {
+                if (!metadata.code_challenge_methods_supported?.includes("S256")) {
+                    errors.push(`metadata missing PKCE S256 support: ${url}`);
+                    continue;
+                }
+                return {
+                    authorizationEndpoint: metadata.authorization_endpoint,
+                    tokenEndpoint: metadata.token_endpoint,
+                    registrationEndpoint: typeof metadata.registration_endpoint === "string"
+                        ? metadata.registration_endpoint
+                        : undefined,
+                    issuer,
+                    resourceDocumentation: typeof metadata.resource_documentation === "string"
+                        ? metadata.resource_documentation
+                        : undefined,
+                };
+            }
+            errors.push(`metadata missing endpoints: ${url}`);
+        }
+        catch (err) {
+            errors.push(err instanceof Error ? err.message : String(err));
+        }
+    }
+    // MCP 2025-11-25：metadata 不可用或缺 PKCE 声明时必须拒绝继续，
+    // 不允许猜测端点。可用 --authorization-endpoint/--token-endpoint 手动指定。
+    throw new Error(`无法发现可信的 authorization server metadata（issuer=${issuer}）。` +
+        `如需绕过自动发现，请同时指定 --authorization-endpoint 与 --token-endpoint。\n${errors.join("\n")}`);
+}
+export function knownOAuthDefaultsForMcpURL(mcpURL) {
+    const u = new URL(mcpURL);
+    const path = trimRightSlash(u.pathname);
+    const resourcePath = path === "/v1" ? "/v1" : "/mcp";
+    switch (u.hostname) {
+        case "ai-mcp-pre.tianyancha.com":
+            return {
+                issuer: "https://ai-pre.tianyancha.com/oauth",
+                resource: `https://ai-mcp-pre.tianyancha.com${resourcePath}`,
+            };
+        case "mcp.tianyancha.com":
+            return {
+                issuer: "https://ai.tianyancha.com/oauth",
+                resource: `https://mcp.tianyancha.com${resourcePath}`,
+            };
+        default:
+            return {};
+    }
+}
+export function createPKCE() {
+    const codeVerifier = randomBytes(32).toString("base64url");
+    const codeChallenge = createHash("sha256")
+        .update(codeVerifier)
+        .digest("base64url");
+    return { codeVerifier, codeChallenge };
+}
+export function randomState() {
+    return randomBytes(24).toString("base64url");
+}
+function callbackHTML(title, body) {
+    return `<!doctype html>
+<meta charset="utf-8">
+<title>${title}</title>
+<body style="font-family: system-ui, -apple-system, sans-serif; line-height: 1.5; padding: 32px;">
+  <h1>${title}</h1>
+  <p>${body}</p>
+</body>`;
+}
+export async function startCallbackServer(opts) {
+    let server;
+    let settled = false;
+    let timer;
+    const codePromise = new Promise((resolve, reject) => {
+        timer = setTimeout(() => {
+            if (settled)
+                return;
+            settled = true;
+            reject(new Error("等待 OAuth 回调超时"));
+            server?.close();
+        }, opts.timeoutMs);
+        server = createServer((req, res) => {
+            const url = new URL(req.url || "/", `http://${req.headers.host || opts.host}`);
+            if (url.pathname !== opts.path) {
+                res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
+                res.end("Not found");
+                return;
+            }
+            if (settled) {
+                res.writeHead(409, { "Content-Type": "text/html; charset=utf-8" });
+                res.end(callbackHTML("OAuth 已处理", "可以关闭这个窗口。"));
+                return;
+            }
+            const gotState = url.searchParams.get("state") || "";
+            const error = url.searchParams.get("error");
+            const errorDescription = url.searchParams.get("error_description");
+            const code = url.searchParams.get("code");
+            if (gotState !== opts.state) {
+                settled = true;
+                res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+                res.end(callbackHTML("OAuth 登录失败", "state 校验失败，请回到终端重新运行 tyc login。"));
+                reject(new Error("OAuth state mismatch"));
+                server?.close();
+                return;
+            }
+            if (error) {
+                settled = true;
+                res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+                res.end(callbackHTML("OAuth 登录失败", errorDescription || error));
+                reject(new Error(`OAuth error: ${errorDescription || error}`));
+                server?.close();
+                return;
+            }
+            if (!code) {
+                settled = true;
+                res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+                res.end(callbackHTML("OAuth 登录失败", "授权服务未返回 code。"));
+                reject(new Error("OAuth callback missing code"));
+                server?.close();
+                return;
+            }
+            settled = true;
+            res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+            res.end(callbackHTML("OAuth 登录成功", "tyc CLI 已收到授权结果，可以关闭这个窗口。"));
+            resolve(code);
+            server?.close();
+        });
+    });
+    await new Promise((resolve, reject) => {
+        if (!server) {
+            reject(new Error("callback server not initialized"));
+            return;
+        }
+        const onError = (err) => reject(err);
+        server.once("error", onError);
+        server.listen(opts.port, opts.host, () => {
+            server?.off("error", onError);
+            resolve();
+        });
+    });
+    const address = server?.address();
+    if (!address || typeof address.port !== "number") {
+        server?.close();
+        throw new Error("无法启动 OAuth 本地回调服务");
+    }
+    const redirectUri = `http://${opts.host}:${address.port}${opts.path}`;
+    return {
+        redirectUri,
+        close: () => {
+            if (timer)
+                clearTimeout(timer);
+            server?.close();
+        },
+        waitForCode: async () => {
+            try {
+                return await codePromise;
+            }
+            finally {
+                if (timer)
+                    clearTimeout(timer);
+                server?.close();
+            }
+        },
+    };
+}
+export function buildAuthorizationURL(opts) {
+    const url = new URL(opts.authorizationEndpoint);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("client_id", opts.clientId);
+    url.searchParams.set("redirect_uri", opts.redirectUri);
+    url.searchParams.set("scope", opts.scope);
+    url.searchParams.set("state", opts.state);
+    url.searchParams.set("code_challenge", opts.codeChallenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    if (opts.resource)
+        url.searchParams.set("resource", opts.resource);
+    return url.toString();
+}
+export async function registerDynamicOAuthClient(opts) {
+    const registered = await fetchJSON(opts.registrationEndpoint, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            client_name: opts.clientName,
+            redirect_uris: opts.redirectUris,
+            grant_types: opts.grantTypes || ["authorization_code", "refresh_token"],
+            response_types: opts.responseTypes || ["code"],
+            token_endpoint_auth_method: opts.tokenEndpointAuthMethod || "none",
+            application_type: "native",
+        }),
+    });
+    if (!registered.client_id) {
+        throw new Error("DCR response missing client_id");
+    }
+    return {
+        clientId: registered.client_id,
+        clientSecret: registered.client_secret,
+    };
+}
+export async function exchangeAuthorizationCode(opts) {
+    const body = new URLSearchParams();
+    body.set("grant_type", "authorization_code");
+    body.set("client_id", opts.clientId);
+    body.set("code", opts.code);
+    body.set("redirect_uri", opts.redirectUri);
+    body.set("code_verifier", opts.codeVerifier);
+    if (opts.clientSecret)
+        body.set("client_secret", opts.clientSecret);
+    if (opts.resource)
+        body.set("resource", opts.resource);
+    const resp = await fetch(opts.tokenEndpoint, {
+        method: "POST",
+        headers: {
+            Accept: "application/json",
+            "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body,
+    });
+    const text = await resp.text();
+    if (resp.status < 200 || resp.status >= 300) {
+        throw new Error(`token endpoint HTTP ${resp.status}: ${text.slice(0, 500)}`);
+    }
+    const token = JSON.parse(text);
+    if (!token.access_token) {
+        throw new Error("token endpoint response missing access_token");
+    }
+    return token;
+}
+export async function exchangeRefreshToken(opts) {
+    const body = new URLSearchParams();
+    body.set("grant_type", "refresh_token");
+    body.set("client_id", opts.clientId);
+    body.set("refresh_token", opts.refreshToken);
+    if (opts.clientSecret)
+        body.set("client_secret", opts.clientSecret);
+    if (opts.resource)
+        body.set("resource", opts.resource);
+    const resp = await fetch(opts.tokenEndpoint, {
+        method: "POST",
+        headers: {
+            Accept: "application/json",
+            "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body,
+    });
+    const text = await resp.text();
+    if (resp.status < 200 || resp.status >= 300) {
+        throw new Error(`token refresh HTTP ${resp.status}: ${text.slice(0, 500)}`);
+    }
+    const token = JSON.parse(text);
+    if (!token.access_token) {
+        throw new Error("token refresh response missing access_token");
+    }
+    return token;
+}
+function callbackSearchParams(raw) {
+    try {
+        const url = new URL(raw);
+        if (url.search)
+            return url.searchParams;
+        if (url.hash.includes("="))
+            return new URLSearchParams(url.hash.replace(/^#/, ""));
+        return null;
+    }
+    catch {
+        if (raw.startsWith("?") || raw.includes("code=") || raw.includes("error=")) {
+            return new URLSearchParams(raw.replace(/^[?#]/, ""));
+        }
+        return null;
+    }
+}
+export function parseAuthorizationCallbackCode(raw, expectedState) {
+    const trimmed = raw.trim();
+    if (!trimmed) {
+        throw new Error("empty callback token");
+    }
+    const params = callbackSearchParams(trimmed);
+    if (!params) {
+        return trimmed;
+    }
+    const error = params.get("error");
+    if (error) {
+        throw new Error(`OAuth error: ${params.get("error_description") || error}`);
+    }
+    const state = params.get("state");
+    if (expectedState && state && state !== expectedState) {
+        throw new Error("OAuth state mismatch");
+    }
+    const code = params.get("code");
+    if (!code) {
+        throw new Error("callback URL missing code");
+    }
+    return code;
+}
+export function openBrowser(url) {
+    const platform = process.platform;
+    let command;
+    let args;
+    if (platform === "darwin") {
+        command = "open";
+        args = [url];
+    }
+    else if (platform === "win32") {
+        command = "cmd";
+        args = ["/c", "start", "", url];
+    }
+    else {
+        command = "xdg-open";
+        args = [url];
+    }
+    const child = spawn(command, args, {
+        detached: true,
+        stdio: "ignore",
+    });
+    child.unref();
+}

package/dist/oauthPending.js

@@ -0,0 +1,41 @@
+// ~/.tyc/oauth_pending.json 读写
+//
+// 非阻塞 OAuth 登录会先保存 PKCE code_verifier、state、client_id 等一次性上下文；
+// 用户完成浏览器授权后，再用 tyc login --callback-token <code_or_callback_url> 继续换取 access token。
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+const PENDING_DIR = join(homedir(), ".tyc");
+export const PENDING_FILE = join(PENDING_DIR, "oauth_pending.json");
+export function loadPendingOAuthLogin() {
+    if (!existsSync(PENDING_FILE))
+        return null;
+    try {
+        const raw = readFileSync(PENDING_FILE, "utf-8");
+        return JSON.parse(raw);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`读取 OAuth pending 状态失败：${PENDING_FILE}：${msg}`);
+    }
+}
+export function savePendingOAuthLogin(pending) {
+    if (!existsSync(PENDING_DIR))
+        mkdirSync(PENDING_DIR, { recursive: true, mode: 0o700 });
+    writeFileSync(PENDING_FILE, JSON.stringify(pending, null, 2) + "\n", "utf-8");
+    try {
+        chmodSync(PENDING_FILE, 0o600);
+    }
+    catch { /* best effort */ }
+}
+export function clearPendingOAuthLogin(verbose = false) {
+    try {
+        rmSync(PENDING_FILE, { force: true });
+    }
+    catch (err) {
+        if (verbose) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.error(`> 清理 OAuth pending 状态失败（忽略）：${PENDING_FILE}：${msg}`);
+        }
+    }
+}

package/dist/types.js

@@ -2,8 +2,7 @@
 //
 // CLI 运行时模型：
 //  - Catalog：构建时由 apimcp 主仓生成，打包在 src/catalog.json，用于构建命令树
-//  - MCP 层类型：JSON-RPC 请求/响应、tools/call 结果
-//  - Session：本地缓存的 MCP 会话状态（~/.tyc/session.json）
-//  - Config：CLI 配置（~/.tyc/config.json），与主流 MCP 客户端配置风格一致
-//    { url, headers }
+//  - Tool call 结果：沿用 MCP content shape，便于共享输出逻辑
+//  - Config：CLI 配置（~/.tyc/config.json），{ url, coreUrl, headers }；
+//    OAuth 登录会额外保存 oauth 刷新上下文
 export {};

package/dist/version.js

@@ -1,6 +1,6 @@
 // CLI 版本号单一来源：从 package.json 读取
 //
-// 历史上 index.ts 与 mcpClient.ts 各自硬编码版本字符串，多处漂移。
+// 历史上 index.ts 与 client 实现各自硬编码版本字符串，多处漂移。
 // 收敛到 package.json 一处后，bump 版本只需 npm version <x>。
 // 运行时 fs 读：dev (`tsx src/version.ts`) 与 dist (`dist/version.js`) 与
 // package.json 都同级 (cli/t1_1/{src,dist} ↔ cli/t1_1/package.json)，

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "tyc-cli",
-  "version": "0.3.4",
-  "description": "天眼查 MCP CLI — 162 个业务语义聚合工具 · 命令行直达企业数据 · 通过 MCP Server 调用",
+  "version": "0.3.6",
+  "description": "天眼查 AI CLI — 162 个业务语义聚合工具 · 默认 Shared Core 调用 · 兼容 MCP transport",
   "main": "dist/index.js",
   "bin": {
     "tyc": "./dist/index.js"

package/dist/mcpClient.js

@@ -1,146 +0,0 @@
-// MCP JSON-RPC over Streamable HTTP 客户端
-//
-// 职责：
-//   1. initialize：拿 Mcp-Session-Id（服务端在响应 header 下发）
-//   2. tools/call：透传 Authorization + Mcp-Session-Id，解析 SSE/JSON 响应
-//   3. Session 失效（404/410 或服务端 "session not found"）→ 清 session → 重试 1 次
-//
-// 不做：
-//   - 不维护 tools/list 缓存（CLI 命令树从本地 catalog.json 构建）
-//   - 不做业务聚合/时间戳格式化（由 MCP Server 完成）
-//   - 不做 Authorization 解析/验签
-import { clearSession, isSessionFresh, loadSession, saveSession } from "./session.js";
-import { VERSION } from "./version.js";
-const PROTOCOL_VERSION = "2024-11-05";
-function maskToken(v) {
-    if (!v)
-        return "";
-    if (v.length <= 8)
-        return "****";
-    return v.slice(0, 4) + "****" + v.slice(-4);
-}
-function logVerbose(cfg, title, extra) {
-    const masked = {};
-    for (const [k, v] of Object.entries(cfg.headers)) {
-        masked[k] = k.toLowerCase() === "authorization" ? maskToken(v) : v;
-    }
-    console.error(`> ${title}`);
-    console.error(`> headers: ${JSON.stringify(masked)}`);
-    if (extra)
-        console.error(extra);
-}
-/** 解析 MCP Streamable HTTP 响应——server 端实测固定回 application/json 单包，
- *  无论 client Accept 头声明什么。SSE 路径不存在，所以只解析 JSON。 */
-function parseJsonRpc(raw) {
-    const trimmed = raw.trim();
-    if (!trimmed.startsWith("{")) {
-        throw new Error(`Unparseable MCP response: ${trimmed.slice(0, 200)}`);
-    }
-    return JSON.parse(trimmed);
-}
-async function httpPost(url, headers, body, verbose) {
-    const h = {
-        "Content-Type": "application/json",
-        "Accept": "application/json",
-        ...headers,
-    };
-    if (verbose) {
-        console.error(`> POST ${url}`);
-        const masked = {};
-        for (const [k, v] of Object.entries(h)) {
-            masked[k] = k.toLowerCase() === "authorization" ? maskToken(v) : v;
-        }
-        console.error(`> headers: ${JSON.stringify(masked)}`);
-        console.error(`> body: ${JSON.stringify(body)}`);
-    }
-    const resp = await fetch(url, {
-        method: "POST",
-        headers: h,
-        body: JSON.stringify(body),
-    });
-    const text = await resp.text();
-    if (verbose) {
-        console.error(`< ${resp.status} ${resp.statusText}`);
-        console.error(`< body: ${text.slice(0, 2000)}`);
-    }
-    return { status: resp.status, text, headers: resp.headers };
-}
-async function doInitialize(cfg, verbose) {
-    if (verbose)
-        logVerbose(cfg, `MCP initialize → ${cfg.url}`);
-    const { status, text, headers } = await httpPost(cfg.url, cfg.headers, {
-        jsonrpc: "2.0",
-        id: 1,
-        method: "initialize",
-        params: {
-            protocolVersion: PROTOCOL_VERSION,
-            capabilities: {},
-            clientInfo: { name: "tyc-cli", version: VERSION },
-        },
-    }, verbose);
-    if (status < 200 || status >= 300) {
-        throw new Error(`initialize 失败：HTTP ${status}\n${text.slice(0, 500)}`);
-    }
-    const sessionId = headers.get("Mcp-Session-Id") || headers.get("mcp-session-id");
-    if (!sessionId) {
-        throw new Error(`initialize 响应未包含 Mcp-Session-Id header。请确认 ${cfg.url} 是 Streamable HTTP MCP Server。`);
-    }
-    const rpc = parseJsonRpc(text);
-    if (rpc.error) {
-        throw new Error(`initialize JSON-RPC error: ${rpc.error.message}`);
-    }
-    const s = {
-        url: cfg.url,
-        sessionId,
-        initializedAt: Date.now(),
-        protocolVersion: rpc.result?.protocolVersion,
-    };
-    saveSession(s);
-    return s;
-}
-/** 获取可用 session：若缓存新鲜则复用，否则 initialize + 落盘。 */
-export async function ensureSession(cfg, opts) {
-    const cached = loadSession();
-    if (isSessionFresh(cached, cfg.url))
-        return cached;
-    return doInitialize(cfg, !!opts?.verbose);
-}
-function isSessionInvalidResponse(status, text) {
-    if (status === 404 || status === 410)
-        return true;
-    const lower = text.toLowerCase();
-    return lower.includes("session not found") || lower.includes("invalid session");
-}
-/** 调用 MCP tool；透明处理 session 失效重建。 */
-export async function callTool(cfg, name, args, opts) {
-    const verbose = !!opts?.verbose;
-    let session = await ensureSession(cfg, opts);
-    const doCall = async (s) => {
-        const h = { ...cfg.headers, "Mcp-Session-Id": s.sessionId };
-        return httpPost(cfg.url, h, {
-            jsonrpc: "2.0",
-            id: 2,
-            method: "tools/call",
-            params: { name, arguments: args },
-        }, verbose);
-    };
-    let resp = await doCall(session);
-    if (isSessionInvalidResponse(resp.status, resp.text)) {
-        if (verbose)
-            console.error("> session invalid, re-initializing …");
-        clearSession();
-        session = await doInitialize(cfg, verbose);
-        resp = await doCall(session);
-    }
-    if (resp.status < 200 || resp.status >= 300) {
-        throw new Error(`tools/call HTTP ${resp.status}\n${resp.text.slice(0, 500)}`);
-    }
-    const rpc = parseJsonRpc(resp.text);
-    if (rpc.error) {
-        throw new Error(`MCP error ${rpc.error.code}: ${rpc.error.message}`);
-    }
-    if (!rpc.result) {
-        throw new Error("tools/call 响应缺少 result 字段");
-    }
-    return rpc.result;
-}