vitaminmcp 3.1.0 → 3.1.1

package/checksums.json

@@ -1,14 +1,14 @@
 {
-  "version": "3.1.0",
+  "version": "3.1.1",
   "jars": {
-    "mcp-server.jar": "f64ee16d5aaa115a9d4e019adccf830b74ebe8683d2ade5e05b7db0cf9692d66"
+    "mcp-server.jar": "423c885926a6c5f82d1c403ce01592afabfcc0646b756c5ce7370a0a88be09b1"
   },
   "assets": {
-    "bot-runner-win-x64.exe": "8af36a3e4a3678db5246777c1c8080bea230b50a742dff173758d0513df74e98",
-    "bot-runner-linux-x64": "2f344983a5558d36cf03e4bcf55e0752324d159aebefc18f711c28704cf48264",
-    "bot-runner-linux-arm64": "fa6c49b5db5b6cc84b62d295bbef2ace49305400a7480e86baa009e9629d120c",
-    "bot-runner-darwin-x64": "1769db980857d36204bf93e14bbe5ba329435032b116c8003a12043ba817168a",
-    "bot-runner-darwin-arm64": "b137677b9117af944d006ff0da0e94b524875c86ebfa2596c2b856b9ef63fd2e",
+    "bot-runner-win-x64.exe": "0f97651dd8bdc9861b587780ced4b94711ccaf52e5383ca1d61796b89c6c9947",
+    "bot-runner-linux-x64": "c178ef44dfb36f9e0fab3b2e78ba954e670bc0e227c49a2ef00de345ef96c6d6",
+    "bot-runner-linux-arm64": "65cd7adb1c35fbfe20671b59f9bb95b15ba9b0678646b3c4ce53d24e93024617",
+    "bot-runner-darwin-x64": "8c67b91564c8db96e27c817e0adaa778426ba5cc300ea6e2cd71c6aeb00e9737",
+    "bot-runner-darwin-arm64": "a0a6467a8fe08254fa4d1e830d16fad3368d6f8e8fb2ba18e078a7073243cbb9",
     "bot-runner-viewer-win-x64.tgz": "e39a36cdf92b9223aa7c9610f8231afc7a577e8ed007bc3571895bd945baf3e1"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vitaminmcp",
-  "version": "3.1.0",
+  "version": "3.1.1",
   "mcpName": "io.github.Backas03/vitaminmcp",
   "description": "MCP server for testing Minecraft plugins: drives a real Paper server and real protocol bots from an AI agent.",
   "keywords": [
@@ -25,7 +25,8 @@
   "type": "module",
   "dependencies": {
     "mineflayer": "^4.37.1",
-    "mineflayer-pathfinder": "2.4.5"
+    "mineflayer-pathfinder": "2.4.5",
+    "prismarine-auth": "^3.1.1"
   },
   "bin": {
     "vitaminmcp": "bin/vitaminmcp.mjs"

package/runner/src/bots.mjs

@@ -1,4 +1,8 @@
 import mineflayer from 'mineflayer';
+import { mkdir } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+import prismarineAuth from 'prismarine-auth';
 import { configurePathfinder, loadPathfinder, moveTo } from './movement.mjs';
 import { reachable } from './movement.mjs';
 import { stopAllViews, stopView as stopBotView, view as startView } from './viewer.mjs';
@@ -7,6 +11,12 @@ import { collect, forget } from './clientview.mjs';
 import { addressField, identity } from './identity.mjs';
 import { answerResourcePacks, describeProgress, traceProgress } from './join.mjs';
 
+const { Authflow } = prismarineAuth;
+
+const DEFAULT_ACCOUNTS_DIRECTORY = resolve(
+  process.env.VITAMINMCP_ACCOUNTS_DIR ?? join(homedir(), '.vitaminmcp', 'accounts'),
+);
+
 /** How long a bot has to get from a socket to standing in the world. */
 const LOGIN_TIMEOUT_MILLIS = 30_000;
 
@@ -28,16 +38,19 @@ export class BotRegistry {
 
   #version;
 
+  #accounts;
+
   #bots = new Map();
 
-  constructor(host, port, version) {
+  constructor(host, port, version, accounts = new MicrosoftAccounts()) {
     this.#host = host;
     this.#port = port;
     this.#version = version;
+    this.#accounts = accounts;
   }
 
   /** Connects a bot and waits until it is standing in the world. */
-  async spawn(name, clientIp) {
+  async spawn(name, clientIp, auth = 'offline', account = '') {
     // The Java runner overwrites the map entry, so a repeated spawn is not an error there and must
     // not become one here. Closing the old socket first is the only difference: leaving it open
     // would hold a player slot under a name this runner no longer tracks.
@@ -47,12 +60,40 @@ export class BotRegistry {
       quietly(() => existing.quit());
     }
 
-    const id = identity(name);
-    // Normal logins use the server's ordinary offline UUID for this name, which stays stable when
-    // a test reuses the same bot. A clientIp is an explicit request for the opt-in BungeeCord
-    // forwarding handshake used by tests that need a spoofed address or UUID.
+    const mode = authenticationMode(auth);
+    if (mode === 'microsoft' && clientIp?.trim()) {
+      throw new Error('clientIp forwarding is only available for offline bots');
+    }
+
+    const accountKey = account?.trim() || name;
+    const authenticated = mode === 'microsoft'
+      ? await this.#accounts.require(accountKey)
+      : null;
+    if (authenticated && authenticated.profile.name.toLowerCase() !== name.toLowerCase()) {
+      throw new Error(
+        `Microsoft account '${accountKey}' owns profile '${authenticated.profile.name}', `
+          + `not '${name}'. Call bot_spawn with name='${authenticated.profile.name}'.`,
+      );
+    }
+
+    const id = authenticated
+      ? identity(authenticated.profile.name, { uuid: canonicalUuid(authenticated.profile.id) })
+      : identity(name);
     const bot = mineflayer.createBot(
-      connectionOptions(this.#host, this.#port, this.#version, id, clientIp),
+      connectionOptions(
+        this.#host,
+        this.#port,
+        this.#version,
+        id,
+        clientIp,
+        mode,
+        accountKey,
+        authenticated?.profilesFolder,
+        (code) => {
+          this.#accounts.invalidate(accountKey);
+          throw new Error(loginRequired(accountKey, code));
+        },
+      ),
     );
     loadPathfinder(bot);
 
@@ -84,7 +125,11 @@ export class BotRegistry {
     configurePathfinder(bot);
     await settle(bot, name);
     await worldKnown(bot, name);
-    return position(bot);
+    return {
+      ...position(bot),
+      playerName: id.name,
+      uuid: id.uuid,
+    };
   }
 
   async move(name, x, y, z, mode, timeoutMillis) {
@@ -144,24 +189,151 @@ export class BotRegistry {
   }
 }
 
-/** Builds a normal login, adding BungeeCord forwarding only for an explicit clientIp test. */
-export function connectionOptions(host, port, version, id, clientIp) {
+/** Builds a login, adding BungeeCord forwarding only for an explicit offline-mode IP test. */
+export function connectionOptions(
+  host,
+  port,
+  version,
+  id,
+  clientIp,
+  auth = 'offline',
+  account = id.name,
+  profilesFolder = DEFAULT_ACCOUNTS_DIRECTORY,
+  onMsaCode = undefined,
+) {
+  const mode = authenticationMode(auth);
   const options = {
     host,
     port,
-    username: id.name,
-    auth: 'offline',
+    username: mode === 'microsoft' ? account : id.name,
+    auth: mode,
     version,
     checkTimeoutInterval: LOGIN_TIMEOUT_MILLIS,
     // mineflayer's default console.logs bot errors, and stdout is the protocol channel.
     logErrors: false,
   };
-  if (clientIp && clientIp.trim()) {
+  if (mode === 'microsoft') {
+    options.profilesFolder = profilesFolder;
+    options.onMsaCode = onMsaCode;
+  } else if (clientIp && clientIp.trim()) {
     options.fakeHost = addressField(host, clientIp.trim(), id);
   }
   return options;
 }
 
+/** Microsoft device-code authentication that survives a failed first spawn through its cache. */
+export class MicrosoftAccounts {
+  #directory;
+
+  #createFlow;
+
+  #states = new Map();
+
+  constructor(
+    directory = DEFAULT_ACCOUNTS_DIRECTORY,
+    createFlow = (account, profilesFolder, onCode) => new Authflow(
+      account,
+      profilesFolder,
+      undefined,
+      onCode,
+    ),
+  ) {
+    this.#directory = resolve(directory);
+    this.#createFlow = createFlow;
+  }
+
+  async require(account) {
+    let state = this.#states.get(account);
+    if (!state) {
+      state = this.#start(account);
+      this.#states.set(account, state);
+    }
+    if (state.status === 'starting') {
+      await state.firstUpdate;
+    }
+    if (state.status === 'ready') {
+      return { profile: state.profile, profilesFolder: this.#directory };
+    }
+    if (state.status === 'failed') {
+      this.#states.delete(account);
+      throw state.error;
+    }
+    throw new Error(loginRequired(account, state.code));
+  }
+
+  invalidate(account) {
+    this.#states.delete(account);
+  }
+
+  #start(account) {
+    let announce;
+    const state = {
+      status: 'starting',
+      code: null,
+      profile: null,
+      error: null,
+      firstUpdate: new Promise((resolveFirstUpdate) => {
+        announce = resolveFirstUpdate;
+      }),
+    };
+
+    const authenticate = async () => {
+      await mkdir(this.#directory, { recursive: true, mode: 0o700 });
+      const flow = this.#createFlow(account, this.#directory, (code) => {
+        state.status = 'pending';
+        state.code = code;
+        announce();
+      });
+      const result = await flow.getMinecraftJavaToken({
+        fetchProfile: true,
+        fetchCertificates: false,
+      });
+      if (!result.profile?.name || !result.profile?.id) {
+        throw new Error(`Microsoft account '${account}' has no Minecraft Java profile`);
+      }
+      state.status = 'ready';
+      state.profile = result.profile;
+      announce();
+    };
+
+    authenticate().catch((error) => {
+      state.status = 'failed';
+      state.error = error instanceof Error ? error : new Error(String(error));
+      announce();
+    });
+    return state;
+  }
+}
+
+function authenticationMode(auth) {
+  const mode = String(auth || 'offline').toLowerCase();
+  if (mode !== 'offline' && mode !== 'microsoft') {
+    throw new Error(`unknown bot auth '${auth}'; use offline or microsoft`);
+  }
+  return mode;
+}
+
+function loginRequired(account, code) {
+  const uri = code?.verification_uri || 'https://www.microsoft.com/link';
+  const userCode = code?.user_code || '(request a new code)';
+  return `Microsoft login required for account '${account}'. Open ${uri} and enter code `
+    + `${userCode}, complete sign-in, then call bot_spawn again with the same name and account.`;
+}
+
+function canonicalUuid(value) {
+  const compact = String(value).replaceAll('-', '');
+  if (!/^[0-9a-fA-F]{32}$/.test(compact)) {
+    throw new Error(`Microsoft returned an invalid Minecraft profile UUID: ${value}`);
+  }
+  return [
+    compact.slice(0, 8),
+    compact.slice(8, 12),
+    compact.slice(12, 16),
+    compact.slice(16, 20),
+    compact.slice(20),
+  ].join('-').toLowerCase();
+}
+
 function position(bot) {
   const at = bot.entity?.position;
   return at ? { x: at.x, y: at.y, z: at.z } : { x: 0, y: 0, z: 0 };

package/runner/src/dispatch.mjs

@@ -39,7 +39,9 @@ export class Dispatch {
     switch (verb) {
       case protocol.SPAWN: {
         const clientIp = command.length > 2 ? command[2] : '';
-        return positionLine(verb, await this.#bots.spawn(command[1], clientIp));
+        const auth = command.length > 3 ? command[3] : 'offline';
+        const account = command.length > 4 ? command[4] : '';
+        return spawnLine(verb, await this.#bots.spawn(command[1], clientIp, auth, account));
       }
 
       case protocol.DESPAWN: {
@@ -302,3 +304,15 @@ function positionLine(verb, at) {
     protocol.javaDouble(at.z),
   );
 }
+
+function spawnLine(verb, at) {
+  return protocol.encode(
+    protocol.OK,
+    verb,
+    protocol.javaDouble(at.x),
+    protocol.javaDouble(at.y),
+    protocol.javaDouble(at.z),
+    protocol.sanitize(at.playerName),
+    protocol.sanitize(at.uuid),
+  );
+}