@ai-ecoverse/mcpcat 0.14.1 → 0.14.2

package/dist/host/mcpcat.mjs

@@ -49,6 +49,101 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// src/config/lock.ts
+var lock_exports = {};
+__export(lock_exports, {
+  acquireLock: () => acquireLock
+});
+function isEexist(err) {
+  if (err instanceof Error && "code" in err)
+    return err.code === "EEXIST";
+  if (err instanceof Error) return err.message.includes("EEXIST");
+  return false;
+}
+async function removeStaleLockDir(fs, lockPath) {
+  try {
+    const s = await fs.stat(lockPath);
+    if (Date.now() - s.mtimeMs > LOCK_STALE_MS) {
+      try {
+        await fs.rmdir(lockPath);
+      } catch {
+      }
+      return true;
+    }
+  } catch {
+  }
+  return false;
+}
+async function removeStaleLockFile(fs, lockPath) {
+  try {
+    const s = await fs.stat(lockPath);
+    if (Date.now() - s.mtimeMs > LOCK_STALE_MS) {
+      try {
+        await fs.unlink(lockPath);
+      } catch {
+      }
+      return true;
+    }
+  } catch {
+  }
+  return false;
+}
+async function acquireLock(fs, configPath) {
+  const useFile = typeof fs.createExclusive === "function";
+  const lockPath = `${configPath}.lock`;
+  const start = Date.now();
+  const parentDir = lockPath.slice(0, lockPath.lastIndexOf("/"));
+  if (parentDir) {
+    try {
+      await fs.mkdir(parentDir);
+    } catch {
+    }
+  }
+  while (true) {
+    try {
+      if (useFile) {
+        await fs.createExclusive(lockPath);
+      } else {
+        await fs.mkdirExclusive(lockPath);
+      }
+      break;
+    } catch (err) {
+      if (!isEexist(err)) throw err;
+      if (useFile) {
+        await removeStaleLockFile(fs, lockPath);
+      } else {
+        await removeStaleLockDir(fs, lockPath);
+      }
+    }
+    if (Date.now() - start > LOCK_MAX_WAIT_MS) {
+      throw new Error(`mcpcat: could not acquire lock ${lockPath} within ${LOCK_MAX_WAIT_MS}ms`);
+    }
+    await new Promise((r) => setTimeout(r, LOCK_POLL_MS));
+  }
+  let released = false;
+  return async () => {
+    if (released) return;
+    released = true;
+    try {
+      if (useFile && fs.unlink) {
+        await fs.unlink(lockPath);
+      } else {
+        await fs.rmdir(lockPath);
+      }
+    } catch {
+    }
+  };
+}
+var LOCK_STALE_MS, LOCK_POLL_MS, LOCK_MAX_WAIT_MS;
+var init_lock = __esm({
+  "src/config/lock.ts"() {
+    "use strict";
+    LOCK_STALE_MS = 1e4;
+    LOCK_POLL_MS = 50;
+    LOCK_MAX_WAIT_MS = 5e3;
+  }
+});
+
 // node_modules/isexe/windows.js
 var require_windows = __commonJS({
   "node_modules/isexe/windows.js"(exports, module) {
@@ -6345,7 +6440,7 @@ var McpOAuthProvider = class {
 };
 
 // src/auth/jerk-token-source.ts
-var MIN_VERSION = [0, 13, 0];
+var MIN_VERSION = [0, 14, 1];
 var VERSION_TIMEOUT_MS = 2e3;
 var cachedAvailable;
 function parseVersion(raw) {
@@ -6471,6 +6566,192 @@ var JerkTokenSource = class {
   }
 };
 
+// src/auth/pi-store.ts
+init_lock();
+
+// src/config/paths.ts
+function userConfigDir(platform2) {
+  const piDir = platform2.env.PI_CODING_AGENT_DIR;
+  if (piDir) return piDir;
+  const home = platform2.env.HOME ?? platform2.env.USERPROFILE ?? "/";
+  return `${home}/.pi/agent`;
+}
+function userConfigPath(platform2) {
+  return `${userConfigDir(platform2)}/mcp.json`;
+}
+function projectConfigPath(platform2) {
+  return `${platform2.cwd}/.pi/mcp.json`;
+}
+function stateDir(platform2) {
+  if (platform2.env.XDG_STATE_HOME) return `${platform2.env.XDG_STATE_HOME}/mcpcat`;
+  const home = platform2.env.HOME ?? platform2.env.USERPROFILE ?? "/";
+  if (platform2.env.LOCALAPPDATA) return `${platform2.env.LOCALAPPDATA}\\mcpcat\\state`;
+  if (platform2.env.SLICC_KERNEL) return `${home}/.local/state/mcpcat`;
+  return `${home}/Library/Application Support/mcpcat`;
+}
+
+// src/auth/token-source.ts
+function mcpNamespace(server) {
+  return `mcp__${server.replace(/-/g, "_")}`;
+}
+function storeKey(name, serverUrl) {
+  const ns = mcpNamespace(name);
+  const url = String(new URL(serverUrl));
+  return `${ns}|${url}`;
+}
+function isKernel(platform2) {
+  return platform2.kind === "kernel";
+}
+
+// src/auth/pi-store.ts
+var AUTH_FILE = "mcp-auth.json";
+var FILE_MODE = 384;
+var DIR_MODE = 448;
+function parseStates(raw) {
+  if (!raw?.trim()) return {};
+  const parsed = JSON.parse(raw);
+  return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : {};
+}
+function serializeStates(states) {
+  return `${JSON.stringify(states, null, 2)}
+`;
+}
+function legacyKey(serverUrl) {
+  return String(new URL(serverUrl));
+}
+var PiFileTokenSource = class {
+  platform;
+  authPath;
+  dirPath;
+  constructor(platform2) {
+    this.platform = platform2;
+    this.dirPath = userConfigDir(platform2);
+    this.authPath = `${this.dirPath}/${AUTH_FILE}`;
+  }
+  get path() {
+    return this.authPath;
+  }
+  async loadWithoutLock(name, serverUrl) {
+    const key = storeKey(name, serverUrl);
+    const legacy = legacyKey(serverUrl);
+    try {
+      const raw = await this.readRaw();
+      const states = parseStates(raw);
+      return states[key] ?? states[legacy];
+    } catch {
+      return void 0;
+    }
+  }
+  async getToken(name, serverUrl) {
+    const state = await this.load(name, serverUrl);
+    if (!state?.tokens?.access_token) return void 0;
+    return {
+      accessToken: state.tokens.access_token,
+      expiresAt: state.tokensExpireAt
+    };
+  }
+  async load(name, serverUrl) {
+    const key = storeKey(name, serverUrl);
+    const legacy = legacyKey(serverUrl);
+    const release = await this.acquireLock();
+    try {
+      const raw = await this.readRaw();
+      const states = parseStates(raw);
+      if (states[key]) return states[key];
+      if (states[legacy]) {
+        states[key] = states[legacy];
+        delete states[legacy];
+        await this.writeStates(states);
+        return states[key];
+      }
+      return void 0;
+    } finally {
+      await release();
+    }
+  }
+  async save(name, serverUrl, state) {
+    const key = storeKey(name, serverUrl);
+    const release = await this.acquireLock();
+    try {
+      const raw = await this.readRaw();
+      const states = parseStates(raw);
+      states[key] = state;
+      await this.writeStates(states);
+    } finally {
+      await release();
+    }
+  }
+  async remove(name, serverUrl) {
+    const key = storeKey(name, serverUrl);
+    const legacy = legacyKey(serverUrl);
+    const release = await this.acquireLock();
+    try {
+      const raw = await this.readRaw();
+      const states = parseStates(raw);
+      const stored = key in states ? key : legacy in states ? legacy : void 0;
+      if (!stored) return false;
+      delete states[stored];
+      await this.writeStates(states);
+      return true;
+    } finally {
+      await release();
+    }
+  }
+  async acquireLock() {
+    await this.ensureDir();
+    return acquireLock(this.platform.fs, this.authPath);
+  }
+  async ensureDir() {
+    const fs = this.platform.fs;
+    try {
+      await fs.mkdir(this.dirPath, { mode: DIR_MODE });
+    } catch {
+    }
+    if (fs.chmod) {
+      try {
+        await fs.chmod(this.dirPath, DIR_MODE);
+      } catch {
+      }
+      const piDir = this.dirPath.slice(0, this.dirPath.lastIndexOf("/"));
+      if (piDir) {
+        try {
+          await fs.chmod(piDir, DIR_MODE);
+        } catch {
+        }
+      }
+    }
+  }
+  async readRaw() {
+    try {
+      const data = await this.platform.fs.readFile(this.authPath);
+      return new TextDecoder().decode(data);
+    } catch {
+      return void 0;
+    }
+  }
+  async writeStates(states) {
+    const fs = this.platform.fs;
+    const content = serializeStates(states);
+    const tmpPath = `${this.authPath}.tmp.${Date.now()}`;
+    try {
+      await fs.writeFile(tmpPath, content, { mode: FILE_MODE });
+      await fs.rename(tmpPath, this.authPath);
+    } catch (renameErr) {
+      try {
+        if (fs.unlink) await fs.unlink(tmpPath);
+      } catch {
+      }
+      throw renameErr;
+    }
+    if (fs.chmod) {
+      try {
+        await fs.chmod(this.authPath, FILE_MODE);
+      } catch {
+      }
+    }
+  }
+};
+
 // src/auth/auth-provider.ts
 var CIMD_URL = "https://mcpcat.sliccy.ai/oauth/client.json";
 var CLIENT_NAME = "mcpcat";
@@ -6492,10 +6773,12 @@ var SourceBackedStore = class {
   source;
   name;
   serverUrl;
-  constructor(source, name, serverUrl) {
+  platform;
+  constructor(source, name, serverUrl, platform2) {
     this.source = source;
     this.name = name;
     this.serverUrl = serverUrl;
+    this.platform = platform2;
   }
   async load() {
     return this.source.load(this.name, this.serverUrl);
@@ -6503,6 +6786,17 @@ var SourceBackedStore = class {
   async save(state) {
     await this.source.save(this.name, this.serverUrl, state);
   }
+  async withRefreshLock(fn) {
+    if (!(this.source instanceof PiFileTokenSource)) return fn();
+    const refreshPath = `${this.source.path}.refresh`;
+    const { acquireLock: acquireLock2 } = await Promise.resolve().then(() => (init_lock(), lock_exports));
+    const release = await acquireLock2(this.platform.fs, refreshPath);
+    try {
+      return await fn();
+    } finally {
+      await release();
+    }
+  }
 };
 function cimdFn(redirectUrl) {
   return (metadata) => {
@@ -6531,10 +6825,9 @@ function createMcpAuthProvider(options) {
 function createJerkAuthProvider(options) {
   const { name, serverUrl, source } = options;
   let currentToken;
+  const _fetched = false;
   return {
     async token() {
-      const result = await source.getToken(name, serverUrl);
-      currentToken = result?.accessToken;
       return currentToken;
     },
     async onUnauthorized(context) {
@@ -6565,10 +6858,10 @@ function createJerkAuthProvider(options) {
 }
 function createPiAuthProvider(options) {
   const { name, serverUrl, source, oauth, platform: platform2 } = options;
-  const store = new SourceBackedStore(source, name, serverUrl);
+  const store = new SourceBackedStore(source, name, serverUrl, platform2);
   let refreshing;
   const refresh = async (staleToken) => {
-    refreshing ??= (async () => {
+    refreshing ??= store.withRefreshLock(async () => {
       const state = await store.load();
       if (state?.tokens?.access_token !== staleToken) return;
       if (!state?.tokens?.refresh_token) throw new McpOAuthAuthorizationRequiredError();
@@ -6591,7 +6884,7 @@ function createPiAuthProvider(options) {
         fetch: timedFetch(platform2.fetch)
       });
       if (result === "REDIRECT") throw new McpOAuthAuthorizationRequiredError();
-    })().finally(() => {
+    }).finally(() => {
       refreshing = void 0;
     });
     return refreshing;
@@ -9571,27 +9864,6 @@ async function loadConfig(input) {
   };
 }
 
-// src/config/paths.ts
-function userConfigDir(platform2) {
-  const piDir = platform2.env.PI_CODING_AGENT_DIR;
-  if (piDir) return piDir;
-  const home = platform2.env.HOME ?? platform2.env.USERPROFILE ?? "/";
-  return `${home}/.pi/agent`;
-}
-function userConfigPath(platform2) {
-  return `${userConfigDir(platform2)}/mcp.json`;
-}
-function projectConfigPath(platform2) {
-  return `${platform2.cwd}/.pi/mcp.json`;
-}
-function stateDir(platform2) {
-  if (platform2.env.XDG_STATE_HOME) return `${platform2.env.XDG_STATE_HOME}/mcpcat`;
-  const home = platform2.env.HOME ?? platform2.env.USERPROFILE ?? "/";
-  if (platform2.env.LOCALAPPDATA) return `${platform2.env.LOCALAPPDATA}\\mcpcat\\state`;
-  if (platform2.env.SLICC_KERNEL) return `${home}/.local/state/mcpcat`;
-  return `${home}/Library/Application Support/mcpcat`;
-}
-
 // src/config/index.ts
 var MergedConfigSource = class _MergedConfigSource {
   entries;
@@ -9631,65 +9903,8 @@ var MergedConfigSource = class _MergedConfigSource {
   }
 };
 
-// src/config/lock.ts
-var LOCK_STALE_MS = 1e4;
-var LOCK_POLL_MS = 50;
-var LOCK_MAX_WAIT_MS = 5e3;
-function isEexist(err) {
-  if (err instanceof Error && "code" in err)
-    return err.code === "EEXIST";
-  if (err instanceof Error) return err.message.includes("EEXIST");
-  return false;
-}
-async function removeStaleLock(fs, lockPath) {
-  try {
-    const s = await fs.stat(lockPath);
-    if (Date.now() - s.mtimeMs > LOCK_STALE_MS) {
-      try {
-        await fs.rmdir(lockPath);
-      } catch {
-      }
-      return true;
-    }
-  } catch {
-  }
-  return false;
-}
-async function acquireLock(fs, configPath) {
-  const lockPath = `${configPath}.lock`;
-  const start = Date.now();
-  const parentDir = lockPath.slice(0, lockPath.lastIndexOf("/"));
-  if (parentDir) {
-    try {
-      await fs.mkdir(parentDir);
-    } catch {
-    }
-  }
-  while (true) {
-    try {
-      await fs.mkdirExclusive(lockPath);
-      break;
-    } catch (err) {
-      if (!isEexist(err)) throw err;
-      await removeStaleLock(fs, lockPath);
-    }
-    if (Date.now() - start > LOCK_MAX_WAIT_MS) {
-      throw new Error(`mcpcat: could not acquire lock ${lockPath} within ${LOCK_MAX_WAIT_MS}ms`);
-    }
-    await new Promise((r) => setTimeout(r, LOCK_POLL_MS));
-  }
-  let released = false;
-  return async () => {
-    if (released) return;
-    released = true;
-    try {
-      await fs.rmdir(lockPath);
-    } catch {
-    }
-  };
-}
-
 // src/config/edit.ts
+init_lock();
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -12934,124 +13149,6 @@ async function signIn(options) {
   }
 }
 
-// src/auth/token-source.ts
-function mcpNamespace(server) {
-  return `mcp__${server.replace(/-/g, "_")}`;
-}
-function storeKey(name, serverUrl) {
-  const ns = mcpNamespace(name);
-  const url = String(new URL(serverUrl));
-  return `${ns}|${url}`;
-}
-function isKernel(platform2) {
-  return platform2.kind === "kernel";
-}
-
-// src/auth/pi-store.ts
-var AUTH_FILE = "mcp-auth.json";
-var FILE_MODE = 384;
-function parseStates(raw) {
-  if (!raw?.trim()) return {};
-  const parsed = JSON.parse(raw);
-  return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : {};
-}
-function serializeStates(states) {
-  return `${JSON.stringify(states, null, 2)}
-`;
-}
-function legacyKey(serverUrl) {
-  return String(new URL(serverUrl));
-}
-var PiFileTokenSource = class {
-  platform;
-  authPath;
-  dirPath;
-  constructor(platform2) {
-    this.platform = platform2;
-    this.dirPath = userConfigDir(platform2);
-    this.authPath = `${this.dirPath}/${AUTH_FILE}`;
-  }
-  get path() {
-    return this.authPath;
-  }
-  async getToken(name, serverUrl) {
-    const state = await this.load(name, serverUrl);
-    if (!state?.tokens?.access_token) return void 0;
-    return {
-      accessToken: state.tokens.access_token,
-      expiresAt: state.tokensExpireAt
-    };
-  }
-  async load(name, serverUrl) {
-    const key = storeKey(name, serverUrl);
-    const legacy = legacyKey(serverUrl);
-    const release = await this.acquireLock();
-    try {
-      const raw = await this.readRaw();
-      const states = parseStates(raw);
-      if (states[key]) return states[key];
-      if (states[legacy]) {
-        states[key] = states[legacy];
-        delete states[legacy];
-        await this.writeStates(states);
-        return states[key];
-      }
-      return void 0;
-    } finally {
-      await release();
-    }
-  }
-  async save(name, serverUrl, state) {
-    const key = storeKey(name, serverUrl);
-    const release = await this.acquireLock();
-    try {
-      const raw = await this.readRaw();
-      const states = parseStates(raw);
-      states[key] = state;
-      await this.writeStates(states);
-    } finally {
-      await release();
-    }
-  }
-  async remove(name, serverUrl) {
-    const key = storeKey(name, serverUrl);
-    const legacy = legacyKey(serverUrl);
-    const release = await this.acquireLock();
-    try {
-      const raw = await this.readRaw();
-      const states = parseStates(raw);
-      const stored = key in states ? key : legacy in states ? legacy : void 0;
-      if (!stored) return false;
-      delete states[stored];
-      await this.writeStates(states);
-      return true;
-    } finally {
-      await release();
-    }
-  }
-  async acquireLock() {
-    await this.ensureDir();
-    return acquireLock(this.platform.fs, this.authPath);
-  }
-  async ensureDir() {
-    try {
-      await this.platform.fs.mkdir(this.dirPath);
-    } catch {
-    }
-  }
-  async readRaw() {
-    try {
-      const data = await this.platform.fs.readFile(this.authPath);
-      return new TextDecoder().decode(data);
-    } catch {
-      return void 0;
-    }
-  }
-  async writeStates(states) {
-    await this.platform.fs.writeFile(this.authPath, serializeStates(states), { mode: FILE_MODE });
-  }
-};
-
 // src/cli/auth-verbs.ts
 var resolvedSource;
 async function createTokenSource(platform2) {
@@ -14745,6 +14842,17 @@ async function runCall(platform2, conn, toolName, dataArg, toolArgs, opts) {
       return EXIT_USAGE;
     }
     fin = mergeArgs(base, c.value);
+  } else if (!dataArg && !opts.noValidate) {
+    const tools = await conn.listTools();
+    const tool = tools.find((t) => t.name === toolName);
+    const schema = tool?.inputSchema;
+    const required = Array.isArray(schema?.required) ? schema.required : [];
+    for (const r of required) {
+      if (!Object.hasOwn(base, r)) {
+        await writeErr(platform2, opts.json ?? false, "usage", `missing required flag --${r}`);
+        return EXIT_USAGE;
+      }
+    }
   }
   return renderCallResult(
     platform2,
@@ -14962,7 +15070,10 @@ async function probeServer(_name, config, platform2) {
     const opts = { version: "probe" };
     if ("url" in config && config.url) {
       opts.url = config.url;
-      if ("headers" in config) opts.headers = config.headers;
+      if ("headers" in config) {
+        const expanded = expandHeaders(config.headers, platform2.env);
+        if (expanded) opts.headers = expanded;
+      }
     } else if ("command" in config && config.command) {
       opts.command = config.command;
       if ("args" in config) opts.args = config.args;
@@ -15324,11 +15435,25 @@ function classifyError(err) {
 }
 async function resolveAuthProvider(platform2, hasAuthHeader, url, target, config) {
   if (hasAuthHeader || !url) return void 0;
-  const source = await createTokenSource(platform2);
+  const piSource = new PiFileTokenSource(platform2);
   const entry = config.entry(target);
   const oauth = entry && "url" in entry.config ? entry.config.oauth : void 0;
   const name = entry ? target : `url:${new URL(url).origin}${new URL(url).pathname}`;
-  return createMcpAuthProvider({ name, serverUrl: url, source, oauth, platform: platform2 });
+  const provider = createMcpAuthProvider({
+    name,
+    serverUrl: url,
+    source: piSource,
+    oauth,
+    platform: platform2
+  });
+  const credentialSecrets = [];
+  const state = await piSource.loadWithoutLock(name, url);
+  if (state?.tokens?.access_token) credentialSecrets.push(state.tokens.access_token);
+  if (state?.tokens?.refresh_token) credentialSecrets.push(state.tokens.refresh_token);
+  if (state?.clientInformation && "client_secret" in state.clientInformation && state.clientInformation.client_secret) {
+    credentialSecrets.push(state.clientInformation.client_secret);
+  }
+  return { provider, credentialSecrets };
 }
 function classifyConnectionError(err, target, interrupted) {
   if (err instanceof McpAuthError || err instanceof AuthStepUpError || err instanceof JerkSignInRequiredError) {
@@ -15374,7 +15499,7 @@ async function handleInputRequired(platform2, conn, err, respondData, json) {
 `);
     return EXIT_INPUT_REQUIRED;
   }
-  const isTty = platform2.isatty(0);
+  const isTty = platform2.isatty(0) && platform2.isatty(2);
   const elicitResult = await handleElicitation(platform2, inputReq, isTty, respondData);
   if ("exitCode" in elicitResult) {
     await platform2.write(2, `${err.requestJson}
@@ -15467,13 +15592,20 @@ async function runClientVerb(platform2, version, parsed) {
   };
   const mergedHeaders = { ...configHeaders, ...expanded };
   const hasAuthHeader = "Authorization" in mergedHeaders;
-  const authProvider = await resolveAuthProvider(
+  const authResolved = await resolveAuthProvider(
     platform2,
     hasAuthHeader,
     resolved.url,
     target,
     config
   );
+  const authProvider = authResolved?.provider;
+  if (authResolved?.credentialSecrets) {
+    for (const s of authResolved.credentialSecrets) {
+      allSecrets.add(s);
+      verbose.secrets.add(s);
+    }
+  }
   const roots = buildRoots(parsed.roots, !!resolved.command, platform2.cwd);
   let respondData;
   if (parsed.respondArg) {
@@ -15570,7 +15702,18 @@ function isSpawnNotFound(err) {
 // src/platform/host.ts
 import { spawn as cpSpawn } from "node:child_process";
 import { constants } from "node:fs";
-import { access, mkdir, readFile as readFile3, rename, rmdir, stat, unlink, writeFile } from "node:fs/promises";
+import {
+  access,
+  chmod,
+  mkdir,
+  open,
+  readFile as readFile3,
+  rename,
+  rmdir,
+  stat,
+  unlink,
+  writeFile
+} from "node:fs/promises";
 import { createServer as createServer2 } from "node:net";
 import { Readable, Writable } from "node:stream";
 import * as tty from "node:tty";
@@ -15672,6 +15815,13 @@ var hostFs = {
   },
   async unlink(path) {
     await unlink(path);
+  },
+  async createExclusive(path) {
+    const fh = await open(path, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY);
+    await fh.close();
+  },
+  async chmod(path, mode) {
+    await chmod(path, mode);
   }
 };
 function createStdinStream() {
@@ -15792,5 +15942,5 @@ try {
   });
 } catch {
 }
-var code = await run(platform, "0.14.1", args);
+var code = await run(platform, "0.14.2", args);
 process.exit(code);