@ai-ecoverse/mcpcat 0.14.1 → 0.14.3

package/dist/host/mcpcat.mjs

@@ -49,6 +49,101 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// src/config/lock.ts
+var lock_exports = {};
+__export(lock_exports, {
+  acquireLock: () => acquireLock
+});
+function isEexist(err) {
+  if (err instanceof Error && "code" in err)
+    return err.code === "EEXIST";
+  if (err instanceof Error) return err.message.includes("EEXIST");
+  return false;
+}
+async function removeStaleLockDir(fs, lockPath) {
+  try {
+    const s = await fs.stat(lockPath);
+    if (Date.now() - s.mtimeMs > LOCK_STALE_MS) {
+      try {
+        await fs.rmdir(lockPath);
+      } catch {
+      }
+      return true;
+    }
+  } catch {
+  }
+  return false;
+}
+async function removeStaleLockFile(fs, lockPath) {
+  try {
+    const s = await fs.stat(lockPath);
+    if (Date.now() - s.mtimeMs > LOCK_STALE_MS) {
+      try {
+        await fs.unlink(lockPath);
+      } catch {
+      }
+      return true;
+    }
+  } catch {
+  }
+  return false;
+}
+async function acquireLock(fs, configPath) {
+  const useFile = typeof fs.createExclusive === "function";
+  const lockPath = `${configPath}.lock`;
+  const start = Date.now();
+  const parentDir = lockPath.slice(0, lockPath.lastIndexOf("/"));
+  if (parentDir) {
+    try {
+      await fs.mkdir(parentDir);
+    } catch {
+    }
+  }
+  while (true) {
+    try {
+      if (useFile) {
+        await fs.createExclusive(lockPath);
+      } else {
+        await fs.mkdirExclusive(lockPath);
+      }
+      break;
+    } catch (err) {
+      if (!isEexist(err)) throw err;
+      if (useFile) {
+        await removeStaleLockFile(fs, lockPath);
+      } else {
+        await removeStaleLockDir(fs, lockPath);
+      }
+    }
+    if (Date.now() - start > LOCK_MAX_WAIT_MS) {
+      throw new Error(`mcpcat: could not acquire lock ${lockPath} within ${LOCK_MAX_WAIT_MS}ms`);
+    }
+    await new Promise((r) => setTimeout(r, LOCK_POLL_MS));
+  }
+  let released = false;
+  return async () => {
+    if (released) return;
+    released = true;
+    try {
+      if (useFile && fs.unlink) {
+        await fs.unlink(lockPath);
+      } else {
+        await fs.rmdir(lockPath);
+      }
+    } catch {
+    }
+  };
+}
+var LOCK_STALE_MS, LOCK_POLL_MS, LOCK_MAX_WAIT_MS;
+var init_lock = __esm({
+  "src/config/lock.ts"() {
+    "use strict";
+    LOCK_STALE_MS = 1e4;
+    LOCK_POLL_MS = 50;
+    LOCK_MAX_WAIT_MS = 5e3;
+  }
+});
+
 // node_modules/isexe/windows.js
 var require_windows = __commonJS({
   "node_modules/isexe/windows.js"(exports, module) {
@@ -6345,7 +6440,7 @@ var McpOAuthProvider = class {
 };
 
 // src/auth/jerk-token-source.ts
-var MIN_VERSION = [0, 13, 0];
+var MIN_VERSION = [0, 14, 1];
 var VERSION_TIMEOUT_MS = 2e3;
 var cachedAvailable;
 function parseVersion(raw) {
@@ -6471,6 +6566,192 @@ var JerkTokenSource = class {
   }
 };
 
+// src/auth/pi-store.ts
+init_lock();
+
+// src/config/paths.ts
+function userConfigDir(platform2) {
+  const piDir = platform2.env.PI_CODING_AGENT_DIR;
+  if (piDir) return piDir;
+  const home = platform2.env.HOME ?? platform2.env.USERPROFILE ?? "/";
+  return `${home}/.pi/agent`;
+}
+function userConfigPath(platform2) {
+  return `${userConfigDir(platform2)}/mcp.json`;
+}
+function projectConfigPath(platform2) {
+  return `${platform2.cwd}/.pi/mcp.json`;
+}
+function stateDir(platform2) {
+  if (platform2.env.XDG_STATE_HOME) return `${platform2.env.XDG_STATE_HOME}/mcpcat`;
+  const home = platform2.env.HOME ?? platform2.env.USERPROFILE ?? "/";
+  if (platform2.env.LOCALAPPDATA) return `${platform2.env.LOCALAPPDATA}\\mcpcat\\state`;
+  if (platform2.env.SLICC_KERNEL) return `${home}/.local/state/mcpcat`;
+  return `${home}/Library/Application Support/mcpcat`;
+}
+
+// src/auth/token-source.ts
+function mcpNamespace(server) {
+  return `mcp__${server.replace(/-/g, "_")}`;
+}
+function storeKey(name, serverUrl) {
+  const ns = mcpNamespace(name);
+  const url = String(new URL(serverUrl));
+  return `${ns}|${url}`;
+}
+function isKernel(platform2) {
+  return platform2.kind === "kernel";
+}
+
+// src/auth/pi-store.ts
+var AUTH_FILE = "mcp-auth.json";
+var FILE_MODE = 384;
+var DIR_MODE = 448;
+function parseStates(raw) {
+  if (!raw?.trim()) return {};
+  const parsed = JSON.parse(raw);
+  return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : {};
+}
+function serializeStates(states) {
+  return `${JSON.stringify(states, null, 2)}
+`;
+}
+function legacyKey(serverUrl) {
+  return String(new URL(serverUrl));
+}
+var PiFileTokenSource = class {
+  platform;
+  authPath;
+  dirPath;
+  constructor(platform2) {
+    this.platform = platform2;
+    this.dirPath = userConfigDir(platform2);
+    this.authPath = `${this.dirPath}/${AUTH_FILE}`;
+  }
+  get path() {
+    return this.authPath;
+  }
+  async loadWithoutLock(name, serverUrl) {
+    const key = storeKey(name, serverUrl);
+    const legacy = legacyKey(serverUrl);
+    try {
+      const raw = await this.readRaw();
+      const states = parseStates(raw);
+      return states[key] ?? states[legacy];
+    } catch {
+      return void 0;
+    }
+  }
+  async getToken(name, serverUrl) {
+    const state = await this.load(name, serverUrl);
+    if (!state?.tokens?.access_token) return void 0;
+    return {
+      accessToken: state.tokens.access_token,
+      expiresAt: state.tokensExpireAt
+    };
+  }
+  async load(name, serverUrl) {
+    const key = storeKey(name, serverUrl);
+    const legacy = legacyKey(serverUrl);
+    const release = await this.acquireLock();
+    try {
+      const raw = await this.readRaw();
+      const states = parseStates(raw);
+      if (states[key]) return states[key];
+      if (states[legacy]) {
+        states[key] = states[legacy];
+        delete states[legacy];
+        await this.writeStates(states);
+        return states[key];
+      }
+      return void 0;
+    } finally {
+      await release();
+    }
+  }
+  async save(name, serverUrl, state) {
+    const key = storeKey(name, serverUrl);
+    const release = await this.acquireLock();
+    try {
+      const raw = await this.readRaw();
+      const states = parseStates(raw);
+      states[key] = state;
+      await this.writeStates(states);
+    } finally {
+      await release();
+    }
+  }
+  async remove(name, serverUrl) {
+    const key = storeKey(name, serverUrl);
+    const legacy = legacyKey(serverUrl);
+    const release = await this.acquireLock();
+    try {
+      const raw = await this.readRaw();
+      const states = parseStates(raw);
+      const stored = key in states ? key : legacy in states ? legacy : void 0;
+      if (!stored) return false;
+      delete states[stored];
+      await this.writeStates(states);
+      return true;
+    } finally {
+      await release();
+    }
+  }
+  async acquireLock() {
+    await this.ensureDir();
+    return acquireLock(this.platform.fs, this.authPath);
+  }
+  async ensureDir() {
+    const fs = this.platform.fs;
+    try {
+      await fs.mkdir(this.dirPath, { mode: DIR_MODE });
+    } catch {
+    }
+    if (fs.chmod) {
+      try {
+        await fs.chmod(this.dirPath, DIR_MODE);
+      } catch {
+      }
+      const piDir = this.dirPath.slice(0, this.dirPath.lastIndexOf("/"));
+      if (piDir) {
+        try {
+          await fs.chmod(piDir, DIR_MODE);
+        } catch {
+        }
+      }
+    }
+  }
+  async readRaw() {
+    try {
+      const data = await this.platform.fs.readFile(this.authPath);
+      return new TextDecoder().decode(data);
+    } catch {
+      return void 0;
+    }
+  }
+  async writeStates(states) {
+    const fs = this.platform.fs;
+    const content = serializeStates(states);
+    const tmpPath = `${this.authPath}.tmp.${Date.now()}`;
+    try {
+      await fs.writeFile(tmpPath, content, { mode: FILE_MODE });
+      await fs.rename(tmpPath, this.authPath);
+    } catch (renameErr) {
+      try {
+        if (fs.unlink) await fs.unlink(tmpPath);
+      } catch {
+      }
+      throw renameErr;
+    }
+    if (fs.chmod) {
+      try {
+        await fs.chmod(this.authPath, FILE_MODE);
+      } catch {
+      }
+    }
+  }
+};
+
 // src/auth/auth-provider.ts
 var CIMD_URL = "https://mcpcat.sliccy.ai/oauth/client.json";
 var CLIENT_NAME = "mcpcat";
@@ -6492,10 +6773,12 @@ var SourceBackedStore = class {
   source;
   name;
   serverUrl;
-  constructor(source, name, serverUrl) {
+  platform;
+  constructor(source, name, serverUrl, platform2) {
     this.source = source;
     this.name = name;
     this.serverUrl = serverUrl;
+    this.platform = platform2;
   }
   async load() {
     return this.source.load(this.name, this.serverUrl);
@@ -6503,6 +6786,17 @@ var SourceBackedStore = class {
   async save(state) {
     await this.source.save(this.name, this.serverUrl, state);
   }
+  async withRefreshLock(fn) {
+    if (!(this.source instanceof PiFileTokenSource)) return fn();
+    const refreshPath = `${this.source.path}.refresh`;
+    const { acquireLock: acquireLock2 } = await Promise.resolve().then(() => (init_lock(), lock_exports));
+    const release = await acquireLock2(this.platform.fs, refreshPath);
+    try {
+      return await fn();
+    } finally {
+      await release();
+    }
+  }
 };
 function cimdFn(redirectUrl) {
   return (metadata) => {
@@ -6531,10 +6825,9 @@ function createMcpAuthProvider(options) {
 function createJerkAuthProvider(options) {
   const { name, serverUrl, source } = options;
   let currentToken;
+  const _fetched = false;
   return {
     async token() {
-      const result = await source.getToken(name, serverUrl);
-      currentToken = result?.accessToken;
       return currentToken;
     },
     async onUnauthorized(context) {
@@ -6565,10 +6858,10 @@ function createJerkAuthProvider(options) {
 }
 function createPiAuthProvider(options) {
   const { name, serverUrl, source, oauth, platform: platform2 } = options;
-  const store = new SourceBackedStore(source, name, serverUrl);
+  const store = new SourceBackedStore(source, name, serverUrl, platform2);
   let refreshing;
   const refresh = async (staleToken) => {
-    refreshing ??= (async () => {
+    refreshing ??= store.withRefreshLock(async () => {
       const state = await store.load();
       if (state?.tokens?.access_token !== staleToken) return;
       if (!state?.tokens?.refresh_token) throw new McpOAuthAuthorizationRequiredError();
@@ -6591,7 +6884,7 @@ function createPiAuthProvider(options) {
         fetch: timedFetch(platform2.fetch)
       });
       if (result === "REDIRECT") throw new McpOAuthAuthorizationRequiredError();
-    })().finally(() => {
+    }).finally(() => {
       refreshing = void 0;
     });
     return refreshing;
@@ -7718,11 +8011,45 @@ var StreamableHttpTransport = class extends TransportEvents {
   }
 };
 
-// src/client/platform-stdio-transport.ts
-var DEFAULT_MAX_MESSAGE_BYTES2 = 4 * 1024 * 1024;
-var DEFAULT_MAX_STDERR_BYTES2 = 64 * 1024;
-var DEFAULT_CLOSE_TIMEOUT_MS2 = 2e3;
-var STDIN_CLOSE_GRACE_MS2 = 500;
+// src/client/stdio-registry.ts
+var GRACE_MS = 2e3;
+var registry = /* @__PURE__ */ new Set();
+function trackStdio(proc) {
+  registry.add(proc);
+  void proc.wait().then(
+    () => registry.delete(proc),
+    () => registry.delete(proc)
+  );
+}
+async function killAllStdio() {
+  const procs = [...registry];
+  if (procs.length === 0) return;
+  await Promise.all(
+    procs.map(async (proc) => {
+      try {
+        await proc.kill("SIGTERM");
+      } catch {
+      }
+      const exited = await Promise.race([
+        proc.wait().then(() => true),
+        new Promise((r) => setTimeout(() => r(false), GRACE_MS))
+      ]);
+      if (!exited) {
+        try {
+          await proc.kill("SIGKILL");
+        } catch {
+        }
+      }
+    })
+  );
+  registry.clear();
+}
+
+// src/client/platform-stdio-transport.ts
+var DEFAULT_MAX_MESSAGE_BYTES2 = 4 * 1024 * 1024;
+var DEFAULT_MAX_STDERR_BYTES2 = 64 * 1024;
+var DEFAULT_CLOSE_TIMEOUT_MS2 = 2e3;
+var STDIN_CLOSE_GRACE_MS2 = 500;
 var PlatformStdioTransport = class {
   options;
   process;
@@ -7774,16 +8101,21 @@ var PlatformStdioTransport = class {
     if (this.started) throw new Error("MCP stdio transport already started");
     if (this.closed) throw new Error("MCP connection closed");
     this.started = true;
-    const env = this.options.inheritEnv === false ? { ...this.options.env ?? {} } : {
-      ...this.options.platform.env,
-      ...this.options.env
-    };
-    this.process = await this.options.platform.spawn({
-      argv: [this.options.command, ...this.options.args ?? []],
-      env,
-      cwd: this.options.cwd
-    });
-    void this.readStdout();
+    if (this.options.existingProcess) {
+      this.process = this.options.existingProcess;
+    } else {
+      const env = this.options.inheritEnv === false ? { ...this.options.env ?? {} } : {
+        ...this.options.platform.env,
+        ...this.options.env
+      };
+      this.process = await this.options.platform.spawn({
+        argv: [this.options.command, ...this.options.args ?? []],
+        env,
+        cwd: this.options.cwd
+      });
+      trackStdio(this.process);
+    }
+    void this.readStdout(this.options.pendingStdout);
     void this.readStderr();
     void this.waitForExit();
   }
@@ -7816,22 +8148,22 @@ var PlatformStdioTransport = class {
     }
     const exited = await Promise.race([done, delay(grace)]);
     if (!exited) {
-      proc.kill("SIGTERM");
+      await proc.kill("SIGTERM");
       const exitedAfterTerm = await Promise.race([done, delay(closeTimeoutMs)]);
       if (!exitedAfterTerm) {
-        proc.kill("SIGKILL");
+        await proc.kill("SIGKILL");
         await done;
       }
     }
-    proc.kill("SIGTERM");
+    await proc.kill("SIGTERM");
     this.emitClose();
   }
-  async readStdout() {
+  async readStdout(pending) {
     const proc = this.process;
     if (!proc) return;
     const reader = proc.stdout.getReader();
     const maxBytes = this.options.maxMessageBytes ?? DEFAULT_MAX_MESSAGE_BYTES2;
-    let buffer = "";
+    let buffer = pending ?? "";
     try {
       for (; ; ) {
         const { done, value } = await reader.read();
@@ -7891,6 +8223,10 @@ var PlatformStdioTransport = class {
       await proc.wait();
     } catch {
     }
+    try {
+      await proc.kill("SIGTERM");
+    } catch {
+    }
     if (!this.closed) {
       this.emitClose();
     }
@@ -8232,7 +8568,9 @@ function buildTransport(options) {
       cwd: options.cwd,
       inheritEnv: true,
       platform: options.platform,
-      onStderr: buildStderrHandler(options)
+      onStderr: buildStderrHandler(options),
+      existingProcess: options.existingProcess?.proc,
+      pendingStdout: options.existingProcess?.pendingStdout
     });
   }
   return new StdioTransport({
@@ -8419,6 +8757,9 @@ function createStdioJsonRpc(proc, platform2, options) {
         reader.releaseLock();
       } catch {
       }
+    },
+    pendingBuffer() {
+      return readBuffer;
     }
   };
 }
@@ -8471,13 +8812,13 @@ function buildConnectionMethods(rpc, discoverResult2, proc) {
     async close() {
       rpc.close();
       try {
-        proc.kill("SIGTERM");
+        await proc.kill("SIGTERM");
       } catch {
       }
     }
   };
 }
-async function createStdioStatelessConnection(options) {
+async function probeStdioStateless(options) {
   const inheritedEnv = {
     ...options.platform.env,
     ...options.env
@@ -8487,22 +8828,30 @@ async function createStdioStatelessConnection(options) {
     env: inheritedEnv,
     cwd: options.cwd
   });
-  void readStderr(proc, options.verbose);
+  trackStdio(proc);
   const rpc = createStdioJsonRpc(proc, options.platform, {
     version: options.version,
     timeoutMs: options.timeoutMs,
     signal: options.signal,
     verbose: options.verbose
   });
-  const discoverRaw = await rpc.request("server/discover", {
-    protocolVersion: PROTOCOL_VERSION
-  });
+  let discoverRaw;
+  try {
+    discoverRaw = await rpc.request("server/discover", {
+      protocolVersion: PROTOCOL_VERSION
+    });
+  } catch (err) {
+    const pending = rpc.pendingBuffer();
+    rpc.close();
+    return { proc, pendingStdout: pending, error: err };
+  }
+  void readStderr(proc, options.verbose);
   const discoverResult2 = discoverRaw;
   const supported = (discoverResult2?.supportedVersions ?? []).filter(
     (v) => typeof v === "string"
   );
   if (!supported.includes(PROTOCOL_VERSION)) {
-    proc.kill("SIGTERM");
+    await proc.kill("SIGTERM");
     throw new Error(
       `Server does not support ${PROTOCOL_VERSION} (advertised: ${supported.join(", ") || "none"})`
     );
@@ -8536,25 +8885,37 @@ async function connect(platform2, options) {
     platform: platform2
   };
   if (options.command) {
+    let fallbackProcess;
     if (!options.protocolVersion || options.protocolVersion.startsWith("2026")) {
-      try {
-        return await createStdioStatelessConnection({
-          command: options.command,
-          args: options.args,
-          env: options.env,
-          cwd: options.cwd,
-          platform: platform2,
-          version: options.version,
-          timeoutMs: options.timeoutMs,
-          signal: options.signal,
-          verbose: options.verbose
-        });
-      } catch (err) {
-        const isMethodNotFound = err instanceof StatelessRpcError && err.code === -32601;
-        const isUnsupported = err instanceof Error && err.message.includes("does not support");
-        if (options.protocolVersion?.startsWith("2026")) throw err;
-        if (!isMethodNotFound && !isUnsupported) throw err;
+      const result = await probeStdioStateless({
+        command: options.command,
+        args: options.args,
+        env: options.env,
+        cwd: options.cwd,
+        platform: platform2,
+        version: options.version,
+        timeoutMs: options.timeoutMs,
+        signal: options.signal,
+        verbose: options.verbose
+      });
+      if (!("proc" in result)) return result;
+      const isMethodNotFound = result.error instanceof StatelessRpcError && result.error.code === -32601;
+      const isUnsupported = result.error.message.includes("does not support");
+      if (options.protocolVersion?.startsWith("2026")) {
+        try {
+          await result.proc.kill("SIGTERM");
+        } catch {
+        }
+        throw result.error;
+      }
+      if (!isMethodNotFound && !isUnsupported) {
+        try {
+          await result.proc.kill("SIGTERM");
+        } catch {
+        }
+        throw result.error;
       }
+      fallbackProcess = { proc: result.proc, pendingStdout: result.pendingStdout };
     }
     return createPiConnection({
       command: options.command,
@@ -8562,6 +8923,7 @@ async function connect(platform2, options) {
       env: options.env,
       cwd: options.cwd,
       roots: options.roots,
+      existingProcess: fallbackProcess,
       ...shared
     });
   }
@@ -9571,27 +9933,6 @@ async function loadConfig(input) {
   };
 }
 
-// src/config/paths.ts
-function userConfigDir(platform2) {
-  const piDir = platform2.env.PI_CODING_AGENT_DIR;
-  if (piDir) return piDir;
-  const home = platform2.env.HOME ?? platform2.env.USERPROFILE ?? "/";
-  return `${home}/.pi/agent`;
-}
-function userConfigPath(platform2) {
-  return `${userConfigDir(platform2)}/mcp.json`;
-}
-function projectConfigPath(platform2) {
-  return `${platform2.cwd}/.pi/mcp.json`;
-}
-function stateDir(platform2) {
-  if (platform2.env.XDG_STATE_HOME) return `${platform2.env.XDG_STATE_HOME}/mcpcat`;
-  const home = platform2.env.HOME ?? platform2.env.USERPROFILE ?? "/";
-  if (platform2.env.LOCALAPPDATA) return `${platform2.env.LOCALAPPDATA}\\mcpcat\\state`;
-  if (platform2.env.SLICC_KERNEL) return `${home}/.local/state/mcpcat`;
-  return `${home}/Library/Application Support/mcpcat`;
-}
-
 // src/config/index.ts
 var MergedConfigSource = class _MergedConfigSource {
   entries;
@@ -9631,65 +9972,8 @@ var MergedConfigSource = class _MergedConfigSource {
   }
 };
 
-// src/config/lock.ts
-var LOCK_STALE_MS = 1e4;
-var LOCK_POLL_MS = 50;
-var LOCK_MAX_WAIT_MS = 5e3;
-function isEexist(err) {
-  if (err instanceof Error && "code" in err)
-    return err.code === "EEXIST";
-  if (err instanceof Error) return err.message.includes("EEXIST");
-  return false;
-}
-async function removeStaleLock(fs, lockPath) {
-  try {
-    const s = await fs.stat(lockPath);
-    if (Date.now() - s.mtimeMs > LOCK_STALE_MS) {
-      try {
-        await fs.rmdir(lockPath);
-      } catch {
-      }
-      return true;
-    }
-  } catch {
-  }
-  return false;
-}
-async function acquireLock(fs, configPath) {
-  const lockPath = `${configPath}.lock`;
-  const start = Date.now();
-  const parentDir = lockPath.slice(0, lockPath.lastIndexOf("/"));
-  if (parentDir) {
-    try {
-      await fs.mkdir(parentDir);
-    } catch {
-    }
-  }
-  while (true) {
-    try {
-      await fs.mkdirExclusive(lockPath);
-      break;
-    } catch (err) {
-      if (!isEexist(err)) throw err;
-      await removeStaleLock(fs, lockPath);
-    }
-    if (Date.now() - start > LOCK_MAX_WAIT_MS) {
-      throw new Error(`mcpcat: could not acquire lock ${lockPath} within ${LOCK_MAX_WAIT_MS}ms`);
-    }
-    await new Promise((r) => setTimeout(r, LOCK_POLL_MS));
-  }
-  let released = false;
-  return async () => {
-    if (released) return;
-    released = true;
-    try {
-      await fs.rmdir(lockPath);
-    } catch {
-    }
-  };
-}
-
 // src/config/edit.ts
+init_lock();
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -11914,7 +12198,7 @@ function capOutput(value, limit) {
 ${value.slice(value.length - half)}`;
 }
 var inflightProcs = /* @__PURE__ */ new Set();
-async function runCommand(platform2, cmdPath, argv, childEnv, stdin, timeoutMs, maxOutput, cwd) {
+async function runCommand(platform2, cmdPath, argv, childEnv, stdin, timeoutMs, maxOutput, cwd, signal) {
   let proc;
   try {
     proc = await platform2.spawn({
@@ -11953,23 +12237,41 @@ async function runCommand(platform2, cmdPath, argv, childEnv, stdin, timeoutMs,
   const timer = new Promise(
     (resolve) => setTimeout(() => resolve("timeout"), timeoutMs)
   );
+  const abortPromise = signal ? new Promise((resolve) => {
+    if (signal.aborted) {
+      resolve("timeout");
+      return;
+    }
+    signal.addEventListener("abort", () => resolve("timeout"), { once: true });
+  }) : null;
   const work = Promise.all([
     readStream3(proc.stdout, stdoutChunks),
     readStream3(proc.stderr, stderrChunks),
     proc.wait()
   ]);
-  const result = await Promise.race([work, timer]);
+  const racers = [
+    work,
+    timer
+  ];
+  if (abortPromise !== null) racers.push(abortPromise);
+  const result = await Promise.race(racers);
   if (result === "timeout") {
-    proc.kill("SIGTERM");
-    await new Promise((resolve) => setTimeout(resolve, 5e3));
-    try {
-      proc.kill("SIGKILL");
-    } catch {
+    await proc.kill("SIGTERM");
+    if (!signal?.aborted) {
+      await new Promise((resolve) => setTimeout(resolve, 5e3));
+      try {
+        await proc.kill("SIGKILL");
+      } catch {
+      }
     }
     inflightProcs.delete(proc);
     return { stdout: "", stderr: "timed out", exitCode: 124 };
   }
   inflightProcs.delete(proc);
+  try {
+    await proc.kill("SIGTERM");
+  } catch {
+  }
   const [, , exitResult] = result;
   const dec = new TextDecoder();
   return {
@@ -11988,25 +12290,31 @@ function concat(chunks) {
   }
   return out;
 }
+var KILL_GRACE_MS = 2e3;
 async function killInflight() {
-  for (const proc of inflightProcs) {
-    try {
-      proc.kill("SIGTERM");
-    } catch {
-    }
-  }
-  if (inflightProcs.size > 0) {
-    await new Promise((resolve) => setTimeout(resolve, 5e3));
-    for (const proc of inflightProcs) {
+  const procs = [...inflightProcs];
+  if (procs.length === 0) return;
+  await Promise.all(
+    procs.map(async (proc) => {
       try {
-        proc.kill("SIGKILL");
+        await proc.kill("SIGTERM");
       } catch {
       }
-    }
-  }
+      const exited = await Promise.race([
+        proc.wait().then(() => true),
+        new Promise((r) => setTimeout(() => r(false), KILL_GRACE_MS))
+      ]);
+      if (!exited) {
+        try {
+          await proc.kill("SIGKILL");
+        } catch {
+        }
+      }
+    })
+  );
   inflightProcs.clear();
 }
-async function runHelpForCli(platform2, filePath, childEnv, cwd) {
+async function runHelpForCli(platform2, filePath, childEnv, cwd, signal) {
   const dashed = await runCommand(
     platform2,
     filePath,
@@ -12015,9 +12323,11 @@ async function runHelpForCli(platform2, filePath, childEnv, cwd) {
     void 0,
     1e4,
     MAX_OUTPUT_DEFAULT,
-    cwd
+    cwd,
+    signal
   );
   if (dashed.exitCode === 0 && dashed.stdout.trim()) return dashed.stdout;
+  if (signal?.aborted) return "";
   const plain = await runCommand(
     platform2,
     filePath,
@@ -12026,7 +12336,8 @@ async function runHelpForCli(platform2, filePath, childEnv, cwd) {
     void 0,
     1e4,
     MAX_OUTPUT_DEFAULT,
-    cwd
+    cwd,
+    signal
   );
   if (plain.exitCode === 0 && plain.stdout.trim()) return plain.stdout;
   return dashed.stdout.trim() ? dashed.stdout : "";
@@ -12053,7 +12364,7 @@ async function expandGroupCommands(platform2, filePath, commands, childEnv, cwd)
   }
   return current;
 }
-async function discoverCli(platform2, filePath, explicitName, childEnv, cwd) {
+async function discoverCli(platform2, filePath, explicitName, childEnv, cwd, signal) {
   const mcp = await runCommand(
     platform2,
     filePath,
@@ -12062,10 +12373,11 @@ async function discoverCli(platform2, filePath, explicitName, childEnv, cwd) {
     void 0,
     1e4,
     MAX_OUTPUT_DEFAULT,
-    cwd
+    cwd,
+    signal
   );
   const override = mcp.exitCode === 0 ? parseMcpOverride(mcp.stdout) : null;
-  const helpText2 = override ? "" : await runHelpForCli(platform2, filePath, childEnv, cwd);
+  const helpText2 = override || signal?.aborted ? "" : await runHelpForCli(platform2, filePath, childEnv, cwd, signal);
   if (!override && !helpText2.trim()) {
     throw new Error(`${filePath} did not print help or --mcp descriptor`);
   }
@@ -12185,6 +12497,32 @@ function createToolExecutor(platform2, clis, allTools, childEnv, options, serveC
   }
   return { invoke, rpcTools };
 }
+async function discoverWithSignal(platform2, commands, childEnv, cwd) {
+  const clis = [];
+  let earlyShutdown = false;
+  let inflightDone;
+  const earlyAbort = new AbortController();
+  const onShutdown = () => {
+    earlyShutdown = true;
+    earlyAbort.abort();
+    inflightDone = killInflight();
+  };
+  platform2.onSignal?.("SIGTERM", onShutdown);
+  platform2.onSignal?.("SIGINT", onShutdown);
+  for (const cmd of commands) {
+    try {
+      const cli = await discoverCli(platform2, cmd.path, cmd.name, childEnv, cwd, earlyAbort.signal);
+      clis.push(cli);
+    } catch (err) {
+      if (earlyShutdown) return { exitCode: 143, inflightDone };
+      await platform2.write(2, `mcpcat serve: ${err.message}
+`);
+      return { exitCode: 2 };
+    }
+  }
+  if (earlyShutdown) return { exitCode: 143, inflightDone };
+  return { clis };
+}
 async function runServe(platform2, options, version) {
   let resolvedBearer;
   let generatedBearer = false;
@@ -12228,17 +12566,17 @@ async function runServe(platform2, options, version) {
   }
   const serveCwd = options.cwd ?? platform2.cwd;
   const childEnv = buildChildEnv(platform2, options.envAllow);
-  const clis = [];
-  for (const cmd of options.commands) {
-    try {
-      const cli = await discoverCli(platform2, cmd.path, cmd.name, childEnv, serveCwd);
-      clis.push(cli);
-    } catch (err) {
-      await platform2.write(2, `mcpcat serve: ${err.message}
-`);
-      return 2;
+  const discovery = await discoverWithSignal(platform2, options.commands, childEnv, serveCwd);
+  if ("exitCode" in discovery) {
+    if (discovery.inflightDone !== void 0) {
+      try {
+        await discovery.inflightDone;
+      } catch {
+      }
     }
+    return discovery.exitCode;
   }
+  const { clis } = discovery;
   const allTools = clis.flatMap((cli) => buildTools(cli.name, cli.commands));
   for (const spec of options.toolTemplates) {
     const tool = parseToolTemplate(spec);
@@ -12464,6 +12802,7 @@ async function runProxyHttp(platform2, options, proxy, resolvedBearer, generated
   if (platform2.onSignal) {
     platform2.onSignal("SIGINT", shutdown);
     platform2.onSignal("SIGTERM", shutdown);
+    platform2.onSignal("SIGHUP", shutdown);
   }
   const handler = (request) => handleProxyMcpRequest(
     request,
@@ -12623,11 +12962,12 @@ async function runHttpServer(platform2, options, tools, call, serverName, versio
   await platform2.write(2, `mcpcat serve: listening on ${listenUrl}
 `);
   let shutdownRequested = false;
+  let inflightDone;
   const shutdown = () => {
     if (shutdownRequested) return;
     shutdownRequested = true;
     listener.close();
-    void killInflight();
+    inflightDone = killInflight();
     if (tokenFilePath) {
       platform2.fs.unlink?.(tokenFilePath).catch(() => {
       });
@@ -12636,6 +12976,7 @@ async function runHttpServer(platform2, options, tools, call, serverName, versio
   if (platform2.onSignal) {
     platform2.onSignal("SIGINT", shutdown);
     platform2.onSignal("SIGTERM", shutdown);
+    platform2.onSignal("SIGHUP", shutdown);
   }
   const handler = (request) => handleMcpRequest(
     request,
@@ -12663,6 +13004,12 @@ async function runHttpServer(platform2, options, tools, call, serverName, versio
   } catch {
     if (!shutdownRequested) throw new Error("listener closed unexpectedly");
   }
+  if (inflightDone !== void 0) {
+    try {
+      await inflightDone;
+    } catch {
+    }
+  }
   return 0;
 }
 async function handleMcpRequest(request, tools, call, serverName, version, serverOrigins, allowedOrigins, allowedHosts, resolvedBearer) {
@@ -12934,124 +13281,6 @@ async function signIn(options) {
   }
 }
 
-// src/auth/token-source.ts
-function mcpNamespace(server) {
-  return `mcp__${server.replace(/-/g, "_")}`;
-}
-function storeKey(name, serverUrl) {
-  const ns = mcpNamespace(name);
-  const url = String(new URL(serverUrl));
-  return `${ns}|${url}`;
-}
-function isKernel(platform2) {
-  return platform2.kind === "kernel";
-}
-
-// src/auth/pi-store.ts
-var AUTH_FILE = "mcp-auth.json";
-var FILE_MODE = 384;
-function parseStates(raw) {
-  if (!raw?.trim()) return {};
-  const parsed = JSON.parse(raw);
-  return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : {};
-}
-function serializeStates(states) {
-  return `${JSON.stringify(states, null, 2)}
-`;
-}
-function legacyKey(serverUrl) {
-  return String(new URL(serverUrl));
-}
-var PiFileTokenSource = class {
-  platform;
-  authPath;
-  dirPath;
-  constructor(platform2) {
-    this.platform = platform2;
-    this.dirPath = userConfigDir(platform2);
-    this.authPath = `${this.dirPath}/${AUTH_FILE}`;
-  }
-  get path() {
-    return this.authPath;
-  }
-  async getToken(name, serverUrl) {
-    const state = await this.load(name, serverUrl);
-    if (!state?.tokens?.access_token) return void 0;
-    return {
-      accessToken: state.tokens.access_token,
-      expiresAt: state.tokensExpireAt
-    };
-  }
-  async load(name, serverUrl) {
-    const key = storeKey(name, serverUrl);
-    const legacy = legacyKey(serverUrl);
-    const release = await this.acquireLock();
-    try {
-      const raw = await this.readRaw();
-      const states = parseStates(raw);
-      if (states[key]) return states[key];
-      if (states[legacy]) {
-        states[key] = states[legacy];
-        delete states[legacy];
-        await this.writeStates(states);
-        return states[key];
-      }
-      return void 0;
-    } finally {
-      await release();
-    }
-  }
-  async save(name, serverUrl, state) {
-    const key = storeKey(name, serverUrl);
-    const release = await this.acquireLock();
-    try {
-      const raw = await this.readRaw();
-      const states = parseStates(raw);
-      states[key] = state;
-      await this.writeStates(states);
-    } finally {
-      await release();
-    }
-  }
-  async remove(name, serverUrl) {
-    const key = storeKey(name, serverUrl);
-    const legacy = legacyKey(serverUrl);
-    const release = await this.acquireLock();
-    try {
-      const raw = await this.readRaw();
-      const states = parseStates(raw);
-      const stored = key in states ? key : legacy in states ? legacy : void 0;
-      if (!stored) return false;
-      delete states[stored];
-      await this.writeStates(states);
-      return true;
-    } finally {
-      await release();
-    }
-  }
-  async acquireLock() {
-    await this.ensureDir();
-    return acquireLock(this.platform.fs, this.authPath);
-  }
-  async ensureDir() {
-    try {
-      await this.platform.fs.mkdir(this.dirPath);
-    } catch {
-    }
-  }
-  async readRaw() {
-    try {
-      const data = await this.platform.fs.readFile(this.authPath);
-      return new TextDecoder().decode(data);
-    } catch {
-      return void 0;
-    }
-  }
-  async writeStates(states) {
-    await this.platform.fs.writeFile(this.authPath, serializeStates(states), { mode: FILE_MODE });
-  }
-};
-
 // src/cli/auth-verbs.ts
 var resolvedSource;
 async function createTokenSource(platform2) {
@@ -14745,6 +14974,17 @@ async function runCall(platform2, conn, toolName, dataArg, toolArgs, opts) {
       return EXIT_USAGE;
     }
     fin = mergeArgs(base, c.value);
+  } else if (!dataArg && !opts.noValidate) {
+    const tools = await conn.listTools();
+    const tool = tools.find((t) => t.name === toolName);
+    const schema = tool?.inputSchema;
+    const required = Array.isArray(schema?.required) ? schema.required : [];
+    for (const r of required) {
+      if (!Object.hasOwn(base, r)) {
+        await writeErr(platform2, opts.json ?? false, "usage", `missing required flag --${r}`);
+        return EXIT_USAGE;
+      }
+    }
   }
   return renderCallResult(
     platform2,
@@ -14962,7 +15202,10 @@ async function probeServer(_name, config, platform2) {
     const opts = { version: "probe" };
     if ("url" in config && config.url) {
       opts.url = config.url;
-      if ("headers" in config) opts.headers = config.headers;
+      if ("headers" in config) {
+        const expanded = expandHeaders(config.headers, platform2.env);
+        if (expanded) opts.headers = expanded;
+      }
     } else if ("command" in config && config.command) {
       opts.command = config.command;
       if ("args" in config) opts.args = config.args;
@@ -15096,6 +15339,10 @@ async function dispatchMultiTarget(platform2, parsed, version) {
       } catch {
       }
     }
+    try {
+      await Promise.race([killAllStdio(), new Promise((r) => setTimeout(r, 3e3))]);
+    } catch {
+    }
     platform2.exit(exitCode);
   }
   platform2.onSignal?.("SIGTERM", () => void killTreeAndExit(143));
@@ -15324,11 +15571,25 @@ function classifyError(err) {
 }
 async function resolveAuthProvider(platform2, hasAuthHeader, url, target, config) {
   if (hasAuthHeader || !url) return void 0;
-  const source = await createTokenSource(platform2);
+  const piSource = new PiFileTokenSource(platform2);
   const entry = config.entry(target);
   const oauth = entry && "url" in entry.config ? entry.config.oauth : void 0;
   const name = entry ? target : `url:${new URL(url).origin}${new URL(url).pathname}`;
-  return createMcpAuthProvider({ name, serverUrl: url, source, oauth, platform: platform2 });
+  const provider = createMcpAuthProvider({
+    name,
+    serverUrl: url,
+    source: piSource,
+    oauth,
+    platform: platform2
+  });
+  const credentialSecrets = [];
+  const state = await piSource.loadWithoutLock(name, url);
+  if (state?.tokens?.access_token) credentialSecrets.push(state.tokens.access_token);
+  if (state?.tokens?.refresh_token) credentialSecrets.push(state.tokens.refresh_token);
+  if (state?.clientInformation && "client_secret" in state.clientInformation && state.clientInformation.client_secret) {
+    credentialSecrets.push(state.clientInformation.client_secret);
+  }
+  return { provider, credentialSecrets };
 }
 function classifyConnectionError(err, target, interrupted) {
   if (err instanceof McpAuthError || err instanceof AuthStepUpError || err instanceof JerkSignInRequiredError) {
@@ -15374,7 +15635,7 @@ async function handleInputRequired(platform2, conn, err, respondData, json) {
 `);
     return EXIT_INPUT_REQUIRED;
   }
-  const isTty = platform2.isatty(0);
+  const isTty = platform2.isatty(0) && platform2.isatty(2);
   const elicitResult = await handleElicitation(platform2, inputReq, isTty, respondData);
   if ("exitCode" in elicitResult) {
     await platform2.write(2, `${err.requestJson}
@@ -15420,6 +15681,10 @@ async function runClientVerb(platform2, version, parsed) {
       } catch {
       }
     }
+    try {
+      await Promise.race([killAllStdio(), new Promise((r) => setTimeout(r, 3e3))]);
+    } catch {
+    }
     platform2.exit(exitCode);
   }
   platform2.onSignal?.("SIGINT", () => {
@@ -15467,13 +15732,20 @@ async function runClientVerb(platform2, version, parsed) {
   };
   const mergedHeaders = { ...configHeaders, ...expanded };
   const hasAuthHeader = "Authorization" in mergedHeaders;
-  const authProvider = await resolveAuthProvider(
+  const authResolved = await resolveAuthProvider(
     platform2,
     hasAuthHeader,
     resolved.url,
     target,
     config
   );
+  const authProvider = authResolved?.provider;
+  if (authResolved?.credentialSecrets) {
+    for (const s of authResolved.credentialSecrets) {
+      allSecrets.add(s);
+      verbose.secrets.add(s);
+    }
+  }
   const roots = buildRoots(parsed.roots, !!resolved.command, platform2.cwd);
   let respondData;
   if (parsed.respondArg) {
@@ -15570,7 +15842,18 @@ function isSpawnNotFound(err) {
 // src/platform/host.ts
 import { spawn as cpSpawn } from "node:child_process";
 import { constants } from "node:fs";
-import { access, mkdir, readFile as readFile3, rename, rmdir, stat, unlink, writeFile } from "node:fs/promises";
+import {
+  access,
+  chmod,
+  mkdir,
+  open,
+  readFile as readFile3,
+  rename,
+  rmdir,
+  stat,
+  unlink,
+  writeFile
+} from "node:fs/promises";
 import { createServer as createServer2 } from "node:net";
 import { Readable, Writable } from "node:stream";
 import * as tty from "node:tty";
@@ -15672,6 +15955,13 @@ var hostFs = {
   },
   async unlink(path) {
     await unlink(path);
+  },
+  async createExclusive(path) {
+    const fh = await open(path, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY);
+    await fh.close();
+  },
+  async chmod(path, mode) {
+    await chmod(path, mode);
   }
 };
 function createStdinStream() {
@@ -15792,5 +16082,5 @@ try {
   });
 } catch {
 }
-var code = await run(platform, "0.14.1", args);
+var code = await run(platform, "0.14.3", args);
 process.exit(code);