@ai-ecoverse/mcpcat 0.14.4 → 0.14.6

package/README.md

@@ -22,7 +22,7 @@ Or via npm:
 npm install -g @ai-ecoverse/mcpcat
 ```
 
-mcpcat runs natively on macOS, Linux and Windows (Node ≥ 24), and inside Sliccy Seven as a kernel program, with the same flags, the same output and the same config file in both places. Orphan-free shutdown of stdio server trees in the kernel needs slicc-kernel ≥ 1.74.0; on older kernels only the direct child is signalled.
+mcpcat runs natively on macOS, Linux and Windows (Node ≥ 24), and inside Sliccy Seven as a kernel program, with the same flags, the same output and the same config file in both places. Orphan-free shutdown of stdio server trees in the kernel needs slicc-kernel ≥ 1.74.0; on older kernels only the direct child is signalled. When the kernel sends SIGKILL to mcpcat's process group, no handler can run and the server tree survives; a kernel "parent death signal" spawn option (like Linux `PR_SET_PDEATHSIG`) would cover that case.
 
 ## Quick start
 

package/dist/host/mcpcat.mjs

@@ -52,7 +52,9 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 // src/config/lock.ts
 var lock_exports = {};
 __export(lock_exports, {
-  acquireLock: () => acquireLock
+  acquireLock: () => acquireLock,
+  releaseAllLocks: () => releaseAllLocks,
+  releaseAllLocksSync: () => releaseAllLocksSync
 });
 function isEexist(err) {
   if (err instanceof Error && "code" in err)
@@ -88,6 +90,35 @@ async function removeStaleLockFile(fs, lockPath) {
   }
   return false;
 }
+function releaseAllLocksSync() {
+  for (const lock of heldLocks) {
+    try {
+      if (lock.useFile && lock.fs.unlink) {
+        void lock.fs.unlink(lock.path).catch(() => {
+        });
+      } else {
+        void lock.fs.rmdir(lock.path).catch(() => {
+        });
+      }
+    } catch {
+    }
+  }
+  heldLocks.clear();
+}
+async function releaseAllLocks() {
+  const locks = [...heldLocks];
+  heldLocks.clear();
+  for (const lock of locks) {
+    try {
+      if (lock.useFile && lock.fs.unlink) {
+        await lock.fs.unlink(lock.path);
+      } else {
+        await lock.fs.rmdir(lock.path);
+      }
+    } catch {
+    }
+  }
+}
 async function acquireLock(fs, configPath) {
   const useFile = typeof fs.createExclusive === "function";
   const lockPath = `${configPath}.lock`;
@@ -120,10 +151,13 @@ async function acquireLock(fs, configPath) {
     }
     await new Promise((r) => setTimeout(r, LOCK_POLL_MS));
   }
+  const entry = { path: lockPath, useFile, fs };
+  heldLocks.add(entry);
   let released = false;
   return async () => {
     if (released) return;
     released = true;
+    heldLocks.delete(entry);
     try {
       if (useFile && fs.unlink) {
         await fs.unlink(lockPath);
@@ -134,13 +168,14 @@ async function acquireLock(fs, configPath) {
     }
   };
 }
-var LOCK_STALE_MS, LOCK_POLL_MS, LOCK_MAX_WAIT_MS;
+var LOCK_STALE_MS, LOCK_POLL_MS, LOCK_MAX_WAIT_MS, heldLocks;
 var init_lock = __esm({
   "src/config/lock.ts"() {
     "use strict";
     LOCK_STALE_MS = 1e4;
     LOCK_POLL_MS = 50;
     LOCK_MAX_WAIT_MS = 5e3;
+    heldLocks = /* @__PURE__ */ new Set();
   }
 });
 
@@ -6825,7 +6860,9 @@ function createMcpAuthProvider(options) {
 function createJerkAuthProvider(options) {
   const { name, serverUrl, source } = options;
   let currentToken;
-  const _fetched = false;
+  function registerCredential(token) {
+    if (token && options.onCredentialObtained) options.onCredentialObtained(token);
+  }
   return {
     async token() {
       return currentToken;
@@ -6837,6 +6874,7 @@ function createJerkAuthProvider(options) {
           const result2 = await source.getToken(name, serverUrl, challenge.scope);
           if (result2) {
             currentToken = result2.accessToken;
+            registerCredential(currentToken);
             return;
           }
         } catch (err) {
@@ -6850,6 +6888,7 @@ function createJerkAuthProvider(options) {
       const result = await source.getToken(name, serverUrl);
       if (result) {
         currentToken = result.accessToken;
+        registerCredential(currentToken);
         return;
       }
       throw new McpOAuthAuthorizationRequiredError();
@@ -6860,6 +6899,9 @@ function createPiAuthProvider(options) {
   const { name, serverUrl, source, oauth, platform: platform2 } = options;
   const store = new SourceBackedStore(source, name, serverUrl, platform2);
   let refreshing;
+  function registerCredential(token) {
+    if (token && options.onCredentialObtained) options.onCredentialObtained(token);
+  }
   const refresh = async (staleToken) => {
     refreshing ??= store.withRefreshLock(async () => {
       const state = await store.load();
@@ -6889,15 +6931,27 @@ function createPiAuthProvider(options) {
     });
     return refreshing;
   };
+  let cachedToken;
+  let tokenLoaded = false;
   return {
     async token() {
       await refreshing?.catch(() => void 0);
+      if (tokenLoaded) return cachedToken;
       const state = await store.load();
-      const token = state?.tokens?.access_token;
+      cachedToken = state?.tokens?.access_token;
+      registerCredential(cachedToken);
+      if (state?.tokens?.refresh_token) registerCredential(state.tokens.refresh_token);
       const expired = state?.tokensExpireAt !== void 0 && state.tokensExpireAt - REFRESH_SKEW_MS <= Date.now();
-      if (!expired || !state?.tokens?.refresh_token) return token;
-      await refresh(token).catch(() => void 0);
-      return (await store.load())?.tokens?.access_token;
+      if (expired && state?.tokens?.refresh_token) {
+        await refresh(cachedToken).catch(() => void 0);
+        const refreshedState = await store.load();
+        cachedToken = refreshedState?.tokens?.access_token;
+        registerCredential(cachedToken);
+        if (refreshedState?.tokens?.refresh_token)
+          registerCredential(refreshedState.tokens.refresh_token);
+      }
+      tokenLoaded = true;
+      return cachedToken;
     },
     async onUnauthorized(context) {
       const challenge = parseWwwAuthenticate(context.response.headers.get("www-authenticate"));
@@ -6905,6 +6959,11 @@ function createPiAuthProvider(options) {
         throw new AuthStepUpError(challenge.scope, options.name);
       }
       await refresh(context.token);
+      const state = await store.load();
+      cachedToken = state?.tokens?.access_token;
+      tokenLoaded = true;
+      registerCredential(cachedToken);
+      if (state?.tokens?.refresh_token) registerCredential(state.tokens.refresh_token);
     }
   };
 }
@@ -9972,6 +10031,9 @@ var MergedConfigSource = class _MergedConfigSource {
   }
 };
 
+// src/cli/main.ts
+init_lock();
+
 // src/config/edit.ts
 init_lock();
 function isRecord2(value) {
@@ -15343,6 +15405,8 @@ async function dispatchMultiTarget(platform2, parsed, version) {
       await Promise.race([killAllStdio(), new Promise((r) => setTimeout(r, 3e3))]);
     } catch {
     }
+    await releaseAllLocks().catch(() => {
+    });
     platform2.exit(exitCode);
   }
   platform2.onSignal?.("SIGTERM", () => void killTreeAndExit(143));
@@ -15393,6 +15457,8 @@ async function dispatchMultiTarget(platform2, parsed, version) {
       return 5;
     } finally {
       await cleanup();
+      await killAllStdio().catch(() => {
+      });
     }
   }
   if (parsed.verb === "grep") {
@@ -15417,6 +15483,8 @@ async function dispatchMultiTarget(platform2, parsed, version) {
       });
     } finally {
       await cleanup();
+      await killAllStdio().catch(() => {
+      });
     }
   }
   if (parsed.verb === "describe" && parsed.showTs) {
@@ -15433,6 +15501,8 @@ async function dispatchMultiTarget(platform2, parsed, version) {
       return await runDescribeTs(platform2, targets, parsed.tsBudget);
     } finally {
       await cleanup();
+      await killAllStdio().catch(() => {
+      });
     }
   }
   return 2;
@@ -15569,25 +15639,28 @@ function classifyError(err) {
   }
   return { code: EXIT_RPC_ERROR, kind: "rpc_error", msg };
 }
-async function resolveAuthProvider(platform2, hasAuthHeader, url, target, config) {
+async function resolveAuthProvider(platform2, hasAuthHeader, url, target, config, onCredentialObtained) {
   if (hasAuthHeader || !url) return void 0;
-  const piSource = new PiFileTokenSource(platform2);
+  const source = await createTokenSource(platform2);
   const entry = config.entry(target);
   const oauth = entry && "url" in entry.config ? entry.config.oauth : void 0;
   const name = entry ? target : `url:${new URL(url).origin}${new URL(url).pathname}`;
   const provider = createMcpAuthProvider({
     name,
     serverUrl: url,
-    source: piSource,
+    source,
     oauth,
-    platform: platform2
+    platform: platform2,
+    onCredentialObtained
   });
   const credentialSecrets = [];
-  const state = await piSource.loadWithoutLock(name, url);
-  if (state?.tokens?.access_token) credentialSecrets.push(state.tokens.access_token);
-  if (state?.tokens?.refresh_token) credentialSecrets.push(state.tokens.refresh_token);
-  if (state?.clientInformation && "client_secret" in state.clientInformation && state.clientInformation.client_secret) {
-    credentialSecrets.push(state.clientInformation.client_secret);
+  if (source instanceof PiFileTokenSource) {
+    const state = await source.loadWithoutLock(name, url);
+    if (state?.tokens?.access_token) credentialSecrets.push(state.tokens.access_token);
+    if (state?.tokens?.refresh_token) credentialSecrets.push(state.tokens.refresh_token);
+    if (state?.clientInformation && "client_secret" in state.clientInformation && state.clientInformation.client_secret) {
+      credentialSecrets.push(state.clientInformation.client_secret);
+    }
   }
   return { provider, credentialSecrets };
 }
@@ -15685,6 +15758,8 @@ async function runClientVerb(platform2, version, parsed) {
       await Promise.race([killAllStdio(), new Promise((r) => setTimeout(r, 3e3))]);
     } catch {
     }
+    await releaseAllLocks().catch(() => {
+    });
     platform2.exit(exitCode);
   }
   platform2.onSignal?.("SIGINT", () => {
@@ -15737,7 +15812,11 @@ async function runClientVerb(platform2, version, parsed) {
     hasAuthHeader,
     resolved.url,
     target,
-    config
+    config,
+    (secret) => {
+      allSecrets.add(secret);
+      verbose.secrets.add(secret);
+    }
   );
   const authProvider = authResolved?.provider;
   if (authResolved?.credentialSecrets) {
@@ -15805,11 +15884,20 @@ async function runClientVerb(platform2, version, parsed) {
     await writeErrRedacted(platform2, parsed.jsonOutput, e.kind, e.msg, redact2);
     return e.code;
   } finally {
-    try {
-      await conn.close();
-    } catch {
-    }
+    await closeAndKillStdio(conn);
+  }
+}
+async function closeAndKillStdio(conn) {
+  try {
+    await conn.close();
+  } catch {
   }
+  try {
+    await killAllStdio();
+  } catch {
+  }
+  await releaseAllLocks().catch(() => {
+  });
 }
 async function writeErr(p, json, kind, msg) {
   if (json) await renderErrorJson(p, kind, msg);
@@ -16082,5 +16170,5 @@ try {
   });
 } catch {
 }
-var code = await run(platform, "0.14.4", args);
+var code = await run(platform, "0.14.6", args);
 process.exit(code);

package/dist/kernel/mcpcat.mjs

@@ -170,7 +170,9 @@ var init_node_stub = __esm({
 // src/config/lock.ts
 var lock_exports = {};
 __export(lock_exports, {
-  acquireLock: () => acquireLock
+  acquireLock: () => acquireLock,
+  releaseAllLocks: () => releaseAllLocks,
+  releaseAllLocksSync: () => releaseAllLocksSync
 });
 function isEexist(err) {
   if (err instanceof Error && "code" in err)
@@ -206,6 +208,35 @@ async function removeStaleLockFile(fs, lockPath) {
   }
   return false;
 }
+function releaseAllLocksSync() {
+  for (const lock of heldLocks) {
+    try {
+      if (lock.useFile && lock.fs.unlink) {
+        void lock.fs.unlink(lock.path).catch(() => {
+        });
+      } else {
+        void lock.fs.rmdir(lock.path).catch(() => {
+        });
+      }
+    } catch {
+    }
+  }
+  heldLocks.clear();
+}
+async function releaseAllLocks() {
+  const locks = [...heldLocks];
+  heldLocks.clear();
+  for (const lock of locks) {
+    try {
+      if (lock.useFile && lock.fs.unlink) {
+        await lock.fs.unlink(lock.path);
+      } else {
+        await lock.fs.rmdir(lock.path);
+      }
+    } catch {
+    }
+  }
+}
 async function acquireLock(fs, configPath) {
   const useFile = typeof fs.createExclusive === "function";
   const lockPath = `${configPath}.lock`;
@@ -238,10 +269,13 @@ async function acquireLock(fs, configPath) {
     }
     await new Promise((r) => setTimeout(r, LOCK_POLL_MS));
   }
+  const entry = { path: lockPath, useFile, fs };
+  heldLocks.add(entry);
   let released = false;
   return async () => {
     if (released) return;
     released = true;
+    heldLocks.delete(entry);
     try {
       if (useFile && fs.unlink) {
         await fs.unlink(lockPath);
@@ -252,13 +286,14 @@ async function acquireLock(fs, configPath) {
     }
   };
 }
-var LOCK_STALE_MS, LOCK_POLL_MS, LOCK_MAX_WAIT_MS;
+var LOCK_STALE_MS, LOCK_POLL_MS, LOCK_MAX_WAIT_MS, heldLocks;
 var init_lock = __esm({
   "src/config/lock.ts"() {
     "use strict";
     LOCK_STALE_MS = 1e4;
     LOCK_POLL_MS = 50;
     LOCK_MAX_WAIT_MS = 5e3;
+    heldLocks = /* @__PURE__ */ new Set();
   }
 });
 
@@ -6446,7 +6481,9 @@ function createMcpAuthProvider(options) {
 function createJerkAuthProvider(options) {
   const { name, serverUrl, source } = options;
   let currentToken;
-  const _fetched = false;
+  function registerCredential(token) {
+    if (token && options.onCredentialObtained) options.onCredentialObtained(token);
+  }
   return {
     async token() {
       return currentToken;
@@ -6458,6 +6495,7 @@ function createJerkAuthProvider(options) {
           const result2 = await source.getToken(name, serverUrl, challenge.scope);
           if (result2) {
             currentToken = result2.accessToken;
+            registerCredential(currentToken);
             return;
           }
         } catch (err) {
@@ -6471,6 +6509,7 @@ function createJerkAuthProvider(options) {
       const result = await source.getToken(name, serverUrl);
       if (result) {
         currentToken = result.accessToken;
+        registerCredential(currentToken);
         return;
       }
       throw new McpOAuthAuthorizationRequiredError();
@@ -6481,6 +6520,9 @@ function createPiAuthProvider(options) {
   const { name, serverUrl, source, oauth, platform: platform2 } = options;
   const store = new SourceBackedStore(source, name, serverUrl, platform2);
   let refreshing;
+  function registerCredential(token) {
+    if (token && options.onCredentialObtained) options.onCredentialObtained(token);
+  }
   const refresh = async (staleToken) => {
     refreshing ??= store.withRefreshLock(async () => {
       const state = await store.load();
@@ -6510,15 +6552,27 @@ function createPiAuthProvider(options) {
     });
     return refreshing;
   };
+  let cachedToken;
+  let tokenLoaded = false;
   return {
     async token() {
       await refreshing?.catch(() => void 0);
+      if (tokenLoaded) return cachedToken;
       const state = await store.load();
-      const token = state?.tokens?.access_token;
+      cachedToken = state?.tokens?.access_token;
+      registerCredential(cachedToken);
+      if (state?.tokens?.refresh_token) registerCredential(state.tokens.refresh_token);
       const expired = state?.tokensExpireAt !== void 0 && state.tokensExpireAt - REFRESH_SKEW_MS <= Date.now();
-      if (!expired || !state?.tokens?.refresh_token) return token;
-      await refresh(token).catch(() => void 0);
-      return (await store.load())?.tokens?.access_token;
+      if (expired && state?.tokens?.refresh_token) {
+        await refresh(cachedToken).catch(() => void 0);
+        const refreshedState = await store.load();
+        cachedToken = refreshedState?.tokens?.access_token;
+        registerCredential(cachedToken);
+        if (refreshedState?.tokens?.refresh_token)
+          registerCredential(refreshedState.tokens.refresh_token);
+      }
+      tokenLoaded = true;
+      return cachedToken;
     },
     async onUnauthorized(context) {
       const challenge = parseWwwAuthenticate(context.response.headers.get("www-authenticate"));
@@ -6526,6 +6580,11 @@ function createPiAuthProvider(options) {
         throw new AuthStepUpError(challenge.scope, options.name);
       }
       await refresh(context.token);
+      const state = await store.load();
+      cachedToken = state?.tokens?.access_token;
+      tokenLoaded = true;
+      registerCredential(cachedToken);
+      if (state?.tokens?.refresh_token) registerCredential(state.tokens.refresh_token);
     }
   };
 }
@@ -9593,6 +9652,9 @@ var MergedConfigSource = class _MergedConfigSource {
   }
 };
 
+// src/cli/main.ts
+init_lock();
+
 // src/config/edit.ts
 init_lock();
 function isRecord2(value) {
@@ -14964,6 +15026,8 @@ async function dispatchMultiTarget(platform2, parsed, version) {
       await Promise.race([killAllStdio(), new Promise((r) => setTimeout(r, 3e3))]);
     } catch {
     }
+    await releaseAllLocks().catch(() => {
+    });
     platform2.exit(exitCode);
   }
   platform2.onSignal?.("SIGTERM", () => void killTreeAndExit(143));
@@ -15014,6 +15078,8 @@ async function dispatchMultiTarget(platform2, parsed, version) {
       return 5;
     } finally {
       await cleanup();
+      await killAllStdio().catch(() => {
+      });
     }
   }
   if (parsed.verb === "grep") {
@@ -15038,6 +15104,8 @@ async function dispatchMultiTarget(platform2, parsed, version) {
       });
     } finally {
       await cleanup();
+      await killAllStdio().catch(() => {
+      });
     }
   }
   if (parsed.verb === "describe" && parsed.showTs) {
@@ -15054,6 +15122,8 @@ async function dispatchMultiTarget(platform2, parsed, version) {
       return await runDescribeTs(platform2, targets, parsed.tsBudget);
     } finally {
       await cleanup();
+      await killAllStdio().catch(() => {
+      });
     }
   }
   return 2;
@@ -15190,25 +15260,28 @@ function classifyError(err) {
   }
   return { code: EXIT_RPC_ERROR, kind: "rpc_error", msg };
 }
-async function resolveAuthProvider(platform2, hasAuthHeader, url, target, config) {
+async function resolveAuthProvider(platform2, hasAuthHeader, url, target, config, onCredentialObtained) {
   if (hasAuthHeader || !url) return void 0;
-  const piSource = new PiFileTokenSource(platform2);
+  const source = await createTokenSource(platform2);
   const entry = config.entry(target);
   const oauth = entry && "url" in entry.config ? entry.config.oauth : void 0;
   const name = entry ? target : `url:${new URL(url).origin}${new URL(url).pathname}`;
   const provider = createMcpAuthProvider({
     name,
     serverUrl: url,
-    source: piSource,
+    source,
     oauth,
-    platform: platform2
+    platform: platform2,
+    onCredentialObtained
   });
   const credentialSecrets = [];
-  const state = await piSource.loadWithoutLock(name, url);
-  if (state?.tokens?.access_token) credentialSecrets.push(state.tokens.access_token);
-  if (state?.tokens?.refresh_token) credentialSecrets.push(state.tokens.refresh_token);
-  if (state?.clientInformation && "client_secret" in state.clientInformation && state.clientInformation.client_secret) {
-    credentialSecrets.push(state.clientInformation.client_secret);
+  if (source instanceof PiFileTokenSource) {
+    const state = await source.loadWithoutLock(name, url);
+    if (state?.tokens?.access_token) credentialSecrets.push(state.tokens.access_token);
+    if (state?.tokens?.refresh_token) credentialSecrets.push(state.tokens.refresh_token);
+    if (state?.clientInformation && "client_secret" in state.clientInformation && state.clientInformation.client_secret) {
+      credentialSecrets.push(state.clientInformation.client_secret);
+    }
   }
   return { provider, credentialSecrets };
 }
@@ -15306,6 +15379,8 @@ async function runClientVerb(platform2, version, parsed) {
       await Promise.race([killAllStdio(), new Promise((r) => setTimeout(r, 3e3))]);
     } catch {
     }
+    await releaseAllLocks().catch(() => {
+    });
     platform2.exit(exitCode);
   }
   platform2.onSignal?.("SIGINT", () => {
@@ -15358,7 +15433,11 @@ async function runClientVerb(platform2, version, parsed) {
     hasAuthHeader,
     resolved.url,
     target,
-    config
+    config,
+    (secret) => {
+      allSecrets.add(secret);
+      verbose.secrets.add(secret);
+    }
   );
   const authProvider = authResolved?.provider;
   if (authResolved?.credentialSecrets) {
@@ -15426,11 +15505,20 @@ async function runClientVerb(platform2, version, parsed) {
     await writeErrRedacted(platform2, parsed.jsonOutput, e.kind, e.msg, redact2);
     return e.code;
   } finally {
-    try {
-      await conn.close();
-    } catch {
-    }
+    await closeAndKillStdio(conn);
+  }
+}
+async function closeAndKillStdio(conn) {
+  try {
+    await conn.close();
+  } catch {
   }
+  try {
+    await killAllStdio();
+  } catch {
+  }
+  await releaseAllLocks().catch(() => {
+  });
 }
 async function writeErr(p, json, kind, msg) {
   if (json) await renderErrorJson(p, kind, msg);
@@ -15746,7 +15834,7 @@ async function main(ctx) {
     packageDir: "/node_modules/@ai-ecoverse/mcpcat"
   });
   const args = ctx.argv.slice(1);
-  return run(platform2, "0.14.4", args);
+  return run(platform2, "0.14.6", args);
 }
 export {
   main as default

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/mcpcat",
-  "version": "0.14.4",
+  "version": "0.14.6",
   "description": "A curl for the Model Context Protocol",
   "type": "module",
   "license": "Apache-2.0",