@ai-ecoverse/mcpcat 0.15.0 → 0.15.2

package/README.md

@@ -22,7 +22,7 @@ Or via npm:
 npm install -g @ai-ecoverse/mcpcat
 ```
 
-mcpcat runs natively on macOS, Linux and Windows (Node ≥ 24), and inside Sliccy Seven as a kernel program, with the same flags, the same output and the same config file in both places. Orphan-free shutdown of stdio server trees in the kernel needs slicc-kernel ≥ 1.74.0; on older kernels only the direct child is signalled. When the kernel sends SIGKILL to mcpcat's process group, no handler can run and the server tree survives; a kernel "parent death signal" spawn option (like Linux `PR_SET_PDEATHSIG`) would cover that case.
+mcpcat runs natively on macOS, Linux and Windows (Node ≥ 24), and inside Sliccy Seven as a kernel program, with the same flags, the same output and the same config file in both places. Orphan-free shutdown of stdio server trees in the kernel needs slicc-kernel ≥ 1.74.0; on older kernels only the direct child is signalled. A SIGKILLed mcpcat runs no handler. On slicc-kernel ≥ 1.88.0, mcpcat spawns stdio servers and served commands with a parent death signal (like Linux `PR_SET_PDEATHSIG`), so the kernel SIGKILLs each server's process group when mcpcat dies. On older kernels, and on the host, where there is no portable equivalent, servers that exit on stdin EOF (most MCP servers) still stop, but servers that ignore it keep running.
 
 ## Quick start
 

package/dist/host/mcpcat.mjs

@@ -8177,7 +8177,8 @@ var PlatformStdioTransport = class {
       this.process = await this.options.platform.spawn({
         argv: [this.options.command, ...this.options.args ?? []],
         env,
-        cwd: this.options.cwd
+        cwd: this.options.cwd,
+        dieWithParent: true
       });
       trackStdio(this.process);
     }
@@ -8343,6 +8344,16 @@ var McpAuthError = class extends Error {
     this.target = target;
   }
 };
+var TransportRefusalError = class extends Error {
+  status;
+  reason;
+  constructor(status, reason) {
+    super(reason);
+    this.name = "TransportRefusalError";
+    this.status = status;
+    this.reason = reason;
+  }
+};
 var AuthRetryableError = class extends Error {
   response;
   constructor(response) {
@@ -8485,6 +8496,15 @@ async function createStatelessConnection(options) {
     return h;
   }
   async function handleErrorStatus(res, method) {
+    if (res.status === 403) {
+      const wwwAuth = res.headers.get("www-authenticate") ?? "";
+      if (!wwwAuth) {
+        const body = await res.text();
+        if (body && !body.includes("insufficient_scope")) {
+          throw new TransportRefusalError(403, body.split("\n")[0].slice(0, 200));
+        }
+      }
+    }
     if ((res.status === 401 || res.status === 403) && authProvider)
       throw new AuthRetryableError(res);
     if (res.status === 401 || res.status === 403) throw new McpAuthError(res.status, url);
@@ -8892,7 +8912,8 @@ async function probeStdioStateless(options) {
   const proc = await options.platform.spawn({
     argv: [options.command, ...options.args ?? []],
     env: inheritedEnv,
-    cwd: options.cwd
+    cwd: options.cwd,
+    dieWithParent: true
   });
   trackStdio(proc);
   const rpc = createStdioJsonRpc(proc, options.platform, {
@@ -9018,6 +9039,7 @@ async function connect(platform2, options) {
     const isMethodNotFound = err instanceof StatelessRpcError && err.code === -32601 || err instanceof StatelessHttpError && err.status >= 400 && err.status < 500;
     if (options.protocolVersion?.startsWith("2026")) throw err;
     if (err instanceof McpAuthError || err instanceof AuthStepUpError) throw err;
+    if (err instanceof TransportRefusalError) throw err;
     if (err.name === "McpOAuthAuthorizationRequiredError") throw err;
     if (isMethodNotFound) {
       return createPiConnection({
@@ -12509,7 +12531,8 @@ async function runCommand(platform2, cmdPath, argv, childEnv, stdin, timeoutMs,
     proc = await platform2.spawn({
       argv: [cmdPath, ...argv],
       env: childEnv,
-      cwd
+      cwd,
+      dieWithParent: true
     });
   } catch (err) {
     return { stdout: "", stderr: `spawn failed: ${err.message}`, exitCode: 127 };
@@ -14449,7 +14472,10 @@ async function sealSecret(platform2, name, value, options) {
   }
   const response = JSON.parse(responseText);
   if (response.error) {
-    throw Object.assign(new Error(response.error), { sealErrno: response.errno ?? "EACCES" });
+    const isStructured = typeof response.error === "object" && response.error !== null && response.error.code;
+    const errno = isStructured ? response.error.code : response.errno ?? "EACCES";
+    const message = isStructured ? response.error.message : response.error;
+    throw Object.assign(new Error(String(message)), { sealErrno: errno });
   }
   return { placeholder: response.placeholder };
 }
@@ -14461,6 +14487,7 @@ function sealErrorMessage(errno, name) {
   if (errno === "EEXIST") return `a non-bridge secret named ${name} already exists`;
   if (errno === "ENOTCONN") return "no vault available; use --bearer '${VAR}' or --no-auth";
   if (errno === "EACCES") return "vault locked; use --bearer '${VAR}' or --no-auth";
+  if (errno === "ETIMEDOUT") return "vault did not respond in time";
   return `vault error: ${errno}`;
 }
 
@@ -16088,6 +16115,9 @@ function classifyError(err) {
   if (err instanceof InputRequiredError) {
     return { code: EXIT_INPUT_REQUIRED, kind: "input_required", msg: err.requestJson };
   }
+  if (err instanceof TransportRefusalError) {
+    return { code: EXIT_CONNECTION, kind: "connection", msg: err.reason };
+  }
   if (err instanceof McpTimeoutError2) {
     return { code: EXIT_TIMEOUT, kind: "timeout", msg: err.message };
   }
@@ -16144,6 +16174,14 @@ async function resolveAuthProvider(platform2, hasAuthHeader, url, target, config
   return { provider, credentialSecrets };
 }
 function classifyConnectionError(err, target, interrupted) {
+  if (err instanceof TransportRefusalError) {
+    const hint = "in seven, reach the host via http://host.slicc.internal:<port>; in tests, enable the transport's hostLoopback";
+    return {
+      code: EXIT_CONNECTION,
+      kind: "connection",
+      msg: `${err.reason} (${hint})`
+    };
+  }
   if (err instanceof McpAuthError || err instanceof AuthStepUpError || err instanceof JerkSignInRequiredError) {
     return classifyError(err);
   }
@@ -16649,5 +16687,5 @@ try {
   });
 } catch {
 }
-var code = await run(platform, "0.15.0", args);
+var code = await run(platform, "0.15.2", args);
 process.exit(code);

package/dist/kernel/mcpcat.mjs

@@ -7798,7 +7798,8 @@ var PlatformStdioTransport = class {
       this.process = await this.options.platform.spawn({
         argv: [this.options.command, ...this.options.args ?? []],
         env: env2,
-        cwd: this.options.cwd
+        cwd: this.options.cwd,
+        dieWithParent: true
       });
       trackStdio(this.process);
     }
@@ -7964,6 +7965,16 @@ var McpAuthError = class extends Error {
     this.target = target;
   }
 };
+var TransportRefusalError = class extends Error {
+  status;
+  reason;
+  constructor(status, reason) {
+    super(reason);
+    this.name = "TransportRefusalError";
+    this.status = status;
+    this.reason = reason;
+  }
+};
 var AuthRetryableError = class extends Error {
   response;
   constructor(response) {
@@ -8106,6 +8117,15 @@ async function createStatelessConnection(options) {
     return h;
   }
   async function handleErrorStatus(res, method) {
+    if (res.status === 403) {
+      const wwwAuth = res.headers.get("www-authenticate") ?? "";
+      if (!wwwAuth) {
+        const body = await res.text();
+        if (body && !body.includes("insufficient_scope")) {
+          throw new TransportRefusalError(403, body.split("\n")[0].slice(0, 200));
+        }
+      }
+    }
     if ((res.status === 401 || res.status === 403) && authProvider)
       throw new AuthRetryableError(res);
     if (res.status === 401 || res.status === 403) throw new McpAuthError(res.status, url);
@@ -8513,7 +8533,8 @@ async function probeStdioStateless(options) {
   const proc = await options.platform.spawn({
     argv: [options.command, ...options.args ?? []],
     env: inheritedEnv,
-    cwd: options.cwd
+    cwd: options.cwd,
+    dieWithParent: true
   });
   trackStdio(proc);
   const rpc = createStdioJsonRpc(proc, options.platform, {
@@ -8639,6 +8660,7 @@ async function connect(platform2, options) {
     const isMethodNotFound = err instanceof StatelessRpcError && err.code === -32601 || err instanceof StatelessHttpError && err.status >= 400 && err.status < 500;
     if (options.protocolVersion?.startsWith("2026")) throw err;
     if (err instanceof McpAuthError || err instanceof AuthStepUpError) throw err;
+    if (err instanceof TransportRefusalError) throw err;
     if (err.name === "McpOAuthAuthorizationRequiredError") throw err;
     if (isMethodNotFound) {
       return createPiConnection({
@@ -12130,7 +12152,8 @@ async function runCommand(platform2, cmdPath, argv, childEnv, stdin, timeoutMs,
     proc = await platform2.spawn({
       argv: [cmdPath, ...argv],
       env: childEnv,
-      cwd
+      cwd,
+      dieWithParent: true
     });
   } catch (err) {
     return { stdout: "", stderr: `spawn failed: ${err.message}`, exitCode: 127 };
@@ -14070,7 +14093,10 @@ async function sealSecret(platform2, name, value, options) {
   }
   const response = JSON.parse(responseText);
   if (response.error) {
-    throw Object.assign(new Error(response.error), { sealErrno: response.errno ?? "EACCES" });
+    const isStructured = typeof response.error === "object" && response.error !== null && response.error.code;
+    const errno = isStructured ? response.error.code : response.errno ?? "EACCES";
+    const message = isStructured ? response.error.message : response.error;
+    throw Object.assign(new Error(String(message)), { sealErrno: errno });
   }
   return { placeholder: response.placeholder };
 }
@@ -14082,6 +14108,7 @@ function sealErrorMessage(errno, name) {
   if (errno === "EEXIST") return `a non-bridge secret named ${name} already exists`;
   if (errno === "ENOTCONN") return "no vault available; use --bearer '${VAR}' or --no-auth";
   if (errno === "EACCES") return "vault locked; use --bearer '${VAR}' or --no-auth";
+  if (errno === "ETIMEDOUT") return "vault did not respond in time";
   return `vault error: ${errno}`;
 }
 
@@ -15709,6 +15736,9 @@ function classifyError(err) {
   if (err instanceof InputRequiredError) {
     return { code: EXIT_INPUT_REQUIRED, kind: "input_required", msg: err.requestJson };
   }
+  if (err instanceof TransportRefusalError) {
+    return { code: EXIT_CONNECTION, kind: "connection", msg: err.reason };
+  }
   if (err instanceof McpTimeoutError2) {
     return { code: EXIT_TIMEOUT, kind: "timeout", msg: err.message };
   }
@@ -15765,6 +15795,14 @@ async function resolveAuthProvider(platform2, hasAuthHeader, url, target, config
   return { provider, credentialSecrets };
 }
 function classifyConnectionError(err, target, interrupted) {
+  if (err instanceof TransportRefusalError) {
+    const hint = "in seven, reach the host via http://host.slicc.internal:<port>; in tests, enable the transport's hostLoopback";
+    return {
+      code: EXIT_CONNECTION,
+      kind: "connection",
+      msg: `${err.reason} (${hint})`
+    };
+  }
   if (err instanceof McpAuthError || err instanceof AuthStepUpError || err instanceof JerkSignInRequiredError) {
     return classifyError(err);
   }
@@ -16059,9 +16097,14 @@ function kernelFs(ctx) {
   };
 }
 var groupSpawnSupported;
+var deathSignalSupported;
+var PARENT_DEATH_SIGNAL = "SIGKILL";
+function isInvalid(err) {
+  return err?.code === "EINVAL";
+}
 async function kernelSpawn(ctx, options) {
   const tryGroup = groupSpawnSupported !== false;
-  const result = await ctx.spawn({
+  const base = {
     argv: options.argv,
     env: options.env,
     cwd: options.cwd,
@@ -16069,7 +16112,20 @@ async function kernelSpawn(ctx, options) {
     stdout: "pipe",
     stderr: "pipe",
     ...tryGroup ? { pgid: 0 } : {}
-  });
+  };
+  const tryDeath = options.dieWithParent === true && deathSignalSupported !== false;
+  let result;
+  if (tryDeath) {
+    try {
+      result = await ctx.spawn({ ...base, parentDeathSignal: PARENT_DEATH_SIGNAL });
+    } catch (err) {
+      if (!isInvalid(err)) throw err;
+      deathSignalSupported = false;
+      result = await ctx.spawn(base);
+    }
+  } else {
+    result = await ctx.spawn(base);
+  }
   const childPid = result.pid;
   if (groupSpawnSupported === void 0) {
     try {
@@ -16313,7 +16369,7 @@ async function main(ctx) {
     packageDir: "/node_modules/@ai-ecoverse/mcpcat"
   });
   const args = ctx.argv.slice(1);
-  return run(platform2, "0.15.0", args);
+  return run(platform2, "0.15.2", args);
 }
 export {
   main as default

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/mcpcat",
-  "version": "0.15.0",
+  "version": "0.15.2",
   "description": "A curl for the Model Context Protocol",
   "type": "module",
   "license": "Apache-2.0",
@@ -56,7 +56,7 @@
     "trust:dry": "npx fledgling sync --dry-run -y --skip-publish"
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc-kernel": "1.83.0",
+    "@ai-ecoverse/slicc-kernel": "1.88.0",
     "@ai-ecoverse/slicc-shared-web": "1.13.1",
     "@biomejs/biome": "2.5.15",
     "@earendil-works/pi-codemode": "1.2.0",