@ai-ecoverse/mcpcat 0.31.16 → 0.31.18

package/dist/host/mcpcat.mjs

@@ -6558,6 +6558,12 @@ function agentIgnoresConfig(platform2, path) {
 function projectConfigPath(platform2) {
   return `${platform2.cwd}/.pi/mcp.json`;
 }
+function cacheDir(platform2) {
+  if (platform2.env.XDG_CACHE_HOME) return `${platform2.env.XDG_CACHE_HOME}/mcpcat`;
+  const home = platform2.env.HOME ?? platform2.env.USERPROFILE ?? "/";
+  if (platform2.env.LOCALAPPDATA) return `${platform2.env.LOCALAPPDATA}\\mcpcat\\cache`;
+  return `${home}/Library/Caches/mcpcat`;
+}
 function stateDir(platform2) {
   if (platform2.env.XDG_STATE_HOME) return `${platform2.env.XDG_STATE_HOME}/mcpcat`;
   const home = platform2.env.HOME ?? platform2.env.USERPROFILE ?? "/";
@@ -14287,10 +14293,30 @@ var HOLDER_RESTART_MAX_MS = 3e4;
 var HOLDER_STABLE_MS = 3e4;
 var HOLDER_STOP_GRACE_MS = 2e3;
 var HOLDER_READY_MS = 2e4;
+var FALLBACK_UNVERIFIED = "webmcp: other-extension fallback could not verify the reloaded document; tools are unavailable";
 var LABEL = "mcpcat serve --webmcp";
-var GUARD_REFUSAL_RE = /^(?:(?:playwright-cli )?webmcp-polyfill: )?[A-Z][A-Za-z]*\.[a-z][A-Za-z]*: slicc: refused: \S/;
+var TERMINAL_REFUSALS = /* @__PURE__ */ new Set([
+  "slicc: refused: target is on seven's origin",
+  "slicc: refused: seven\u2019s own pages and the vault are out of reach of browser automation",
+  "slicc: refused: breakpoints could run in seven\u2019s pages or the vault, so the guard doesn\u2019t offer the Debugger domains",
+  "slicc: refused: update the browser guard and client",
+  "slicc: refused: WebMCP installation could not verify the document; update the browser guard and client",
+  "slicc: refused: WebMCP installation could not verify a usable guard and document; update the browser guard and client",
+  "slicc: refused: WebMCP instrumentation is unavailable; update the browser guard and client",
+  "webmcp: no tools are available through the other-extension fallback; page startup or parse-time checks may have happened before installation"
+]);
+var FALLBACK_REFUSALS = /* @__PURE__ */ new Set([
+  "other-extension fallback could not verify the reloaded document; tools are unavailable",
+  "other-extension fallback could not verify the document"
+]);
+function holderReason(line) {
+  return line.trim().replace(/^playwright-cli webmcp-polyfill: /, "").replace(/^webmcp-polyfill: /, "").replace(/^[A-Z][A-Za-z]*\.[a-z][A-Za-z]*: /, "");
+}
+function isFallbackUnavailable(line) {
+  return FALLBACK_REFUSALS.has(holderReason(line));
+}
 function isGuardRefusal(line) {
-  return GUARD_REFUSAL_RE.test(line.trim());
+  return TERMINAL_REFUSALS.has(holderReason(line)) || isFallbackUnavailable(line);
 }
 function compareVersions(a, b) {
   const pa = a.split(".").map(Number);
@@ -14418,6 +14444,9 @@ function startHolder(platform2, options) {
       return;
     }
     proc = child;
+    state.fallbackUnavailable = false;
+    if (Number.isSafeInteger(child.pid) && child.pid > 0)
+      report(`holder-pid ${child.pid} tab ${options.tab}`);
     writer = child.stdin.getWriter();
     let lastError;
     const out = drain(child.stdout, onEvent);
@@ -14425,7 +14454,8 @@ function startHolder(platform2, options) {
       const text = line.trim();
       if (!text) return;
       lastError = text;
-      if (readyAt === void 0 && isGuardRefusal(text)) refusal ??= text;
+      if (isFallbackUnavailable(text)) state.fallbackUnavailable = true;
+      if (isGuardRefusal(text)) refusal ??= text;
       else relay(text);
     });
     exited = Promise.all([out, err, child.wait()]).then(([, , result]) => {
@@ -14749,6 +14779,12 @@ function startDialogHolder(platform2, options) {
 
 // src/serve/webmcp.ts
 var UNAVAILABLE_RE = /WebMCP is unavailable on this page/;
+function emptyFallbackOrError(error, holderHint) {
+  const hint = error.trim();
+  if (hint === "webmcp: unverified isolated context" && holderHint === FALLBACK_UNVERIFIED)
+    return { tools: [], hint: holderHint };
+  return hint === "webmcp: no tools are available through the other-extension fallback; page startup or parse-time checks may have happened before installation" ? { tools: [], hint } : { tools: [], error };
+}
 function buildBaseArgs(options) {
   const args2 = [];
   if (options.cdp) {
@@ -15317,7 +15353,7 @@ function createWebMcpHandler(platform2, options) {
   async function getRpcTools() {
     const { tools, error, notFound, unavailable } = await listRaw();
     if (notFound) return null;
-    if (error) return { tools: [], error };
+    if (error) return emptyFallbackOrError(error, options.emptyHint?.(false));
     const late = options.late?.() ?? false;
     const rpcTools = [];
     const hidden = {};
@@ -16479,6 +16515,7 @@ function emptyToolsHint(options, polyfill, unavailable) {
     return `the page shows no WebMCP tools, and the WebMCP polyfill needs playwright-cli ${POLYFILL_MIN_VERSION} or newer (found ${polyfill.oldVersion})`;
   }
   const status = polyfill.holder?.status();
+  if (status?.refused && status.fallbackUnavailable) return FALLBACK_UNVERIFIED;
   if (isLate(polyfill.holder)) {
     return "the page may check for WebMCP only when it loads, before the polyfill was injected; reload the tab, or restart with --webmcp-reload (it reloads the tab)";
   }
@@ -17410,6 +17447,142 @@ function parseLauncher(text) {
   return m ? { node: m[1], entry: m[2] } : void 0;
 }
 
+// src/auth/callback-port.ts
+function hasFixedCallback(oauth) {
+  if (oauth?.callbackPort !== void 0 && oauth.callbackPort > 0) return true;
+  if (!oauth?.callbackUrl) return false;
+  try {
+    const port = Number(new URL(oauth.callbackUrl).port);
+    return port > 0;
+  } catch {
+    return false;
+  }
+}
+function needsInjectedCallbackPort(options) {
+  return options.namedEntry && !hasFixedCallback(options.oauth);
+}
+async function withInjectedCallbackPortIfNeeded(platform2, name, options, fn) {
+  if (!needsInjectedCallbackPort(options)) return fn(void 0);
+  const port = await allocateCallbackPort();
+  return withTempCallbackPortConfig(platform2, name, port, fn);
+}
+async function allocateCallbackPort() {
+  const callback = await OAuthCallbackServer.listen({
+    host: "127.0.0.1",
+    port: 0,
+    path: "/callback"
+  });
+  try {
+    return Number(new URL(callback.redirectUrl).port);
+  } finally {
+    await callback.close();
+  }
+}
+function isRecord7(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hostEnv(platform2) {
+  const out = {};
+  for (const [key, value] of Object.entries(platform2.env)) {
+    if (value !== void 0) out[key] = value;
+  }
+  return out;
+}
+async function makeTempDir(platform2) {
+  const base = `${cacheDir(platform2)}/mcp-cb`;
+  await platform2.fs.mkdir(base, { mode: 448 });
+  for (let i = 0; i < 32; i++) {
+    const dir = `${base}/${Date.now().toString(36)}-${i.toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+    try {
+      await platform2.fs.mkdirExclusive(dir);
+      return dir;
+    } catch {
+    }
+  }
+  throw new Error("unable to create temporary mcp config directory");
+}
+async function removeTempDir(platform2, dir) {
+  try {
+    if (platform2.fs.unlink) await platform2.fs.unlink(`${dir}/mcp.json`);
+  } catch {
+  }
+  try {
+    await platform2.fs.rmdir(dir);
+  } catch {
+  }
+}
+async function withTempCallbackPortConfig(platform2, name, port, fn) {
+  const path = userConfigPath(platform2);
+  let raw;
+  try {
+    raw = new TextDecoder().decode(await platform2.fs.readFile(path));
+  } catch {
+    return fn(void 0);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return fn(void 0);
+  }
+  if (!isRecord7(parsed) || !isRecord7(parsed.mcpServers) || !isRecord7(parsed.mcpServers[name])) {
+    return fn(void 0);
+  }
+  const entry = { ...parsed.mcpServers[name] };
+  const prevOauth = isRecord7(entry.oauth) ? { ...entry.oauth } : {};
+  const oauth = { ...prevOauth, callbackPort: port };
+  if (typeof oauth.callbackUrl === "string") {
+    try {
+      const url = new URL(oauth.callbackUrl);
+      if (!(Number(url.port) > 0)) {
+        url.port = String(port);
+        oauth.callbackUrl = url.href;
+      }
+    } catch {
+    }
+  }
+  entry.oauth = oauth;
+  const tempServers = { ...parsed.mcpServers, [name]: entry };
+  const merged = { ...parsed, mcpServers: tempServers };
+  const tempDir = await makeTempDir(platform2);
+  const tempPath = `${tempDir}/mcp.json`;
+  await platform2.fs.writeFile(tempPath, `${JSON.stringify(merged, null, 2)}
+`, { mode: 384 });
+  const env = { ...hostEnv(platform2), PI_MCP_CONFIG: tempPath };
+  let cleaned = false;
+  const cleanup = async () => {
+    if (cleaned) return;
+    cleaned = true;
+    await removeTempDir(platform2, tempDir);
+  };
+  const exitFor = (signal) => signal === "SIGINT" ? 130 : signal === "SIGTERM" ? 143 : 129;
+  let signalCode;
+  let wake;
+  const stopped = new Promise((resolve) => {
+    wake = resolve;
+  });
+  if (platform2.onSignal) {
+    for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+      await platform2.onSignal(signal, () => {
+        void cleanup().then(() => {
+          signalCode = exitFor(signal);
+          wake?.();
+        });
+      });
+    }
+  }
+  try {
+    const result = await Promise.race([
+      fn(env).then((value) => ({ ok: true, value })),
+      stopped.then(() => ({ ok: false }))
+    ]);
+    if (!result.ok) platform2.exit(signalCode ?? 130);
+    return result.value;
+  } finally {
+    await cleanup();
+  }
+}
+
 // src/auth/oauth.ts
 var CALLBACK_HOST2 = "127.0.0.1";
 var CALLBACK_PATH2 = "/callback";
@@ -17425,14 +17598,23 @@ function timedFetch2(fetchImpl) {
     });
   };
 }
+function nonzeroPort(value) {
+  return value !== void 0 && value > 0 ? value : void 0;
+}
+function preferredPortFromRegistration(configured, registered) {
+  if (configured !== void 0) return configured;
+  if (!registered[0]) return void 0;
+  return nonzeroPort(Number(new URL(registered[0]).port));
+}
 function callbackSettings(oauth) {
   const raw = oauth?.callbackUrl ?? `http://${CALLBACK_HOST2}${CALLBACK_PATH2}`;
   const url = new URL(raw);
   const address = url.hostname.replace(/^\[|\]$/g, "");
-  const port = url.port ? Number(url.port) : oauth?.callbackPort;
+  const port = nonzeroPort(url.port ? Number(url.port) : oauth?.callbackPort);
   let fixedRedirectUrl;
-  if (url.port) fixedRedirectUrl = oauth?.callbackUrl;
-  else if (port !== void 0) {
+  if (nonzeroPort(url.port ? Number(url.port) : void 0) !== void 0 && oauth?.callbackUrl) {
+    fixedRedirectUrl = oauth.callbackUrl;
+  } else if (port !== void 0) {
     url.port = String(port);
     fixedRedirectUrl = url.href;
   }
@@ -17444,6 +17626,24 @@ function callbackSettings(oauth) {
     fixedRedirectUrl
   };
 }
+async function listenCallback(cbSettings, preferredPort) {
+  try {
+    return await OAuthCallbackServer.listen({
+      host: cbSettings.host,
+      redirectHost: cbSettings.redirectHost,
+      port: preferredPort ?? 0,
+      path: cbSettings.path
+    });
+  } catch (err) {
+    if (preferredPort === void 0 || cbSettings.fixedRedirectUrl) throw err;
+    return OAuthCallbackServer.listen({
+      host: cbSettings.host,
+      redirectHost: cbSettings.redirectHost,
+      port: 0,
+      path: cbSettings.path
+    });
+  }
+}
 function cimdForServer(metadata, redirectUrl) {
   if (!metadata?.client_id_metadata_document_supported) return void 0;
   if (!metadata.token_endpoint_auth_methods_supported?.includes("none")) return void 0;
@@ -17548,24 +17748,17 @@ async function signIn(options) {
   const stored = await store.load();
   const cbSettings = callbackSettings(oauth);
   const registered = stored?.clientInformation && "redirect_uris" in stored.clientInformation ? stored.clientInformation.redirect_uris : [];
-  const preferredPort = cbSettings.port ?? (registered[0] ? Number(new URL(registered[0]).port) || void 0 : void 0);
-  const callback = await OAuthCallbackServer.listen({
-    host: cbSettings.host,
-    redirectHost: cbSettings.redirectHost,
-    port: preferredPort ?? 0,
-    path: cbSettings.path
-  });
+  const preferredPort = preferredPortFromRegistration(cbSettings.port, registered);
+  const callback = await listenCallback(cbSettings, preferredPort);
   const redirectUrl = cbSettings.fixedRedirectUrl ?? callback.redirectUrl;
   try {
     if (stored) {
       const next = { ...stored };
       delete next.oauthState;
-      const hasCimd = buildClientMetadataDocumentFn(oauth, redirectUrl) !== void 0;
-      const keepClient = oauth?.clientId || (hasCimd ? !stored.clientInformation : registered.includes(redirectUrl));
-      if (!keepClient) {
+      delete next.tokens;
+      delete next.tokensExpireAt;
+      if (!oauth?.clientId) {
         delete next.clientInformation;
-        delete next.tokens;
-        delete next.tokensExpireAt;
       }
       await store.save(next);
     }
@@ -17648,13 +17841,14 @@ async function resolveLoginTarget(platform2, target) {
     return {
       name: target,
       serverUrl: httpConfig.url,
-      oauth: httpConfig.oauth
+      oauth: httpConfig.oauth,
+      namedEntry: true
     };
   }
   const resolved = resolveServerName(target);
   if (resolved.isUrl) {
     const url = withScheme(target);
-    return { name: resolved.name, serverUrl: url, oauth: void 0 };
+    return { name: resolved.name, serverUrl: url, oauth: void 0, namedEntry: false };
   }
   throw new Error(`unknown target '${target}': not a URL and not found in mcp.json`);
 }
@@ -17685,24 +17879,31 @@ async function jerkLogin(platform2, target, resolved, args2) {
   if (args2.includes("--no-browser")) {
     argv.push("--no-browser");
   }
-  const proc = await platform2.spawn({ argv });
-  proc.stdin.close().catch(() => {
-  });
-  const [, errText, result] = await Promise.all([
-    readStream2(proc.stdout),
-    readStream2(proc.stderr),
-    proc.wait()
-  ]);
-  if (result.status === 0) {
-    await platform2.write(1, `Signed in to ${target}
+  return withInjectedCallbackPortIfNeeded(
+    platform2,
+    resolved.name,
+    { namedEntry: resolved.namedEntry, oauth: resolved.oauth },
+    async (env) => {
+      const proc = await platform2.spawn({ argv, env });
+      proc.stdin.close().catch(() => {
+      });
+      const [, errText, result] = await Promise.all([
+        readStream2(proc.stdout),
+        readStream2(proc.stderr),
+        proc.wait()
+      ]);
+      if (result.status === 0) {
+        await platform2.write(1, `Signed in to ${target}
 `);
-    return 0;
-  }
-  if (errText.trim()) {
-    await platform2.write(2, sanitizeTerminal(errText));
-  }
-  if (result.status === JERK_EXIT_SIGN_IN) return 4;
-  return result.status;
+        return 0;
+      }
+      if (errText.trim()) {
+        await platform2.write(2, sanitizeTerminal(errText));
+      }
+      if (result.status === JERK_EXIT_SIGN_IN) return 4;
+      return result.status;
+    }
+  );
 }
 async function jerkLogout(platform2, target, resolved, source) {
   const id = jerkId(resolved.name, resolved.serverUrl);
@@ -17879,11 +18080,11 @@ function concatUint8Arrays(arrays) {
 }
 
 // src/config/import.ts
-function isRecord7(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isStringRecord2(value) {
-  return isRecord7(value) && Object.values(value).every((v) => typeof v === "string");
+  return isRecord8(value) && Object.values(value).every((v) => typeof v === "string");
 }
 function tryParse(text) {
   try {
@@ -17913,17 +18114,17 @@ function importClaude(text, names) {
     result.errors.push(error);
     return result;
   }
-  if (!isRecord7(parsed)) {
+  if (!isRecord8(parsed)) {
     result.errors.push("expected an object");
     return result;
   }
   const mcpServers = parsed.mcpServers;
-  if (!isRecord7(mcpServers)) {
+  if (!isRecord8(mcpServers)) {
     result.errors.push('no "mcpServers" object');
     return result;
   }
   for (const [name, entry] of filterNames(Object.entries(mcpServers), names)) {
-    if (!isRecord7(entry)) {
+    if (!isRecord8(entry)) {
       result.errors.push(`${name}: not an object`);
       continue;
     }
@@ -17938,17 +18139,17 @@ function importVSCode(text, names) {
     result.errors.push(error);
     return result;
   }
-  if (!isRecord7(parsed)) {
+  if (!isRecord8(parsed)) {
     result.errors.push("expected an object");
     return result;
   }
   const servers = parsed.servers ?? parsed.mcpServers;
-  if (!isRecord7(servers)) {
+  if (!isRecord8(servers)) {
     result.errors.push('no "servers" or "mcpServers" object');
     return result;
   }
   for (const [name, entry] of filterNames(Object.entries(servers), names)) {
-    if (!isRecord7(entry)) {
+    if (!isRecord8(entry)) {
       result.errors.push(`${name}: not an object`);
       continue;
     }
@@ -17982,17 +18183,17 @@ function importSixServers(text, names) {
     result.errors.push(error);
     return result;
   }
-  if (!isRecord7(parsed)) {
+  if (!isRecord8(parsed)) {
     result.errors.push("expected an object");
     return result;
   }
   const servers = parsed.servers;
-  if (!isRecord7(servers)) {
+  if (!isRecord8(servers)) {
     result.errors.push('no "servers" object');
     return result;
   }
   for (const [name, entry] of filterNames(Object.entries(servers), names)) {
-    if (!isRecord7(entry)) {
+    if (!isRecord8(entry)) {
       result.errors.push(`${name}: not an object`);
       continue;
     }
@@ -18000,7 +18201,7 @@ function importSixServers(text, names) {
     if (typeof entry.url === "string") config.url = entry.url;
     if (isStringRecord2(entry.headers)) config.headers = entry.headers;
     if (typeof entry.exposure === "string") config.exposure = entry.exposure;
-    if (isRecord7(entry.toolExposure)) config.toolExposure = entry.toolExposure;
+    if (isRecord8(entry.toolExposure)) config.toolExposure = entry.toolExposure;
     result.servers.push({ name, config });
   }
   return result;
@@ -18017,7 +18218,7 @@ function importCodexToml(text, names) {
     if (fields.command) config.command = fields.command;
     if (fields.args) config.args = fields.args;
     if (fields.url) config.url = fields.url;
-    if (fields.env && isRecord7(fields.env)) config.env = fields.env;
+    if (fields.env && isRecord8(fields.env)) config.env = fields.env;
     result.servers.push({ name, config });
   }
   return result;
@@ -18069,7 +18270,7 @@ function convertOpenCodeLocal(entry) {
   } else if (typeof entry.command === "string") {
     config.command = entry.command;
   }
-  if (isRecord7(entry.environment)) {
+  if (isRecord8(entry.environment)) {
     const env = {};
     for (const [k, v] of Object.entries(entry.environment)) {
       if (typeof v === "string")
@@ -18092,17 +18293,17 @@ function importOpenCode(text, names) {
     result.errors.push(error);
     return result;
   }
-  if (!isRecord7(parsed)) {
+  if (!isRecord8(parsed)) {
     result.errors.push("expected an object");
     return result;
   }
   const mcpServers = parsed.mcpServers ?? parsed.mcp;
-  if (!isRecord7(mcpServers)) {
+  if (!isRecord8(mcpServers)) {
     result.errors.push("no mcp servers found");
     return result;
   }
   for (const [name, entry] of filterNames(Object.entries(mcpServers), names)) {
-    if (!isRecord7(entry)) {
+    if (!isRecord8(entry)) {
       result.errors.push(`${name}: not an object`);
       continue;
     }
@@ -18118,9 +18319,9 @@ function detectFormat(text, filename) {
   if (filename.includes(".vscode")) return "vscode";
   try {
     const parsed = JSON.parse(text);
-    if (isRecord7(parsed)) {
-      if (parsed.servers && isRecord7(parsed.servers) && parsed.version !== void 0) return "six";
-      if (parsed.servers && isRecord7(parsed.servers)) return "vscode";
+    if (isRecord8(parsed)) {
+      if (parsed.servers && isRecord8(parsed.servers) && parsed.version !== void 0) return "six";
+      if (parsed.servers && isRecord8(parsed.servers)) return "vscode";
       if (parsed.mcpServers) return "claude";
       if (parsed.mcp) return "opencode";
     }
@@ -22284,5 +22485,5 @@ try {
   });
 } catch {
 }
-var code = await run(platform, "0.31.16", args);
+var code = await run(platform, "0.31.18", args);
 process.exit(code);

package/dist/kernel/mcpcat.mjs

@@ -6179,6 +6179,12 @@ function agentIgnoresConfig(platform2, path) {
 function projectConfigPath(platform2) {
   return `${platform2.cwd}/.pi/mcp.json`;
 }
+function cacheDir(platform2) {
+  if (platform2.env.XDG_CACHE_HOME) return `${platform2.env.XDG_CACHE_HOME}/mcpcat`;
+  const home = platform2.env.HOME ?? platform2.env.USERPROFILE ?? "/";
+  if (platform2.env.LOCALAPPDATA) return `${platform2.env.LOCALAPPDATA}\\mcpcat\\cache`;
+  return `${home}/Library/Caches/mcpcat`;
+}
 function stateDir(platform2) {
   if (platform2.env.XDG_STATE_HOME) return `${platform2.env.XDG_STATE_HOME}/mcpcat`;
   const home = platform2.env.HOME ?? platform2.env.USERPROFILE ?? "/";
@@ -6572,6 +6578,7 @@ var HEADER_REJECTED = "The server rejected the explicit Authorization header.";
 var PLACEHOLDER_NOT_ACCEPTED = "The request carried the signed-in credential's placeholder and the server still answered 401. Seven's vault fills the placeholder in when the request is forwarded, so either that forwarding is not active in this seven yet or the server rejected the credential. Try again from the Settings page's Connect, or ask whoever runs seven.";
 var VAULT_NO_ANSWER = "Seven's vault did not answer, so the request carried no credential. Try again, or ask whoever runs seven.";
 var PLACEHOLDER_REFUSED = "Seven's vault fills a placeholder in when the request is forwarded, so either that forwarding is not active in this seven yet or it failed. Try again, or ask whoever runs seven.";
+var CAUSED = /\brefused \([a-z][a-z-]*\): \S/;
 var NO_PLACEHOLDER = `This user gets no placeholder for this server. With no sign-in yet: ${SETTINGS_SIGN_IN} After a sign-in, the agent already has this server's tools, because a Settings sign-in gives it the server as native tools, and a human can use the server from a panel terminal as root.`;
 function placeholderRefusal(err) {
   if (!(err instanceof TypeError)) return void 0;
@@ -6579,7 +6586,7 @@ function placeholderRefusal(err) {
   if (code !== "EACCES" || typeof detail !== "string") return void 0;
   if (!detail.includes("sealed placeholder")) return void 0;
   const reason = detail.replace(/fnox_proxy_[0-9a-f]{24}/g, "[placeholder]");
-  return authError(`${reason}. ${PLACEHOLDER_REFUSED}`);
+  return authError(CAUSED.test(reason) ? `${reason}.` : `${reason}. ${PLACEHOLDER_REFUSED}`);
 }
 var SettingsSignInError = class extends McpcatError {
   advice;
@@ -13917,10 +13924,30 @@ var HOLDER_RESTART_MAX_MS = 3e4;
 var HOLDER_STABLE_MS = 3e4;
 var HOLDER_STOP_GRACE_MS = 2e3;
 var HOLDER_READY_MS = 2e4;
+var FALLBACK_UNVERIFIED = "webmcp: other-extension fallback could not verify the reloaded document; tools are unavailable";
 var LABEL = "mcpcat serve --webmcp";
-var GUARD_REFUSAL_RE = /^(?:(?:playwright-cli )?webmcp-polyfill: )?[A-Z][A-Za-z]*\.[a-z][A-Za-z]*: slicc: refused: \S/;
+var TERMINAL_REFUSALS = /* @__PURE__ */ new Set([
+  "slicc: refused: target is on seven's origin",
+  "slicc: refused: seven\u2019s own pages and the vault are out of reach of browser automation",
+  "slicc: refused: breakpoints could run in seven\u2019s pages or the vault, so the guard doesn\u2019t offer the Debugger domains",
+  "slicc: refused: update the browser guard and client",
+  "slicc: refused: WebMCP installation could not verify the document; update the browser guard and client",
+  "slicc: refused: WebMCP installation could not verify a usable guard and document; update the browser guard and client",
+  "slicc: refused: WebMCP instrumentation is unavailable; update the browser guard and client",
+  "webmcp: no tools are available through the other-extension fallback; page startup or parse-time checks may have happened before installation"
+]);
+var FALLBACK_REFUSALS = /* @__PURE__ */ new Set([
+  "other-extension fallback could not verify the reloaded document; tools are unavailable",
+  "other-extension fallback could not verify the document"
+]);
+function holderReason(line) {
+  return line.trim().replace(/^playwright-cli webmcp-polyfill: /, "").replace(/^webmcp-polyfill: /, "").replace(/^[A-Z][A-Za-z]*\.[a-z][A-Za-z]*: /, "");
+}
+function isFallbackUnavailable(line) {
+  return FALLBACK_REFUSALS.has(holderReason(line));
+}
 function isGuardRefusal(line) {
-  return GUARD_REFUSAL_RE.test(line.trim());
+  return TERMINAL_REFUSALS.has(holderReason(line)) || isFallbackUnavailable(line);
 }
 function compareVersions(a, b) {
   const pa = a.split(".").map(Number);
@@ -14048,6 +14075,9 @@ function startHolder(platform2, options) {
       return;
     }
     proc = child;
+    state.fallbackUnavailable = false;
+    if (Number.isSafeInteger(child.pid) && child.pid > 0)
+      report(`holder-pid ${child.pid} tab ${options.tab}`);
     writer = child.stdin.getWriter();
     let lastError;
     const out = drain(child.stdout, onEvent);
@@ -14055,7 +14085,8 @@ function startHolder(platform2, options) {
       const text = line.trim();
       if (!text) return;
       lastError = text;
-      if (readyAt === void 0 && isGuardRefusal(text)) refusal ??= text;
+      if (isFallbackUnavailable(text)) state.fallbackUnavailable = true;
+      if (isGuardRefusal(text)) refusal ??= text;
       else relay(text);
     });
     exited = Promise.all([out, err, child.wait()]).then(([, , result]) => {
@@ -14379,6 +14410,12 @@ function startDialogHolder(platform2, options) {
 
 // src/serve/webmcp.ts
 var UNAVAILABLE_RE = /WebMCP is unavailable on this page/;
+function emptyFallbackOrError(error, holderHint) {
+  const hint = error.trim();
+  if (hint === "webmcp: unverified isolated context" && holderHint === FALLBACK_UNVERIFIED)
+    return { tools: [], hint: holderHint };
+  return hint === "webmcp: no tools are available through the other-extension fallback; page startup or parse-time checks may have happened before installation" ? { tools: [], hint } : { tools: [], error };
+}
 function buildBaseArgs(options) {
   const args = [];
   if (options.cdp) {
@@ -14947,7 +14984,7 @@ function createWebMcpHandler(platform2, options) {
   async function getRpcTools() {
     const { tools, error, notFound, unavailable } = await listRaw();
     if (notFound) return null;
-    if (error) return { tools: [], error };
+    if (error) return emptyFallbackOrError(error, options.emptyHint?.(false));
     const late = options.late?.() ?? false;
     const rpcTools = [];
     const hidden = {};
@@ -16109,6 +16146,7 @@ function emptyToolsHint(options, polyfill, unavailable) {
     return `the page shows no WebMCP tools, and the WebMCP polyfill needs playwright-cli ${POLYFILL_MIN_VERSION} or newer (found ${polyfill.oldVersion})`;
   }
   const status = polyfill.holder?.status();
+  if (status?.refused && status.fallbackUnavailable) return FALLBACK_UNVERIFIED;
   if (isLate(polyfill.holder)) {
     return "the page may check for WebMCP only when it loads, before the polyfill was injected; reload the tab, or restart with --webmcp-reload (it reloads the tab)";
   }
@@ -16936,6 +16974,142 @@ function parseUpgradeArgs(args) {
   return { kind: "run", check, force };
 }
 
+// src/auth/callback-port.ts
+function hasFixedCallback(oauth) {
+  if (oauth?.callbackPort !== void 0 && oauth.callbackPort > 0) return true;
+  if (!oauth?.callbackUrl) return false;
+  try {
+    const port = Number(new URL(oauth.callbackUrl).port);
+    return port > 0;
+  } catch {
+    return false;
+  }
+}
+function needsInjectedCallbackPort(options) {
+  return options.namedEntry && !hasFixedCallback(options.oauth);
+}
+async function withInjectedCallbackPortIfNeeded(platform2, name, options, fn) {
+  if (!needsInjectedCallbackPort(options)) return fn(void 0);
+  const port = await allocateCallbackPort();
+  return withTempCallbackPortConfig(platform2, name, port, fn);
+}
+async function allocateCallbackPort() {
+  const callback = await OAuthCallbackServer.listen({
+    host: "127.0.0.1",
+    port: 0,
+    path: "/callback"
+  });
+  try {
+    return Number(new URL(callback.redirectUrl).port);
+  } finally {
+    await callback.close();
+  }
+}
+function isRecord7(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hostEnv(platform2) {
+  const out = {};
+  for (const [key, value] of Object.entries(platform2.env)) {
+    if (value !== void 0) out[key] = value;
+  }
+  return out;
+}
+async function makeTempDir(platform2) {
+  const base = `${cacheDir(platform2)}/mcp-cb`;
+  await platform2.fs.mkdir(base, { mode: 448 });
+  for (let i = 0; i < 32; i++) {
+    const dir = `${base}/${Date.now().toString(36)}-${i.toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+    try {
+      await platform2.fs.mkdirExclusive(dir);
+      return dir;
+    } catch {
+    }
+  }
+  throw new Error("unable to create temporary mcp config directory");
+}
+async function removeTempDir(platform2, dir) {
+  try {
+    if (platform2.fs.unlink) await platform2.fs.unlink(`${dir}/mcp.json`);
+  } catch {
+  }
+  try {
+    await platform2.fs.rmdir(dir);
+  } catch {
+  }
+}
+async function withTempCallbackPortConfig(platform2, name, port, fn) {
+  const path = userConfigPath(platform2);
+  let raw;
+  try {
+    raw = new TextDecoder().decode(await platform2.fs.readFile(path));
+  } catch {
+    return fn(void 0);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return fn(void 0);
+  }
+  if (!isRecord7(parsed) || !isRecord7(parsed.mcpServers) || !isRecord7(parsed.mcpServers[name])) {
+    return fn(void 0);
+  }
+  const entry = { ...parsed.mcpServers[name] };
+  const prevOauth = isRecord7(entry.oauth) ? { ...entry.oauth } : {};
+  const oauth = { ...prevOauth, callbackPort: port };
+  if (typeof oauth.callbackUrl === "string") {
+    try {
+      const url = new URL(oauth.callbackUrl);
+      if (!(Number(url.port) > 0)) {
+        url.port = String(port);
+        oauth.callbackUrl = url.href;
+      }
+    } catch {
+    }
+  }
+  entry.oauth = oauth;
+  const tempServers = { ...parsed.mcpServers, [name]: entry };
+  const merged = { ...parsed, mcpServers: tempServers };
+  const tempDir = await makeTempDir(platform2);
+  const tempPath = `${tempDir}/mcp.json`;
+  await platform2.fs.writeFile(tempPath, `${JSON.stringify(merged, null, 2)}
+`, { mode: 384 });
+  const env2 = { ...hostEnv(platform2), PI_MCP_CONFIG: tempPath };
+  let cleaned = false;
+  const cleanup = async () => {
+    if (cleaned) return;
+    cleaned = true;
+    await removeTempDir(platform2, tempDir);
+  };
+  const exitFor = (signal) => signal === "SIGINT" ? 130 : signal === "SIGTERM" ? 143 : 129;
+  let signalCode;
+  let wake;
+  const stopped = new Promise((resolve2) => {
+    wake = resolve2;
+  });
+  if (platform2.onSignal) {
+    for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+      await platform2.onSignal(signal, () => {
+        void cleanup().then(() => {
+          signalCode = exitFor(signal);
+          wake?.();
+        });
+      });
+    }
+  }
+  try {
+    const result = await Promise.race([
+      fn(env2).then((value) => ({ ok: true, value })),
+      stopped.then(() => ({ ok: false }))
+    ]);
+    if (!result.ok) platform2.exit(signalCode ?? 130);
+    return result.value;
+  } finally {
+    await cleanup();
+  }
+}
+
 // src/auth/oauth.ts
 var CALLBACK_HOST2 = "127.0.0.1";
 var CALLBACK_PATH2 = "/callback";
@@ -16951,14 +17125,23 @@ function timedFetch2(fetchImpl) {
     });
   };
 }
+function nonzeroPort(value) {
+  return value !== void 0 && value > 0 ? value : void 0;
+}
+function preferredPortFromRegistration(configured, registered) {
+  if (configured !== void 0) return configured;
+  if (!registered[0]) return void 0;
+  return nonzeroPort(Number(new URL(registered[0]).port));
+}
 function callbackSettings(oauth) {
   const raw = oauth?.callbackUrl ?? `http://${CALLBACK_HOST2}${CALLBACK_PATH2}`;
   const url = new URL(raw);
   const address = url.hostname.replace(/^\[|\]$/g, "");
-  const port = url.port ? Number(url.port) : oauth?.callbackPort;
+  const port = nonzeroPort(url.port ? Number(url.port) : oauth?.callbackPort);
   let fixedRedirectUrl;
-  if (url.port) fixedRedirectUrl = oauth?.callbackUrl;
-  else if (port !== void 0) {
+  if (nonzeroPort(url.port ? Number(url.port) : void 0) !== void 0 && oauth?.callbackUrl) {
+    fixedRedirectUrl = oauth.callbackUrl;
+  } else if (port !== void 0) {
     url.port = String(port);
     fixedRedirectUrl = url.href;
   }
@@ -16970,6 +17153,24 @@ function callbackSettings(oauth) {
     fixedRedirectUrl
   };
 }
+async function listenCallback(cbSettings, preferredPort) {
+  try {
+    return await OAuthCallbackServer.listen({
+      host: cbSettings.host,
+      redirectHost: cbSettings.redirectHost,
+      port: preferredPort ?? 0,
+      path: cbSettings.path
+    });
+  } catch (err) {
+    if (preferredPort === void 0 || cbSettings.fixedRedirectUrl) throw err;
+    return OAuthCallbackServer.listen({
+      host: cbSettings.host,
+      redirectHost: cbSettings.redirectHost,
+      port: 0,
+      path: cbSettings.path
+    });
+  }
+}
 function cimdForServer(metadata, redirectUrl) {
   if (!metadata?.client_id_metadata_document_supported) return void 0;
   if (!metadata.token_endpoint_auth_methods_supported?.includes("none")) return void 0;
@@ -17074,24 +17275,17 @@ async function signIn(options) {
   const stored = await store.load();
   const cbSettings = callbackSettings(oauth);
   const registered = stored?.clientInformation && "redirect_uris" in stored.clientInformation ? stored.clientInformation.redirect_uris : [];
-  const preferredPort = cbSettings.port ?? (registered[0] ? Number(new URL(registered[0]).port) || void 0 : void 0);
-  const callback = await OAuthCallbackServer.listen({
-    host: cbSettings.host,
-    redirectHost: cbSettings.redirectHost,
-    port: preferredPort ?? 0,
-    path: cbSettings.path
-  });
+  const preferredPort = preferredPortFromRegistration(cbSettings.port, registered);
+  const callback = await listenCallback(cbSettings, preferredPort);
   const redirectUrl = cbSettings.fixedRedirectUrl ?? callback.redirectUrl;
   try {
     if (stored) {
       const next = { ...stored };
       delete next.oauthState;
-      const hasCimd = buildClientMetadataDocumentFn(oauth, redirectUrl) !== void 0;
-      const keepClient = oauth?.clientId || (hasCimd ? !stored.clientInformation : registered.includes(redirectUrl));
-      if (!keepClient) {
+      delete next.tokens;
+      delete next.tokensExpireAt;
+      if (!oauth?.clientId) {
         delete next.clientInformation;
-        delete next.tokens;
-        delete next.tokensExpireAt;
       }
       await store.save(next);
     }
@@ -17174,13 +17368,14 @@ async function resolveLoginTarget(platform2, target) {
     return {
       name: target,
       serverUrl: httpConfig.url,
-      oauth: httpConfig.oauth
+      oauth: httpConfig.oauth,
+      namedEntry: true
     };
   }
   const resolved = resolveServerName(target);
   if (resolved.isUrl) {
     const url = withScheme(target);
-    return { name: resolved.name, serverUrl: url, oauth: void 0 };
+    return { name: resolved.name, serverUrl: url, oauth: void 0, namedEntry: false };
   }
   throw new Error(`unknown target '${target}': not a URL and not found in mcp.json`);
 }
@@ -17211,24 +17406,31 @@ async function jerkLogin(platform2, target, resolved, args) {
   if (args.includes("--no-browser")) {
     argv.push("--no-browser");
   }
-  const proc = await platform2.spawn({ argv });
-  proc.stdin.close().catch(() => {
-  });
-  const [, errText, result] = await Promise.all([
-    readStream2(proc.stdout),
-    readStream2(proc.stderr),
-    proc.wait()
-  ]);
-  if (result.status === 0) {
-    await platform2.write(1, `Signed in to ${target}
+  return withInjectedCallbackPortIfNeeded(
+    platform2,
+    resolved.name,
+    { namedEntry: resolved.namedEntry, oauth: resolved.oauth },
+    async (env2) => {
+      const proc = await platform2.spawn({ argv, env: env2 });
+      proc.stdin.close().catch(() => {
+      });
+      const [, errText, result] = await Promise.all([
+        readStream2(proc.stdout),
+        readStream2(proc.stderr),
+        proc.wait()
+      ]);
+      if (result.status === 0) {
+        await platform2.write(1, `Signed in to ${target}
 `);
-    return 0;
-  }
-  if (errText.trim()) {
-    await platform2.write(2, sanitizeTerminal(errText));
-  }
-  if (result.status === JERK_EXIT_SIGN_IN) return 4;
-  return result.status;
+        return 0;
+      }
+      if (errText.trim()) {
+        await platform2.write(2, sanitizeTerminal(errText));
+      }
+      if (result.status === JERK_EXIT_SIGN_IN) return 4;
+      return result.status;
+    }
+  );
 }
 async function jerkLogout(platform2, target, resolved, source) {
   const id = jerkId(resolved.name, resolved.serverUrl);
@@ -17405,11 +17607,11 @@ function concatUint8Arrays(arrays) {
 }
 
 // src/config/import.ts
-function isRecord7(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isStringRecord2(value) {
-  return isRecord7(value) && Object.values(value).every((v) => typeof v === "string");
+  return isRecord8(value) && Object.values(value).every((v) => typeof v === "string");
 }
 function tryParse(text) {
   try {
@@ -17439,17 +17641,17 @@ function importClaude(text, names) {
     result.errors.push(error);
     return result;
   }
-  if (!isRecord7(parsed)) {
+  if (!isRecord8(parsed)) {
     result.errors.push("expected an object");
     return result;
   }
   const mcpServers = parsed.mcpServers;
-  if (!isRecord7(mcpServers)) {
+  if (!isRecord8(mcpServers)) {
     result.errors.push('no "mcpServers" object');
     return result;
   }
   for (const [name, entry] of filterNames(Object.entries(mcpServers), names)) {
-    if (!isRecord7(entry)) {
+    if (!isRecord8(entry)) {
       result.errors.push(`${name}: not an object`);
       continue;
     }
@@ -17464,17 +17666,17 @@ function importVSCode(text, names) {
     result.errors.push(error);
     return result;
   }
-  if (!isRecord7(parsed)) {
+  if (!isRecord8(parsed)) {
     result.errors.push("expected an object");
     return result;
   }
   const servers = parsed.servers ?? parsed.mcpServers;
-  if (!isRecord7(servers)) {
+  if (!isRecord8(servers)) {
     result.errors.push('no "servers" or "mcpServers" object');
     return result;
   }
   for (const [name, entry] of filterNames(Object.entries(servers), names)) {
-    if (!isRecord7(entry)) {
+    if (!isRecord8(entry)) {
       result.errors.push(`${name}: not an object`);
       continue;
     }
@@ -17508,17 +17710,17 @@ function importSixServers(text, names) {
     result.errors.push(error);
     return result;
   }
-  if (!isRecord7(parsed)) {
+  if (!isRecord8(parsed)) {
     result.errors.push("expected an object");
     return result;
   }
   const servers = parsed.servers;
-  if (!isRecord7(servers)) {
+  if (!isRecord8(servers)) {
     result.errors.push('no "servers" object');
     return result;
   }
   for (const [name, entry] of filterNames(Object.entries(servers), names)) {
-    if (!isRecord7(entry)) {
+    if (!isRecord8(entry)) {
       result.errors.push(`${name}: not an object`);
       continue;
     }
@@ -17526,7 +17728,7 @@ function importSixServers(text, names) {
     if (typeof entry.url === "string") config.url = entry.url;
     if (isStringRecord2(entry.headers)) config.headers = entry.headers;
     if (typeof entry.exposure === "string") config.exposure = entry.exposure;
-    if (isRecord7(entry.toolExposure)) config.toolExposure = entry.toolExposure;
+    if (isRecord8(entry.toolExposure)) config.toolExposure = entry.toolExposure;
     result.servers.push({ name, config });
   }
   return result;
@@ -17543,7 +17745,7 @@ function importCodexToml(text, names) {
     if (fields.command) config.command = fields.command;
     if (fields.args) config.args = fields.args;
     if (fields.url) config.url = fields.url;
-    if (fields.env && isRecord7(fields.env)) config.env = fields.env;
+    if (fields.env && isRecord8(fields.env)) config.env = fields.env;
     result.servers.push({ name, config });
   }
   return result;
@@ -17595,7 +17797,7 @@ function convertOpenCodeLocal(entry) {
   } else if (typeof entry.command === "string") {
     config.command = entry.command;
   }
-  if (isRecord7(entry.environment)) {
+  if (isRecord8(entry.environment)) {
     const env2 = {};
     for (const [k, v] of Object.entries(entry.environment)) {
       if (typeof v === "string")
@@ -17618,17 +17820,17 @@ function importOpenCode(text, names) {
     result.errors.push(error);
     return result;
   }
-  if (!isRecord7(parsed)) {
+  if (!isRecord8(parsed)) {
     result.errors.push("expected an object");
     return result;
   }
   const mcpServers = parsed.mcpServers ?? parsed.mcp;
-  if (!isRecord7(mcpServers)) {
+  if (!isRecord8(mcpServers)) {
     result.errors.push("no mcp servers found");
     return result;
   }
   for (const [name, entry] of filterNames(Object.entries(mcpServers), names)) {
-    if (!isRecord7(entry)) {
+    if (!isRecord8(entry)) {
       result.errors.push(`${name}: not an object`);
       continue;
     }
@@ -17644,9 +17846,9 @@ function detectFormat(text, filename) {
   if (filename.includes(".vscode")) return "vscode";
   try {
     const parsed = JSON.parse(text);
-    if (isRecord7(parsed)) {
-      if (parsed.servers && isRecord7(parsed.servers) && parsed.version !== void 0) return "six";
-      if (parsed.servers && isRecord7(parsed.servers)) return "vscode";
+    if (isRecord8(parsed)) {
+      if (parsed.servers && isRecord8(parsed.servers) && parsed.version !== void 0) return "six";
+      if (parsed.servers && isRecord8(parsed.servers)) return "vscode";
       if (parsed.mcpServers) return "claude";
       if (parsed.mcp) return "opencode";
     }
@@ -21238,6 +21440,7 @@ async function kernelSpawn(ctx, options) {
   const useGroupKill = groupSpawnSupported;
   let waited;
   return {
+    pid: childPid,
     stdin: result.stdin ?? new WritableStream(),
     stdout: result.stdout,
     stderr: result.stderr,
@@ -21651,7 +21854,7 @@ async function main(ctx) {
     packageDir: "/node_modules/@ai-ecoverse/mcpcat"
   });
   const args = ctx.argv.slice(1);
-  return run(platform2, "0.31.16", args);
+  return run(platform2, "0.31.18", args);
 }
 export {
   main as default

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/mcpcat",
-  "version": "0.31.16",
+  "version": "0.31.18",
   "description": "A curl for the Model Context Protocol",
   "type": "module",
   "license": "Apache-2.0",
@@ -58,16 +58,16 @@
     "trust:dry": "npx fledgling sync --dry-run -y --skip-publish"
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc-kernel": "1.172.0",
-    "@ai-ecoverse/slicc-shared-web": "2.13.7",
-    "@ai-ecoverse/slicc-vault": "1.19.0",
+    "@ai-ecoverse/slicc-kernel": "1.174.0",
+    "@ai-ecoverse/slicc-shared-web": "2.13.10",
+    "@ai-ecoverse/slicc-vault": "1.22.0",
     "@biomejs/biome": "2.6.3",
     "@earendil-works/pi-codemode": "1.4.0",
     "@earendil-works/pi-mcp": "1.4.0",
     "@types/node": "26.6.5",
     "esbuild": "0.28.2",
     "lefthook": "2.2.2",
-    "monocart-coverage-reports": "2.13.2",
+    "monocart-coverage-reports": "3.2.0",
     "proper-lockfile": "4.1.2",
     "quickjs-wasi": "3.6.3",
     "semantic-release": "25.0.9",