@alfe.ai/ctrader-mcp 0.3.7 → 0.3.8

package/dist/server.js

@@ -107,6 +107,7 @@ function buildRegistry(creds) {
 			clientSecret,
 			accessToken,
 			accountId,
+			accountIdentifier: account.accountIdentifier?.trim() ?? "",
 			host,
 			isLive,
 			...account.brokerName != null ? { brokerName: account.brokerName } : {},
@@ -586,6 +587,18 @@ var CTraderError = class extends Error {
 	}
 };
 /**
+* cTrader's token-expired reject code. cTrader access tokens live ~30 days and
+* the credentials read serves the STORED token without refreshing, so a
+* long-lived agent's token eventually expires and every account-auth returns
+* this code (Sentry LOCAL-MCP-5 / -A / -B). It is the sole trigger for a
+* refresh + single retry. It is a pre-execution auth rejection whichever
+* request carries it — the OA_ACCOUNT_AUTH_REQ handshake, or the tool request
+* itself on a socket whose memoized account-auth expired mid-session — so
+* retrying the tool call once is safe even for write tools: a request cannot
+* both execute and come back token-invalid.
+*/
+const ACCESS_TOKEN_INVALID = "CH_ACCESS_TOKEN_INVALID";
+/**
 * The unsolicited payload types fanned out to `onEvent` listeners. Everything
 * else without a clientMsgId waiter is still silently dropped (heartbeats,
 * execution events for other sessions, …).
@@ -1019,12 +1032,19 @@ var CTraderPool = class {
 	registry;
 	connectFn;
 	root;
+	refresher;
 	/** host → the single socket serving that host. Lazily populated. */
 	sockets = /* @__PURE__ */ new Map();
-	constructor(registry, connectFn = tlsConnect, root = loadRoot()) {
+	/**
+	* grant accountIdentifier → in-flight refresh. Dedupes concurrent tool calls
+	* that all trip an expired token on the same grant into ONE backend refresh.
+	*/
+	inFlightRefreshByGrant = /* @__PURE__ */ new Map();
+	constructor(registry, connectFn = tlsConnect, root = loadRoot(), refresher) {
 		this.registry = registry;
 		this.connectFn = connectFn;
 		this.root = root;
+		this.refresher = refresher;
 	}
 	/** The account registry (read-only view for tools that list/resolve). */
 	get accounts() {
@@ -1065,14 +1085,53 @@ var CTraderPool = class {
 	* Throws `CTraderError("UNKNOWN_ACCOUNT")` if the id isn't in the registry
 	* (fail closed — never fall back to another account).
 	*/
-	async request(accountId, payloadType, payload) {
+	async request(accountId, payloadType, payload, retryOnAuthFailure = true) {
 		const config = this.resolve(accountId);
 		if (!config) throw new CTraderError("UNKNOWN_ACCOUNT", `Account ${accountId} is not connected`);
-		const socket = this.socketFor(config);
-		await socket.authenticateAccount(config.accountId, config.accessToken);
-		return socket.request(payloadType, {
-			...payload,
-			ctidTraderAccountId: accountIdLong(config.accountId)
+		try {
+			const socket = this.socketFor(config);
+			await socket.authenticateAccount(config.accountId, config.accessToken);
+			return await socket.request(payloadType, {
+				...payload,
+				ctidTraderAccountId: accountIdLong(config.accountId)
+			});
+		} catch (err) {
+			if (retryOnAuthFailure && err instanceof CTraderError && err.errorCode === ACCESS_TOKEN_INVALID && this.refresher !== void 0 && config.accountIdentifier.length > 0) {
+				try {
+					await this.refreshGrant(config.accountIdentifier);
+				} catch (refreshErr) {
+					log$1(`Token refresh failed for account ${accountId}: ${refreshErr instanceof Error ? refreshErr.message : String(refreshErr)}`);
+					throw err;
+				}
+				return this.request(accountId, payloadType, payload, false);
+			}
+			throw err;
+		}
+	}
+	/**
+	* Refresh one grant's token, deduping concurrent callers on the same grant.
+	* A grant token covers EVERY account under that cTrader login, so refreshing
+	* once and rewriting the token on all registry entries sharing the grant is
+	* both correct and avoids N redundant refreshes when several accounts trip
+	* the expiry at once.
+	*/
+	refreshGrant(accountIdentifier) {
+		const inFlight = this.inFlightRefreshByGrant.get(accountIdentifier);
+		if (inFlight !== void 0) return inFlight;
+		const promise = this.refreshGrantInner(accountIdentifier).finally(() => {
+			if (this.inFlightRefreshByGrant.get(accountIdentifier) === promise) this.inFlightRefreshByGrant.delete(accountIdentifier);
+		});
+		this.inFlightRefreshByGrant.set(accountIdentifier, promise);
+		return promise;
+	}
+	async refreshGrantInner(accountIdentifier) {
+		if (this.refresher === void 0) throw new CTraderError("NO_REFRESHER", "No cTrader token refresher is configured");
+		const { accessToken } = await this.refresher.refreshCTraderAccount(accountIdentifier);
+		const newToken = accessToken.trim();
+		if (newToken.length === 0) throw new CTraderError("REFRESH_FAILED", "cTrader token refresh returned an empty access token");
+		for (const [id, cfg] of this.registry) if (cfg.accountIdentifier === accountIdentifier) this.registry.set(id, {
+			...cfg,
+			accessToken: newToken
 		});
 	}
 	/**
@@ -2229,7 +2288,7 @@ async function main() {
 		else log(`Failed to resolve cTrader accounts: ${err instanceof Error ? err.message : String(err)}`);
 		process.exit(1);
 	}
-	const pool = new CTraderPool(registry);
+	const pool = new CTraderPool(registry, void 0, void 0, apiClient);
 	const server = new McpServer({
 		name: "ctrader-mcp-server",
 		version: packageVersion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/ctrader-mcp",
-  "version": "0.3.7",
+  "version": "0.3.8",
   "description": "cTrader MCP server — full trading (market/limit/stop/stop-limit orders, trailing stops), Level 2 depth, live quotes, trade history, PnL & margin over the cTrader Open API (protobuf/TLS)",
   "type": "module",
   "main": "./dist/server.js",
@@ -21,7 +21,7 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "protobufjs": "^8.7.0",
     "zod": "^4.0.5",
-    "@alfe.ai/agent-api-client": "0.15.0",
+    "@alfe.ai/agent-api-client": "0.16.0",
     "@alfe.ai/config": "0.4.1"
   },
   "license": "UNLICENSED",