npm - @bastani/atomic - Versions diffs - 0.9.5-alpha.9 → 0.9.5 - Mend

@bastani/atomic 0.9.5-alpha.9 → 0.9.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (377) hide show

package/dist/builtin/mcp/mcp-callback-server.ts CHANGED Viewed

@@ -11,8 +11,8 @@ import {
   getConfiguredOAuthCallbackPort,
   getOAuthCallbackPort,
   setOAuthCallbackPort,
-} from "./mcp-oauth-provider.ts"
-import { logger } from "./logger.ts"
+} from "./mcp-oauth-provider.js"
+import { logger } from "./logger.js"
 // HTML templates for callback responses
 const HTML_SUCCESS = `<!DOCTYPE html>
@@ -63,8 +63,9 @@ interface PendingAuth {
   timeout: ReturnType<typeof setTimeout>
 }
-/** Server singleton state */
+/** Serialized callback-server ownership prevents startup/teardown publication races. */
 let server: Server | undefined
+let serverTransition: Promise<void> = Promise.resolve()
 const pendingAuths = new Map<string, PendingAuth>()
 /** Timeout for callback completion (5 minutes) */
@@ -108,12 +109,9 @@ export function handleRequest(req: IncomingMessage, res: ServerResponse): void {
     // Send HTTP response first before rejecting promise
     res.writeHead(200, { "Content-Type": "text/html" })
     res.end(renderCallbackErrorHtml())
-    // Reject promise after response is sent (defer to allow test to attach handler)
+    // Reject only after the response is sent.
     if (pendingAuths.has(state)) {
-      const pending = pendingAuths.get(state)!
-      clearTimeout(pending.timeout)
-      pendingAuths.delete(state)
-      setTimeout(() => pending.reject(new Error(errorMsg)), 0)
+      rejectPendingCallback(state, new Error(errorMsg))
     }
     return
   }
@@ -149,69 +147,87 @@ export function handleRequest(req: IncomingMessage, res: ServerResponse): void {
  * If strictPort is true, requires binding on the configured callback port.
  * If strictPort is false, scans forward for an available local port.
  */
-export async function ensureCallbackServer(options: EnsureCallbackServerOptions = {}): Promise<void> {
+export function ensureCallbackServer(options: EnsureCallbackServerOptions = {}): Promise<void> {
+  return enqueueServerTransition(() => ensureCallbackServerNow(options))
+}
+function enqueueServerTransition<T>(operation: () => Promise<T>): Promise<T> {
+  const result = serverTransition.then(operation, operation)
+  serverTransition = result.then(() => undefined, () => undefined)
+  return result
+}
+async function closeServer(target: Server): Promise<void> {
+  await new Promise<void>((resolve) => {
+    target.close(() => resolve())
+  })
+}
+async function stopPublishedServer(): Promise<void> {
+  const target = server
+  if (!target) return
+  server = undefined
+  await closeServer(target)
+}
+async function listen(candidate: Server, port: number): Promise<void> {
+  await new Promise<void>((resolve, reject) => {
+    const onError = (error: Error): void => {
+      candidate.off("error", onError)
+      reject(error)
+    }
+    const onListening = (): void => {
+      candidate.off("error", onError)
+      resolve()
+    }
+    candidate.once("error", onError)
+    candidate.listen(port, "localhost", onListening)
+  })
+}
+async function ensureCallbackServerNow(options: EnsureCallbackServerOptions): Promise<void> {
   const configuredPort = getConfiguredOAuthCallbackPort()
   const strictPort = options.strictPort === true
   if (server) {
     if (!strictPort || getOAuthCallbackPort() === configuredPort) return
     if (pendingAuths.size > 0) {
       throw new Error(
-        `OAuth callback server is running on port ${getOAuthCallbackPort()}, but strict callback port ${configuredPort} is required and cannot be switched while authorizations are pending`
+        `OAuth callback server is running on port ${getOAuthCallbackPort()}, but strict callback port ${configuredPort} is required and cannot be switched while authorizations are pending`,
       )
     }
-    await stopCallbackServer()
+    await stopPublishedServer()
+    setOAuthCallbackPort(configuredPort)
   }
-  const preferredPort = configuredPort
   const maxAttempts = strictPort ? 1 : MAX_PORT_SCAN_ATTEMPTS
   let lastError: Error | undefined
   for (let offset = 0; offset < maxAttempts; offset++) {
-    const candidatePort = preferredPort + offset
+    const candidatePort = configuredPort + offset
     const candidateServer = createServer(handleRequest)
     try {
-      await new Promise<void>((resolve, reject) => {
-        candidateServer.once("error", (err) => {
-          reject(err)
-        })
-        candidateServer.listen(candidatePort, "localhost", () => {
-          resolve()
-        })
-      })
+      await listen(candidateServer, candidatePort)
       server = candidateServer
-      server.unref()
+      candidateServer.unref()
       setOAuthCallbackPort(candidatePort)
       return
     } catch (error) {
       const nodeError = error as NodeJS.ErrnoException
-      await new Promise<void>((resolve) => {
-        candidateServer.close(() => resolve())
-      })
-      if (nodeError.code !== "EADDRINUSE") {
-        throw error
-      }
+      await closeServer(candidateServer)
+      if (nodeError.code !== "EADDRINUSE") throw error
       lastError = error instanceof Error ? error : new Error(String(error))
     }
   }
   if (strictPort) {
     throw new Error(
-      `OAuth callback port ${preferredPort} is already in use. Pre-registered OAuth clients require an exact redirect URI; set MCP_OAUTH_CALLBACK_PORT to your registered port or free port ${preferredPort}`,
-      { cause: lastError }
+      `OAuth callback port ${configuredPort} is already in use. Pre-registered OAuth clients require an exact redirect URI; set MCP_OAUTH_CALLBACK_PORT to your registered port or free port ${configuredPort}`,
+      { cause: lastError },
     )
   }
   throw new Error(
-    `OAuth callback port ${preferredPort} is already in use and no free port was found in range ${preferredPort}-${preferredPort + MAX_PORT_SCAN_ATTEMPTS - 1}`,
-    { cause: lastError }
+    `OAuth callback port ${configuredPort} is already in use and no free port was found in range ${configuredPort}-${configuredPort + MAX_PORT_SCAN_ATTEMPTS - 1}`,
+    { cause: lastError },
   )
 }
@@ -220,7 +236,7 @@ export async function ensureCallbackServer(options: EnsureCallbackServerOptions
  * Returns a promise that resolves with the authorization code.
  */
 export function waitForCallback(oauthState: string): Promise<string> {
-  return new Promise((resolve, reject) => {
+  const promise = new Promise<string>((resolve, reject) => {
     const timeout = setTimeout(() => {
       if (pendingAuths.has(oauthState)) {
         pendingAuths.delete(oauthState)
@@ -230,44 +246,49 @@ export function waitForCallback(oauthState: string): Promise<string> {
     pendingAuths.set(oauthState, { resolve, reject, timeout })
   })
+  void promise.catch(() => undefined)
+  return promise
 }
 /**
  * Cancel a pending authorization by state.
  */
-export function cancelPendingCallback(oauthState: string): void {
+function rejectPendingCallback(oauthState: string, error: Error): boolean {
   const pending = pendingAuths.get(oauthState)
-  if (pending) {
-    clearTimeout(pending.timeout)
-    pendingAuths.delete(oauthState)
-    pending.reject(new Error("Authorization cancelled"))
+  if (!pending) return false
+  pendingAuths.delete(oauthState)
+  clearTimeout(pending.timeout)
+  pending.reject(error)
+  return true
+}
+export function cancelPendingCallback(
+  oauthState: string,
+  error = new Error("Authorization cancelled"),
+): void {
+  rejectPendingCallback(oauthState, error)
+}
+/** Reject and remove every callback waiter before lifecycle cleanup settles. */
+export function cancelAllPendingCallbacks(error: Error): void {
+  for (const oauthState of Array.from(pendingAuths.keys())) {
+    rejectPendingCallback(oauthState, error)
   }
 }
 /**
  * Stop the callback server and reject all pending authorizations.
  */
-export async function stopCallbackServer(): Promise<void> {
-  if (server) {
-    await new Promise<void>((resolve) => {
-      server!.close(() => {
-        resolve()
-      })
-    })
-    server = undefined
-  }
-  setOAuthCallbackPort(getConfiguredOAuthCallbackPort())
-  // Reject all pending auths (defer to allow any pending operations to complete)
-  const pendingList = Array.from(pendingAuths.entries())
-  pendingAuths.clear()
-  setTimeout(() => {
-    for (const [, pending] of pendingList) {
-      clearTimeout(pending.timeout)
-      pending.reject(new Error("OAuth callback server stopped"))
-    }
-  }, 0)
+export function stopCallbackServer(
+  error = new Error("OAuth callback server stopped"),
+): Promise<void> {
+  cancelAllPendingCallbacks(error)
+  return enqueueServerTransition(async () => {
+    // A producer can register its waiter while an earlier startup is publishing.
+    cancelAllPendingCallbacks(error)
+    await stopPublishedServer()
+    setOAuthCallbackPort(getConfiguredOAuthCallbackPort())
+  })
 }
 /**

package/dist/builtin/mcp/mcp-oauth-provider.ts CHANGED Viewed

@@ -24,7 +24,7 @@ import {
   clearTokens,
   type StoredTokens,
   type StoredClientInfo,
-} from "./mcp-auth.ts"
+} from "./mcp-auth.js"
 // Callback server configuration
 const DEFAULT_OAUTH_CALLBACK_PORT = 19876
@@ -64,6 +64,7 @@ export interface McpOAuthConfig {
 /** Callbacks for OAuth flow interactions */
 export interface McpOAuthCallbacks {
   onRedirect: (url: URL) => void | Promise<void>
+  assertActive?: () => void
 }
 /**
@@ -78,6 +79,10 @@ export class McpOAuthProvider implements OAuthClientProvider {
     private callbacks: McpOAuthCallbacks,
   ) {}
+  private ensureActive(): void {
+    this.callbacks.assertActive?.()
+  }
   private get usesClientCredentials(): boolean {
     return this.config.grantType === "client_credentials"
   }
@@ -125,6 +130,7 @@ export class McpOAuthProvider implements OAuthClientProvider {
    * Returns undefined if no client info exists or if the server URL has changed.
    */
   async clientInformation(): Promise<OAuthClientInformation | undefined> {
+    this.ensureActive()
     // Check config first (pre-registered client)
     if (this.config.clientId) {
       return {
@@ -136,6 +142,7 @@ export class McpOAuthProvider implements OAuthClientProvider {
     // Check stored client info (from dynamic registration)
     // Use getAuthForUrl to validate credentials are for the current server URL
     const entry = await getAuthForUrl(this.serverName, this.serverUrl)
+    this.ensureActive()
     if (entry?.clientInfo) {
       // Check if client secret has expired
       if (entry.clientInfo.clientSecretExpiresAt && entry.clientInfo.clientSecretExpiresAt < Date.now() / 1000) {
@@ -155,6 +162,7 @@ export class McpOAuthProvider implements OAuthClientProvider {
    * Save client information from dynamic registration.
    */
   async saveClientInformation(info: OAuthClientInformationFull): Promise<void> {
+    this.ensureActive()
     const clientInfo: StoredClientInfo = {
       clientId: info.client_id,
       clientSecret: info.client_secret,
@@ -169,8 +177,10 @@ export class McpOAuthProvider implements OAuthClientProvider {
    * Returns undefined if no tokens exist or if the server URL has changed.
    */
   async tokens(): Promise<OAuthTokens | undefined> {
+    this.ensureActive()
     // Use getAuthForUrl to validate tokens are for the current server URL
     const entry = await getAuthForUrl(this.serverName, this.serverUrl)
+    this.ensureActive()
     if (!entry?.tokens) return undefined
     return {
@@ -188,6 +198,7 @@ export class McpOAuthProvider implements OAuthClientProvider {
    * Save OAuth tokens.
    */
   async saveTokens(tokens: OAuthTokens): Promise<void> {
+    this.ensureActive()
     const storedTokens: StoredTokens = {
       accessToken: tokens.access_token,
       refreshToken: tokens.refresh_token,
@@ -207,11 +218,13 @@ export class McpOAuthProvider implements OAuthClientProvider {
    * flow, which library hosts cannot complete in-process.
    */
   async redirectToAuthorization(authorizationUrl: URL): Promise<void> {
+    this.ensureActive()
     if (this.usesClientCredentials) {
       throw new Error("redirectToAuthorization is not used for client_credentials flow")
     }
     // No saved oauthState means we're on the post-refresh authorize fallback.
     const entry = await getAuthForUrl(this.serverName, this.serverUrl)
+    this.ensureActive()
     if (!entry?.oauthState) {
       throw new UnauthorizedError(
         `Re-authentication required for MCP server: ${this.serverName}`,
@@ -219,12 +232,14 @@ export class McpOAuthProvider implements OAuthClientProvider {
     }
     // URL is passed to callback, not logged (may contain sensitive params)
     await this.callbacks.onRedirect(authorizationUrl)
+    this.ensureActive()
   }
   /**
    * Save the PKCE code verifier.
    */
   async saveCodeVerifier(codeVerifier: string): Promise<void> {
+    this.ensureActive()
     updateCodeVerifier(this.serverName, codeVerifier, this.serverUrl)
   }
@@ -233,10 +248,12 @@ export class McpOAuthProvider implements OAuthClientProvider {
    * @throws Error if no code verifier is stored
    */
   async codeVerifier(): Promise<string> {
+    this.ensureActive()
     if (this.usesClientCredentials) {
       throw new Error("codeVerifier is not used for client_credentials flow")
     }
     const entry = await getAuthForUrl(this.serverName, this.serverUrl)
+    this.ensureActive()
     if (!entry?.codeVerifier) {
       throw new Error(`No code verifier saved for MCP server: ${this.serverName}`)
     }
@@ -247,6 +264,7 @@ export class McpOAuthProvider implements OAuthClientProvider {
    * Save the OAuth state parameter for CSRF protection.
    */
   async saveState(state: string): Promise<void> {
+    this.ensureActive()
     updateOAuthState(this.serverName, state, this.serverUrl)
   }
@@ -255,10 +273,12 @@ export class McpOAuthProvider implements OAuthClientProvider {
    * @throws UnauthorizedError if no flow is in progress (see redirectToAuthorization)
    */
   async state(): Promise<string> {
+    this.ensureActive()
     if (this.usesClientCredentials) {
       throw new Error("state is not used for client_credentials flow")
     }
     const entry = await getAuthForUrl(this.serverName, this.serverUrl)
+    this.ensureActive()
     if (!entry?.oauthState) {
       throw new UnauthorizedError(
         `Re-authentication required for MCP server: ${this.serverName}`,
@@ -272,6 +292,7 @@ export class McpOAuthProvider implements OAuthClientProvider {
    * Clears tokens, client info, or all credentials based on the type.
    */
   async invalidateCredentials(type: "all" | "client" | "tokens"): Promise<void> {
+    this.ensureActive()
     switch (type) {
       case "all":
         clearAllCredentials(this.serverName)
@@ -286,6 +307,7 @@ export class McpOAuthProvider implements OAuthClientProvider {
   }
   prepareTokenRequest(scope?: string): URLSearchParams | undefined {
+    this.ensureActive()
     if (!this.usesClientCredentials) {
       return undefined
     }

package/dist/builtin/mcp/metadata-hydration.ts CHANGED Viewed

@@ -1,30 +1,44 @@
-import type { McpExtensionState } from "./state.ts";
-import { lazyConnect, updateMetadataCache, updateServerMetadata } from "./init.ts";
-import { parallelLimit } from "./utils.ts";
+import type { McpExtensionState } from "./state.js";
+import { lazyConnect, updateMetadataCache, updateServerMetadata } from "./init.js";
+import { parallelLimit } from "./utils.js";
+import { waitForCaller } from "./caller-wait.js";
+import { assertMcpStateLease, type AssertMcpStateLease } from "./state-lease.js";
 export async function hydrateServerMetadata(
   state: McpExtensionState,
   serverName: string,
+  signal?: AbortSignal,
+  assertActive?: AssertMcpStateLease,
 ): Promise<boolean> {
+  signal?.throwIfAborted();
+  assertMcpStateLease(assertActive);
   if (state.toolMetadata.has(serverName)) return true;
   if (!state.config.mcpServers[serverName]) return false;
   const connection = state.manager.getConnection(serverName);
   if (connection?.status === "connected") {
+    assertMcpStateLease(assertActive);
     updateServerMetadata(state, serverName);
     updateMetadataCache(state, serverName);
     return state.toolMetadata.has(serverName);
   }
-  return lazyConnect(state, serverName);
+  const connected = await waitForCaller(() => lazyConnect(state, serverName), signal);
+  signal?.throwIfAborted();
+  assertMcpStateLease(assertActive);
+  return connected;
 }
 export async function hydrateMissingMetadata(
   state: McpExtensionState,
   options?: { server?: string },
+  signal?: AbortSignal,
+  assertActive?: AssertMcpStateLease,
 ): Promise<void> {
+  signal?.throwIfAborted();
+  assertMcpStateLease(assertActive);
   if (options?.server) {
-    await hydrateServerMetadata(state, options.server);
+    await hydrateServerMetadata(state, options.server, signal, assertActive);
     return;
   }
@@ -32,6 +46,7 @@ export async function hydrateMissingMetadata(
     (serverName) => !state.toolMetadata.has(serverName),
   );
   await parallelLimit(missingServers, 10, async (serverName) => {
-    await hydrateServerMetadata(state, serverName);
+    await hydrateServerMetadata(state, serverName, signal, assertActive);
   });
+  assertMcpStateLease(assertActive);
 }

package/dist/builtin/mcp/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/mcp",
-  "version": "0.9.5-alpha.9",
+  "version": "0.9.5",
   "private": true,
   "description": "Atomic extension that adapts MCP (Model Context Protocol) servers into the coding agent. Fork of: https://github.com/nicobailon/pi-mcp-adapter",
   "contributors": [
@@ -32,8 +32,8 @@
   },
   "peerDependencies": {
     "@bastani/atomic": "*",
-    "@earendil-works/pi-ai": "^0.80.3",
-    "@earendil-works/pi-tui": "^0.80.3",
+    "@earendil-works/pi-ai": "^0.80.6",
+    "@earendil-works/pi-tui": "^0.80.6",
     "zod": "^3.25.0 || ^4.0.0"
   },
   "peerDependenciesMeta": {

package/dist/builtin/mcp/proxy-auth.ts CHANGED Viewed

@@ -1,8 +1,8 @@
-import type { McpExtensionState } from "./state.ts";
-import { authenticate, supportsOAuth } from "./mcp-auth-flow.ts";
-import { formatAuthRequiredMessage } from "./utils.ts";
+import type { McpExtensionState } from "./state.js";
+import { authenticate, supportsOAuth } from "./mcp-auth-flow.js";
+import { formatAuthRequiredMessage } from "./utils.js";
-type AutoAuthResult =
+export type AutoAuthResult =
   | { status: "skipped" }
   | { status: "success" }
   | { status: "failed"; message: string };