@deotio/mcp-sigv4-proxy 0.4.0 → 0.4.2

package/dist/proxy.js

@@ -3,6 +3,8 @@ import { SignatureV4 } from '@smithy/signature-v4';
 import { HttpRequest } from '@smithy/protocol-http';
 import { Sha256 } from '@aws-crypto/sha256-js';
 import readline from 'readline';
+import { createRequire } from 'module';
+const { version: PROXY_VERSION } = createRequire(import.meta.url)('../package.json');
 export const MAX_SSE_BUFFER_BYTES = 1_048_576; // 1 MB
 const DEFAULT_TIMEOUT_MS = 180_000; // 180s, matches AWS proxy
 const DEFAULT_RETRIES = 2;
@@ -19,7 +21,7 @@ const LOG_LEVEL_ORDER = {
     ERROR: 3,
     SILENT: 4,
 };
-let currentLogLevel = 'ERROR';
+let currentLogLevel = 'INFO';
 export function setLogLevel(level) {
     currentLogLevel = level;
 }
@@ -65,11 +67,17 @@ export function validateEnv() {
     const inferred = parseEndpointUrl(url.hostname);
     const region = process.env.AWS_REGION || inferred?.region || 'us-east-1';
     const service = process.env.AWS_SERVICE || inferred?.service || 'bedrock-agentcore';
-    // Parse log level
-    const envLogLevel = (process.env.MCP_LOG_LEVEL ?? 'ERROR').toUpperCase();
-    if (envLogLevel in LOG_LEVEL_ORDER) {
-        setLogLevel(envLogLevel);
+    // Parse log level — only override the default if explicitly set
+    if (process.env.MCP_LOG_LEVEL) {
+        const envLogLevel = process.env.MCP_LOG_LEVEL.toUpperCase();
+        if (envLogLevel in LOG_LEVEL_ORDER) {
+            setLogLevel(envLogLevel);
+        }
+        else {
+            log('WARNING', `unknown MCP_LOG_LEVEL value "${process.env.MCP_LOG_LEVEL}", using default`);
+        }
     }
+    log('INFO', `v${PROXY_VERSION} starting`);
     // Parse timeout
     const timeoutMs = process.env.MCP_TIMEOUT
         ? Number(process.env.MCP_TIMEOUT) * 1000
@@ -270,8 +278,20 @@ export async function processLine(line, config, signer) {
         return;
     const { body, requestId } = input;
     const request = buildHttpRequest(config.url, body);
+    let signed;
+    try {
+        signed = await signer.sign(request);
+    }
+    catch (err) {
+        log('ERROR', `signing failed (check AWS credentials for profile/env): ${err}`);
+        process.stdout.write(JSON.stringify({
+            jsonrpc: '2.0',
+            id: requestId,
+            error: { code: -32000, message: 'Request signing failed — check AWS credentials' },
+        }) + '\n');
+        return;
+    }
     try {
-        const signed = await signer.sign(request);
         log('DEBUG', `-> POST ${config.url.pathname}`);
         const response = await fetchWithRetry(config.url.toString(), {
             method: 'POST',
@@ -294,6 +314,8 @@ export async function processLine(line, config, signer) {
 const WARM_CACHEABLE = new Set([
     'initialize', 'tools/list', 'resources/list', 'prompts/list',
 ]);
+// Exported for testing
+export { syntheticInitializeResult };
 /**
  * Synthetic MCP initialize response returned when the backend hasn't responded yet.
  * Advertises tools/resources/prompts capabilities so Claude Code proceeds to list calls.
@@ -302,7 +324,7 @@ function syntheticInitializeResult() {
     return {
         protocolVersion: '2025-03-26',
         capabilities: { tools: {}, resources: {}, prompts: {} },
-        serverInfo: { name: 'mcp-sigv4-proxy-warm', version: '0.4.0' },
+        serverInfo: { name: 'mcp-sigv4-proxy-warm', version: PROXY_VERSION },
     };
 }
 export async function warmBackend(config, signer) {
@@ -337,13 +359,24 @@ export async function warmBackend(config, signer) {
                     initResponse = null;
                     continue;
                 }
-                log('WARNING', `warm: initialize failed with HTTP ${initResponse.status}`);
+                const hint = initResponse.status === 403
+                    ? ' (check IAM permissions for the calling identity)'
+                    : initResponse.status === 404
+                        ? ' (check MCP_SERVER_URL — endpoint not found)'
+                        : initResponse.status === 406
+                            ? ' (server rejected request — possibly missing Accept header)'
+                            : '';
+                log('ERROR', `warm: initialize failed with HTTP ${initResponse.status}${hint}`);
                 return false;
             }
             catch (err) {
+                const isCredentialError = err instanceof Error &&
+                    (err.message.includes('credential') ||
+                        err.message.includes('Could not load credentials') ||
+                        err.message.includes('profile'));
                 if (attempt < config.warmRetries) {
                     const delay = config.warmRetryDelayMs * Math.pow(2, attempt);
-                    log('WARNING', `warm: initialize error (${err}), retrying in ${delay}ms`);
+                    log(isCredentialError ? 'ERROR' : 'WARNING', `warm: initialize ${isCredentialError ? 'credential error' : 'error'} (${err}), retrying in ${delay}ms (${attempt + 1}/${config.warmRetries})`);
                     await sleep(Math.min(delay, deadline - Date.now()));
                     continue;
                 }
@@ -389,11 +422,41 @@ export async function warmBackend(config, signer) {
                 const response = await fetchWithTimeout(config.url.toString(), { method: 'POST', headers: signed.headers, body: listBody }, Math.min(config.timeoutMs, Math.max(1000, deadline - Date.now())));
                 if (response.ok) {
                     const body = await response.text();
-                    const parsed = JSON.parse(body);
-                    if (parsed.result) {
+                    const ct = response.headers.get('content-type') ?? '';
+                    let parsed = null;
+                    if (ct.includes('text/event-stream')) {
+                        // Extract the first data: line from the SSE stream
+                        const dataLine = body.split('\n').find((l) => l.startsWith('data: '));
+                        if (dataLine) {
+                            try {
+                                parsed = JSON.parse(dataLine.slice(6).trim());
+                            }
+                            catch {
+                                log('WARNING', `warm: ${method} SSE data line is not valid JSON`);
+                            }
+                        }
+                        else {
+                            log('WARNING', `warm: ${method} returned SSE but contained no data: lines`);
+                        }
+                    }
+                    else {
+                        try {
+                            parsed = JSON.parse(body);
+                        }
+                        catch {
+                            log('WARNING', `warm: ${method} response is not valid JSON (content-type: ${ct})`);
+                        }
+                    }
+                    if (parsed?.result) {
                         state.cache[method] = parsed.result;
                         log('DEBUG', `warm: cached ${method} (${JSON.stringify(parsed.result).length} bytes)`);
                     }
+                    else if (parsed) {
+                        log('WARNING', `warm: ${method} response had no .result field`);
+                    }
+                }
+                else {
+                    log('WARNING', `warm: prefetch ${method} failed with HTTP ${response.status}`);
                 }
             }
             catch (err) {
@@ -437,33 +500,62 @@ export function tryWarmResponse(body, requestId, warmState) {
     // Claude Code sends this too, but in warm mode we intercepted initialize so we handle it.
     return true;
 }
+/**
+ * Handle a single parsed JSON-RPC message in warm mode.
+ * Returns true if the message was served locally (no need to forward to backend).
+ */
+export async function handleWarmLine(input, ws) {
+    const method = JSON.parse(input.body).method;
+    if (method === 'initialize') {
+        // Respond IMMEDIATELY — never block on ws.ready here.
+        // This is the critical path: Claude Code's 30s timeout applies to this response.
+        const result = ws.cache.initialize ?? syntheticInitializeResult();
+        process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id: input.requestId, result }) + '\n');
+        log('DEBUG', `warm: served initialize ${ws.cache.initialize ? 'from cache' : 'synthetic'}`);
+        return true;
+    }
+    if (WARM_CACHEABLE.has(method)) {
+        // List methods: serve from cache immediately if available…
+        if (tryWarmResponse(input.body, input.requestId, ws))
+            return true;
+        // …otherwise wait for warm-up to complete, then try cache again before forwarding
+        log('INFO', `warm: cache miss for ${method}, waiting for warm-up to complete`);
+        const warmed = await ws.ready;
+        log('INFO', `warm: warm-up ${warmed ? 'succeeded' : 'failed'} — ${method} ${warmed ? 'served from cache' : 'forwarding to backend'}`);
+        if (tryWarmResponse(input.body, input.requestId, ws))
+            return true;
+        log('INFO', `warm: cache still empty for ${method}, forwarding to backend`);
+    }
+    // Non-cacheable methods (tools/call etc): return false to forward normally.
+    // fetchWithRetry handles any residual 424s if the backend isn't warm yet.
+    return false;
+}
 // --- Main entry ---
 export function startProxy() {
     const config = validateEnv();
     const signer = createSigner(config);
     const rl = readline.createInterface({ input: process.stdin, terminal: false });
-    // Start warm-up in background if enabled (non-blocking)
-    let warmState = null;
-    if (config.warm) {
-        warmBackend(config, signer).then((state) => { warmState = state; });
-    }
+    // Start warm-up immediately. warmBackend() has no awaits before returning the WarmState
+    // object, so this promise resolves in the next microtask — effectively instant. The
+    // warmState.ready promise inside it is what takes minutes to resolve.
+    const warmStateP = config.warm
+        ? warmBackend(config, signer)
+        : null;
     let pending = Promise.resolve();
     rl.on('line', (line) => {
         pending = pending.then(async () => {
-            // In warm mode, try to serve from cache first
-            if (warmState) {
+            if (warmStateP) {
                 const input = parseInputLine(line);
                 if (input) {
-                    // Wait for warm-up to finish before deciding
-                    const warmActive = await warmState.ready;
-                    if (warmActive && tryWarmResponse(input.body, input.requestId, warmState)) {
-                        return; // served from cache
-                    }
-                    // Fall through: warm mode inactive or method not cacheable — forward normally
+                    const ws = await warmStateP; // resolves almost instantly
+                    if (await handleWarmLine(input, ws))
+                        return;
                 }
             }
             await processLine(line, config, signer);
-        }).catch(() => { });
+        }).catch((err) => {
+            log('ERROR', `unhandled error in line processing: ${err}`);
+        });
     });
     rl.on('close', async () => {
         log('INFO', 'stdin closed, draining in-flight requests');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deotio/mcp-sigv4-proxy",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "stdio MCP proxy with AWS SigV4 signing — connect Claude Code to any IAM-authenticated MCP server using a named AWS profile",
   "type": "module",
   "bin": {
@@ -19,16 +19,16 @@
   "dependencies": {
     "@aws-sdk/credential-providers": "^3.0.0",
     "@aws-crypto/sha256-js": "^5.0.0",
-    "@smithy/protocol-http": "^4.0.0",
+    "@smithy/protocol-http": "^5.3.12",
     "@smithy/signature-v4": "^4.0.0"
   },
   "devDependencies": {
-    "@types/jest": "^29.0.0",
+    "@types/jest": "^30.0.0",
     "@types/node": "^22.0.0",
     "@typescript-eslint/eslint-plugin": "^7.0.0",
     "@typescript-eslint/parser": "^7.0.0",
     "eslint": "^8.0.0",
-    "jest": "^29.0.0",
+    "jest": "^30.3.0",
     "prettier": "^3.0.0",
     "ts-jest": "^29.0.0",
     "typescript": "^5.0.0"