@deotio/mcp-sigv4-proxy 0.4.2 → 0.4.4

package/dist/proxy.js

@@ -14,6 +14,7 @@ const COLD_START_RETRY_MS = 5000;
 const DEFAULT_WARM_RETRIES = 5;
 const DEFAULT_WARM_RETRY_DELAY_MS = 10_000;
 const DEFAULT_WARM_TIMEOUT_MS = 300_000; // 5 min
+const DEFAULT_SIGN_TIMEOUT_MS = 10_000; // 10 s — fail fast if credentials are unavailable
 const LOG_LEVEL_ORDER = {
     DEBUG: 0,
     INFO: 1,
@@ -82,6 +83,10 @@ export function validateEnv() {
     const timeoutMs = process.env.MCP_TIMEOUT
         ? Number(process.env.MCP_TIMEOUT) * 1000
         : DEFAULT_TIMEOUT_MS;
+    // Parse signing timeout
+    const signTimeoutMs = process.env.MCP_SIGN_TIMEOUT
+        ? Number(process.env.MCP_SIGN_TIMEOUT) * 1000
+        : DEFAULT_SIGN_TIMEOUT_MS;
     // Parse retries
     const retries = process.env.MCP_RETRIES
         ? Math.min(Math.max(0, Math.floor(Number(process.env.MCP_RETRIES))), 10)
@@ -105,7 +110,7 @@ export function validateEnv() {
     if (warm) {
         log('INFO', `warm mode enabled (retries: ${warmRetries}, delay: ${warmRetryDelayMs}ms, timeout: ${warmTimeoutMs}ms)`);
     }
-    return { url, region, service, timeoutMs, retries, warm, warmRetries, warmRetryDelayMs, warmTimeoutMs };
+    return { url, region, service, timeoutMs, retries, warm, warmRetries, warmRetryDelayMs, warmTimeoutMs, signTimeoutMs };
 }
 export function createSigner(config) {
     return new SignatureV4({
@@ -115,6 +120,38 @@ export function createSigner(config) {
         sha256: Sha256,
     });
 }
+export async function signWithTimeout(signer, request, timeoutMs) {
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`credential resolution timed out after ${timeoutMs}ms — ` +
+            'run: aws sso login --profile <your-profile>')), timeoutMs);
+    });
+    try {
+        return await Promise.race([signer.sign(request), timeout]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+export async function probeCredentials(timeoutMs = 5_000) {
+    const provider = fromNodeProviderChain();
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`timed out after ${timeoutMs}ms`)), timeoutMs);
+    });
+    try {
+        await Promise.race([provider(), timeout]);
+        log('INFO', `credentials OK (profile: ${process.env.AWS_PROFILE ?? 'default'})`);
+    }
+    catch (err) {
+        log('ERROR', `credential probe failed — AWS requests will fail until credentials are refreshed.\n` +
+            `  Run: aws sso login --profile ${process.env.AWS_PROFILE ?? '<profile>'}\n` +
+            `  Details: ${err}`);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 // --- Input parsing ---
 export function parseInputLine(line) {
     const body = line.trim();
@@ -135,7 +172,8 @@ export function parseInputLine(line) {
         return null;
     }
     const requestId = parsed.id ?? null;
-    return { body, requestId };
+    const isNotification = !('id' in parsed);
+    return { body, requestId, isNotification };
 }
 // --- Request building ---
 export function buildHttpRequest(url, body) {
@@ -150,6 +188,7 @@ export function buildHttpRequest(url, body) {
         ...(Object.keys(query).length > 0 && { query }),
         headers: {
             'Content-Type': 'application/json',
+            'Accept': 'application/json, text/event-stream',
             'Content-Length': String(Buffer.byteLength(body)),
             host: url.hostname,
         },
@@ -276,19 +315,21 @@ export async function processLine(line, config, signer) {
     const input = parseInputLine(line);
     if (!input)
         return;
-    const { body, requestId } = input;
+    const { body, requestId, isNotification } = input;
     const request = buildHttpRequest(config.url, body);
     let signed;
     try {
-        signed = await signer.sign(request);
+        signed = await signWithTimeout(signer, request, config.signTimeoutMs);
     }
     catch (err) {
         log('ERROR', `signing failed (check AWS credentials for profile/env): ${err}`);
-        process.stdout.write(JSON.stringify({
-            jsonrpc: '2.0',
-            id: requestId,
-            error: { code: -32000, message: 'Request signing failed — check AWS credentials' },
-        }) + '\n');
+        if (!isNotification) {
+            process.stdout.write(JSON.stringify({
+                jsonrpc: '2.0',
+                id: requestId,
+                error: { code: -32000, message: 'Request signing failed — check AWS credentials' },
+            }) + '\n');
+        }
         return;
     }
     try {
@@ -304,11 +345,13 @@ export async function processLine(line, config, signer) {
         const isTimeout = err instanceof DOMException && err.name === 'AbortError';
         const message = isTimeout ? 'Request timed out' : 'Proxy request failed';
         log('ERROR', `request failed: ${err}`);
-        process.stdout.write(JSON.stringify({
-            jsonrpc: '2.0',
-            id: requestId,
-            error: { code: -32000, message },
-        }) + '\n');
+        if (!isNotification) {
+            process.stdout.write(JSON.stringify({
+                jsonrpc: '2.0',
+                id: requestId,
+                error: { code: -32000, message },
+            }) + '\n');
+        }
     }
 }
 const WARM_CACHEABLE = new Set([
@@ -339,7 +382,7 @@ export async function warmBackend(config, signer) {
             params: {
                 protocolVersion: '2025-03-26',
                 capabilities: {},
-                clientInfo: { name: 'mcp-sigv4-proxy', version: '0.4.0' },
+                clientInfo: { name: 'mcp-sigv4-proxy', version: PROXY_VERSION },
             },
         });
         let initResponse = null;
@@ -348,7 +391,7 @@ export async function warmBackend(config, signer) {
                 break;
             try {
                 const request = buildHttpRequest(config.url, initBody);
-                const signed = await signer.sign(request);
+                const signed = await signWithTimeout(signer, request, config.signTimeoutMs);
                 initResponse = await fetchWithTimeout(config.url.toString(), { method: 'POST', headers: signed.headers, body: initBody }, Math.min(config.timeoutMs, deadline - Date.now()));
                 if (initResponse.ok)
                     break;
@@ -373,10 +416,17 @@ export async function warmBackend(config, signer) {
                 const isCredentialError = err instanceof Error &&
                     (err.message.includes('credential') ||
                         err.message.includes('Could not load credentials') ||
-                        err.message.includes('profile'));
+                        err.message.includes('profile') ||
+                        err.message.includes('timed out')); // catches signWithTimeout errors
+                if (isCredentialError) {
+                    // No point retrying — expired tokens won't fix themselves.
+                    log('ERROR', `warm: credential error — aborting warm-up. ` +
+                        `Run: aws sso login --profile <your-profile>\n  Details: ${err}`);
+                    return false;
+                }
                 if (attempt < config.warmRetries) {
                     const delay = config.warmRetryDelayMs * Math.pow(2, attempt);
-                    log(isCredentialError ? 'ERROR' : 'WARNING', `warm: initialize ${isCredentialError ? 'credential error' : 'error'} (${err}), retrying in ${delay}ms (${attempt + 1}/${config.warmRetries})`);
+                    log('WARNING', `warm: initialize error (${err}), retrying in ${delay}ms (${attempt + 1}/${config.warmRetries})`);
                     await sleep(Math.min(delay, deadline - Date.now()));
                     continue;
                 }
@@ -418,7 +468,7 @@ export async function warmBackend(config, signer) {
                     jsonrpc: '2.0', id: `__warmup_${method}__`, method, params: {},
                 });
                 const request = buildHttpRequest(config.url, listBody);
-                const signed = await signer.sign(request);
+                const signed = await signWithTimeout(signer, request, config.signTimeoutMs);
                 const response = await fetchWithTimeout(config.url.toString(), { method: 'POST', headers: signed.headers, body: listBody }, Math.min(config.timeoutMs, Math.max(1000, deadline - Date.now())));
                 if (response.ok) {
                     const body = await response.text();
@@ -460,7 +510,17 @@ export async function warmBackend(config, signer) {
                 }
             }
             catch (err) {
-                log('WARNING', `warm: failed to prefetch ${method}: ${err}`);
+                const isCredentialError = err instanceof Error &&
+                    (err.message.includes('credential') ||
+                        err.message.includes('Could not load credentials') ||
+                        err.message.includes('profile') ||
+                        err.message.includes('timed out'));
+                if (isCredentialError) {
+                    log('ERROR', `warm: credential error during prefetch of ${method} — skipping. Details: ${err}`);
+                }
+                else {
+                    log('WARNING', `warm: failed to prefetch ${method}: ${err}`);
+                }
             }
         }));
         state.active = true;
@@ -515,16 +575,13 @@ export async function handleWarmLine(input, ws) {
         return true;
     }
     if (WARM_CACHEABLE.has(method)) {
-        // List methods: serve from cache immediately if available…
-        if (tryWarmResponse(input.body, input.requestId, ws))
-            return true;
-        // …otherwise wait for warm-up to complete, then try cache again before forwarding
-        log('INFO', `warm: cache miss for ${method}, waiting for warm-up to complete`);
-        const warmed = await ws.ready;
-        log('INFO', `warm: warm-up ${warmed ? 'succeeded' : 'failed'} — ${method} ${warmed ? 'served from cache' : 'forwarding to backend'}`);
+        // List methods: serve from cache immediately if available — never block on ws.ready.
+        // Warm-up is an optimistic pre-fetch; if it hasn't completed yet, fall through and
+        // let the backend answer directly. Blocking here would cause Claude Code's 60s
+        // tool-discovery timeout to fire before warm-up finishes.
         if (tryWarmResponse(input.body, input.requestId, ws))
             return true;
-        log('INFO', `warm: cache still empty for ${method}, forwarding to backend`);
+        log('INFO', `warm: cache miss for ${method}, forwarding to backend`);
     }
     // Non-cacheable methods (tools/call etc): return false to forward normally.
     // fetchWithRetry handles any residual 424s if the backend isn't warm yet.
@@ -534,6 +591,8 @@ export async function handleWarmLine(input, ws) {
 export function startProxy() {
     const config = validateEnv();
     const signer = createSigner(config);
+    // Non-blocking credential check — surfaces expired SSO immediately.
+    probeCredentials().catch(() => { });
     const rl = readline.createInterface({ input: process.stdin, terminal: false });
     // Start warm-up immediately. warmBackend() has no awaits before returning the WarmState
     // object, so this promise resolves in the next microtask — effectively instant. The

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deotio/mcp-sigv4-proxy",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "stdio MCP proxy with AWS SigV4 signing — connect Claude Code to any IAM-authenticated MCP server using a named AWS profile",
   "type": "module",
   "bin": {