@executor-js/plugin-mcp 1.4.31 → 1.4.32

package/dist/{chunk-H5PLTEMB.js → chunk-LEGVPKYH.js}

@@ -5,6 +5,7 @@ import {
   MCP_OAUTH_CLIENT_ID_SLOT,
   MCP_OAUTH_CLIENT_SECRET_SLOT,
   MCP_OAUTH_CONNECTION_SLOT,
+  McpAuthRequiredError,
   McpConfiguredValueInput,
   McpConnectionAuthInput,
   McpConnectionError,
@@ -18,7 +19,7 @@ import {
   SecretBackedValue,
   mcpHeaderSlot,
   mcpQueryParamSlot
-} from "./chunk-3TGDWTNE.js";
+} from "./chunk-6OYEXHU3.js";
 
 // src/sdk/binding-store.ts
 import { Effect, Option, Predicate, Schema } from "effect";
@@ -152,10 +153,13 @@ import {
   Schema as Schema5,
   ScopedCache as ScopedCache2
 } from "effect";
+import { CallToolResultSchema } from "@modelcontextprotocol/sdk/types.js";
+import * as z from "zod/v4";
 import {
   ScopeId,
   SourceDetectionResult,
   ToolResult,
+  authToolFailure,
   defaultSourceInstallScopeId,
   definePlugin,
   tool,
@@ -221,7 +225,7 @@ var createMcpConnector = (input) => {
     }
     return Effect2.gen(function* () {
       const { createStdioTransport } = yield* Effect2.tryPromise({
-        try: () => import("./stdio-connector-MDW6PW36.js"),
+        try: () => import("./stdio-connector-AA5S6UUJ.js"),
         catch: () => new McpConnectionError({
           transport: "stdio",
           message: "Failed to load stdio transport module"
@@ -843,6 +847,26 @@ var mcpToolFailure = (code, message, details) => ToolResult.fail({
   message,
   ...details === void 0 ? {} : { details }
 });
+var mcpAuthToolFailure = (failure) => authToolFailure({
+  code: failure.code,
+  message: failure.message,
+  source: { id: failure.sourceId, scope: failure.sourceScope },
+  credential: {
+    kind: failure.credentialKind,
+    ...failure.credentialLabel ? { label: failure.credentialLabel } : {},
+    ...failure.slotKey ? { slotKey: failure.slotKey } : {},
+    ...failure.secretId ? { secretId: failure.secretId } : {},
+    ...failure.connectionId ? { connectionId: failure.connectionId } : {}
+  },
+  ...failure.status !== void 0 ? { status: failure.status } : {},
+  ...failure.details !== void 0 ? {
+    upstream: {
+      ...failure.status !== void 0 ? { status: failure.status } : {},
+      details: failure.details
+    }
+  } : {},
+  recovery: { configureSourceTool: "executor.mcp.configureSource" }
+});
 var McpAddSourceInputStandardSchema = schemaToStaticToolSchema(McpAddSourceInputSchema);
 var McpAddSourceOutputStandardSchema = schemaToStaticToolSchema(McpAddSourceOutputSchema);
 var McpProbeEndpointInputStandardSchema = schemaToStaticToolSchema(McpProbeEndpointInputSchema);
@@ -882,6 +906,19 @@ var normalizeNamespace = (config) => config.namespace ?? deriveMcpNamespace({
   endpoint: config.transport === "remote" ? config.endpoint : void 0,
   command: config.transport === "stdio" ? config.command : void 0
 });
+var McpCallToolResultJsonSchema = z.toJSONSchema(CallToolResultSchema);
+var mcpCallToolResultOutputSchema = (structuredContentSchema) => {
+  const defaultStructuredContentSchema = McpCallToolResultJsonSchema.properties?.structuredContent ?? {};
+  return {
+    ...McpCallToolResultJsonSchema,
+    properties: {
+      ...McpCallToolResultJsonSchema.properties,
+      structuredContent: structuredContentSchema === void 0 ? defaultStructuredContentSchema : structuredContentSchema,
+      isError: { const: false }
+    },
+    required: structuredContentSchema === void 0 ? ["content"] : ["content", "structuredContent"]
+  };
+};
 var toBinding = (entry) => McpToolBinding.make({
   toolId: entry.toolId,
   toolName: entry.toolName,
@@ -1105,21 +1142,34 @@ var resolveMcpBindingValueMap = (ctx, values, params) => Effect6.gen(function* (
       value.slot
     );
     if (binding?.value.kind === "secret") {
-      const secret = yield* ctx.secrets.getAtScope(binding.value.secretId, binding.scopeId).pipe(
+      const secretBinding = binding.value;
+      const secret = yield* ctx.secrets.getAtScope(secretBinding.secretId, binding.scopeId).pipe(
         Effect6.catchTag(
           "SecretOwnedByConnectionError",
           () => Effect6.fail(
-            new McpConnectionError({
-              transport: "remote",
+            new McpAuthRequiredError({
+              code: "credential_secret_missing",
+              sourceId: params.sourceId,
+              sourceScope: params.sourceScope,
+              credentialKind: "secret",
+              credentialLabel: name,
+              slotKey: value.slot,
+              secretId: String(secretBinding.secretId),
               message: `Failed to resolve secret for ${params.missingLabel} "${name}"`
             })
           )
         )
       );
       if (secret === null) {
-        return yield* new McpConnectionError({
-          transport: "remote",
-          message: `Missing secret "${binding.value.secretId}" for ${params.missingLabel} "${name}"`
+        return yield* new McpAuthRequiredError({
+          code: "credential_secret_missing",
+          sourceId: params.sourceId,
+          sourceScope: params.sourceScope,
+          credentialKind: "secret",
+          credentialLabel: name,
+          slotKey: value.slot,
+          secretId: String(secretBinding.secretId),
+          message: `Missing secret "${secretBinding.secretId}" for ${params.missingLabel} "${name}"`
         });
       }
       resolved[name] = value.prefix ? `${value.prefix}${secret}` : secret;
@@ -1129,8 +1179,13 @@ var resolveMcpBindingValueMap = (ctx, values, params) => Effect6.gen(function* (
       resolved[name] = value.prefix ? `${value.prefix}${binding.value.text}` : binding.value.text;
       continue;
     }
-    return yield* new McpConnectionError({
-      transport: "remote",
+    return yield* new McpAuthRequiredError({
+      code: "credential_binding_missing",
+      sourceId: params.sourceId,
+      sourceScope: params.sourceScope,
+      credentialKind: "secret",
+      credentialLabel: name,
+      slotKey: value.slot,
       message: `Missing binding for ${params.missingLabel} "${name}"`
     });
   }
@@ -1192,20 +1247,33 @@ var resolveMcpHeaderAuth = (ctx, sourceId, sourceScope, auth) => Effect6.gen(fun
   if (auth.kind !== "header") return {};
   const binding = yield* resolveMcpSourceBinding(ctx, sourceId, sourceScope, auth.secretSlot);
   if (binding?.value.kind === "secret") {
-    const secret = yield* ctx.secrets.getAtScope(binding.value.secretId, binding.scopeId).pipe(
+    const secretBinding = binding.value;
+    const secret = yield* ctx.secrets.getAtScope(secretBinding.secretId, binding.scopeId).pipe(
       Effect6.catchTag(
         "SecretOwnedByConnectionError",
         () => Effect6.fail(
-          new McpConnectionError({
-            transport: "remote",
+          new McpAuthRequiredError({
+            code: "credential_secret_missing",
+            sourceId,
+            sourceScope,
+            credentialKind: "secret",
+            credentialLabel: auth.headerName,
+            slotKey: auth.secretSlot,
+            secretId: String(secretBinding.secretId),
             message: `Failed to resolve header auth binding "${auth.secretSlot}"`
           })
         )
       )
     );
     if (secret === null) {
-      return yield* new McpConnectionError({
-        transport: "remote",
+      return yield* new McpAuthRequiredError({
+        code: "credential_secret_missing",
+        sourceId,
+        sourceScope,
+        credentialKind: "secret",
+        credentialLabel: auth.headerName,
+        slotKey: auth.secretSlot,
+        secretId: String(secretBinding.secretId),
         message: `Missing secret for header auth binding "${auth.secretSlot}"`
       });
     }
@@ -1216,8 +1284,13 @@ var resolveMcpHeaderAuth = (ctx, sourceId, sourceScope, auth) => Effect6.gen(fun
       [auth.headerName]: auth.prefix ? `${auth.prefix}${binding.value.text}` : binding.value.text
     };
   }
-  return yield* new McpConnectionError({
-    transport: "remote",
+  return yield* new McpAuthRequiredError({
+    code: "credential_binding_missing",
+    sourceId,
+    sourceScope,
+    credentialKind: "secret",
+    credentialLabel: auth.headerName,
+    slotKey: auth.secretSlot,
     message: `Missing header auth binding "${auth.secretSlot}"`
   });
 });
@@ -1225,19 +1298,80 @@ var resolveMcpStoredOauthProvider = (ctx, sourceId, sourceScope, auth) => Effect
   if (auth.kind !== "oauth2") return void 0;
   const binding = yield* resolveMcpSourceBinding(ctx, sourceId, sourceScope, auth.connectionSlot);
   if (binding?.value.kind !== "connection") {
-    return yield* new McpConnectionError({
-      transport: "remote",
+    return yield* new McpAuthRequiredError({
+      code: "oauth_connection_missing",
+      sourceId,
+      sourceScope,
+      credentialKind: "connection",
+      credentialLabel: "OAuth sign-in",
+      slotKey: auth.connectionSlot,
       message: `Missing OAuth connection binding for MCP source "${sourceId}"`
     });
   }
   const connectionId = binding.value.connectionId;
   const accessToken = yield* ctx.connections.accessTokenAtScope(connectionId, binding.scopeId).pipe(
-    Effect6.mapError(
-      ({ message }) => new McpConnectionError({
-        transport: "remote",
-        message: `Failed to resolve OAuth connection "${connectionId}": ${message}`
-      })
-    )
+    Effect6.catchTags({
+      ConnectionReauthRequiredError: ({ message, connectionId: failedConnectionId }) => Effect6.fail(
+        new McpAuthRequiredError({
+          code: "oauth_reauth_required",
+          sourceId,
+          sourceScope,
+          credentialKind: "oauth",
+          credentialLabel: "OAuth sign-in",
+          slotKey: auth.connectionSlot,
+          connectionId: String(failedConnectionId),
+          message: `OAuth connection "${failedConnectionId}" needs re-authentication: ${message}`
+        })
+      ),
+      ConnectionNotFoundError: ({ connectionId: failedConnectionId }) => Effect6.fail(
+        new McpAuthRequiredError({
+          code: "oauth_connection_missing",
+          sourceId,
+          sourceScope,
+          credentialKind: "connection",
+          credentialLabel: "OAuth sign-in",
+          slotKey: auth.connectionSlot,
+          connectionId: String(failedConnectionId),
+          message: `OAuth connection "${failedConnectionId}" was not found for MCP source "${sourceId}"`
+        })
+      ),
+      ConnectionProviderNotRegisteredError: ({ provider }) => Effect6.fail(
+        new McpAuthRequiredError({
+          code: "oauth_connection_failed",
+          sourceId,
+          sourceScope,
+          credentialKind: "oauth",
+          credentialLabel: "OAuth sign-in",
+          slotKey: auth.connectionSlot,
+          connectionId: String(connectionId),
+          message: `OAuth provider "${provider}" is not registered`
+        })
+      ),
+      ConnectionRefreshNotSupportedError: ({ provider, connectionId: failedConnectionId }) => Effect6.fail(
+        new McpAuthRequiredError({
+          code: "oauth_connection_failed",
+          sourceId,
+          sourceScope,
+          credentialKind: "oauth",
+          credentialLabel: "OAuth sign-in",
+          slotKey: auth.connectionSlot,
+          connectionId: String(failedConnectionId),
+          message: `OAuth provider "${provider}" cannot refresh connection "${failedConnectionId}"`
+        })
+      ),
+      ConnectionRefreshError: ({ message, connectionId: failedConnectionId }) => Effect6.fail(
+        new McpAuthRequiredError({
+          code: "oauth_connection_failed",
+          sourceId,
+          sourceScope,
+          credentialKind: "oauth",
+          credentialLabel: "OAuth sign-in",
+          slotKey: auth.connectionSlot,
+          connectionId: String(failedConnectionId),
+          message: `OAuth connection "${failedConnectionId}" refresh failed: ${message}`
+        })
+      )
+    })
   );
   return makeOAuthProvider(accessToken);
 });
@@ -1610,6 +1744,12 @@ var mcpPlugin = definePlugin((options) => {
           })
         );
         if (Result.isFailure(resolved) && sd.transport === "stdio") {
+          if (Predicate3.isTagged(resolved.failure, "McpAuthRequiredError")) {
+            return yield* new McpConnectionError({
+              transport: sd.transport,
+              message: resolved.failure.message
+            });
+          }
           return yield* Effect6.fail(resolved.failure);
         }
         const discovery = Result.isSuccess(resolved) ? yield* discoverTools(createMcpConnector(resolved.success)).pipe(
@@ -1657,7 +1797,7 @@ var mcpPlugin = definePlugin((options) => {
                 name: e.toolId,
                 description: e.description ?? `MCP tool: ${e.toolName}`,
                 inputSchema: e.inputSchema,
-                outputSchema: e.outputSchema
+                outputSchema: mcpCallToolResultOutputSchema(e.outputSchema)
               }))
             });
             if (initialRemote && initialBindings.length > 0) {
@@ -1690,6 +1830,12 @@ var mcpPlugin = definePlugin((options) => {
           yield* configFile.upsertSource(toMcpConfigEntry(namespace, sourceName, config)).pipe(Effect6.withSpan("mcp.plugin.config_file.upsert"));
         }
         if (Result.isFailure(discovery)) {
+          if (Predicate3.isTagged(discovery.failure, "McpAuthRequiredError")) {
+            return yield* new McpConnectionError({
+              transport: sd.transport,
+              message: discovery.failure.message
+            });
+          }
           return yield* Effect6.fail(discovery.failure);
         }
         return { toolCount: manifest.tools.length, namespace };
@@ -1735,6 +1881,10 @@ var mcpPlugin = definePlugin((options) => {
           });
         }
         const ci = yield* resolveConnectorInput(namespace, scope, sd, ctx, allowStdio).pipe(
+          Effect6.catchTag(
+            "McpAuthRequiredError",
+            ({ message }) => Effect6.fail(new McpConnectionError({ transport: sd.transport, message }))
+          ),
           Effect6.withSpan("mcp.plugin.resolve_connector", {
             attributes: {
               "mcp.source.namespace": namespace,
@@ -1780,7 +1930,7 @@ var mcpPlugin = definePlugin((options) => {
                 name: e.toolId,
                 description: e.description ?? `MCP tool: ${e.toolName}`,
                 inputSchema: e.inputSchema,
-                outputSchema: e.outputSchema
+                outputSchema: mcpCallToolResultOutputSchema(e.outputSchema)
               }))
             });
           })
@@ -2101,6 +2251,10 @@ var mcpPlugin = definePlugin((options) => {
       }
       return ToolResult.ok(raw);
     }).pipe(
+      Effect6.catchTag(
+        "McpAuthRequiredError",
+        (error) => Effect6.succeed(mcpAuthToolFailure(error))
+      ),
       Effect6.withSpan("mcp.plugin.invoke_tool", {
         attributes: {
           "mcp.tool.name": toolRow.id,
@@ -2234,4 +2388,4 @@ export {
   makeMcpStore,
   mcpPlugin
 };
-//# sourceMappingURL=chunk-H5PLTEMB.js.map
+//# sourceMappingURL=chunk-LEGVPKYH.js.map