@fitchmultz/pi-mcp-adapter 8.0.5 → 8.0.7

package/OAUTH.md

@@ -42,6 +42,7 @@ For most MCP servers, you only need the URL:
 ```
 
 OAuth is automatically enabled for HTTP servers. The SDK will:
+
 - Auto-detect if the server requires OAuth
 - Discover OAuth endpoints from the server
 - Reuse a configured/stored client, use CIMD when supported, or register dynamically
@@ -69,8 +70,6 @@ You can optionally provide a pre-registered client:
 }
 ```
 
-
-
 ### Configuration Options
 
 - `url` - The MCP server URL (required)
@@ -145,13 +144,13 @@ Set `oauth.privateKeyJwt` to authenticate native token requests with `private_ke
 }
 ```
 
-| Option | Meaning |
-| --- | --- |
-| `privateKey` | PKCS#8 PEM string, JWK object or JWK JSON string. Strings support `${VAR}`, `$env:VAR`, `{env:VAR}` and existing `!command` / `!!` conventions, resolved only when authenticating. |
-| `algorithm` | Required asymmetric JOSE algorithm. Native PEM import supports RS, PS and ES families; EdDSA / Ed25519 require a JWK. The SDK validates supported key/algorithm combinations. HMAC (`HS*`) and `none` are not private-key authentication. |
-| `audience` | Optional nonempty JWT audience string; defaults to the discovered authorization-server issuer, then token URL. It does not change the request destination. |
-| `lifetimeSeconds` | Optional positive integer; native default is 300 seconds. |
-| `claims` | Optional object of additional JWT claims. Native `iss`, `sub`, `aud`, `iat`, `exp` and `jti` take precedence over overlapping entries. |
+| Option            | Meaning                                                                                                                                                                                                                                   |
+| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `privateKey`      | PKCS#8 PEM string, JWK object or JWK JSON string. Strings support `${VAR}`, `$env:VAR`, `{env:VAR}` and existing `!command` / `!!` conventions, resolved only when authenticating.                                                        |
+| `algorithm`       | Required asymmetric JOSE algorithm. Native PEM import supports RS, PS and ES families; EdDSA / Ed25519 require a JWK. The SDK validates supported key/algorithm combinations. HMAC (`HS*`) and `none` are not private-key authentication. |
+| `audience`        | Optional nonempty JWT audience string; defaults to the discovered authorization-server issuer, then token URL. It does not change the request destination.                                                                                |
+| `lifetimeSeconds` | Optional positive integer; native default is 300 seconds.                                                                                                                                                                                 |
+| `claims`          | Optional object of additional JWT claims. Native `iss`, `sub`, `aud`, `iat`, `exp` and `jti` take precedence over overlapping entries.                                                                                                    |
 
 Keys must belong to an externally registered `clientId`, or a custom `clientMetadataUrl` whose document describes `private_key_jwt` and provides the matching public verification key. The SDK signs issuer and subject as the actual selected client ID. Configured and usable stored clients retain their existing priority. If a previous login uses the shared method-`none` browser identity or a shared secret, private-key authentication fails before key resolution instead of silently migrating or erasing that login. `clientSecret` and `privateKeyJwt` cannot be configured together. The shared Fitch document cannot identify a private-key client. Explicit pre-registration and opaque DCR client IDs are not classified as shared CIMD merely because their strings resemble a document URL.
 
@@ -197,6 +196,7 @@ Run the `/mcp-auth` command with the server name:
 Manual `/mcp-auth` is the default flow. With `settings.autoAuth: true`, proxy/direct/script tool execution may authenticate when a server needs auth or rejects a call for insufficient scope. Browser authorization still requires an interactive host, and each invocation gets at most one automatic auth attempt and one post-auth retry. Initial sign-in does not grant a second automatic consent attempt in the same invocation.
 
 For browser authorization, this will:
+
 1. Start the callback server lazily on an OS-assigned local port, or on the exact `oauth.redirectUri` port for pre-registered callbacks
 2. Discover OAuth endpoints automatically
 3. Select a configured/stored client, CIMD, or dynamic registration
@@ -253,6 +253,7 @@ mcp({ action: "call", server: "my-oauth-server", tool: "my-tool", args: { key: "
 ```
 
 The SDK automatically:
+
 - Adds the access token to requests
 - Refreshes expired tokens automatically
 - Re-authenticates if tokens are invalid
@@ -434,12 +435,8 @@ The default remains strict, including when `protocolVersion` is `"legacy"`. The
 The implementation uses the official split MCP SDK v2 client and OAuth APIs. MCP Apps also uses this split SDK graph; SDK v1 is not a runtime dependency:
 
 ```typescript
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/client"
-import {
-  auth,
-  UnauthorizedError,
-  type OAuthClientProvider,
-} from "@modelcontextprotocol/client"
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/client";
+import { auth, UnauthorizedError, type OAuthClientProvider } from "@modelcontextprotocol/client";
 ```
 
 The `McpOAuthProvider` class implements `OAuthClientProvider` and is passed to `StreamableHTTPClientTransport`:
@@ -447,7 +444,7 @@ The `McpOAuthProvider` class implements `OAuthClientProvider` and is passed to `
 ```typescript
 const transport = new StreamableHTTPClientTransport(url, {
   authProvider: new McpOAuthProvider(serverName, serverUrl, config, callbacks),
-})
+});
 ```
 
 ## References

package/README.md

@@ -44,14 +44,14 @@ By default, servers connect when Pi discovers an uncached catalog or calls a too
 
 ## Controls and settings
 
-| Command | Purpose |
-| --- | --- |
-| `/mcp` | Show servers and pin tools |
-| `/mcp status` | Show connection state and tool/resource counts |
-| `/mcp reconnect <server>` | Reconnect and refresh the catalog |
-| `/mcp-auth <server>` | Start OAuth in an interactive session |
-| `/mcp disable <server>` | Disable the server for this project; apply with `/reload` |
-| `/mcp enable <server>` | Enable the server for this project; apply with `/reload` |
+| Command                   | Purpose                                                   |
+| ------------------------- | --------------------------------------------------------- |
+| `/mcp`                    | Show servers and pin tools                                |
+| `/mcp status`             | Show connection state and tool/resource counts            |
+| `/mcp reconnect <server>` | Reconnect and refresh the catalog                         |
+| `/mcp-auth <server>`      | Start OAuth in an interactive session                     |
+| `/mcp disable <server>`   | Disable the server for this project; apply with `/reload` |
+| `/mcp enable <server>`    | Enable the server for this project; apply with `/reload`  |
 
 Use [`directTools`](docs/reference.md#typed-discovery-and-pinned-tools) to pin tools at startup. Other tools remain available for discovery. Global search covers known catalogs; select a server to discover an unknown catalog.
 

package/cli.js

@@ -8,9 +8,14 @@ import stripJsonComments from "strip-json-comments";
 
 const HOME = os.homedir();
 
+/** @param {string} input @returns {string} */
 function expandHome(input) {
-  if (input === "~") return HOME;
-  if (input.startsWith("~/")) return path.resolve(HOME, input.slice(2));
+  if (input === "~") {
+    return HOME;
+  }
+  if (input.startsWith("~/")) {
+    return path.resolve(HOME, input.slice(2));
+  }
   return path.resolve(input);
 }
 
@@ -31,11 +36,10 @@ const IMPORT_PATHS = {
     path.join(HOME, ".claude.json"),
     path.join(HOME, ".claude", "claude_desktop_config.json"),
   ],
-  "claude-desktop": [path.join(HOME, "Library", "Application Support", "Claude", "claude_desktop_config.json")],
-  codex: [
-    path.join(HOME, ".codex", "config.toml"),
-    path.join(HOME, ".codex", "config.json"),
+  "claude-desktop": [
+    path.join(HOME, "Library", "Application Support", "Claude", "claude_desktop_config.json"),
   ],
+  codex: [path.join(HOME, ".codex", "config.toml"), path.join(HOME, ".codex", "config.json")],
   opencode: [
     path.join(HOME, ".config", "opencode", "opencode.json"),
     path.resolve(process.cwd(), "opencode.json"),
@@ -55,8 +59,11 @@ function printHelp(log = console.log) {
   log("  fitch-mcp-adapter migrate [--dry-run]  Copy pre-v5 state without changing its sources");
 }
 
+/** @param {string} filePath */
 function readJsonFile(filePath) {
-  return JSON.parse(stripJsonComments(fs.readFileSync(filePath, "utf-8"), { trailingCommas: true }));
+  return JSON.parse(
+    stripJsonComments(fs.readFileSync(filePath, "utf-8"), { trailingCommas: true }),
+  );
 }
 
 function loadPiConfig() {
@@ -67,13 +74,17 @@ function loadPiConfig() {
   const raw = readJsonFile(PI_CONFIG_PATH);
   const mcpServers = raw.mcpServers ?? raw["mcp-servers"] ?? {};
   if (!mcpServers || typeof mcpServers !== "object" || Array.isArray(mcpServers)) {
-    throw new Error(`Invalid MCP config at ${PI_CONFIG_PATH}: expected \"mcpServers\" to be an object`);
+    throw new Error(
+      `Invalid MCP config at ${PI_CONFIG_PATH}: expected "mcpServers" to be an object`,
+    );
   }
 
   const normalized = { ...raw };
   delete normalized["mcp-servers"];
 
-  const imports = Array.isArray(raw.imports) ? raw.imports.filter((value) => typeof value === "string") : undefined;
+  const imports = Array.isArray(raw.imports)
+    ? raw.imports.filter((/** @type {unknown} */ value) => typeof value === "string")
+    : undefined;
   return {
     ...normalized,
     mcpServers,
@@ -94,6 +105,7 @@ function findAvailableImports() {
   return found;
 }
 
+/** @param {(line: string) => void} log @param {{ kind: string; path: string }[]} imports */
 function printDiscovery(log, imports) {
   log("Config discovery:\n");
 
@@ -107,6 +119,9 @@ function printDiscovery(log, imports) {
   ];
 
   for (const [label, filePath] of paths) {
+    if (filePath === undefined) {
+      continue;
+    }
     const prefix = fs.existsSync(filePath) ? "✓" : "-";
     log(`${prefix} ${label}: ${filePath}`);
   }
@@ -122,11 +137,13 @@ function printDiscovery(log, imports) {
   }
 }
 
+/** @param {{ imports?: unknown }} config */
 function writePiConfig(config) {
   fs.mkdirSync(path.dirname(PI_CONFIG_PATH), { recursive: true });
   fs.writeFileSync(PI_CONFIG_PATH, `${JSON.stringify(config, null, 2)}\n`, "utf-8");
 }
 
+/** @param {string[]} argv @param {(line: string) => void} [log] */
 async function runInit(argv, log = console.log) {
   const dryRun = argv.includes("--dry-run");
   const discoverHostConfigs = argv.includes("--discover-host-configs");
@@ -139,16 +156,21 @@ async function runInit(argv, log = console.log) {
 
   printDiscovery(log, foundImports);
 
-  const discoverySettingChanged = discoverHostConfigs && existingConfig.settings?.hostConfigDiscovery !== "on";
+  const discoverySettingChanged =
+    discoverHostConfigs && existingConfig.settings?.hostConfigDiscovery !== "on";
   if (importsToAdd.length === 0 && !discoverySettingChanged) {
     log("\nNo Pi config changes needed.");
-    log("Standard MCP configs are discovered automatically, and host-specific imports are already configured or unavailable.");
+    log(
+      "Standard MCP configs are discovered automatically, and host-specific imports are already configured or unavailable.",
+    );
     return 0;
   }
 
   const nextConfig = {
     ...existingConfig,
-    ...(discoverySettingChanged ? { settings: { ...existingConfig.settings, hostConfigDiscovery: "on" } } : {}),
+    ...(discoverySettingChanged
+      ? { settings: { ...existingConfig.settings, hostConfigDiscovery: "on" } }
+      : {}),
     ...(importsToAdd.length > 0 ? { imports: [...existingImports, ...importsToAdd] } : {}),
     mcpServers: existingConfig.mcpServers ?? {},
   };
@@ -157,7 +179,9 @@ async function runInit(argv, log = console.log) {
     log(`\nDetected host configs to import into Pi: ${importsToAdd.join(", ")}`);
   }
   if (discoverySettingChanged) {
-    log("Opting in to host-specific fallback discovery (standard and Pi-owned configs still take precedence).");
+    log(
+      "Opting in to host-specific fallback discovery (standard and Pi-owned configs still take precedence).",
+    );
   }
 
   if (dryRun) {
@@ -167,9 +191,13 @@ async function runInit(argv, log = console.log) {
 
   writePiConfig(nextConfig);
   log(`Updated ${PI_CONFIG_PATH}`);
-  log("Pi will now keep reading standard MCP configs automatically, while these imports cover host-specific config formats.");
+  log(
+    "Pi will now keep reading standard MCP configs automatically, while these imports cover host-specific config formats.",
+  );
   if (discoverySettingChanged) {
-    log("Host config discovery is explicit and does not write to or execute commands from external host files.");
+    log(
+      "Host config discovery is explicit and does not write to or execute commands from external host files.",
+    );
   }
   return 0;
 }
@@ -184,7 +212,9 @@ export async function main(argv = process.argv.slice(2), log = console.log, erro
 
   if (command === "install") {
     error("The custom downloader has been retired.");
-    error("Use `pi install npm:@fitchmultz/pi-mcp-adapter` instead, then optionally run `fitch-mcp-adapter init`.");
+    error(
+      "Use `pi install npm:@fitchmultz/pi-mcp-adapter` instead, then optionally run `fitch-mcp-adapter init`.",
+    );
     return 1;
   }
 
@@ -196,11 +226,17 @@ export async function main(argv = process.argv.slice(2), log = console.log, erro
     const { migrateLegacyState } = await import("./dist/legacy-migration.js");
     const dryRun = rest.includes("--dry-run");
     const result = migrateLegacyState({ dryRun });
-    for (const file of result.files) log(`${file.status}: ${file.source} -> ${file.destination}`);
-    for (const credential of result.credentials) log(`OAuth ${credential.server}: ${credential.status}`);
-    log(dryRun
-      ? "Dry run: no files changed and no credential store accessed."
-      : "Migration complete. Existing destinations and all source files/credentials were left intact. Restart Pi to use the independent adapter.");
+    for (const file of result.files) {
+      log(`${file.status}: ${file.source} -> ${file.destination}`);
+    }
+    for (const credential of result.credentials) {
+      log(`OAuth ${credential.server}: ${credential.status}`);
+    }
+    log(
+      dryRun
+        ? "Dry run: no files changed and no credential store accessed."
+        : "Migration complete. Existing destinations and all source files/credentials were left intact. Restart Pi to use the independent adapter.",
+    );
     return 0;
   }
 
@@ -210,13 +246,16 @@ export async function main(argv = process.argv.slice(2), log = console.log, erro
 }
 
 const resolvedEntrypoint = process.argv[1] ? fs.realpathSync(process.argv[1]) : undefined;
-const isEntrypoint = resolvedEntrypoint && import.meta.url === pathToFileURL(resolvedEntrypoint).href;
+const isEntrypoint =
+  resolvedEntrypoint && import.meta.url === pathToFileURL(resolvedEntrypoint).href;
 
 if (isEntrypoint) {
-  main().then((code) => {
-    process.exitCode = code;
-  }).catch((err) => {
-    console.error(`\nHelper failed: ${err instanceof Error ? err.message : String(err)}`);
-    process.exit(1);
-  });
+  main()
+    .then((code) => {
+      process.exitCode = code;
+    })
+    .catch((err) => {
+      console.error(`\nHelper failed: ${err instanceof Error ? err.message : String(err)}`);
+      process.exit(1);
+    });
 }

package/dist/abort.js

@@ -1,32 +1,41 @@
 export function throwIfAborted(signal) {
-    if (!signal?.aborted)
+    if (!signal?.aborted) {
         return;
-    throw signal.reason instanceof Error ? signal.reason : new Error(String(signal.reason ?? "MCP request aborted"));
+    }
+    throw signal.reason instanceof Error
+        ? signal.reason
+        : new Error(String(signal.reason ?? "MCP request aborted"));
 }
 export async function abortable(promise, signal) {
-    if (!signal)
+    if (!signal) {
         return promise;
+    }
     throwIfAborted(signal);
     return await new Promise((resolve, reject) => {
         let settled = false;
         const cleanup = () => signal.removeEventListener("abort", onAbort);
         const onAbort = () => {
-            if (settled)
+            if (settled) {
                 return;
+            }
             settled = true;
             cleanup();
-            reject(signal.reason instanceof Error ? signal.reason : new Error(String(signal.reason ?? "MCP request aborted")));
+            reject(signal.reason instanceof Error
+                ? signal.reason
+                : new Error(String(signal.reason ?? "MCP request aborted")));
         };
         signal.addEventListener("abort", onAbort, { once: true });
-        promise.then(value => {
-            if (settled)
+        promise.then((value) => {
+            if (settled) {
                 return;
+            }
             settled = true;
             cleanup();
             resolve(value);
-        }, error => {
-            if (settled)
+        }, (error) => {
+            if (settled) {
                 return;
+            }
             settled = true;
             cleanup();
             reject(error);

package/dist/client-operations.js

@@ -4,16 +4,18 @@ export async function drainClientCallbacks(client) {
         const pending = [...(clientOperations.get(client) ?? [])]
             .filter(([, kind]) => kind === "sampling callback" || kind === "elicitation callback")
             .map(([operation]) => operation);
-        if (!pending.length)
+        if (!pending.length) {
             return;
+        }
         await Promise.allSettled(pending);
     }
 }
 export async function drainClientOperations(client) {
     for (;;) {
         const pending = [...(clientOperations.get(client)?.keys() ?? [])];
-        if (!pending.length)
+        if (!pending.length) {
             return;
+        }
         await Promise.allSettled(pending);
     }
 }