@miphamai/cli 0.52.0 → 0.54.0

package/src/daemon/feishu/adapter.ts

@@ -4,6 +4,7 @@ import type { FeishuConfig, FeishuTextMessage } from './types.js'
 import type { SessionManager } from '../session-manager'
 import type { SessionWorker } from '../session-worker'
 import type { RateLimiter } from '../rate-limiter'
+import { handleChannelMessage } from '../channel-message.js'
 
 export interface FeishuAdapterDeps {
   sm: SessionManager
@@ -24,33 +25,21 @@ export function createFeishuAdapter(config: FeishuConfig, deps: FeishuAdapterDep
   const allowed = new Set(config.allowedOpenIds)
 
   const onMessage = async (msg: FeishuTextMessage) => {
-    try {
-      if (!allowed.has(msg.openId)) return
-      if (!deps.rateLimiter.check(`feishu:${msg.openId}`).allowed) return
-
-      const session = deps.sm.getOrCreateByExternalUser(
-        'feishu',
-        msg.openId,
-        deps.cwd,
-        deps.provider,
-        deps.model,
-      )
-      const worker = deps.getOrCreateWorker(session.id)
-      if (!worker) {
-        await api.sendText(msg.openId, '（会话初始化失败，请稍后重试）')
-        return
-      }
-      await worker.processPrompt(msg.text)
-      const result = worker.getLastAssistantContent()
-      await api.sendText(msg.openId, result ? result.slice(0, 4000) : '（无回复）')
-    } catch (err) {
-      console.error('[feishu] message handling failed:', err)
-      try {
-        await api.sendText(msg.openId, '（处理失败，请稍后重试）')
-      } catch {
-        /* 忽略回送失败，确保不 rethrow → Feishu 不重试 */
-      }
-    }
+    await handleChannelMessage({
+      channel: 'feishu',
+      externalId: msg.openId,
+      text: msg.text,
+      allowed,
+      rateLimiter: deps.rateLimiter,
+      sm: deps.sm,
+      getOrCreateWorker: deps.getOrCreateWorker,
+      cwd: deps.cwd,
+      provider: deps.provider,
+      model: deps.model,
+      sendText: (id, t) => api.sendText(id, t),
+      maxLen: 4000,
+      logPrefix: '[feishu]',
+    })
   }
 
   const dispatcher = createFeishuEventDispatcher(config, onMessage)

package/src/daemon/index.ts

@@ -27,6 +27,10 @@ import { parseFeishuEnv } from './feishu/env.js'
 import type { FeishuConfig } from './feishu/types.js'
 import { parseTelegramEnv } from './telegram/env.js'
 import type { TelegramConfig } from './telegram/types.js'
+import { parseWecomEnv } from './wecom/env.js'
+import type { WecomConfig } from './wecom/types.js'
+import { parseDingtalkEnv } from './dingtalk/env.js'
+import type { DingtalkConfig } from './dingtalk/types.js'
 import { loadConfig } from '../config/loader'
 
 const HOME = homedir()
@@ -194,6 +198,34 @@ export async function startDaemon(): Promise<{ port: number; token: string }> {
     }
   }
 
+  // 企业微信 remote-control adapter（env 未配置时跳过）
+  const wecomConfig = parseWecomEnv()
+  let wecom: { config: WecomConfig; cwd: string; provider: string; model: string } | undefined
+  if (wecomConfig) {
+    const cfg = loadConfig()
+    const provider = cfg.providers.find((p) => p.status !== 'upcoming') ?? cfg.providers[0]
+    wecom = {
+      config: wecomConfig,
+      cwd: process.env.WECOM_CWD || process.cwd(),
+      provider: provider?.id ?? 'anthropic',
+      model: provider?.models?.[0]?.id ?? 'claude-sonnet-5',
+    }
+  }
+
+  // 钉钉 remote-control adapter（Stream 长连接，env 未配置时跳过）
+  const dingtalkConfig = parseDingtalkEnv()
+  let dingtalk: { config: DingtalkConfig; cwd: string; provider: string; model: string } | undefined
+  if (dingtalkConfig) {
+    const cfg = loadConfig()
+    const provider = cfg.providers.find((p) => p.status !== 'upcoming') ?? cfg.providers[0]
+    dingtalk = {
+      config: dingtalkConfig,
+      cwd: process.env.DINGTALK_CWD || process.cwd(),
+      provider: provider?.id ?? 'anthropic',
+      model: provider?.models?.[0]?.id ?? 'claude-sonnet-5',
+    }
+  }
+
   // Start HTTP server (Bun.serve starts listening immediately)
   const server = createServer({
     db,
@@ -210,6 +242,8 @@ export async function startDaemon(): Promise<{ port: number; token: string }> {
     rateLimiter,
     feishu,
     telegram,
+    wecom,
+    dingtalk,
   })
   activeServer = server
 

package/src/daemon/server.ts

@@ -29,6 +29,12 @@ import type { FeishuConfig } from './feishu/types.js'
 import { createTelegramAdapter } from './telegram/adapter.js'
 import { createTelegramApi } from './telegram/api.js'
 import type { TelegramConfig } from './telegram/types.js'
+import { createWecomAdapter } from './wecom/adapter.js'
+import { createWecomApi } from './wecom/api.js'
+import type { WecomConfig } from './wecom/types.js'
+import { createDingtalkAdapter } from './dingtalk/adapter.js'
+import { createDingtalkApi } from './dingtalk/api.js'
+import type { DingtalkConfig } from './dingtalk/types.js'
 import { startHeartbeat } from './heartbeat'
 
 interface ServerConfig {
@@ -46,6 +52,8 @@ interface ServerConfig {
   rateLimiter: RateLimiter
   feishu?: { config: FeishuConfig; cwd: string; provider: string; model: string }
   telegram?: { config: TelegramConfig; cwd: string; provider: string; model: string }
+  wecom?: { config: WecomConfig; cwd: string; provider: string; model: string }
+  dingtalk?: { config: DingtalkConfig; cwd: string; provider: string; model: string }
 }
 
 interface WsData {
@@ -124,6 +132,8 @@ export function createServer(config: ServerConfig): Server<WsData> {
     rateLimiter,
     feishu,
     telegram,
+    wecom,
+    dingtalk,
   } = config
 
   const wsClients = new Map<string, Set<ServerWebSocket<WsData>>>()
@@ -274,6 +284,32 @@ export function createServer(config: ServerConfig): Server<WsData> {
     : undefined
   telegramAdapter?.start()
 
+  // ── 企业微信 remote-control adapter（长连接，无需 webhook 路由）──
+  const wecomAdapter = wecom
+    ? createWecomAdapter(wecom.config, createWecomApi(wecom.config), {
+        sm,
+        getOrCreateWorker,
+        rateLimiter,
+        cwd: wecom.cwd,
+        provider: wecom.provider,
+        model: wecom.model,
+      })
+    : undefined
+  wecomAdapter?.start()
+
+  // ── 钉钉 remote-control adapter（Stream 长连接，无需 webhook 路由）──
+  const dingtalkAdapter = dingtalk
+    ? createDingtalkAdapter(dingtalk.config, createDingtalkApi(dingtalk.config), {
+        sm,
+        getOrCreateWorker,
+        rateLimiter,
+        cwd: dingtalk.cwd,
+        provider: dingtalk.provider,
+        model: dingtalk.model,
+      })
+    : undefined
+  dingtalkAdapter?.start()
+
   // ── 心跳式通知：定时扫 pending（goal/schedule），只通知、不自主行动 ──
   const heartbeatSource = {
     listGoals: () => sm.listSessions().flatMap((s) => goalManager.getGoals(s.id)),

package/src/daemon/telegram/adapter.ts

@@ -3,6 +3,7 @@ import type { TelegramConfig, TelegramMessage } from './types.js'
 import type { SessionManager } from '../session-manager'
 import type { SessionWorker } from '../session-worker'
 import type { RateLimiter } from '../rate-limiter'
+import { handleChannelMessage } from '../channel-message.js'
 import { startTelegramPoller } from './poller.js'
 
 export interface TelegramAdapterDeps {
@@ -29,33 +30,21 @@ export function createTelegramAdapter(
   let stopPoller: (() => void) | null = null
 
   async function handleMessage(msg: TelegramMessage): Promise<void> {
-    try {
-      if (!allowed.has(msg.chatId)) return
-      if (!deps.rateLimiter.check(`telegram:${msg.chatId}`).allowed) return
-
-      const session = deps.sm.getOrCreateByExternalUser(
-        'telegram',
-        msg.chatId,
-        deps.cwd,
-        deps.provider,
-        deps.model,
-      )
-      const worker = deps.getOrCreateWorker(session.id)
-      if (!worker) {
-        await api.sendText(msg.chatId, '（会话初始化失败，请稍后重试）')
-        return
-      }
-      await worker.processPrompt(msg.text)
-      const result = worker.getLastAssistantContent()
-      await api.sendText(msg.chatId, result ? result.slice(0, 4096) : '（无回复）')
-    } catch (err) {
-      console.error('[telegram] message handling failed:', err)
-      try {
-        await api.sendText(msg.chatId, '（处理失败，请稍后重试）')
-      } catch {
-        /* 忽略回送失败，不 rethrow */
-      }
-    }
+    await handleChannelMessage({
+      channel: 'telegram',
+      externalId: msg.chatId,
+      text: msg.text,
+      allowed,
+      rateLimiter: deps.rateLimiter,
+      sm: deps.sm,
+      getOrCreateWorker: deps.getOrCreateWorker,
+      cwd: deps.cwd,
+      provider: deps.provider,
+      model: deps.model,
+      sendText: (id, t) => api.sendText(id, t),
+      maxLen: 4096,
+      logPrefix: '[telegram]',
+    })
   }
 
   return {

package/src/daemon/telegram/poller.ts

@@ -1,5 +1,6 @@
 import type { TelegramApi } from './api.js'
 import type { TelegramMessage } from './types.js'
+import { nextBackoff } from '../backoff.js'
 
 /** 从 update 提取文本消息；非文本/缺 message → null。chat.id 统一字符串化比对（id < 2^53；超范围 bigint 后续再引入）。 */
 export function extractTextMessage(update: unknown): TelegramMessage | null {
@@ -16,11 +17,6 @@ export function nextOffset(updates: Array<{ update_id?: number }>, prevOffset: n
   return Math.max(...updates.map((u) => u.update_id ?? prevOffset)) + 1
 }
 
-/** 指数退避，封顶 30s。 */
-export function nextBackoff(currentMs: number): number {
-  return Math.min(currentMs * 2, 30_000)
-}
-
 /** 长轮询循环（unref 不阻退出）。返回 stop 函数。循环行为由 Task 7 集成测试覆盖。 */
 export function startTelegramPoller(
   api: TelegramApi,

package/src/daemon/wecom/adapter.ts

@@ -0,0 +1,61 @@
+import type { WecomApi } from './api.js'
+import type { WecomConfig, WecomMessage } from './types.js'
+import type { SessionManager } from '../session-manager'
+import type { SessionWorker } from '../session-worker'
+import type { RateLimiter } from '../rate-limiter'
+import { startWecomWs } from './ws-client.js'
+import { handleChannelMessage } from '../channel-message.js'
+
+export interface WecomAdapterDeps {
+  sm: SessionManager
+  getOrCreateWorker: (sessionId: string) => SessionWorker | null
+  rateLimiter: RateLimiter
+  cwd: string
+  provider: string
+  model: string
+}
+
+export interface WecomAdapter {
+  start(): () => void
+  handleMessage(msg: WecomMessage): Promise<void>
+  isAllowed(userId: string): boolean
+}
+
+export function createWecomAdapter(
+  config: WecomConfig,
+  api: WecomApi,
+  deps: WecomAdapterDeps,
+): WecomAdapter {
+  const allowed = new Set(config.allowedUserIds)
+  let stopWs: (() => void) | null = null
+
+  async function handleMessage(msg: WecomMessage): Promise<void> {
+    await handleChannelMessage({
+      channel: 'wecom',
+      externalId: msg.userId,
+      text: msg.text,
+      allowed,
+      rateLimiter: deps.rateLimiter,
+      sm: deps.sm,
+      getOrCreateWorker: deps.getOrCreateWorker,
+      cwd: deps.cwd,
+      provider: deps.provider,
+      model: deps.model,
+      sendText: async (userId, text) => {
+        api.respond(userId, text)
+      },
+      maxLen: 2048,
+      logPrefix: '[wecom]',
+    })
+  }
+
+  return {
+    handleMessage,
+    isAllowed: (userId) => allowed.has(userId),
+    start() {
+      if (stopWs) return stopWs
+      stopWs = startWecomWs(api, handleMessage)
+      return stopWs
+    },
+  }
+}

package/src/daemon/wecom/api.ts

@@ -0,0 +1,58 @@
+import type { WecomConfig, WecomMessage } from './types.js'
+
+export interface WecomApi {
+  open(): WebSocket
+  subscribe(ws: WebSocket): void
+  ping(ws: WebSocket): void
+  attach(ws: WebSocket | null): void
+  respond(userId: string, text: string): void
+  parseMessage(frame: unknown): WecomMessage | null
+  isDisconnected(frame: unknown): boolean
+}
+
+const WS_ENDPOINT = 'wss://openws.work.weixin.qq.com'
+
+/** 协议帧 codec；内部持有 activeWs（由 ws-client attach）。零依赖（globalThis.WebSocket）。 */
+export function createWecomApi(config: WecomConfig): WecomApi {
+  let activeWs: WebSocket | null = null
+  return {
+    open() {
+      return new WebSocket(WS_ENDPOINT)
+    },
+    subscribe(ws) {
+      ws.send(
+        JSON.stringify({
+          cmd: 'aibot_subscribe',
+          body: { bot_id: config.botId, bot_secret: config.botSecret },
+        }),
+      )
+    },
+    ping(ws) {
+      ws.send(JSON.stringify({ cmd: 'ping' }))
+    },
+    attach(ws) {
+      activeWs = ws
+    },
+    respond(userId, text) {
+      if (activeWs) {
+        activeWs.send(
+          JSON.stringify({ cmd: 'aibot_respond_msg', body: { userid: userId, content: text } }),
+        )
+      }
+    },
+    parseMessage(frame) {
+      if (!frame || typeof frame !== 'object') return null
+      const f = frame as {
+        cmd?: string
+        body?: { userid?: string; chatid?: string; msg_id?: string; content?: string }
+      }
+      if (f.cmd !== 'aibot_msg_callback' || !f.body) return null
+      const { userid, chatid, msg_id, content } = f.body
+      if (!userid || !content) return null
+      return { userId: userid, chatId: chatid ?? '', msgId: msg_id ?? '', text: content }
+    },
+    isDisconnected(frame) {
+      return (frame as { cmd?: string })?.cmd === 'disconnected_event'
+    },
+  }
+}

package/src/daemon/wecom/env.ts

@@ -0,0 +1,16 @@
+import type { WecomConfig } from './types.js'
+
+/** fail-closed：缺 botId 或 botSecret → null（daemon 不启用企微）。 */
+export function parseWecomEnv(): WecomConfig | null {
+  const botId = process.env.WECOM_BOT_ID
+  const botSecret = process.env.WECOM_BOT_SECRET
+  if (!botId || !botSecret) return null
+  return {
+    botId,
+    botSecret,
+    allowedUserIds: (process.env.WECOM_ALLOWED_USER_IDS || '')
+      .split(',')
+      .map((s) => s.trim())
+      .filter(Boolean),
+  }
+}

package/src/daemon/wecom/types.ts

@@ -0,0 +1,12 @@
+export interface WecomConfig {
+  botId: string
+  botSecret: string
+  allowedUserIds: string[] // 白名单（企微内部 userid）
+}
+
+export interface WecomMessage {
+  userId: string // 发消息用户（userid）
+  chatId: string // 会话 id（chatid）
+  msgId: string // 消息 id（req_id 关联回包）
+  text: string // 文本内容
+}

package/src/daemon/wecom/ws-client.ts

@@ -0,0 +1,73 @@
+import type { WecomApi } from './api.js'
+import type { WecomMessage } from './types.js'
+import { nextBackoff } from '../backoff.js'
+
+/** WebSocket 长连接生命周期：建连→subscribe→心跳→消息回调→断开重连。返回 stop。 */
+export function startWecomWs(
+  api: WecomApi,
+  onMessage: (msg: WecomMessage) => Promise<void>,
+  opts?: { heartbeatMs?: number },
+): () => void {
+  const heartbeatMs = opts?.heartbeatMs ?? 30_000
+  let stopped = false
+  let disconnected = false // disconnected_event 触发时置 true，主动 close 后不重连
+  let ws: WebSocket
+  let backoffMs = 1000
+  let heartbeatTimer: ReturnType<typeof setInterval> | null = null
+  let reconnectTimer: ReturnType<typeof setTimeout> | null = null
+
+  function clearTimers() {
+    if (heartbeatTimer) clearInterval(heartbeatTimer)
+    if (reconnectTimer) clearTimeout(reconnectTimer)
+    heartbeatTimer = null
+    reconnectTimer = null
+  }
+
+  function connect() {
+    if (stopped) return
+    ws = api.open()
+    ws.onopen = () => {
+      backoffMs = 1000
+      api.attach(ws)
+      api.subscribe(ws)
+      heartbeatTimer = setInterval(() => api.ping(ws), heartbeatMs)
+      ;(heartbeatTimer as unknown as { unref?: () => void }).unref?.()
+    }
+    ws.onmessage = (ev) => {
+      let frame: unknown
+      try {
+        frame = JSON.parse(ev.data as string)
+      } catch {
+        return
+      }
+      if (api.isDisconnected(frame)) {
+        disconnected = true
+        ws.close()
+        return
+      }
+      const msg = api.parseMessage(frame)
+      if (msg) void onMessage(msg).catch(() => {})
+    }
+    ws.onclose = () => {
+      api.attach(null)
+      if (heartbeatTimer) clearInterval(heartbeatTimer)
+      heartbeatTimer = null
+      if (stopped || disconnected) return
+      reconnectTimer = setTimeout(connect, backoffMs)
+      backoffMs = nextBackoff(backoffMs)
+      ;(reconnectTimer as unknown as { unref?: () => void }).unref?.()
+    }
+  }
+
+  connect()
+  return () => {
+    stopped = true
+    disconnected = true
+    clearTimers()
+    try {
+      ws.close()
+    } catch {
+      /* 连接尚未建立时 close 可能抛错，忽略 */
+    }
+  }
+}

package/src/i18n-core/locales/en-US.json

@@ -215,6 +215,9 @@
       "entered": "Entered plan mode.",
       "content": "── Plan Mode ──\n\nEntering plan mode — read-only analysis and design.\nUse EnterPlanMode to start, ExitPlanMode to submit for approval."
     },
+    "save": {
+      "content": "── Save to Wiki ──\n\nAnalyzing the conversation and filing the most valuable insight into your Obsidian wiki…"
+    },
     "diff": {
       "clean": "No uncommitted changes (working tree clean).",
       "title": "── Git Diff ──",
@@ -560,6 +563,7 @@
     "cd": {
       "usage": "Usage: /cd <path>\n\nChange the session working directory.\nExample: /cd ~/projects/my-app\n\nCurrent: {cwd}",
       "not_found": "❌ Directory not found: {path}",
+      "suggestions": "Did you mean:",
       "failed": "❌ Failed to change directory: {error}",
       "title": "── Directory Changed ──",
       "content": "New CWD: {path}\n\nThe AI will now work relative to this directory.\nNote: This changes the filesystem root for tools like Read, Write, Bash."
@@ -591,7 +595,10 @@
       "git_section": "── Git ──",
       "no_git": "  (not a git repository or git not available)",
       "skills_section": "── Skills ──",
-      "skills_unavailable": "  (skills info unavailable)"
+      "skills_unavailable": "  (skills info unavailable)",
+      "audit_section": "── CLAUDE.md Audit ──",
+      "audit_clean": "  ✓ no code-derivable sections found",
+      "audit_found": "Add the sections above to the `prompt-exclude` frontmatter to stop sending them to the model."
     },
     "plugins": {
       "unavailable": "PluginManager not available in this session.",

package/src/i18n-core/locales/zh-CN.json

@@ -215,6 +215,9 @@
       "entered": "已进入计划模式。",
       "content": "── 计划模式 ──\n\n进入计划模式 — 只读分析与设计。\n使用 EnterPlanMode 开始，ExitPlanMode 提交审批。"
     },
+    "save": {
+      "content": "── 保存到 Wiki ──\n\n正在分析对话，并把最有价值的洞察归档到你的 Obsidian wiki…"
+    },
     "diff": {
       "clean": "没有未提交的更改（工作区干净）。",
       "title": "── Git Diff ──",
@@ -560,6 +563,7 @@
     "cd": {
       "usage": "用法: /cd <path>\n\n更改会话工作目录。\n示例: /cd ~/projects/my-app\n\n当前: {cwd}",
       "not_found": "❌ 目录未找到: {path}",
+      "suggestions": "你是想找：",
       "failed": "❌ 更改目录失败: {error}",
       "title": "── 目录已更改 ──",
       "content": "新目录: {path}\n\nAI 将相对于此目录工作。\n注意: 这会更改 Read、Write、Bash 等工具的文件系统根路径。"
@@ -591,7 +595,10 @@
       "git_section": "── Git ──",
       "no_git": "  （不是 git 仓库或 git 不可用）",
       "skills_section": "── 技能 ──",
-      "skills_unavailable": "  （技能信息不可用）"
+      "skills_unavailable": "  （技能信息不可用）",
+      "audit_section": "── CLAUDE.md 审计 ──",
+      "audit_clean": "  ✓ 未发现可从代码推断的冗余章节",
+      "audit_found": "将上述章节加入 `prompt-exclude` frontmatter，可停止发送给模型、节省 token。"
     },
     "plugins": {
       "unavailable": "当前会话中 PluginManager 不可用。",

package/src/mcp/client.ts

@@ -161,8 +161,8 @@ export class McpClient {
     if (existing?.status === 'connected') return
 
     const transport: StdioTransport | HttpTransport = config.url
-      ? new HttpTransport()
-      : new StdioTransport()
+      ? new HttpTransport(undefined, config.request_timeout_ms)
+      : new StdioTransport(config.request_timeout_ms)
     const protocol = new McpProtocol(transport)
 
     const connection: ActiveConnection = {

package/src/mcp/http-transport.ts

@@ -1,10 +1,9 @@
 import type { JsonRpcRequest, JsonRpcResponse, JsonRpcNotification, JsonRpcError } from './types'
 import type { Transport, NotificationHandler } from './transport'
+import { DEFAULT_REQUEST_TIMEOUT_MS, requestTimeoutError } from './transport'
 
 type FetchFn = (input: string, init?: RequestInit) => Promise<Response>
 
-const REQUEST_TIMEOUT_MS = 60_000
-
 /**
  * Merge multiple SSE `data:` events into a single JSON-RPC result.
  *
@@ -74,7 +73,10 @@ export class HttpTransport implements Transport {
   private closed = false
   private notificationHandlers: NotificationHandler[] = []
 
-  constructor(private fetchImpl: FetchFn = fetch as unknown as FetchFn) {}
+  constructor(
+    private fetchImpl: FetchFn = fetch as unknown as FetchFn,
+    private requestTimeoutMs = DEFAULT_REQUEST_TIMEOUT_MS,
+  ) {}
 
   async start(
     url: string,
@@ -107,7 +109,7 @@ export class HttpTransport implements Transport {
     }
 
     const controller = new AbortController()
-    const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS)
+    const timer = setTimeout(() => controller.abort(), this.requestTimeoutMs)
 
     try {
       const response = await this.fetchImpl(this.url, {
@@ -142,6 +144,11 @@ export class HttpTransport implements Transport {
         throw new Error(`MCP error ${json.error.code}: ${json.error.message}`)
       }
       return json.result
+    } catch (err) {
+      if (controller.signal.aborted) {
+        throw requestTimeoutError(method, this.requestTimeoutMs)
+      }
+      throw err
     } finally {
       clearTimeout(timer)
     }

package/src/mcp/oauth.ts

@@ -4,6 +4,7 @@ import { createServer, Server } from 'node:http'
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import type { McpServerConfig } from '../shared/types'
 import { TokenStore } from './token-store'
+import { fetchWithRetry } from '../providers/fetch-utils'
 import { createT } from '../i18n-core/t'
 import enUS from '../i18n-core/locales/en-US.json'
 import zhCN from '../i18n-core/locales/zh-CN.json'
@@ -148,15 +149,22 @@ export class OAuthClient {
       throw new Error(`No refresh token available for "${serverName}"`)
     }
     const auth = config.auth!
-    const response = await fetch(auth.tokenUrl, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-      body: new URLSearchParams({
-        grant_type: 'refresh_token',
-        refresh_token: saved.refreshToken,
-        client_id: auth.clientId,
-      }).toString(),
-    })
+    // A single failed refresh is often a transient network/server error, not a
+    // real revocation — retry (5xx/429/network) before forcing PKCE. 4xx (e.g.
+    // invalid_grant) is a genuine revocation and falls through to PKCE directly.
+    const response = await fetchWithRetry(
+      auth.tokenUrl,
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          grant_type: 'refresh_token',
+          refresh_token: saved.refreshToken,
+          client_id: auth.clientId,
+        }).toString(),
+      },
+      { maxRetries: 1, baseDelay: 300 },
+    )
     if (!response.ok) {
       this.store.delete(serverName)
       const fresh = await this.executePkceFlow(config)

package/src/mcp/transport.ts

@@ -19,7 +19,12 @@ export interface Transport {
   isConnected(): boolean
 }
 
-const REQUEST_TIMEOUT_MS = 60_000
+export const DEFAULT_REQUEST_TIMEOUT_MS = 60_000
+
+/** Shared timeout error for both stdio and HTTP transports. */
+export function requestTimeoutError(method: string, ms: number): Error {
+  return new Error(`MCP request timeout: ${method} (${ms}ms)`)
+}
 
 // ── Environment variable security: block sensitive vars from MCP subprocess ──
 //
@@ -69,6 +74,7 @@ function buildProcEnv(extra?: Record<string, string>): Record<string, string> {
  * Uses Node.js child_process for portability across Bun and Node runtimes.
  */
 export class StdioTransport implements Transport {
+  constructor(private requestTimeoutMs = DEFAULT_REQUEST_TIMEOUT_MS) {}
   private proc: ChildProcess | null = null
   private msgId = 0
   private pending = new Map<
@@ -169,8 +175,8 @@ export class StdioTransport implements Transport {
     return new Promise((resolve, reject) => {
       const timer = setTimeout(() => {
         this.pending.delete(id)
-        reject(new Error(`MCP request timeout: ${method} (${REQUEST_TIMEOUT_MS}ms)`))
-      }, REQUEST_TIMEOUT_MS)
+        reject(requestTimeoutError(method, this.requestTimeoutMs))
+      }, this.requestTimeoutMs)
 
       this.pending.set(id, { resolve, reject, timer })