@pentoshi/clai 4.13.1 → 4.14.1

package/dist/mcp/transport-http.js

@@ -1,5 +1,5 @@
-import { isJsonRpcResponse, parseMessage, SseDecoder, } from "./jsonrpc.js";
-import { McpTransportError, withTimeout, } from "./transport.js";
+import { createNotification, isJsonRpcResponse, parseMessage, SseDecoder } from "./jsonrpc.js";
+import { McpTransportError, awaitMcpOperation, dispatchServerMessage, withTimeout, } from "./transport.js";
 import { parseWwwAuthenticate } from "./auth/www-authenticate.js";
 import { MCP_PROTOCOL_VERSION, } from "./types.js";
 const DEFAULT_REQUEST_TIMEOUT_MS = 60_000;
@@ -36,14 +36,10 @@ async function rejectRedirect(response) {
     throw error;
 }
 function sseStreamError(server, status) {
-    return new McpTransportError("network", status === 401
-        ? unauthorizedHint(server)
-        : `MCP SSE stream returned ${status}.`, status);
+    return new McpTransportError("network", status === 401 ? unauthorizedHint(server) : `MCP SSE stream returned ${status}.`, status);
 }
 function ssePostError(server, status) {
-    return new McpTransportError("network", status === 401
-        ? unauthorizedHint(server)
-        : `MCP SSE POST returned ${status}.`, status);
+    return new McpTransportError("network", status === 401 ? unauthorizedHint(server) : `MCP SSE POST returned ${status}.`, status);
 }
 async function readBoundedText(response, maxBytes) {
     const body = response.body;
@@ -80,14 +76,13 @@ function baseHeaders(sessionId, protocolVersion, accept) {
         headers[PROTOCOL_HEADER] = protocolVersion;
     return headers;
 }
-async function collectSseResponse(response, targetId, maxBytes) {
+async function collectSseResponse(response, targetId, maxBytes, onMessage, onEvent) {
     const body = response.body;
     if (!body) {
         throw new McpTransportError("protocol", "MCP SSE response had no body.");
     }
     const reader = body.getReader();
-    const sse = new SseDecoder();
-    let total = 0;
+    const sse = new SseDecoder(maxBytes);
     try {
         while (true) {
             const { done, value } = await reader.read();
@@ -95,22 +90,21 @@ async function collectSseResponse(response, targetId, maxBytes) {
                 break;
             if (!value)
                 continue;
-            total += value.byteLength;
-            if (total > maxBytes) {
-                throw new McpTransportError("too-large", "MCP SSE stream exceeded the size limit.");
-            }
             for (const event of sse.push(value)) {
+                onEvent(event.id);
                 const message = parseMessage(event.data);
                 if (message && isJsonRpcResponse(message) && String(message.id) === String(targetId)) {
                     return message;
                 }
+                if (message)
+                    await onMessage(message);
             }
         }
     }
     finally {
         await reader.cancel().catch(() => undefined);
     }
-    throw new McpTransportError("protocol", "MCP SSE stream closed before a matching response arrived.");
+    throw new McpTransportError("closed", "MCP SSE stream closed before a matching response arrived.");
 }
 function unauthorizedHint(server) {
     return (`MCP server ${server} returned 401 Unauthorized. ` +
@@ -124,6 +118,10 @@ export class StreamableHttpTransport {
     protocolVersion = MCP_PROTOCOL_VERSION;
     nextId = 1;
     closed = false;
+    handlers;
+    lifetime = new AbortController();
+    listening = false;
+    sentTokens = new WeakMap();
     constructor(config, options = {}) {
         this.config = config;
         this.options = options;
@@ -140,35 +138,49 @@ export class StreamableHttpTransport {
     setProtocolVersion(version) {
         this.protocolVersion = version;
     }
+    setHandlers(handlers) {
+        this.handlers = handlers;
+    }
     start() {
         return Promise.resolve();
     }
     async resolveHeaders(accept) {
         const base = baseHeaders(this.session, this.protocolVersion, accept);
-        const authHeaders = this.options.authProvider
-            ? await this.options.authProvider.headers()
-            : {};
+        const authHeaders = this.options.authProvider ? await this.options.authProvider.headers() : {};
         return {
             ...base,
             ...authHeaders,
             ...this.config.headers,
         };
     }
-    async sendOnce(accept, method, body, signal) {
-        const headers = await this.resolveHeaders(accept);
-        const init = { method, headers, redirect: "manual", signal };
+    async sendOnce(accept, method, body, signal, extraHeaders) {
+        const headers = await awaitMcpOperation(this.resolveHeaders(accept), signal);
+        const init = {
+            method,
+            headers: { ...headers, ...extraHeaders },
+            redirect: "manual",
+            signal,
+        };
         if (body !== undefined)
             init.body = body;
-        return this.fetchImpl(this.config.url, init);
+        const response = await this.fetchImpl(this.config.url, init);
+        const authorization = new Headers(headers).get("authorization");
+        if (authorization)
+            this.sentTokens.set(response, authorization.replace(/^Bearer\s+/i, ""));
+        return response;
     }
-    async retryOnUnauthorized(response, resend) {
+    async retryOnUnauthorized(response, resend, signal) {
         const provider = this.options.authProvider;
         if (!provider)
             return response;
         const challenge = parseWwwAuthenticate(response.headers.get("www-authenticate"));
         if (response.body)
             await response.body.cancel().catch(() => undefined);
-        const refreshed = await provider.onUnauthorized(challenge);
+        const refreshed = await provider.onUnauthorized(challenge, {
+            interactive: false,
+            signal,
+            rejectedToken: this.sentTokens.get(response),
+        });
         if (!refreshed)
             return response;
         return resend();
@@ -187,38 +199,70 @@ export class StreamableHttpTransport {
         const id = this.nextId++;
         const framed = { ...message, id };
         const timeoutMs = options.timeoutMs ?? this.options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
-        const { signal, dispose } = withTimeout(options.signal, timeoutMs);
+        const parent = options.signal
+            ? AbortSignal.any([options.signal, this.lifetime.signal])
+            : this.lifetime.signal;
+        const { signal, dispose } = withTimeout(parent, timeoutMs);
         const accept = "application/json, text/event-stream";
         const body = JSON.stringify(framed);
         const resend = () => this.sendOnce(accept, "POST", body, signal);
         try {
             let response = await resend();
-            this.captureSession(response);
-            const redirect = redirectError(response);
-            if (redirect)
-                throw redirect;
-            if (response.status === 401) {
-                response = await this.retryOnUnauthorized(response, resend);
+            if (framed.method === "initialize" && response.ok)
                 this.captureSession(response);
-                const retryRedirect = redirectError(response);
-                if (retryRedirect)
-                    throw retryRedirect;
+            await rejectRedirect(response);
+            if (response.status === 401) {
+                response = await this.retryOnUnauthorized(response, resend, signal);
+                if (framed.method === "initialize" && response.ok)
+                    this.captureSession(response);
+                await rejectRedirect(response);
             }
             if (!response.ok)
                 await this.failForStatus(response);
             const contentType = (response.headers.get("content-type") ?? "").toLowerCase();
             if (contentType.includes("text/event-stream")) {
-                return await collectSseResponse(response, framed.id, this.maxBytes);
+                let lastEventId;
+                for (let attempt = 0;; attempt++) {
+                    try {
+                        return await collectSseResponse(response, framed.id, this.maxBytes, (message) => dispatchServerMessage(message, this.handlers, (reply) => this.postResponse(reply, signal)), (eventId) => {
+                            if (eventId !== undefined)
+                                lastEventId = eventId;
+                        });
+                    }
+                    catch (error) {
+                        if (signal.aborted ||
+                            !lastEventId ||
+                            attempt >= 3 ||
+                            (error instanceof McpTransportError &&
+                                error.kind !== "closed" &&
+                                error.kind !== "network"))
+                            throw error;
+                        response = await this.sendOnce("text/event-stream", "GET", undefined, signal, {
+                            "last-event-id": lastEventId,
+                        });
+                        await rejectRedirect(response);
+                        if (!response.ok)
+                            await this.failForStatus(response);
+                    }
+                }
             }
             const text = await readBoundedText(response, this.maxBytes);
             const parsed = parseMessage(text);
             if (!parsed || !isJsonRpcResponse(parsed)) {
                 throw new McpTransportError("protocol", "MCP HTTP response was not a JSON-RPC response.");
             }
+            if (String(parsed.id) !== String(framed.id))
+                throw new McpTransportError("protocol", "MCP HTTP response id did not match the request.");
             return parsed;
         }
         catch (error) {
-            throw mapFetchError(error);
+            if (signal.aborted && message.method !== "initialize" && !this.closed) {
+                void this.notify(createNotification("notifications/cancelled", {
+                    requestId: id,
+                    reason: "Client stopped waiting for this request.",
+                }), { timeoutMs: 1_000 }).catch(() => undefined);
+            }
+            throw mapFetchError(error, signal);
         }
         finally {
             dispose();
@@ -228,18 +272,24 @@ export class StreamableHttpTransport {
         if (this.closed)
             throw new McpTransportError("closed", "MCP HTTP transport closed.");
         const timeoutMs = options.timeoutMs ?? this.options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
-        const { signal, dispose } = withTimeout(options.signal, timeoutMs);
+        const parent = options.signal
+            ? AbortSignal.any([options.signal, this.lifetime.signal])
+            : this.lifetime.signal;
+        const { signal, dispose } = withTimeout(parent, timeoutMs);
         try {
-            const response = await this.sendOnce("application/json, text/event-stream", "POST", JSON.stringify(message), signal);
-            this.captureSession(response);
-            const redirect = redirectError(response);
-            if (redirect)
-                throw redirect;
+            const resend = () => this.sendOnce("application/json, text/event-stream", "POST", JSON.stringify(message), signal);
+            let response = await resend();
+            await rejectRedirect(response);
+            if (response.status === 401)
+                response = await this.retryOnUnauthorized(response, resend, signal);
+            await rejectRedirect(response);
+            if (!response.ok)
+                await this.failForStatus(response);
             if (response.body)
                 await response.body.cancel().catch(() => undefined);
         }
         catch (error) {
-            throw mapFetchError(error);
+            throw mapFetchError(error, signal);
         }
         finally {
             dispose();
@@ -247,17 +297,74 @@ export class StreamableHttpTransport {
     }
     captureSession(response) {
         const id = response.headers.get(SESSION_HEADER);
-        if (id && id.length > 0)
+        if (id && !/^[\x21-\x7e]+$/.test(id))
+            throw new McpTransportError("protocol", "MCP server returned an invalid session id.");
+        if (id)
             this.session = id;
     }
+    async postResponse(message, signal) {
+        const response = await this.sendOnce("application/json, text/event-stream", "POST", JSON.stringify(message), signal);
+        await rejectRedirect(response);
+        if (!response.ok)
+            await this.failForStatus(response);
+        await response.body?.cancel().catch(() => undefined);
+    }
+    listen() {
+        if (this.listening || this.closed)
+            return;
+        this.listening = true;
+        void this.pumpNotifications().finally(() => {
+            this.listening = false;
+        });
+    }
+    async pumpNotifications() {
+        let lastEventId;
+        for (let attempt = 0; !this.closed && attempt < 4; attempt++) {
+            try {
+                const response = await this.sendOnce("text/event-stream", "GET", undefined, this.lifetime.signal, lastEventId ? { "last-event-id": lastEventId } : undefined);
+                await rejectRedirect(response);
+                if (!response.ok || !response.body) {
+                    await response.body?.cancel().catch(() => undefined);
+                    return;
+                }
+                const decoder = new SseDecoder(this.maxBytes);
+                const reader = response.body.getReader();
+                try {
+                    for (;;) {
+                        const { value, done } = await reader.read();
+                        if (done)
+                            break;
+                        if (!value)
+                            continue;
+                        for (const event of decoder.push(value)) {
+                            if (event.id !== undefined)
+                                lastEventId = event.id;
+                            const message = parseMessage(event.data);
+                            if (message)
+                                await dispatchServerMessage(message, this.handlers, (reply) => this.postResponse(reply, this.lifetime.signal));
+                        }
+                    }
+                }
+                finally {
+                    await reader.cancel().catch(() => undefined);
+                }
+                if (!lastEventId)
+                    return;
+            }
+            catch {
+                return;
+            }
+        }
+    }
     async close() {
         if (this.closed)
             return;
         this.closed = true;
+        this.lifetime.abort(new McpTransportError("closed", "MCP HTTP transport closed."));
         if (!this.session)
             return;
         try {
-            const { signal, dispose } = withTimeout(undefined, DEFAULT_REQUEST_TIMEOUT_MS);
+            const { signal, dispose } = withTimeout(undefined, 2_000);
             try {
                 const response = await this.sendOnce("application/json", "DELETE", undefined, signal);
                 if (response.body)
@@ -284,6 +391,8 @@ export class LegacySseTransport {
     pending = new Map();
     readyPromise;
     pumpError;
+    handlers;
+    sentTokens = new WeakMap();
     constructor(config, options = {}) {
         this.config = config;
         this.options = options;
@@ -300,23 +409,46 @@ export class LegacySseTransport {
     setProtocolVersion(version) {
         this.protocolVersion = version;
     }
-    start() {
+    setHandlers(handlers) {
+        this.handlers = handlers;
+    }
+    start(options = {}) {
+        if (this.closed)
+            return Promise.reject(new McpTransportError("closed", "MCP SSE transport closed."));
         if (this.readyPromise)
             return this.readyPromise;
         this.readyPromise = new Promise((resolve, reject) => {
+            const { signal, dispose } = withTimeout(options.signal, options.timeoutMs ?? this.options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS);
             let settled = false;
             const onReady = () => {
                 if (settled)
                     return;
                 settled = true;
+                dispose();
+                signal.removeEventListener("abort", onAbort);
                 resolve();
             };
             const onFail = (error) => {
                 if (settled)
                     return;
                 settled = true;
+                dispose();
+                signal.removeEventListener("abort", onAbort);
                 reject(error);
             };
+            const onAbort = () => {
+                const error = signal.reason instanceof McpTransportError
+                    ? signal.reason
+                    : new McpTransportError("cancelled", "MCP SSE connection cancelled.");
+                this.pumpError = error;
+                this.streamController.abort(error);
+                onFail(error);
+            };
+            if (signal.aborted) {
+                onAbort();
+                return;
+            }
+            signal.addEventListener("abort", onAbort, { once: true });
             this.pump(onReady, onFail).catch((error) => onFail(mapFetchError(error)));
         });
         return this.readyPromise;
@@ -325,19 +457,21 @@ export class LegacySseTransport {
         const base = { accept };
         if (this.protocolVersion)
             base[PROTOCOL_HEADER] = this.protocolVersion;
-        const authHeaders = this.options.authProvider
-            ? await this.options.authProvider.headers()
-            : {};
+        const authHeaders = this.options.authProvider ? await this.options.authProvider.headers() : {};
         return { ...base, ...authHeaders, ...this.config.headers };
     }
     async openStream() {
-        const headers = await this.streamHeaders("text/event-stream");
-        return this.fetchImpl(this.config.url, {
+        const headers = await awaitMcpOperation(this.streamHeaders("text/event-stream"), this.streamController.signal);
+        const response = await this.fetchImpl(this.config.url, {
             method: "GET",
             headers,
             redirect: "manual",
             signal: this.streamController.signal,
         });
+        const authorization = new Headers(headers).get("authorization");
+        if (authorization)
+            this.sentTokens.set(response, authorization.replace(/^Bearer\s+/i, ""));
+        return response;
     }
     async openAuthorizedStream() {
         let response = await this.openStream();
@@ -348,7 +482,11 @@ export class LegacySseTransport {
         const challenge = parseWwwAuthenticate(response.headers.get("www-authenticate"));
         if (response.body)
             await response.body.cancel().catch(() => undefined);
-        const refreshed = await provider.onUnauthorized(challenge);
+        const refreshed = await provider.onUnauthorized(challenge, {
+            interactive: false,
+            signal: this.streamController.signal,
+            rejectedToken: this.sentTokens.get(response),
+        });
         if (!refreshed)
             return response;
         response = await this.openStream();
@@ -369,8 +507,7 @@ export class LegacySseTransport {
             return;
         }
         const reader = response.body.getReader();
-        const sse = new SseDecoder();
-        let total = 0;
+        const sse = new SseDecoder(this.maxBytes);
         try {
             while (true) {
                 const { done, value } = await reader.read();
@@ -378,15 +515,14 @@ export class LegacySseTransport {
                     break;
                 if (!value)
                     continue;
-                total += value.byteLength;
-                if (total > this.maxBytes) {
-                    throw new McpTransportError("too-large", "MCP SSE stream exceeded the size limit.");
-                }
                 for (const event of sse.push(value)) {
                     this.handleEvent(event.event, event.data, onReady);
                 }
             }
-            this.failAll(new McpTransportError("closed", "MCP SSE stream closed."));
+            const closed = new McpTransportError("closed", "MCP SSE stream closed.");
+            this.pumpError = closed;
+            onFail(closed);
+            this.failAll(closed);
         }
         catch (error) {
             const mapped = mapFetchError(error);
@@ -401,17 +537,29 @@ export class LegacySseTransport {
     handleEvent(event, data, onReady) {
         if (event === "endpoint") {
             try {
-                this.endpointUrl = new URL(data, this.config.url).toString();
+                const endpoint = new URL(data, this.config.url);
+                if (endpoint.origin !== new URL(this.config.url).origin ||
+                    endpoint.username ||
+                    endpoint.password) {
+                    throw new McpTransportError("protocol", "MCP SSE announced an endpoint on another origin; credentials cannot be forwarded there.");
+                }
+                this.endpointUrl = endpoint.toString();
                 onReady();
             }
-            catch {
-                void 0;
+            catch (error) {
+                throw error instanceof McpTransportError
+                    ? error
+                    : new McpTransportError("protocol", "MCP SSE announced an invalid endpoint.");
             }
             return;
         }
         const message = parseMessage(data);
-        if (!message || !isJsonRpcResponse(message))
+        if (!message)
             return;
+        if (!isJsonRpcResponse(message)) {
+            void dispatchServerMessage(message, this.handlers, (reply) => this.postMessage(JSON.stringify(reply), this.streamController.signal)).catch(() => undefined);
+            return;
+        }
         const numericId = typeof message.id === "number" ? message.id : Number(message.id);
         if (!Number.isFinite(numericId))
             return;
@@ -433,29 +581,35 @@ export class LegacySseTransport {
         const base = { "content-type": "application/json" };
         if (this.protocolVersion)
             base[PROTOCOL_HEADER] = this.protocolVersion;
-        const authHeaders = this.options.authProvider
-            ? await this.options.authProvider.headers()
-            : {};
+        const authHeaders = this.options.authProvider ? await this.options.authProvider.headers() : {};
         return { ...base, ...authHeaders, ...this.config.headers };
     }
     async sendPost(endpoint, body, signal) {
-        const headers = await this.postHeaders();
-        return this.fetchImpl(endpoint, {
+        const headers = await awaitMcpOperation(this.postHeaders(), signal);
+        const response = await this.fetchImpl(endpoint, {
             method: "POST",
             headers,
             body,
             signal,
             redirect: "manual",
         });
+        const authorization = new Headers(headers).get("authorization");
+        if (authorization)
+            this.sentTokens.set(response, authorization.replace(/^Bearer\s+/i, ""));
+        return response;
     }
-    async retryPostUnauthorized(response, resend) {
+    async retryPostUnauthorized(response, resend, signal) {
         const provider = this.options.authProvider;
         if (response.status !== 401 || !provider)
             return response;
         const challenge = parseWwwAuthenticate(response.headers.get("www-authenticate"));
         if (response.body)
             await response.body.cancel().catch(() => undefined);
-        const refreshed = await provider.onUnauthorized(challenge);
+        const refreshed = await provider.onUnauthorized(challenge, {
+            interactive: false,
+            signal,
+            rejectedToken: this.sentTokens.get(response),
+        });
         if (!refreshed)
             return response;
         const retried = await resend();
@@ -470,7 +624,7 @@ export class LegacySseTransport {
         const resend = () => this.sendPost(endpoint, body, signal);
         let response = await resend();
         await rejectRedirect(response);
-        response = await this.retryPostUnauthorized(response, resend);
+        response = await this.retryPostUnauthorized(response, resend, signal);
         if (response.body)
             await response.body.cancel().catch(() => undefined);
         if (!response.ok)
@@ -479,19 +633,28 @@ export class LegacySseTransport {
     async request(message, options = {}) {
         if (this.closed)
             throw new McpTransportError("closed", "MCP SSE transport closed.");
-        await this.start();
+        await this.start(options);
         if (this.pumpError)
             throw this.pumpError;
         const id = this.nextId++;
         const framed = { ...message, id };
         const timeoutMs = options.timeoutMs ?? this.options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
-        const { signal, dispose } = withTimeout(options.signal, timeoutMs);
+        const parent = options.signal
+            ? AbortSignal.any([options.signal, this.streamController.signal])
+            : this.streamController.signal;
+        const { signal, dispose } = withTimeout(parent, timeoutMs);
         return await new Promise((resolve, reject) => {
             const onAbort = () => {
                 const entry = this.pending.get(id);
                 if (entry) {
                     this.pending.delete(id);
                     entry.dispose();
+                    if (message.method !== "initialize") {
+                        void this.notify(createNotification("notifications/cancelled", {
+                            requestId: id,
+                            reason: "Client stopped waiting for this request.",
+                        }), { timeoutMs: 1_000 }).catch(() => undefined);
+                    }
                 }
                 const reason = signal.reason;
                 reject(reason instanceof McpTransportError
@@ -515,16 +678,21 @@ export class LegacySseTransport {
                     this.pending.delete(id);
                     entry.dispose();
                 }
-                reject(mapFetchError(error));
+                reject(mapFetchError(error, signal));
             });
         });
     }
     async notify(message, options = {}) {
         if (this.closed)
             throw new McpTransportError("closed", "MCP SSE transport closed.");
-        await this.start();
+        await this.start(options);
+        if (this.pumpError)
+            throw this.pumpError;
         const timeoutMs = options.timeoutMs ?? this.options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
-        const { signal, dispose } = withTimeout(options.signal, timeoutMs);
+        const parent = options.signal
+            ? AbortSignal.any([options.signal, this.streamController.signal])
+            : this.streamController.signal;
+        const { signal, dispose } = withTimeout(parent, timeoutMs);
         try {
             await this.postMessage(JSON.stringify(message), signal);
         }