@pharaoh-so/mcp 0.3.23 → 0.3.25

package/dist/auth.js

@@ -52,6 +52,13 @@ export async function pollOnce(baseUrl, deviceCode) {
         const token = (await res.json());
         return { status: "authorized", token };
     }
+    // 5xx is an upstream/transport issue (CDN 503, Render cold-start 502,
+    // gateway 504 with an HTML error page). Treat as network_error so the
+    // gateway keeps the pending cycle alive and retries on the next tool call
+    // — a transient hiccup must not surface to the user as "auth denied".
+    if (res.status >= 500) {
+        return { status: "network_error", error: `HTTP ${res.status}` };
+    }
     const body = (await res.json().catch(() => ({ error: "unknown" })));
     if (body.error === "authorization_pending") {
         return { status: "pending" };

package/dist/backend.d.ts

@@ -51,6 +51,8 @@ export declare class AuthRequiredBackend implements Backend {
     listTools(): Promise<Tool[]>;
     callTool(_name: string, _args: Record<string, unknown>): Promise<CallToolResult>;
 }
+/** Backoff schedule for reconnect attempts (milliseconds). Exported for tests. */
+export declare const BACKOFF_MS: number[];
 /**
  * Real SSE-backed backend. Owns an MCP Client + SSEClientTransport and a
  * reconnect loop. Forwards listTools/callTool to the remote server.
@@ -62,7 +64,7 @@ export declare class AuthRequiredBackend implements Backend {
  *   let this loop create a fresh transport for the next attempt. 5 retries
  *   (2s, 4s, 8s, 16s, 32s) before giving up.
  */
-declare class SseProxyBackend implements Backend {
+export declare class SseProxyBackend implements Backend {
     private readonly sseUrl;
     private readonly token;
     readonly name: "sse";
@@ -93,4 +95,3 @@ declare class SseProxyBackend implements Backend {
  * depend on its internal reconnect state.
  */
 export declare function createSseBackend(sseUrl: string, token: string): SseProxyBackend;
-export {};

package/dist/backend.js

@@ -81,8 +81,8 @@ export class AuthRequiredBackend {
         return response;
     }
 }
-/** Backoff schedule for reconnect attempts (milliseconds). */
-const BACKOFF_MS = [2000, 4000, 8000, 16000, 32000];
+/** Backoff schedule for reconnect attempts (milliseconds). Exported for tests. */
+export const BACKOFF_MS = [2000, 4000, 8000, 16000, 32000];
 /**
  * Build the SSEClientTransport with Bearer token auth. Injects the
  * Authorization header into both the SSE connection (via custom fetch) and
@@ -117,7 +117,7 @@ function sleep(ms) {
  *   let this loop create a fresh transport for the next attempt. 5 retries
  *   (2s, 4s, 8s, 16s, 32s) before giving up.
  */
-class SseProxyBackend {
+export class SseProxyBackend {
     sseUrl;
     token;
     name = "sse";
@@ -207,7 +207,12 @@ class SseProxyBackend {
                 if (err instanceof TokenExpiredError || err instanceof TenantSuspendedError) {
                     throw err;
                 }
-                attempt++;
+                // Do NOT increment attempt here — the try block already incremented
+                // it before calling reconnectAfter. A second bump would halve the
+                // effective retry budget so only ~3 of the 5 BACKOFF_MS slots
+                // would fire (skipping the 4s and 16s delays). The guard below
+                // catches the max-retries case where reconnectAfter's own throw
+                // arrives after we've already spent the budget in the try block.
                 if (attempt > BACKOFF_MS.length) {
                     throw err instanceof Error
                         ? err

package/dist/gateway.js

@@ -17,17 +17,31 @@
 import { openBrowser, pollOnce, requestDeviceCode, } from "./auth.js";
 import { readCredentials, writeCredentials } from "./credentials.js";
 import { resolveSseUrl, tokenToCredentials } from "./helpers.js";
-function isAccessExpired(creds) {
+/**
+ * True when the credentials' access token is at or past its expiry.
+ *
+ * Takes `now` as a parameter so boundary tests (Date.now() === expires_at
+ * exactly) work naturally with the gateway's injected clock — previously
+ * this used Date.now() directly, which couldn't be controlled from tests.
+ */
+function isAccessExpired(creds, now) {
     const expiresAt = new Date(creds.expires_at).getTime();
     if (Number.isNaN(expiresAt))
         return true;
-    return Date.now() >= expiresAt;
+    return now() >= expiresAt;
 }
 function buildAuthResponse(device) {
+    // Stryker disable next-line StringLiteral: user-facing UX copy; wording
+    // changes are deliberate and covered by manual review, not mutation testing.
     const prefix = device.errorMessage ? `${device.errorMessage}\n\n` : "";
-    const text = `${prefix}Pharaoh authentication required.\n\n` +
+    const text = 
+    // Stryker disable next-line StringLiteral: user-facing UX copy
+    `${prefix}Pharaoh authentication required.\n\n` +
+        // Stryker disable next-line StringLiteral: user-facing UX copy
         `  1. Visit ${device.verification_uri_complete}\n` +
+        // Stryker disable next-line StringLiteral: user-facing UX copy
         `  2. Enter code: ${device.user_code}\n` +
+        // Stryker disable next-line StringLiteral: user-facing UX copy
         `  3. Re-run this tool after authorizing.`;
     return {
         content: [{ type: "text", text }],
@@ -45,6 +59,12 @@ function buildAuthResponse(device) {
  */
 export function createGateway(opts) {
     const now = opts.now ?? (() => Date.now());
+    // Stryker disable next-line LogicalOperator: the `??` fallback is exercised
+    // at runtime when no opts.openBrowser is passed, but tests vi.mock auth.js's
+    // openBrowser to a noop, so a mutated operator can't be distinguished via
+    // observable behavior. vi.mock is the safety net; the fallback is defense
+    // in depth for production. See packages/mcp-proxy/tests/*.test.ts for the
+    // module-level mock that keeps real browser-open calls out of CI.
     const openBrowserImpl = opts.openBrowser ?? openBrowser;
     let pending = null;
     let lastCreds = null;
@@ -91,8 +111,6 @@ export function createGateway(opts) {
     }
     /** Decide whether the cached response is still valid without polling. */
     function shouldSkipPoll(state) {
-        if (state.last_poll_at === null)
-            return false;
         return now() - state.last_poll_at < state.interval_ms;
     }
     /**
@@ -110,6 +128,7 @@ export function createGateway(opts) {
             // inline so the agent sees why; the user will naturally retry.
             pending = null;
             return {
+                // Stryker disable next-line StringLiteral: user-facing UX copy
                 content: [{ type: "text", text: `Pharaoh auth denied: ${result.error}` }],
                 isError: true,
                 _meta: {
@@ -153,7 +172,7 @@ export function createGateway(opts) {
         if (!creds)
             return false;
         lastCreds = creds;
-        return !isAccessExpired(creds);
+        return !isAccessExpired(creds, now);
     }
     function getCredentials() {
         return lastCreds;

package/dist/proxy-server.js

@@ -87,12 +87,17 @@ export class ProxyServer {
      */
     async setBackend(next) {
         const prev = this.backend;
-        this.backend = next;
+        // Start the new backend BEFORE swapping the reference. If start() rejects
+        // (e.g. SSE connect fails), `prev` stays active — otherwise the proxy
+        // would be wedged with a not-yet-started backend that throws on every
+        // list/call until the caller tried again. This ordering also closes the
+        // race window where an in-flight request could arrive between the
+        // reference swap and a slow SSE handshake.
         if (next.start)
             await next.start();
-        // Only emit after backend reference is swapped — if the client races
-        // a list request against the notification, we want them to see the
-        // new catalog.
+        this.backend = next;
+        // Fire the notification after the swap so a client that races a list
+        // request against it sees the new catalog.
         await this.server.sendToolListChanged();
         // Fire-and-forget stop of the old backend. Errors here don't affect
         // the running session — the swap has already happened.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@pharaoh-so/mcp",
   "mcpName": "so.pharaoh/pharaoh",
-  "version": "0.3.23",
+  "version": "0.3.25",
   "description": "MCP proxy for Pharaoh — maps codebases into queryable knowledge graphs for AI agents. Enables Claude Code in headless environments (VPS, SSH, CI) via device flow auth.",
   "type": "module",
   "main": "dist/index.js",