@pi-archimedes/mcp 2.5.0 → 2.6.2

package/src/commands-auth.test.ts

@@ -7,17 +7,7 @@ import type { ServerManager } from "./server-manager.js";
 import type { HttpServerDef, ServerDef } from "./types.js";
 
 // ── mocks ────────────────────────────────────────────────────────────────────
-// The real BorderedLoader needs a live TUI; a stub with the same surface
-// (constructor message + onAbort) is enough to drive runMcpAuthCommand.
 vi.mock("@earendil-works/pi-coding-agent", () => ({
-  BorderedLoader: class {
-    message: string;
-    onAbort?: () => void;
-    constructor(_tui: unknown, _theme: unknown, message: string) {
-      this.message = message;
-    }
-    dispose() {}
-  },
   // core/settings-io builds its settings path at module load
   getAgentDir: () => `${process.env.TMPDIR ?? "/tmp"}/pi-archimedes-mock-agent`,
 }));
@@ -26,56 +16,19 @@ vi.mock("./auth-storage.js", () => ({ deleteAuthEntry: vi.fn() }));
 
 // ── fakes ────────────────────────────────────────────────────────────────────
 
-/** The loader shape `ui.custom`'s factory returns (BorderedLoader surface). */
-interface FakeLoader {
-  message: string;
-  onAbort?: () => void;
-}
-
-interface CtxState {
-  notify: ReturnType<typeof vi.fn>;
-  custom: ReturnType<typeof vi.fn>;
-  lastLoader: FakeLoader | null;
-}
-
-/** Fake ExtensionCommandContext: notify is captured; ui.custom runs the
- *  factory synchronously and resolves when done() is first called. */
-function makeCtx(hasUI: boolean): { ctx: ExtensionCommandContext; state: CtxState } {
-  const state: CtxState = { notify: vi.fn(), custom: vi.fn(), lastLoader: null };
-  const ui = {
-    notify: (message: string, type?: "info" | "warning" | "error") =>
-      state.notify(message, type),
-    custom: (
-      factory: (
-        tui: unknown,
-        theme: unknown,
-        keybindings: unknown,
-        done: (result: unknown) => void,
-      ) => unknown,
-    ) => {
-      let resolve!: (result: unknown) => void;
-      const pending = new Promise<unknown>((r) => (resolve = r));
-      let settled = false;
-      const done = (result: unknown) => {
-        if (!settled) {
-          settled = true;
-          resolve(result);
-        }
-      };
-      state.lastLoader = factory({}, {}, {}, done) as FakeLoader;
-      return pending;
-    },
-  };
-  return {
-    ctx: { hasUI, ui } as unknown as ExtensionCommandContext,
-    state,
-  };
+function makeCtx(hasUI: boolean): { ctx: ExtensionCommandContext; notify: ReturnType<typeof vi.fn>; setStatus: ReturnType<typeof vi.fn>; confirm: ReturnType<typeof vi.fn>; input: ReturnType<typeof vi.fn> } {
+  const notify = vi.fn();
+  const setStatus = vi.fn();
+  const confirm = vi.fn().mockResolvedValue(false);
+  const input = vi.fn().mockResolvedValue(undefined);
+  const ctx = {
+    hasUI,
+    ui: { notify, setStatus, confirm, input },
+  } as unknown as ExtensionCommandContext;
+  return { ctx, notify, setStatus, confirm, input };
 }
 
 interface FakeClientOpts {
-  /** success: resolves (optionally after onAuthorizationUrl settles);
-   *  wait: neither settles nor rejects until the signal aborts;
-   *  throw: rejects with `error`. */
   outcome?: "success" | "wait" | "throw";
   error?: string;
   invokeAuthUrl?: boolean;
@@ -83,45 +36,29 @@ interface FakeClientOpts {
 
 const AUTH_URL = "https://as.example/authorize?state=xyz";
 
-/** Fake ServerClient: authenticate/close/connect are individually scripted. */
 function makeFakeClient(opts: FakeClientOpts = {}) {
   const client = {
+    name: "srv",
     status: "needs-auth" as string,
     tools: [
       { name: "t1", serverName: "srv" },
       { name: "t2", serverName: "srv" },
     ],
-    connect: vi.fn().mockImplementation(async () => {
-      client.status = "connected";
-    }),
+    connect: vi.fn().mockImplementation(async () => { client.status = "connected"; }),
     close: vi.fn().mockResolvedValue(undefined),
     authenticate: null as unknown as ReturnType<typeof vi.fn>,
   };
   client.authenticate = vi.fn(
     (options?: { signal?: AbortSignal; onAuthorizationUrl?: (u: URL) => void | Promise<void> }) => {
-      const { outcome = "success", error, invokeAuthUrl } = opts;
-      if (options?.signal?.aborted) {
-        return Promise.reject(new Error("OAuth cancelled"));
-      }
-      if (outcome === "wait") {
-        // Hangs until the signal aborts — like a browser flow awaiting a callback.
+      if (options?.signal?.aborted) return Promise.reject(new Error("OAuth cancelled"));
+      if (opts.outcome === "wait") {
         return new Promise<void>((_resolve, reject) => {
-          options?.signal?.addEventListener(
-            "abort",
-            () => reject(new Error("OAuth cancelled")),
-            { once: true },
-          );
+          options?.signal?.addEventListener("abort", () => reject(new Error("OAuth cancelled")), { once: true });
         });
       }
-      if (outcome === "throw") {
-        return Promise.reject(new Error(error ?? "boom"));
-      }
-      if (invokeAuthUrl) {
-        // Resolve only after the URL hook settles, so `open()` and the
-        // notification are guaranteed to have run before success.
-        return Promise.resolve(options?.onAuthorizationUrl?.(new URL(AUTH_URL))).then(
-          () => undefined,
-        );
+      if (opts.outcome === "throw") return Promise.reject(new Error(opts.error ?? "boom"));
+      if (opts.invokeAuthUrl) {
+        return Promise.resolve(options?.onAuthorizationUrl?.(new URL(AUTH_URL))).then(() => undefined);
       }
       return Promise.resolve();
     },
@@ -129,147 +66,95 @@ function makeFakeClient(opts: FakeClientOpts = {}) {
   return client;
 }
 
-/** Deps mirroring the index.ts wiring: fresh config read, http/sse defs only. */
 function makeDeps(defs: Record<string, ServerDef>, client: unknown) {
   const manager = { getClient: vi.fn().mockReturnValue(client) } as unknown as ServerManager;
-  // Mirrors the production index.ts wiring: shape-based (url) classification
   const getServerDef = (name: string): HttpServerDef | undefined => {
     const def = defs[name];
     return def !== undefined && isHttpDef(def) ? def : undefined;
   };
-  return {
-    deps: { getServerDef, getManager: () => manager },
-    manager,
-  };
+  return { deps: { getServerDef, getManager: () => manager }, manager };
 }
 
 const oauthDef: HttpServerDef = { type: "http", url: "https://mcps.example/mcp", auth: "oauth" };
 
-// ── runMcpAuthCommand (former /mcp-auth handler body) ──────────────────────
+// ── runMcpAuthCommand ────────────────────────────────────────────────────────
 
 describe("runMcpAuthCommand", () => {
   it("rejects without an interactive TUI", async () => {
     const { deps } = makeDeps({ srv: oauthDef }, makeFakeClient());
-    const { ctx, state } = makeCtx(false);
+    const { ctx, notify } = makeCtx(false);
     await runMcpAuthCommand("srv", ctx, deps);
-    expect(state.notify).toHaveBeenCalledWith(
-      expect.stringContaining("interactive TUI"),
-      "error",
-    );
-    expect(state.custom).not.toHaveBeenCalled();
+    expect(notify).toHaveBeenCalledWith(expect.stringContaining("interactive TUI"), "error");
   });
 
   it("notifies unknown servers", async () => {
     const { deps } = makeDeps({ srv: oauthDef }, makeFakeClient());
-    const { ctx, state } = makeCtx(true);
+    const { ctx, notify } = makeCtx(true);
     await runMcpAuthCommand("ghost", ctx, deps);
-    expect(state.notify).toHaveBeenCalledWith("Unknown server: ghost", "error");
-    expect(state.custom).not.toHaveBeenCalled();
+    expect(notify).toHaveBeenCalledWith("Unknown server: ghost", "error");
   });
 
   it("treats stdio servers as unknown (OAuth is http/sse only)", async () => {
-    const { deps } = makeDeps(
-      { cli: { type: "stdio", command: "true" } },
-      makeFakeClient(),
-    );
-    const { ctx, state } = makeCtx(true);
+    const { deps } = makeDeps({ cli: { type: "stdio", command: "true" } }, makeFakeClient());
+    const { ctx, notify } = makeCtx(true);
     await runMcpAuthCommand("cli", ctx, deps);
-    expect(state.notify).toHaveBeenCalledWith("Unknown server: cli", "error");
-    expect(state.custom).not.toHaveBeenCalled();
+    expect(notify).toHaveBeenCalledWith("Unknown server: cli", "error");
   });
 
   it("finds a URL server without a type field (shape-based classification)", async () => {
     const client = makeFakeClient({ outcome: "success" });
-    const { deps } = makeDeps(
-      { srv: { url: "https://mcps.example/mcp", auth: "oauth" } },
-      client,
-    );
-    const { ctx, state } = makeCtx(true);
+    const { deps } = makeDeps({ srv: { url: "https://mcps.example/mcp", auth: "oauth" } }, client);
+    const { ctx, notify } = makeCtx(true);
     await runMcpAuthCommand("srv", ctx, deps);
-    expect(state.notify).not.toHaveBeenCalledWith("Unknown server: srv", "error");
-    expect(state.notify).toHaveBeenCalledWith("✓ srv authenticated — 2 tools available", "info");
+    expect(notify).not.toHaveBeenCalledWith("Unknown server: srv", "error");
+    expect(notify).toHaveBeenCalledWith("✓ srv authenticated — 2 tools available", "info");
   });
 
-  it("notifies machines configured for a static bearer token as not-OAuth", async () => {
+  it("notifies servers configured for a static bearer token as not-OAuth", async () => {
     const { deps } = makeDeps(
       { svc: { type: "http", url: "http://127.0.0.1:1/mcp", auth: { token: "t" } } },
       makeFakeClient(),
     );
-    const { ctx, state } = makeCtx(true);
+    const { ctx, notify } = makeCtx(true);
     await runMcpAuthCommand("svc", ctx, deps);
-    expect(state.notify).toHaveBeenCalledWith("Server svc is not configured for OAuth", "error");
-    expect(state.custom).not.toHaveBeenCalled();
+    expect(notify).toHaveBeenCalledWith("Server svc is not configured for OAuth", "error");
   });
 
   it("notifies when the manager holds no client for the server", async () => {
     const { deps } = makeDeps({ srv: oauthDef }, undefined);
-    const { ctx, state } = makeCtx(true);
+    const { ctx, notify } = makeCtx(true);
     await runMcpAuthCommand("srv", ctx, deps);
-    expect(state.notify).toHaveBeenCalledWith(
-      expect.stringContaining("srv"),
-      "error",
-    );
-    expect(state.custom).not.toHaveBeenCalled();
+    expect(notify).toHaveBeenCalledWith(expect.stringContaining("srv"), "error");
   });
 
-  it("runs authenticate on the client, opens the URL, reconnects, and reports tools", async () => {
+  it("runs authenticate, opens the URL visibly, reconnects, and reports tools", async () => {
     const client = makeFakeClient({ outcome: "success", invokeAuthUrl: true });
     const { deps } = makeDeps({ srv: oauthDef }, client);
-    const { ctx, state } = makeCtx(true);
+    const { ctx, notify, setStatus } = makeCtx(true);
     await runMcpAuthCommand("srv", ctx, deps);
 
-    // Single entry point: authenticate with an abort signal + URL hook
     expect(client.authenticate).toHaveBeenCalledTimes(1);
     expect(client.authenticate).toHaveBeenCalledWith(
-      expect.objectContaining({
-        signal: expect.any(AbortSignal),
-        onAuthorizationUrl: expect.any(Function),
-      }),
+      expect.objectContaining({ onAuthorizationUrl: expect.any(Function) }),
     );
-    // Browser opened with the canonical URL + user notified of it
+    // Browser opened + URL notified
     expect(open).toHaveBeenCalledWith(AUTH_URL);
-    expect(state.notify).toHaveBeenCalledWith(
-      `Opening browser… if it didn't open, visit: ${AUTH_URL}`,
-      "info",
-    );
-    // Loader label mentions the server
-    expect(state.lastLoader?.message).toContain("srv");
-    // Reconnect to pick up the new token, success with tool count
+    expect(notify).toHaveBeenCalledWith(expect.stringContaining(AUTH_URL), "info");
+    // Status set then cleared
+    expect(setStatus).toHaveBeenCalledWith(expect.stringContaining("srv"), expect.stringContaining("srv"));
+    expect(setStatus).toHaveBeenLastCalledWith(expect.stringContaining("srv"), undefined);
+    // Reconnect + success notification
     expect(client.close).toHaveBeenCalled();
     expect(client.connect).toHaveBeenCalled();
-    expect(state.notify).toHaveBeenCalledWith("✓ srv authenticated — 2 tools available", "info");
-  });
-
-  it("Esc aborts the controller, cancels cleanly, and closes without reconnect", async () => {
-    const client = makeFakeClient({ outcome: "wait" });
-    const { deps } = makeDeps({ srv: oauthDef }, client);
-    const { ctx, state } = makeCtx(true);
-
-    const running = runMcpAuthCommand("srv", ctx, deps);
-    await vi.waitFor(() => expect(client.authenticate).toHaveBeenCalledTimes(1));
-    const signal = (client.authenticate.mock.calls[0]?.[0] as { signal: AbortSignal }).signal;
-    expect(signal.aborted).toBe(false);
-
-    // Simulate Esc in the loader
-    state.lastLoader!.onAbort!();
-    await running;
-
-    expect(signal.aborted).toBe(true);
-    expect(state.notify).toHaveBeenCalledWith("Authentication cancelled", "info");
-    expect(state.notify).not.toHaveBeenCalledWith(expect.anything(), "error");
-    expect(client.close).not.toHaveBeenCalled();
-    expect(client.connect).not.toHaveBeenCalled();
+    expect(notify).toHaveBeenCalledWith("✓ srv authenticated — 2 tools available", "info");
   });
 
   it("surfaces flow failures as error notifications", async () => {
     const client = makeFakeClient({ outcome: "throw", error: "token endpoint refused" });
     const { deps } = makeDeps({ srv: oauthDef }, client);
-    const { ctx, state } = makeCtx(true);
+    const { ctx, notify } = makeCtx(true);
     await runMcpAuthCommand("srv", ctx, deps);
-    expect(state.notify).toHaveBeenCalledWith(
-      expect.stringContaining("token endpoint refused"),
-      "error",
-    );
+    expect(notify).toHaveBeenCalledWith(expect.stringContaining("token endpoint refused"), "error");
     expect(client.connect).not.toHaveBeenCalled();
   });
 
@@ -277,22 +162,19 @@ describe("runMcpAuthCommand", () => {
     const client = makeFakeClient({ outcome: "success" });
     client.connect.mockRejectedValue(new Error("connection refused"));
     const { deps } = makeDeps({ srv: oauthDef }, client);
-    const { ctx, state } = makeCtx(true);
+    const { ctx, notify } = makeCtx(true);
     await runMcpAuthCommand("srv", ctx, deps);
-    expect(state.notify).toHaveBeenCalledWith(
-      expect.stringContaining("connection refused"),
-      "error",
-    );
+    expect(notify).toHaveBeenCalledWith(expect.stringContaining("connection refused"), "error");
   });
 });
 
-// ── mcpLogoutServer (former /mcp-logout handler body) ──────────────────────
+// ── mcpLogoutServer ──────────────────────────────────────────────────────────
 
 describe("mcpLogoutServer", () => {
   it("deletes the keyring entry and closes the connected client", async () => {
     const { deleteAuthEntry } = vi.mocked(await import("./auth-storage.js"));
     const client = makeFakeClient();
-    const { deps, manager } = makeDeps({ srv: oauthDef }, client);
+    const { deps } = makeDeps({ srv: oauthDef }, client);
     const result = mcpLogoutServer("srv", deps.getManager);
     expect(deleteAuthEntry).toHaveBeenCalledWith("srv");
     expect(client.close).toHaveBeenCalled();
@@ -307,10 +189,10 @@ describe("mcpLogoutServer", () => {
     expect(result).toEqual({ ok: true });
   });
 
-  it("reports a fail-closed keyring instead of throwing", async () => {
+  it("reports a fail-closed keyring error instead of throwing", async () => {
     const { deleteAuthEntry } = vi.mocked(await import("./auth-storage.js"));
     deleteAuthEntry.mockImplementationOnce(() => {
-      throw new Error("OS credential store unavailable — cannot store OAuth tokens securely");
+      throw new Error("OS credential store unavailable");
     });
     const { deps } = makeDeps({}, makeFakeClient());
     const result = mcpLogoutServer("srv", deps.getManager);

package/src/commands-auth.ts

@@ -3,16 +3,14 @@
  *
  * The standalone `/mcp-auth` and `/mcp-logout` commands are retired; the
  * `/mcp auth <server>` and `/mcp logout <server>` subcommands (dispatched in
- * `commands.ts`) call these two functions instead. The UX is unchanged from
- * plan-026.
+ * `commands.ts`) call these two functions instead.
  *
  * `runMcpAuthCommand` runs the OAuth flow through the server client's
- * SINGLE auth entry point (`ServerClient.authenticate`) while a
- * `BorderedLoader` (tui.md Pattern 2) shows progress. Esc fires the
- * loader's `onAbort`, which forwards to the flow's `AbortController`; the
- * cancelled flow rethrows "OAuth cancelled", so cancel and failure stay
- * distinguishable in the notification. On success the client is closed and
- * reconnected, which re-reads the freshly stored token.
+ * SINGLE auth entry point (`ServerClient.authenticate`) via
+ * `runAuthWithLoader`, which shows the authorization URL via notify (always
+ * visible), opens the browser, and provides a confirm+input fallback for
+ * remote/headless users. On success the client is closed and reconnected,
+ * which re-reads the freshly stored token.
  *
  * `mcpLogoutServer` deletes the keyring entry and closes the managed client
  * (if any) so the next connect re-evaluates auth.
@@ -41,9 +39,9 @@ export interface McpAuthCommandDeps {
 
 /**
  * The former `/mcp-auth <server>` handler body, extracted so the `/mcp auth`
- * subcommand reuses the full command-layer UX (BorderedLoader +
- * notifications) unchanged. (The management panel authenticates in-panel
- * instead — ADR 0005 — reusing only the shared plumbing in `auth-run.ts`.)
+ * subcommand reuses the full command-layer UX unchanged. (The management
+ * panel authenticates in-panel instead — ADR 0005 — reusing only the shared
+ * plumbing in `auth-run.ts`.)
  * `serverName` must be non-empty — the dispatcher enforces that.
  */
 export async function runMcpAuthCommand(

package/src/commands.test.ts

@@ -117,6 +117,9 @@ function makeCtx(cwd: string, hasUI: boolean = true): { ctx: ExtensionCommandCon
   const ui = {
     notify: (message: string, type?: "info" | "warning" | "error") =>
       state.notify(message, type),
+    setStatus: vi.fn(),
+    confirm: vi.fn().mockResolvedValue(false),
+    input: vi.fn().mockResolvedValue(undefined),
     custom: (
       factory: (
         tui: unknown,
@@ -662,17 +665,12 @@ describe("/mcp auth", () => {
     const env = setupEnv({ srv: httpOauthDef });
     // The auth entry point is scripted (the real flow needs a live browser/
     // callback server — exercised separately in the auth-flow tests); the
-    // loader, reconnect, and notification machinery under test is real.
+    // status, reconnect, and notification machinery under test is real.
     const client = env.manager.getClient("srv")!;
     vi.spyOn(client, "authenticate").mockResolvedValue(undefined);
     await env.run("auth srv");
-    // The BorderedLoader stub surfaced its label
-    expect(env.state.lastLoader?.message).toContain("Authenticating srv");
-    expect(env.state.lastLoader?.message).toContain("esc to cancel");
     // Success path: client reconnected, tool count reported
     expect(env.notify).toHaveBeenCalledWith("✓ srv authenticated — 1 tools available", "info");
-    // ADR 0004: the post-auth reconnect is a settle point the panel task wires;
-    // the text command itself does not record outcomes in this task.
   });
 });
 

package/src/index.test.ts

@@ -524,7 +524,10 @@ describe("mcp proxy — command wiring", () => {
           return pending;
         },
       );
-      const ctx = { hasUI: true, ui: { notify, custom } } as never;
+      const setStatus = vi.fn();
+      const confirm = vi.fn().mockResolvedValue(false);
+      const input = vi.fn().mockResolvedValue(undefined);
+      const ctx = { hasUI: true, ui: { notify, custom, setStatus, confirm, input } } as never;
       const handler = commands["mcp"]!.handler as (
         args: string,
         ctx: unknown,

package/src/server-client.ts

@@ -364,7 +364,10 @@ export class ServerClient {
           if (e instanceof StreamableHTTPError && e.code === 401) {
             const c = this.client;
             this.client = null;
-            await c.close().catch(() => {});
+            // A failed connect auto-closes the transport (SDK Client.connect())
+            // which fires onclose and may already have nulled this.client —
+            // without this guard the TypeError masked the needs-auth state.
+            if (c) await c.close().catch(() => {});
             this._status = "needs-auth";
             this._error = NEEDS_AUTH_MESSAGE;
             return;