@skydiveai/pi-extensions 0.1.0-beta.1973 → 0.1.0-beta.1975

package/dist/index.d.mts

@@ -1,4 +1,6 @@
 import { A2AOptions, Middleware, ProtocolsOptions } from "@skydiveai/pi-server";
+import { Type } from "typebox";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { ExtensionFactory } from "@earendil-works/pi-coding-agent";
 import { Logger } from "pino";
 

package/dist/index.mjs

@@ -9,7 +9,7 @@ import { pathToFileURL } from "node:url";
 import { CallToolResultSchema } from "@modelcontextprotocol/sdk/types.js";
 import { Type } from "typebox";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { StdioClientTransport, getDefaultEnvironment } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { StreamableHTTPClientTransport, StreamableHTTPError } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
 import { Check, Errors } from "typebox/value";
@@ -957,6 +957,47 @@ function createStderrBuffer({ maxBytes }) {
 const DEFAULT_CONNECT_TIMEOUT_MS = 5e3;
 const STDERR_BUFFER_BYTES = 4096;
 /**
+* Sandbox egress variables a stdio MCP server needs to make outbound HTTPS
+* calls. The SDK's default child environment is a tiny whitelist (HOME,
+* LOGNAME, PATH, SHELL, TERM, USER on Linux), which drops NODE_EXTRA_CA_CERTS
+* — but the sandbox's egress proxy terminates TLS with a private CA, so a
+* child spawned without it fails every HTTPS request with a bare
+* `fetch failed` (cause: UNABLE_TO_VERIFY_LEAF_SIGNATURE) that looks like the
+* remote service is down. Same story for SSL_CERT_FILE (OpenSSL-based
+* runtimes) and the *_PROXY set. Inherit them from this process so a stdio
+* server gets working egress like every other process in the sandbox.
+*/
+const INHERITED_EGRESS_ENV_VARS = [
+	"NODE_EXTRA_CA_CERTS",
+	"SSL_CERT_FILE",
+	"SSL_CERT_DIR",
+	"REQUESTS_CA_BUNDLE",
+	"CURL_CA_BUNDLE",
+	"HTTP_PROXY",
+	"HTTPS_PROXY",
+	"NO_PROXY",
+	"http_proxy",
+	"https_proxy",
+	"no_proxy"
+];
+/**
+* Environment for a stdio MCP server child: the SDK's safe defaults, plus the
+* sandbox's egress/TLS variables, plus (last, so it wins) the server's own
+* configured `env`. Building the merge here — instead of only when `env` is
+* unset — also fixes the workaround trap where supplying any `env` in
+* mcp.config.json silently replaced the ENTIRE default set, so a config that
+* added one API key lost PATH/HOME and the server failed to spawn at all.
+*/
+function buildStdioEnv(configured, processEnv = process.env) {
+	const env = { ...getDefaultEnvironment() };
+	for (const key of INHERITED_EGRESS_ENV_VARS) {
+		const value = processEnv[key];
+		if (value !== void 0) env[key] = value;
+	}
+	if (configured) Object.assign(env, configured);
+	return env;
+}
+/**
 * undici's fetch throws `TypeError: fetch failed` with the actual
 * network error hung off `.cause` (e.g. `getaddrinfo ENOTFOUND ...`,
 * `ECONNREFUSED`, TLS errors). Surfacing only `err.message` makes
@@ -988,6 +1029,15 @@ function formatError(err) {
 	}
 	return parts.join(": ");
 }
+function probeAlive(pid) {
+	if (pid === null) return null;
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch {
+		return false;
+	}
+}
 async function connectHttp(_id, config, client) {
 	const transport = new StreamableHTTPClientTransport(new URL(config.url), { ...config.headers !== null ? { requestInit: { headers: config.headers } } : {} });
 	try {
@@ -1022,9 +1072,9 @@ async function connectClient(id, config, opts = {}) {
 	const params = {
 		command: config.command,
 		args: config.args,
-		stderr: "pipe"
+		stderr: "pipe",
+		env: buildStdioEnv(config.env)
 	};
-	if (config.env !== null) params.env = config.env;
 	if (config.cwd !== null) params.cwd = config.cwd;
 	const transport = new StdioClientTransport(params);
 	const stderrBuffer = createStderrBuffer({ maxBytes: STDERR_BUFFER_BYTES });
@@ -1036,6 +1086,10 @@ async function connectClient(id, config, opts = {}) {
 			resolve();
 		};
 	});
+	let stdoutMessages = 0;
+	transport.onmessage = () => {
+		if (stdoutMessages < 1e4) stdoutMessages += 1;
+	};
 	const connectPromise = client.connect(transport);
 	const TIMEOUT_SENTINEL = Symbol("timeout");
 	const result = await Promise.race([
@@ -1053,12 +1107,20 @@ async function connectClient(id, config, opts = {}) {
 		error: `server "${id}" exited before completing initialize`,
 		stderr: stderrBuffer.read()
 	};
-	if (result === TIMEOUT_SENTINEL) return {
-		status: "timeout",
-		client,
-		stderr: stderrBuffer.read(),
-		stderrBuffer
-	};
+	if (result === TIMEOUT_SENTINEL) {
+		const pid = transport.pid;
+		return {
+			status: "timeout",
+			client,
+			stderr: stderrBuffer.read(),
+			stderrBuffer,
+			diagnostics: {
+				pid,
+				alive: probeAlive(pid),
+				stdoutMessages
+			}
+		};
+	}
 	try {
 		await client.close();
 	} catch {}
@@ -1543,7 +1605,8 @@ var McpExtension = class {
 				},
 				serverStatus: {
 					status: "timeout",
-					stderr: result.stderr
+					stderr: result.stderr,
+					diagnostics: result.diagnostics
 				},
 				change,
 				error: null,
@@ -1590,7 +1653,8 @@ var McpExtension = class {
 				},
 				serverStatus: {
 					status: "timeout",
-					stderr: retry.stderr
+					stderr: retry.stderr,
+					diagnostics: retry.diagnostics
 				},
 				change: null,
 				error: null,
@@ -1623,7 +1687,8 @@ var McpExtension = class {
 				store: connected,
 				serverStatus: {
 					status: "timeout",
-					stderr
+					stderr,
+					diagnostics: null
 				},
 				change: null,
 				error: null,
@@ -1844,9 +1909,21 @@ function pendingAuthEntries(summary) {
 function timeoutEntries(summary) {
 	return Object.entries(summary.servers).flatMap(([id, status]) => status.status === "timeout" ? [{
 		id,
-		stderr: status.stderr
+		stderr: status.stderr,
+		diagnostics: status.diagnostics
 	}] : []);
 }
+/**
+* One line describing what the connect probe learned about a timed-out
+* stdio child, so an empty stderr is no longer a dead end. Empty array
+* when the entry was re-surfaced without a fresh probe.
+*/
+function timeoutDiagnosticLines(diagnostics) {
+	if (diagnostics === null) return [];
+	const alive = diagnostics.alive === null ? "unknown (no pid)" : diagnostics.alive ? "alive" : "DEAD";
+	const spoke = diagnostics.stdoutMessages === 0 ? "no JSON-RPC received on stdout (initialize never answered — slow startup, or blocked e.g. on OAuth)" : `${diagnostics.stdoutMessages} JSON-RPC message(s) received on stdout (server spoke but the handshake stalled)`;
+	return [`    child process: ${alive}${diagnostics.pid !== null ? ` (pid ${diagnostics.pid})` : ""}; ${spoke}`];
+}
 function failedEntries(summary) {
 	return Object.entries(summary.servers).flatMap(([id, status]) => status.status === "failed" ? [{
 		id,
@@ -1854,6 +1931,13 @@ function failedEntries(summary) {
 		stderr: status.stderr
 	}] : []);
 }
+function appendTimeoutStderrBlock(lines, stderr) {
+	if (!stderr) {
+		lines.push("    stderr: (empty — the child wrote nothing to stderr)");
+		return;
+	}
+	appendStderrBlock(lines, stderr);
+}
 function appendStderrBlock(lines, stderr) {
 	if (!stderr) return;
 	lines.push("    stderr:");
@@ -1892,11 +1976,12 @@ function summaryText(summary) {
 		lines.push(`    run \`${cliHint}\` in the shell to authenticate.`);
 		appendStderrBlock(lines, stderr);
 	}
-	for (const { id, stderr } of timeoutEntries(summary)) {
+	for (const { id, stderr, diagnostics } of timeoutEntries(summary)) {
 		lines.push(`  TIMED OUT ${id}:`);
 		lines.push(`    bridge spawned but did not complete initialize in time`);
 		lines.push(`    (usually mcp-remote mid-OAuth — see captured stderr).`);
-		appendStderrBlock(lines, stderr);
+		lines.push(...timeoutDiagnosticLines(diagnostics));
+		appendTimeoutStderrBlock(lines, stderr);
 	}
 	for (const { id, error, stderr } of failedEntries(summary)) {
 		lines.push(`  FAILED ${id}: ${error}`);
@@ -1941,9 +2026,10 @@ function formatMcpUpdateMessage(summary) {
 	if (timedOut.length > 0) {
 		lines.push("");
 		lines.push("Servers that timed out during initialize (bridge is still alive in the background; usually mcp-remote-style stdio bridges mid-OAuth):");
-		for (const { id, stderr } of timedOut) {
+		for (const { id, stderr, diagnostics } of timedOut) {
 			lines.push(`  - ${id}:`);
-			appendStderrBlock(lines, stderr);
+			lines.push(...timeoutDiagnosticLines(diagnostics));
+			appendTimeoutStderrBlock(lines, stderr);
 		}
 		lines.push("If the bridge prints an auth URL in its stderr, share it with the user. Then call `reload_mcp` once they've finished.");
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skydiveai/pi-extensions",
-  "version": "0.1.0-beta.1973",
+  "version": "0.1.0-beta.1975",
   "homepage": "https://skydive.com",
   "license": "MIT",
   "author": "Create, Inc.",