@sparkelf/dsh-plugin-mcp-credentials 0.2.1-rc.2.2 → 0.2.1-rc.2.4

package/lib/index.js

@@ -494,8 +494,66 @@ const RECONNECT_DEFAULTS = Object.freeze({
 	maxDelayMs: 3e4,
 	maxAttempts: 10
 });
+/**
+* How long to wait before trying again after the server rejected our credentials.
+*
+* A rejected credential is not an outage: retrying within seconds cannot help, because the
+* credential only changes when somebody signs in again. Backing off on a minutes-long curve
+* keeps the tools registered (a credential outage is recoverable without a reload) and makes
+* the recovery automatic — the first attempt after a fresh sign-in succeeds.
+*/
+const AUTH_RETRY_INITIAL_MS = 6e4;
+/** Ceiling for the credential-rejection retry curve. */
+const AUTH_RETRY_MAX_MS = 3e5;
+/**
+* Whether a connection failure means "the server refused our credentials".
+*
+* The MCP SDK reports HTTP status as `code` on its transport error; 401 and 403 are both
+* refusals of the credential, not signs of a flaky link. Everything else — refused connection,
+* DNS, timeout, 5xx — is treated as an outage and keeps the existing backoff.
+*
+* @param error - Whatever the transport threw.
+* @returns `true` when retrying cannot fix it without a new credential.
+*/
+const isCredentialRefusal = (error) => {
+	if (typeof error !== "object" || error === null) return false;
+	const code = error.code;
+	return code === 401 || code === 403;
+};
 const GENERATION_CLOSE_TIMEOUT_MS = 5e3;
 /**
+* Decide the next move after a failed connection attempt.
+*
+* Pure on purpose: the interesting rule here is the one that used to be wrong — a refused
+* credential was spent against the outage budget, so ten quick retries unregistered every tool
+* and left the server unusable until the process restarted. Separating the decision from the
+* timers and the tool bookkeeping makes that rule testable without a server.
+*
+* @param input - The failure cause, the policy, and the counters that survive between attempts.
+* @returns The plan; `retry` carries the delay and whether the credential curve was used.
+*/
+const planReconnect = (input) => {
+	if (isCredentialRefusal(input.cause)) {
+		const attempt = input.credentialAttempts + 1;
+		return {
+			kind: "retry",
+			credential: true,
+			delayMs: Math.min(AUTH_RETRY_MAX_MS, AUTH_RETRY_INITIAL_MS * 2 ** (attempt - 1))
+		};
+	}
+	if (!input.policy.enabled) return {
+		kind: "disabled",
+		established: input.established
+	};
+	const failedAttempts = (input.stableForMs !== void 0 && input.stableForMs >= input.policy.maxDelayMs ? 0 : input.failedAttempts) + 1;
+	if (failedAttempts > input.policy.maxAttempts) return { kind: "giveup" };
+	return {
+		kind: "retry",
+		credential: false,
+		delayMs: Math.min(input.policy.maxDelayMs, input.policy.initialDelayMs * 2 ** (failedAttempts - 1))
+	};
+};
+/**
 * The one explicit resolve step from raw reconnect config to the policy the
 * supervisor runs. Programmatic construction may bypass Schemastery
 * normalization, so every default and bound is re-judged here — misconfiguration
@@ -554,6 +612,8 @@ function startConnection(ctx, config, policy) {
 	let reconnectTimer;
 	/** Consecutive failed connection attempts within the current outage. */
 	let failedAttempts = 0;
+	/** Consecutive attempts made since the server last refused our credentials. */
+	let credentialAttempts = 0;
 	/** When the current generation finished connect + initial sync; undefined while down. */
 	let connectedAt;
 	/** The real error from the first connection attempt, for startup-await diagnostics. */
@@ -576,11 +636,11 @@ function startConnection(ctx, config, policy) {
 		return run;
 	}
 	/** One disconnect decision per generation: the isCurrent guard makes racing close/error signals idempotent. */
-	function generationDown(generation) {
+	function generationDown(generation, cause) {
 		if (!isCurrent(generation)) return;
 		client = void 0;
 		clientClosed = void 0;
-		scheduleReconnect();
+		scheduleReconnect(cause);
 	}
 	/** Wait for the transport-owned close signal without letting a broken transport wedge teardown forever. */
 	function waitForClose(closed) {
@@ -595,17 +655,23 @@ function startConnection(ctx, config, policy) {
 			});
 		});
 	}
-	function scheduleReconnect() {
-		const lostEstablishedConnection = connectedAt !== void 0;
-		if (!policy.enabled) {
-			const message = lostEstablishedConnection ? "connection lost and reconnect is disabled — registered tools will fail until an HMR reload or Host restart" : "connection failed and reconnect is disabled — no tools were registered; reload the plugin or restart the Host to connect";
+	function scheduleReconnect(cause) {
+		const established = connectedAt !== void 0;
+		const stableForMs = connectedAt === void 0 ? void 0 : Date.now() - connectedAt;
+		const plan = planReconnect({
+			...cause === void 0 ? {} : { cause },
+			policy,
+			established,
+			failedAttempts,
+			credentialAttempts,
+			...stableForMs === void 0 ? {} : { stableForMs }
+		});
+		if (plan.kind === "disabled") {
+			const message = plan.established ? "connection lost and reconnect is disabled — registered tools will fail until an HMR reload or Host restart" : "connection failed and reconnect is disabled — no tools were registered; reload the plugin or restart the Host to connect";
 			ctx.logger.error(`${label}: ${message}`);
 			return;
 		}
-		if (connectedAt !== void 0 && Date.now() - connectedAt >= policy.maxDelayMs) failedAttempts = 0;
-		connectedAt = void 0;
-		failedAttempts += 1;
-		if (failedAttempts > policy.maxAttempts) {
+		if (plan.kind === "giveup") {
 			syncChain = syncChain.then(() => {
 				for (const dispose of disposers.values()) dispose();
 				disposers = /* @__PURE__ */ new Map();
@@ -613,13 +679,21 @@ function startConnection(ctx, config, policy) {
 			ctx.logger.error(`${label}: giving up after ${policy.maxAttempts} consecutive failed reconnect attempts — tools unregistered; reload the plugin or restart the Host to reconnect`);
 			return;
 		}
-		const delayMs = Math.min(policy.maxDelayMs, policy.initialDelayMs * 2 ** (failedAttempts - 1));
-		const action = lostEstablishedConnection ? "connection lost; reconnecting" : "connection failed; retrying";
-		ctx.logger.warn(`${label}: ${action} in ${delayMs}ms (attempt ${failedAttempts}/${policy.maxAttempts})`);
+		if (plan.credential) {
+			credentialAttempts += 1;
+			ctx.logger.warn(`${label}: credential rejected by the server; keeping registered tools and retrying in ${plan.delayMs}ms (attempt ${credentialAttempts})`);
+		} else {
+			credentialAttempts = 0;
+			if (stableForMs !== void 0 && stableForMs >= policy.maxDelayMs) failedAttempts = 0;
+			failedAttempts += 1;
+			const action = established ? "connection lost; reconnecting" : "connection failed; retrying";
+			ctx.logger.warn(`${label}: ${action} in ${plan.delayMs}ms (attempt ${failedAttempts}/${policy.maxAttempts})`);
+		}
+		connectedAt = void 0;
 		reconnectTimer = setTimeout(() => {
 			reconnectTimer = void 0;
 			settling = connectGeneration(false);
-		}, delayMs);
+		}, plan.delayMs);
 		reconnectTimer.unref();
 	}
 	/**
@@ -680,7 +754,7 @@ function startConnection(ctx, config, policy) {
 				ctx.logger.error(`${label}: failed generation did not close within ${GENERATION_CLOSE_TIMEOUT_MS}ms — reconnect stopped to avoid overlapping server processes; reload the plugin or restart the Host to retry`);
 				return;
 			}
-			generationDown(generation);
+			generationDown(generation, error);
 			return;
 		}
 		attemptSettled = true;
@@ -690,6 +764,7 @@ function startConnection(ctx, config, policy) {
 		}
 		if (!isCurrent(generation)) return;
 		connectedAt = Date.now();
+		credentialAttempts = 0;
 		if (failedAttempts > 0) ctx.logger.info(`${label}: reconnected and re-synced tools (attempt ${failedAttempts}/${policy.maxAttempts})`);
 	}
 	/** The in-flight (or last settled) connection attempt; dispose awaits it for quiescence. */

package/lib/types/connection.d.ts

@@ -29,6 +29,36 @@ export interface ReconnectConfig {
 }
 /** Defaults shared by the Config schema and {@link resolveReconnectPolicy}. */
 export declare const RECONNECT_DEFAULTS: Required<ReconnectConfig>;
+/** What the supervisor should do after one failed connection attempt. */
+export type ReconnectPlan = {
+    readonly kind: 'disabled';
+    readonly established: boolean;
+} | {
+    readonly kind: 'giveup';
+} | {
+    readonly kind: 'retry';
+    readonly delayMs: number;
+    readonly credential: boolean;
+};
+/**
+ * Decide the next move after a failed connection attempt.
+ *
+ * Pure on purpose: the interesting rule here is the one that used to be wrong — a refused
+ * credential was spent against the outage budget, so ten quick retries unregistered every tool
+ * and left the server unusable until the process restarted. Separating the decision from the
+ * timers and the tool bookkeeping makes that rule testable without a server.
+ *
+ * @param input - The failure cause, the policy, and the counters that survive between attempts.
+ * @returns The plan; `retry` carries the delay and whether the credential curve was used.
+ */
+export declare const planReconnect: (input: {
+    readonly cause?: unknown;
+    readonly policy: ResolvedReconnectPolicy;
+    readonly established: boolean;
+    readonly failedAttempts: number;
+    readonly credentialAttempts: number;
+    readonly stableForMs?: number;
+}) => ReconnectPlan;
 /** Fully resolved reconnect policy captured at plugin load. */
 export type ResolvedReconnectPolicy = Readonly<Required<ReconnectConfig>>;
 /**

package/package.json

@@ -50,5 +50,5 @@
   },
   "type": "module",
   "types": "lib/types/index.d.ts",
-  "version": "0.2.1-rc.2.2"
+  "version": "0.2.1-rc.2.4"
 }