chainlesschain 0.166.103 → 0.166.104

package/src/harness/mcp-client.js

@@ -744,6 +744,51 @@ function mcpTransportError(code, message, details = {}) {
   return error;
 }
 
+function pendingToolFailure(error, entry, method, dispatched) {
+  const httpStatus = safeRpcProperty(error, "status");
+  if (
+    method !== "tools/call" ||
+    !dispatched ||
+    isMcpRpcError(error) ||
+    safeRpcProperty(error, "outcomeUnknown") != null ||
+    (safeRpcProperty(error, "code") === "CC_MCP_HTTP_STATUS" &&
+      (httpStatus === 401 || httpStatus === 403 || httpStatus === 404))
+  ) {
+    return error;
+  }
+  const originalCode = safeRpcProperty(error, "code");
+  if (
+    typeof originalCode === "string" &&
+    originalCode.startsWith("CC_MCP_") &&
+    !isProxy(error) &&
+    error instanceof Error
+  ) {
+    try {
+      error.dispatched = true;
+      error.outcomeUnknown = true;
+      return error;
+    } catch {
+      // A frozen host error still needs a public uncertainty marker.
+    }
+  }
+  const message = safeRpcErrorText(error) || "MCP tool request failed";
+  return mcpTransportError(
+    typeof originalCode === "string" && originalCode.startsWith("CC_MCP_")
+      ? originalCode
+      : "CC_MCP_TOOL_OUTCOME_UNKNOWN",
+    `${message}; tool outcome is unknown and was not replayed`,
+    {
+      transport: entry?.transportKind,
+      url: entry?.config?.url,
+      status: httpStatus,
+      closeCode: safeRpcProperty(error, "closeCode"),
+      limitBytes: safeRpcProperty(error, "limitBytes"),
+      dispatched: true,
+      outcomeUnknown: true,
+    },
+  );
+}
+
 function dispatchMcpToolRequest(options, metadata, dispatch) {
   const admission = options?.dispatchAdmission ?? null;
   if (metadata.method !== "tools/call" || admission === null) {
@@ -916,8 +961,8 @@ function mcpInboundBudgetError(serverName, entry, budget) {
 function mcpJsonBudgetError(serverName, entry, budget) {
   const dispatched = Boolean(
     (entry?._pending instanceof Map && entry._pending.size > 0) ||
-    (entry?._httpRequestControllers instanceof Set &&
-      entry._httpRequestControllers.size > 0),
+      (entry?._httpRequestControllers instanceof Set &&
+        entry._httpRequestControllers.size > 0),
   );
   if (budget === "depth") {
     const limitDepth = mcpJsonDepthLimit(entry?.config?.maxJsonDepth);
@@ -956,6 +1001,15 @@ function mcpSseEventTimeoutError(timeoutMs) {
   return error;
 }
 
+function mcpSseHeaderTimeoutError(timeoutMs) {
+  const error = new Error(
+    `MCP HTTP message stream headers exceeded the ${timeoutMs}ms host deadline`,
+  );
+  error.code = "CC_MCP_SSE_HEADER_TIMEOUT";
+  error.timeoutMs = timeoutMs;
+  return error;
+}
+
 function mcpHttpResponseTimeoutError(
   serverName,
   entry,
@@ -999,6 +1053,7 @@ const MCP_NON_RETRYABLE_PROTOCOL_ERROR_CODES = new Set([
   "CC_MCP_HTTP_RESPONSE_TIMEOUT",
   "CC_MCP_HTTP_DISCARD_TIMEOUT",
   "CC_MCP_SSE_EVENT_TIMEOUT",
+  "CC_MCP_SSE_HEADER_TIMEOUT",
   "CC_MCP_INBOUND_RATE_EXCEEDED",
   "CC_MCP_INBOUND_TRAFFIC_EXCEEDED",
   "CC_MCP_JSON_DEPTH_EXCEEDED",
@@ -1009,6 +1064,8 @@ const MCP_NON_RETRYABLE_PROTOCOL_ERROR_CODES = new Set([
   "CC_MCP_RPC_ERROR_INVALID",
   "CC_MCP_RPC_RESPONSE_INVALID",
   "CC_MCP_RPC_MESSAGE_INVALID",
+  "CC_MCP_TOOL_CATALOG_STALE",
+  "CC_MCP_TOOL_NOT_ADVERTISED",
 ]);
 
 function isMcpNonRetryableProtocolError(error) {
@@ -1422,6 +1479,7 @@ export class MCPClient extends EventEmitter {
     this._toolMetadataBytes = 0;
     this._nextId = 1;
     this._reconnectors = new Map(); // name → async () => config|null
+    this._unknownOutcomeRecovery = new Set(); // reconnect only for future explicit calls
     this._reconnecting = new Map(); // name → in-flight reconnect promise
     // progressToken → reset-idle callback for in-flight tools/call requests.
     // Tokens are generated by this client and are removed on every terminal
@@ -2162,15 +2220,25 @@ export class MCPClient extends EventEmitter {
    * Register a reconnector for a server: an async function that returns a
    * FRESH connection config (or null when the server can't be found anymore).
    * When a `callTool` on that server fails with a connection-shaped error,
-   * the client re-resolves the config, reconnects, and retries the call once.
+   * the client re-resolves the config. An opt-in bridge may also reconnect
+   * after an unknown tool outcome, without replaying that call.
    *
    * Used by the IDE bridge: a window reload / extension update restarts the
    * editor's MCP server on a new port with a new token, so the original
    * config is permanently dead but a lockfile re-scan finds the new one.
    */
-  setReconnector(name, fn) {
-    if (typeof fn === "function") this._reconnectors.set(name, fn);
-    else this._reconnectors.delete(name);
+  setReconnector(name, fn, options = {}) {
+    if (typeof fn === "function") {
+      this._reconnectors.set(name, fn);
+      if (options.recoverUnknownOutcome === true) {
+        this._unknownOutcomeRecovery.add(name);
+      } else {
+        this._unknownOutcomeRecovery.delete(name);
+      }
+    } else {
+      this._reconnectors.delete(name);
+      this._unknownOutcomeRecovery.delete(name);
+    }
   }
 
   /** Return the opaque host authority used to resolve policy-bearing MCP cwd. */
@@ -3057,6 +3125,7 @@ export class MCPClient extends EventEmitter {
           this._replaceToolInventory(name, entry, toolsResult?.tools || []);
         } catch (err) {
           if (isMcpFatalDiscoveryError(err)) throw err;
+          entry._toolInventoryReady = true;
           if (advertisesTools) {
             toolsDiscoveryFailed = true;
             entry.toolsError = err?.message || String(err);
@@ -3464,6 +3533,7 @@ export class MCPClient extends EventEmitter {
       clientBytesUsed,
     });
     entry.tools = admitted.tools;
+    entry._toolInventoryReady = true;
     entry._toolMetadataBytes = admitted.metadataBytes;
     this._toolMetadataBytes = clientBytesUsed + admitted.metadataBytes;
     return entry.tools;
@@ -3525,9 +3595,9 @@ export class MCPClient extends EventEmitter {
    * Call a tool on a specific server. If the server has a registered
    * reconnector and the call fails with a connection-shaped error (server
    * restarted / token rotated / entry dropped), re-resolve the config,
-   * reconnect, and retry the call exactly once. HTTP 404 only reinitializes
-   * the connection: an already-dispatched tool has an unknown outcome and
-   * must never be retried automatically just because its session expired.
+   * reconnect, and retry a call only when its outcome is known not to have
+   * occurred. An already-dispatched tool with an unknown outcome may refresh
+   * the connection for a later explicit call, but is never replayed here.
    * @param {string} serverName - Server name
    * @param {string} toolName - Tool name
    * @param {object} args - Tool arguments
@@ -3589,7 +3659,28 @@ export class MCPClient extends EventEmitter {
         // Retry exactly once after every out-of-band flow reports completion.
         return this._callToolOnce(serverName, toolName, args, options);
       }
-      if (safeRpcProperty(err, "outcomeUnknown") === true) throw err;
+      if (safeRpcProperty(err, "outcomeUnknown") === true) {
+        if (
+          !options?.signal?.aborted &&
+          isLikelyConnectionError(err) &&
+          this._unknownOutcomeRecovery.has(serverName)
+        ) {
+          const current = this.servers.get(serverName);
+          const recovered =
+            current && current !== attemptedEntry
+              ? current.state === ServerState.CONNECTED
+              : await this._tryReconnect(serverName, {
+                  connectAuthRetryUsed: true,
+                  expectedEntry: attemptedEntry,
+                });
+          try {
+            err.connectionRecovered = Boolean(recovered);
+          } catch {
+            // A frozen error still retains its original unknown-outcome marker.
+          }
+        }
+        throw err;
+      }
       if (
         !this._reconnectors.has(serverName) &&
         !this.servers.get(serverName)?.config?.headersHelper
@@ -3704,6 +3795,23 @@ export class MCPClient extends EventEmitter {
     if (entry.state !== ServerState.CONNECTED) {
       throw new Error(`Server "${serverName}" is not connected`);
     }
+    if (entry._toolInventoryDirty) {
+      throw mcpTransportError(
+        "CC_MCP_TOOL_CATALOG_STALE",
+        `MCP tool catalog for server "${serverName}" is refreshing; retry after it settles`,
+        { transport: entry.transportKind, dispatched: false },
+      );
+    }
+    if (
+      entry._toolInventoryReady &&
+      !entry.tools.some((tool) => tool.name === toolName)
+    ) {
+      throw mcpTransportError(
+        "CC_MCP_TOOL_NOT_ADVERTISED",
+        `MCP tool "${toolName}" is not advertised by server "${serverName}"`,
+        { transport: entry.transportKind, dispatched: false },
+      );
+    }
 
     const timeoutMs = mcpToolIdleTimeoutMs(entry.config, options);
     const progressToken = `cc:${randomUUID()}`;
@@ -4137,7 +4245,8 @@ export class MCPClient extends EventEmitter {
       };
       const pending = {
         resolve: (value) => settle(resolve, value),
-        reject: (error) => settle(reject, error),
+        reject: (error) =>
+          settle(reject, pendingToolFailure(error, entry, method, dispatched)),
       };
       entry._pending.set(id, pending);
 
@@ -4184,7 +4293,7 @@ export class MCPClient extends EventEmitter {
       if (!longRunning && timeoutMs > 0) {
         timeout = setTimeout(() => {
           const timeoutError = new Error(`Request timeout: ${method}`);
-          if (!settle(reject, timeoutError)) return;
+          if (!pending.reject(timeoutError)) return;
           this._sendRequestCancellation(
             serverName,
             method,
@@ -4276,7 +4385,8 @@ export class MCPClient extends EventEmitter {
       };
       const pending = {
         resolve: (value) => settle(resolve, value),
-        reject: (error) => settle(reject, error),
+        reject: (error) =>
+          settle(reject, pendingToolFailure(error, entry, method, dispatched)),
       };
       entry._pending.set(id, pending);
 
@@ -4314,7 +4424,7 @@ export class MCPClient extends EventEmitter {
             `Request timeout: ${method} (WebSocket, no response in ${timeoutMs}ms)`,
             { transport: entry.transportKind, url: entry.config?.url },
           );
-          if (!settle(reject, timeoutError)) return;
+          if (!pending.reject(timeoutError)) return;
           this._sendRequestCancellation(
             serverName,
             method,
@@ -4472,7 +4582,10 @@ export class MCPClient extends EventEmitter {
                   ? { dispatcher: entry._httpDispatcher }
                   : {}),
               }),
-              stream.controller?.signal,
+              {
+                controller: stream.controller,
+                timeoutMs: _sseEventTimeout(entry.config?.requestTimeoutMs),
+              },
             );
             if (response.status === 405) {
               _cancelHttpResponseBody(response);
@@ -4547,6 +4660,7 @@ export class MCPClient extends EventEmitter {
               return;
             }
             if (error?.code === "CC_MCP_SSE_EVENT_TIMEOUT") return;
+            if (error?.code === "CC_MCP_SSE_HEADER_TIMEOUT") return;
             if (error?.code === "CC_MCP_INBOUND_RATE_EXCEEDED") return;
             if (error?.code === "CC_MCP_INBOUND_TRAFFIC_EXCEEDED") return;
             if (error?.code === "CC_MCP_JSON_DEPTH_EXCEEDED") return;
@@ -4853,10 +4967,15 @@ export class MCPClient extends EventEmitter {
         throwIfAborted();
       } catch (abortError) {
         settleLifecycle("failed-closed");
-        throw abortError;
+        throw pendingToolFailure(
+          abortError,
+          entry,
+          method,
+          request?.dispatched,
+        );
       }
       settleLifecycle("failed-closed");
-      throw err;
+      throw pendingToolFailure(err, entry, method, request?.dispatched);
     } finally {
       if (timer) clearTimeout(timer);
       if (responseTimer) clearTimeout(responseTimer);
@@ -5272,15 +5391,22 @@ export class MCPClient extends EventEmitter {
   async _refreshServerList(serverName, kind) {
     const entry = this.servers.get(serverName);
     if (!entry) return;
+    if (kind === "tools") {
+      entry._toolInventoryDirty = true;
+    }
     const flags = (entry._listRefresh = entry._listRefresh || {});
     if (flags[`${kind}Running`]) {
       flags[`${kind}Dirty`] = true;
       return;
     }
     flags[`${kind}Running`] = true;
+    let refreshed = false;
+    let toolCount = 0;
     try {
       do {
+        if (this.servers.get(serverName) !== entry) return;
         flags[`${kind}Dirty`] = false;
+        refreshed = false;
         try {
           const method =
             kind === "tools"
@@ -5289,6 +5415,10 @@ export class MCPClient extends EventEmitter {
                 ? "resources/templates/list"
                 : "resources/list";
           const result = await this._sendRequest(serverName, method, {});
+          // A reconnect can replace this entry while the old list request is
+          // pending. Never let its late result mutate the replacement's global
+          // metadata budget or publish a stale inventory event.
+          if (this.servers.get(serverName) !== entry) return;
           const list =
             (kind === "tools"
               ? result?.tools
@@ -5298,14 +5428,17 @@ export class MCPClient extends EventEmitter {
           if (kind === "tools") {
             this._replaceToolInventory(serverName, entry, list);
             entry.toolsError = null;
+            toolCount = list.length;
           } else {
             entry[kind] = list;
+            this.emit(`${kind}-changed`, {
+              server: serverName,
+              count: list.length,
+            });
           }
-          this.emit(`${kind}-changed`, {
-            server: serverName,
-            count: list.length,
-          });
+          refreshed = true;
         } catch (error) {
+          if (this.servers.get(serverName) !== entry) return;
           if (kind === "tools" && isMcpToolMetadataError(error)) {
             entry.toolsError = error.message;
             this.emit("server-error", {
@@ -5331,6 +5464,19 @@ export class MCPClient extends EventEmitter {
       } while (flags[`${kind}Dirty`]);
     } finally {
       flags[`${kind}Running`] = false;
+      if (
+        kind === "tools" &&
+        refreshed &&
+        this.servers.get(serverName) === entry
+      ) {
+        // Event listeners may call a newly advertised tool immediately.
+        entry._toolInventoryDirty = false;
+        try {
+          this.emit("tools-changed", { server: serverName, count: toolCount });
+        } catch {
+          // An observer cannot make a successfully refreshed catalog stale.
+        }
+      }
     }
   }
 
@@ -5601,9 +5747,12 @@ function _readHttpReaderChunk(reader, signal) {
   });
 }
 
-function _waitForHttpMessageStreamResponse(responsePromise, signal) {
-  if (!signal?.addEventListener) return Promise.resolve(responsePromise);
-  if (signal.aborted) {
+function _waitForHttpMessageStreamResponse(
+  responsePromise,
+  { controller, timeoutMs } = {},
+) {
+  const signal = controller?.signal;
+  if (signal?.aborted) {
     Promise.resolve(responsePromise).then(
       (response) => _cancelHttpResponseBody(response),
       () => {},
@@ -5613,7 +5762,11 @@ function _waitForHttpMessageStreamResponse(responsePromise, signal) {
   return new Promise((resolve, reject) => {
     let settled = false;
     let aborted = false;
-    const cleanup = () => signal.removeEventListener?.("abort", onAbort);
+    let timer;
+    const cleanup = () => {
+      clearTimeout(timer);
+      signal?.removeEventListener?.("abort", onAbort);
+    };
     const finish = (settler, value) => {
       if (settled) return false;
       settled = true;
@@ -5625,7 +5778,15 @@ function _waitForHttpMessageStreamResponse(responsePromise, signal) {
       aborted = true;
       finish(reject, _httpReadAbortedError());
     };
-    signal.addEventListener("abort", onAbort, { once: true });
+    if (Number.isFinite(timeoutMs) && timeoutMs > 0) {
+      timer = setTimeout(() => {
+        aborted = true;
+        if (finish(reject, mcpSseHeaderTimeoutError(timeoutMs))) {
+          controller?.abort();
+        }
+      }, timeoutMs);
+    }
+    signal?.addEventListener?.("abort", onAbort, { once: true });
     Promise.resolve(responsePromise).then(
       (response) => {
         if (!finish(resolve, response) && aborted) {

package/src/lib/background-session-transport.js

@@ -50,17 +50,28 @@ export function transportPipePath(id, dir, options = {}) {
  */
 export function createNdjsonReader(onMessage, onError = () => {}) {
   let carry = "";
+  let droppingOversizedLine = false;
+  const decoder = new TextDecoder("utf-8");
   return (chunk) => {
-    carry += chunk.toString("utf8");
-    if (carry.length > MAX_LINE_BYTES) {
-      carry = "";
-      onError(new Error("line too long"));
-      return;
+    let text =
+      typeof chunk === "string"
+        ? chunk
+        : decoder.decode(chunk, { stream: true });
+    if (droppingOversizedLine) {
+      const end = text.indexOf("\n");
+      if (end < 0) return;
+      droppingOversizedLine = false;
+      text = text.slice(end + 1);
     }
+    carry += text;
     let index;
     while ((index = carry.indexOf("\n")) !== -1) {
       const line = carry.slice(0, index).replace(/\r$/, "");
       carry = carry.slice(index + 1);
+      if (Buffer.byteLength(line, "utf8") > MAX_LINE_BYTES) {
+        onError(new Error("line too long"));
+        continue;
+      }
       if (!line.trim()) continue;
       let message;
       try {
@@ -71,6 +82,11 @@ export function createNdjsonReader(onMessage, onError = () => {}) {
       }
       onMessage(message);
     }
+    if (Buffer.byteLength(carry, "utf8") > MAX_LINE_BYTES) {
+      carry = "";
+      droppingOversizedLine = true;
+      onError(new Error("line too long"));
+    }
   };
 }