dsh-oauth-mcp 0.0.1 → 0.0.2

package/index.js

@@ -825,5 +825,12 @@ export async function apply(ctx, config) {
     } catch (error) {
       logger?.warn?.('dsh-oauth-mcp: the tool registry did not dispose cleanly', { error: String(error?.message ?? error) })
     }
+    try {
+      // The pending authorizations hold a ref'd timer; they must be given up
+      // when the plugin goes away, or the timer keeps the process alive.
+      service.dispose()
+    } catch (error) {
+      logger?.warn?.('dsh-oauth-mcp: the pending authorizations did not release cleanly', { error: String(error?.message ?? error) })
+    }
   }
 }

package/lib/build-info.js

@@ -12,13 +12,13 @@ import { createTranslator } from './i18n/index.js'
 export const PLUGIN_ID = 'dsh-oauth-mcp'
 
 /** The version of the plugin. It is reported to every server it talks to. */
-export const PLUGIN_VERSION = '0.0.1'
+export const PLUGIN_VERSION = '0.0.2'
 
 /**
  * Short marker of the current source revision. Bump it whenever the behaviour
  * of the user facing surfaces (commands, tools, panel, callback pages) changes.
  */
-export const BUILD_STAMP = '2026-11-08-first-npm-release'
+export const BUILD_STAMP = '2026-11-08-release-timer-fix'
 
 /**
  * One line that names the version and the build of the running code.

package/lib/http/client.js

@@ -160,71 +160,76 @@ export function createHttpClient({ timeoutMs = 15_000, fetchImpl = globalThis.fe
     const startedAt = now()
     let response
     try {
-      response = await fetchImpl(target, {
-        method,
-        headers: requestHeaders,
-        body,
-        redirect: 'manual',
-        signal: combined.signal,
-      })
-    } catch (error) {
-      combined.dispose()
-      timeout?.dispose()
-      const durationMs = now() - startedAt
-      if (timeout?.signal.aborted || error?.name === 'TimeoutError') {
-        const timeoutError = new HttpError(`Request timed out after ${timeoutMs}ms`, {
+      try {
+        response = await fetchImpl(target, {
+          method,
+          headers: requestHeaders,
+          body,
+          redirect: 'manual',
+          signal: combined.signal,
+        })
+      } catch (error) {
+        const durationMs = now() - startedAt
+        if (timeout?.signal.aborted || error?.name === 'TimeoutError') {
+          const timeoutError = new HttpError(`Request timed out after ${timeoutMs}ms`, {
+            url: safeUrl,
+            cause: error,
+          })
+          timeoutError.durationMs = durationMs
+          throw timeoutError
+        }
+        if (signal?.aborted) {
+          const abortError = new HttpError('Request was aborted.', { url: safeUrl, cause: error })
+          abortError.durationMs = durationMs
+          throw abortError
+        }
+        const networkError = new HttpError(`Request to ${safeUrl} failed.`, {
           url: safeUrl,
+          detail: truncateDetail(redactText(error?.message ?? '')),
           cause: error,
         })
-        timeoutError.durationMs = durationMs
-        throw timeoutError
-      }
-      if (signal?.aborted) {
-        const abortError = new HttpError('Request was aborted.', { url: safeUrl, cause: error })
-        abortError.durationMs = durationMs
-        throw abortError
+        networkError.durationMs = durationMs
+        throw networkError
       }
-      const networkError = new HttpError(`Request to ${safeUrl} failed.`, {
-        url: safeUrl,
-        detail: truncateDetail(redactText(error?.message ?? '')),
-        cause: error,
-      })
-      networkError.durationMs = durationMs
-      throw networkError
-    }
-    combined.dispose()
-    timeout?.dispose()
-    let text = ''
-    try {
-      text = await response.text()
-    } catch {
-      text = ''
-    }
-    const status = response.status
-    if (status >= 300 && status < 400) {
-      throw new HttpError(`Cross-origin redirect is not allowed: ${safeUrl}`, {
-        status,
-        url: safeUrl,
-        detail: safeDetail(text),
-      })
-    }
-    if (status < 200 || status >= 300) {
-      throw new HttpError(`Request to ${safeUrl} failed with status ${status}.`, {
-        status,
-        url: safeUrl,
-        detail: safeDetail(text),
-        headers: response.headers,
-      })
-    }
-    let parsed
-    if (text.length > 0) {
+
+      let text = ''
       try {
-        parsed = JSON.parse(text)
+        text = await response.text()
       } catch {
-        parsed = undefined
+        text = ''
+      }
+      const status = response.status
+      if (status >= 300 && status < 400) {
+        throw new HttpError(`Cross-origin redirect is not allowed: ${safeUrl}`, {
+          status,
+          url: safeUrl,
+          detail: safeDetail(text),
+        })
       }
+      if (status < 200 || status >= 300) {
+        throw new HttpError(`Request to ${safeUrl} failed with status ${status}.`, {
+          status,
+          url: safeUrl,
+          detail: safeDetail(text),
+          headers: response.headers,
+        })
+      }
+      let parsed
+      if (text.length > 0) {
+        try {
+          parsed = JSON.parse(text)
+        } catch {
+          parsed = undefined
+        }
+      }
+      return { status, headers: response.headers, body: parsed, text }
+    } finally {
+      // The timeout and the combined signal are released on every path,
+      // including the failing ones: a timer that outlives the request keeps
+      // the event loop alive.
+      combined.dispose()
+      timeout?.dispose()
     }
-    return { status, headers: response.headers, body: parsed, text }
   }
 
   /**

package/lib/mcp/transport.js

@@ -374,65 +374,69 @@ export function createMcpTransport(options = {}) {
     const signal = linkSignals([sendOptions.signal, timeout.signal])
     let response
     try {
-      response = await fetchImpl(url, {
-        method: 'POST',
-        headers: mergeHeaders(baseHeaders, extraHeaders),
-        body: JSON.stringify(message),
-        signal,
-        redirect: 'manual',
-      })
-    } catch (cause) {
-      timeout.dispose()
-      if (timeout.signal.aborted) {
-        throw new McpError(`Request timed out after ${timeoutMs}ms`, {
-          code: ERROR_CODES.mcp_transport_error,
-          cause,
+      try {
+        response = await fetchImpl(url, {
+          method: 'POST',
+          headers: mergeHeaders(baseHeaders, extraHeaders),
+          body: JSON.stringify(message),
+          signal,
+          redirect: 'manual',
         })
-      }
-      if (sendOptions.signal?.aborted) {
-        throw new McpError('The MCP request was aborted.', {
+      } catch (cause) {
+        if (timeout.signal.aborted) {
+          throw new McpError(`Request timed out after ${timeoutMs}ms`, {
+            code: ERROR_CODES.mcp_transport_error,
+            cause,
+          })
+        }
+        if (sendOptions.signal?.aborted) {
+          throw new McpError('The MCP request was aborted.', {
+            code: ERROR_CODES.mcp_transport_error,
+            cause,
+          })
+        }
+        throw new McpError(`The MCP server at ${safeUrl} could not be reached.`, {
           code: ERROR_CODES.mcp_transport_error,
+          detail: redactText(cause?.message ?? String(cause)),
           cause,
         })
       }
-      throw new McpError(`The MCP server at ${safeUrl} could not be reached.`, {
-        code: ERROR_CODES.mcp_transport_error,
-        detail: redactText(cause?.message ?? String(cause)),
-        cause,
-      })
-    }
 
-    const responseHeaders = response.headers
-    timeout.dispose()
-    const assignedSessionId = readHeader(responseHeaders, 'mcp-session-id')
-    if (typeof assignedSessionId === 'string' && assignedSessionId.length > 0) {
-      currentSessionId = assignedSessionId
-    }
+      const responseHeaders = response.headers
+      const assignedSessionId = readHeader(responseHeaders, 'mcp-session-id')
+      if (typeof assignedSessionId === 'string' && assignedSessionId.length > 0) {
+        currentSessionId = assignedSessionId
+      }
 
-    const status = typeof response.status === 'number' ? response.status : 0
-    if (status === 202) {
-      // The server accepted a notification; there is no body to read.
-      await response.text().catch(() => '')
-      return { status, headers: collectHeaders(responseHeaders), messages: [], response: undefined }
-    }
-    if (status < 200 || status >= 300) {
-      const text = await response.text().catch(() => '')
-      throw httpError(status, text, responseHeaders)
-    }
+      const status = typeof response.status === 'number' ? response.status : 0
+      if (status === 202) {
+        // The server accepted a notification; there is no body to read.
+        await response.text().catch(() => '')
+        return { status, headers: collectHeaders(responseHeaders), messages: [], response: undefined }
+      }
+      if (status < 200 || status >= 300) {
+        const text = await response.text().catch(() => '')
+        throw httpError(status, text, responseHeaders)
+      }
 
-    const contentType = readHeader(responseHeaders, 'content-type') ?? ''
-    const messages = contentType.toLowerCase().includes(SSE_CONTENT_TYPE)
-      ? await readEventStream(response, { matchId: requestId })
-      : parseJsonBody(await response.text())
+      const contentType = readHeader(responseHeaders, 'content-type') ?? ''
+      const messages = contentType.toLowerCase().includes(SSE_CONTENT_TYPE)
+        ? await readEventStream(response, { matchId: requestId })
+        : parseJsonBody(await response.text())
 
-    const matched = messages.find((message) => sameId(message?.id, requestId))
-    if (requestId !== undefined && matched === undefined) {
-      throw new McpError('The MCP server did not answer the request.', {
-        code: ERROR_CODES.mcp_protocol_error,
-        status,
-      })
+      const matched = messages.find((message) => sameId(message?.id, requestId))
+      if (requestId !== undefined && matched === undefined) {
+        throw new McpError('The MCP server did not answer the request.', {
+          code: ERROR_CODES.mcp_protocol_error,
+          status,
+        })
+      }
+      return { status, headers: collectHeaders(responseHeaders), messages, response: matched }
+    } finally {
+      // The timer is released on every path, including the failing ones: a
+      // timer that outlives the request keeps the event loop alive.
+      timeout.dispose()
     }
-    return { status, headers: collectHeaders(responseHeaders), messages, response: matched }
   }
 
   /**
@@ -450,14 +454,19 @@ export function createMcpTransport(options = {}) {
     if (currentProtocolVersion) extraHeaders['MCP-Protocol-Version'] = currentProtocolVersion
     try {
       const timeout = createTimeoutSignal(DEFAULT_REQUEST_TIMEOUT_MS)
-      const response = await fetchImpl(url, {
-        method: 'DELETE',
-        headers: mergeHeaders(baseHeaders, { ...extraHeaders, 'Mcp-Session-Id': currentSessionId }),
-        signal: timeout.signal,
-        redirect: 'manual',
-      })
-      timeout.dispose()
-      await response.text().catch(() => '')
+      try {
+        const response = await fetchImpl(url, {
+          method: 'DELETE',
+          headers: mergeHeaders(baseHeaders, { ...extraHeaders, 'Mcp-Session-Id': currentSessionId }),
+          signal: timeout.signal,
+          redirect: 'manual',
+        })
+        await response.text().catch(() => '')
+      } finally {
+        // The timer must be released on every path, including the failing one:
+        // a timer that outlives the request keeps the event loop alive.
+        timeout.dispose()
+      }
     } catch {
       // Terminating the session is best effort: the server may not support DELETE.
     }

package/lib/service.js

@@ -626,6 +626,30 @@ export function createOauthMcpService(options) {
     return refreshed
   }
 
+  /**
+   * Release every pending authorization.
+   *
+   * The timer of a pending authorization keeps the event loop alive: it is
+   * ref'd on purpose, so that a request that waits for the user still times
+   * out on Node 22 (see `lib/http/timeout.js`). The host must therefore be
+   * able to give the pending authorizations up when the plugin is unloaded,
+   * and a test must be able to do the same after it is done.
+   *
+   * @returns {void}
+   */
+  function dispose() {
+    for (const serverId of [...pending.keys()]) {
+      rejectPending(
+        serverId,
+        new OAuthError(
+          ERROR_CODES.authorization_cancelled,
+          language().t('server.error.no_pending_authorization', { serverId }),
+        ),
+      )
+    }
+    stateIndex.clear()
+  }
+
   return {
     listServers,
     describeServer,
@@ -645,6 +669,7 @@ export function createOauthMcpService(options) {
     updateServer,
     isAuthorized,
     refreshToken,
+    dispose,
     /** @internal Exposed for the host callback receiver and the host command. */
     ctx,
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-oauth-mcp",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "description": "OAuth 2.1 client and MCP bridge for DSH: discover and authorize remote MCP servers, keep tokens fresh, and expose their tools",
   "keywords": [
     "dsh",