pi-code 1.0.73 → 1.0.74

package/extensions/internal/mcp-oauth.ts

@@ -188,6 +188,19 @@ export class FileOAuthProvider implements OAuthClientProvider {
     return this.data.tokens !== undefined
   }
 
+  /** Called by the SDK when the server rejects what is stored: `invalid_grant` for an expired
+   * or revoked refresh token, `invalid_client` for a forgotten registration. It restarts
+   * authorization once this returns, which reaches the login prompt. Without it the
+   * rejection propagated and the dead credentials stayed on disk, so the server failed the
+   * same way on every connect. Discovery state is not stored, and the redirect port is kept
+   * so a re-login can still bind the port the client was registered with. */
+  invalidateCredentials(scope: 'all' | 'client' | 'tokens' | 'verifier' | 'discovery'): void {
+    if (scope === 'all' || scope === 'client') delete this.data.client
+    if (scope === 'all' || scope === 'tokens') delete this.data.tokens
+    if (scope === 'all' || scope === 'verifier') delete this.data.verifier
+    this.persist()
+  }
+
   /** The CSRF token the SDK adds to the authorization URL as `state`; waitForAuthCode
    * verifies the redirect echoes exactly this value. */
   state(): string {

package/extensions/mcp/index.ts

@@ -49,7 +49,7 @@ import { disabledServerNames, loadConfigFrom, loadPluginServers, loadUserScope,
 import { collectServerResourceEntries, listAllPrompts, listAllTools, type McpToolInfo, resourceServerFilter } from './listing.js'
 import { formatPromptCommandName, formatToolName, type McpContentBlock, type McpPromptInfo, mapContent, mapPromptArguments, normalizeSchema, promptMessageContent } from './mapping.js'
 import { applyServerPolicy, loadManagedMcpServers, type McpPolicy, mcpAllowDeny, projectServerPolicy, splitByPolicy } from './policy.js'
-import { type AuthUi, callRequestOptions, callTimeoutMs, connect, connectTimeoutMs, connectWithRetries, isUnauthorized, mcpConnectTimeoutMs, type ServerCallTuning, type SessionDirs, serverCallTuning, withTimeout } from './transport.js'
+import { type AuthUi, callRequestOptions, callTimeoutMs, connect, connectTimeoutMs, connectWithRetries, isConnectionLost, isUnauthorized, mcpConnectTimeoutMs, type ServerCallTuning, type SessionDirs, serverCallTuning, withTimeout } from './transport.js'
 
 export { managedSettingsPath, setManagedSettingsPath } from '../internal/managed-settings.js'
 // Re-exports for consumers: the module split keeps the extension's public surface
@@ -189,6 +189,19 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     return count
   }
 
+  /** A client that is gone: flip the status and free the name so a reconnect can take it.
+   * Claude reconnects a dropped remote server with exponential backoff; stdio servers are
+   * local processes and are not reconnected. Shutdown closes clients while they are still
+   * in the map, so the flag guards against scheduling a reconnect for a deliberate
+   * teardown. Called by the transport's onclose and by a call that found the connection
+   * dead (isConnectionLost), so several calls failing together schedule one reconnect. */
+  function dropClient(name: string, client: Client, config: ServerConfig): void {
+    if (clients.get(name) !== client) return
+    clients.delete(name)
+    status.set(name, { state: 'disconnected', tools: 0 })
+    if (!shuttingDown && !serverCallTuning(config).stdio) void reconnectWithBackoff(name, config)
+  }
+
   /** Claude's mid-session reconnect for a dropped remote server: five attempts with
    * a delay doubling from one second. connectServers redoes the full bring-up
    * (tools, prompts, subscriptions, a fresh onclose) and its duplicate guard skips
@@ -205,17 +218,27 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     }
   }
 
+  // One auth recovery per server at a time, shared by every call that met the same 401.
+  const authReconnects = new Map<string, Promise<void>>()
+
   /** Claude's 401/403 tool-call recovery: drop the client and reconnect once, so the
    * headersHelper re-runs (fresh credential) or the OAuth tokens refresh, then the
    * caller retries the call once. The map delete precedes the close so the onclose
-   * guard does not also schedule a backoff reconnect. */
-  async function reconnectForAuth(name: string, config: ServerConfig): Promise<void> {
-    const old = clients.get(name)
-    if (old) {
+   * guard does not also schedule a backoff reconnect. Parallel calls that all met the
+   * expired credential share the one reconnect: `failed` is the client a call was made
+   * on, and a map holding another one means a sibling already replaced it, so closing
+   * "the client in the map" would tear down the fresh connection under that sibling. */
+  function reconnectForAuth(name: string, config: ServerConfig, failed: Client | undefined): Promise<void> {
+    const inFlight = authReconnects.get(name)
+    if (inFlight !== undefined) return inFlight
+    if (clients.get(name) !== failed) return Promise.resolve()
+    const recovery = (async () => {
       clients.delete(name)
-      await withTimeout(old.close(), 3000, 'close').catch(() => {})
-    }
-    await connectServers({ [name]: config }, sessionAuthUi, true)
+      if (failed) await withTimeout(failed.close(), 3000, 'close').catch(() => {})
+      await connectServers({ [name]: config }, sessionAuthUi, true)
+    })().finally(() => authReconnects.delete(name))
+    authReconnects.set(name, recovery)
+    return recovery
   }
 
   /** A tool call with the auth retry: on a 401/403 rejection, reconnect once and
@@ -223,16 +246,26 @@ export default async function mcpExtension(pi: ExtensionAPI) {
   async function callToolWithAuthRetry(name: string, config: ServerConfig, args: { name: string; arguments: Record<string, unknown> }, label: string): Promise<Awaited<ReturnType<Client['callTool']>>> {
     const tuning = serverCallTuning(config)
     const wall = tuning.serverTimeoutMs ?? callTimeoutMs()
+    let used: Client | undefined
     const callOnce = async () => {
       const current = clients.get(name)
       if (!current) throw new Error(`MCP server "${name}" is not connected`)
-      return await withTimeout(current.callTool(args, undefined, callRequestOptions(wall, tuning)), wall, label)
+      used = current
+      try {
+        return await withTimeout(current.callTool(args, undefined, callRequestOptions(wall, tuning)), wall, label)
+      } catch (error) {
+        if (isConnectionLost(error)) {
+          dropClient(name, current, config)
+          void withTimeout(current.close(), 3000, 'close').catch(() => {})
+        }
+        throw error
+      }
     }
     try {
       return await callOnce()
     } catch (error) {
       if (!isUnauthorized(error)) throw error
-      await reconnectForAuth(name, config)
+      await reconnectForAuth(name, config, used)
       return await callOnce()
     }
   }
@@ -463,16 +496,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
           // A server that dies mid-session would otherwise stay "connected" in /mcp
           // while every call fails with the SDK's bare "Not connected"; flip the
           // status and free the name so a later session start can reconnect it.
-          client.onclose = () => {
-            if (clients.get(name) !== client) return
-            clients.delete(name)
-            status.set(name, { state: 'disconnected', tools: 0 })
-            // Claude reconnects a dropped remote server with exponential backoff;
-            // stdio servers are local processes and are not reconnected. Shutdown
-            // closes clients while they are still in the map, so the flag guards
-            // against scheduling a reconnect for a deliberate teardown.
-            if (!shuttingDown && !serverCallTuning(config).stdio) void reconnectWithBackoff(name, config)
-          }
+          client.onclose = () => dropClient(name, client, config)
         } catch (error) {
           status.set(name, { state: `failed: ${errorMessage(error)}`, tools: 0 })
           // Connected but failed after (tool listing hung or errored): left in the

package/extensions/mcp/mapping.ts

@@ -4,11 +4,25 @@
  * blocks mapped into pi's output budget.
  */
 
+import { createHash } from 'node:crypto'
+
 import { DEFAULT_MAX_BYTES } from '@earendil-works/pi-coding-agent'
 import { capForContext } from '../internal/output-guard.js'
 
+/** Providers take a tool name only as `^[a-zA-Z0-9_-]{1,64}$` (64 is OpenAI's cap, the
+ * tighter of the two) and reject the whole request otherwise, so one bad name failed every
+ * turn of the session. */
+const MAX_TOOL_NAME = 64
+
+/** The pi tool name for a server's tool: `server_tool` with every character a provider
+ * rejects (the MCP spec allows dots; a server name is whatever the user typed) as an
+ * underscore. A name over the limit is cut and ends in a hash of the whole, so two long
+ * tools of one server stay apart and a tool keeps its name from one session to the next. */
 export function formatToolName(server: string, tool: string): string {
-  return `${server}_${tool}`.replaceAll('-', '_')
+  const name = `${server}_${tool}`.replace(/\W/g, '_')
+  if (name.length <= MAX_TOOL_NAME) return name
+  const digest = createHash('sha256').update(name).digest('hex').slice(0, 8)
+  return `${name.slice(0, MAX_TOOL_NAME - digest.length - 1)}_${digest}`
 }
 
 /** Claude exposes server prompts as /mcp__<server>__<prompt> slash commands: any

package/extensions/mcp/transport.ts

@@ -339,6 +339,21 @@ export function isTransientConnectError(error: unknown): boolean {
   return /ECONNREFUSED|ECONNRESET|ETIMEDOUT|timed out after/.test(String(error))
 }
 
+/** Whether a failed call means the server is gone, not that the call was wrong: a refused,
+ * reset or unreachable connection, the 404 a restarted stateful server answers for a
+ * session it forgot (the spec has the client start a new one), or the SDK's own
+ * closed-connection errors. The SDK fires `Client.onclose` only from `close()`, never when
+ * an HTTP or SSE server disappears, so a call is the one place a dead server shows.
+ * Narrower than isTransientConnectError on purpose: a tool timing out, or a tool's own
+ * 5xx, says nothing about the connection and must not drop a healthy server. The closed
+ * connection is matched by the SDK's message, not its -32000 code, which servers also use
+ * for errors of their own. */
+export function isConnectionLost(error: unknown): boolean {
+  const code = typeof error === 'object' && error !== null ? (error as { code?: unknown }).code : undefined
+  if (code === 404 || errorCodes(error).some((one) => TRANSIENT_CODES.has(one))) return true
+  return /\(HTTP 404\)|^Not connected$|^MCP error -32000: Connection closed$/.test(error instanceof Error ? error.message : '')
+}
+
 const delay = (ms: number): Promise<void> => new Promise((resolve) => setTimeout(resolve, ms))
 
 /** Connect with Claude's first-connection retry: an HTTP or SSE server's transient

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.73",
+  "version": "1.0.74",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, subagents, and goals",
   "keywords": [
     "pi",