pi-mcp-adapter 2.8.0 → 2.10.0

package/mcp-auth-flow.ts

@@ -38,10 +38,15 @@ export type AuthStatus = "authenticated" | "expired" | "not_authenticated"
 
 // Track pending transports for auth completion
 const pendingTransports = new Map<string, StreamableHTTPClientTransport>()
+const pendingAuthStates = new Map<string, string>()
+const pendingAuthCleanupTimers = new Map<string, ReturnType<typeof setTimeout>>()
 
 // Deduplicate concurrent authenticate() calls per server.
 const pendingAuthentications = new Map<string, Promise<AuthStatus>>()
 
+/** Timeout for manual auth completion (5 minutes) */
+const MANUAL_AUTH_TIMEOUT_MS = 5 * 60 * 1000
+
 /**
  * Generate a cryptographically secure random state parameter.
  */
@@ -214,18 +219,124 @@ export async function startAuth(
     if (!capturedUrl) {
       throw new UnauthorizedError("OAuth authorization URL was not provided")
     }
-    pendingTransports.set(
-      serverName,
-      new StreamableHTTPClientTransport(new URL(serverUrl), { authProvider }),
-    )
+    const pendingTransport = new StreamableHTTPClientTransport(new URL(serverUrl), { authProvider })
+    await setPendingTransport(serverName, pendingTransport, oauthState)
     return { authorizationUrl: capturedUrl.toString() }
   } catch (error) {
-    releaseCallbackServer(oauthState)
-    await clearOAuthState(serverName)
+    await clearPendingAuth(serverName, oauthState)
     throw error
   }
 }
 
+async function setPendingTransport(
+  serverName: string,
+  transport: StreamableHTTPClientTransport,
+  oauthState: string,
+): Promise<void> {
+  await clearPendingAuth(serverName)
+  pendingTransports.set(serverName, transport)
+  pendingAuthStates.set(serverName, oauthState)
+  const cleanupTimer = setTimeout(() => {
+    void clearPendingAuth(serverName, oauthState)
+  }, MANUAL_AUTH_TIMEOUT_MS)
+  cleanupTimer.unref?.()
+  pendingAuthCleanupTimers.set(serverName, cleanupTimer)
+}
+
+async function clearPendingAuth(serverName: string, oauthState?: string): Promise<void> {
+  const pendingState = pendingAuthStates.get(serverName)
+  if (oauthState && pendingState && pendingState !== oauthState) return
+
+  const timer = pendingAuthCleanupTimers.get(serverName)
+  if (timer) {
+    clearTimeout(timer)
+    pendingAuthCleanupTimers.delete(serverName)
+  }
+
+  const transport = pendingTransports.get(serverName)
+  pendingTransports.delete(serverName)
+  pendingAuthStates.delete(serverName)
+  const stateToRelease = pendingState ?? oauthState
+  if (stateToRelease) {
+    releaseCallbackServer(stateToRelease)
+    const storedState = await getOAuthState(serverName)
+    if (storedState === stateToRelease) {
+      await clearOAuthState(serverName)
+    }
+  }
+  if (transport) {
+    await transport.close().catch(() => {})
+  }
+}
+
+function getSearchParamsFromInput(input: string): URLSearchParams | undefined {
+  try {
+    const url = new URL(input)
+    const params = new URLSearchParams(url.search)
+    if (url.hash) {
+      const hash = url.hash.startsWith("#") ? url.hash.slice(1) : url.hash
+      const hashParams = new URLSearchParams(hash)
+      for (const [key, value] of hashParams) {
+        if (!params.has(key)) params.set(key, value)
+      }
+    }
+    return params
+  } catch {
+    const query = input.includes("?") ? input.slice(input.indexOf("?") + 1) : input
+    const params = new URLSearchParams(query.startsWith("#") ? query.slice(1) : query)
+    return params.has("code") || params.has("state") || params.has("error") ? params : undefined
+  }
+}
+
+/**
+ * Extract an OAuth authorization code from either a raw code, a query string,
+ * or the full localhost redirect URL copied from the browser address bar.
+ */
+export function parseAuthorizationCodeInput(input: string, expectedState?: string): string {
+  const trimmed = input.trim()
+  if (!trimmed) {
+    throw new Error("Authorization code or redirect URL is required")
+  }
+
+  const params = getSearchParamsFromInput(trimmed)
+  if (params) {
+    const error = params.get("error")
+    if (error) {
+      const description = params.get("error_description")
+      throw new Error(description ? `${error}: ${description}` : error)
+    }
+
+    const state = params.get("state")
+    if (expectedState && !state) {
+      throw new Error("OAuth state missing from redirect URL")
+    }
+    if (expectedState && state !== expectedState) {
+      throw new Error("OAuth state mismatch - potential CSRF attack")
+    }
+
+    const code = params.get("code")
+    if (code) return code
+  }
+
+  if (/^[A-Za-z0-9._~+/=-]+$/.test(trimmed)) {
+    return trimmed
+  }
+
+  throw new Error("Could not find an OAuth authorization code in the provided input")
+}
+
+/**
+ * Complete OAuth authentication from manual user input.
+ */
+export async function completeAuthFromInput(
+  serverName: string,
+  input: string,
+): Promise<AuthStatus> {
+  const oauthState = await getOAuthState(serverName)
+  const code = parseAuthorizationCodeInput(input, oauthState)
+  return completeAuth(serverName, code)
+}
+
 /**
  * Complete OAuth authentication with the authorization code.
  */
@@ -245,12 +356,7 @@ export async function completeAuth(
     await transport.finishAuth(authorizationCode)
     return "authenticated"
   } finally {
-    if (oauthState) {
-      releaseCallbackServer(oauthState)
-    }
-    await clearOAuthState(serverName)
-    pendingTransports.delete(serverName)
-    await transport.close().catch(() => {})
+    await clearPendingAuth(serverName, oauthState)
   }
 }
 
@@ -291,16 +397,13 @@ export async function authenticate(
     const callbackPromise = waitForCallback(oauthState)
 
     try {
-      // Open browser
-      console.log(`MCP Auth: Opening browser for ${serverName}`)
+      // Open browser. Always print the URL first so remote/headless users can copy it
+      // even when the OS browser handoff is unavailable or invisible.
+      console.log(`MCP Auth: Open this URL to authenticate ${serverName}:\n${authorizationUrl}`)
       try {
         await open(authorizationUrl)
       } catch (error) {
-        console.warn(`MCP Auth: Failed to open browser for ${serverName}`, { error })
-        throw new Error(
-          `Could not open browser. Please open this URL manually: ${authorizationUrl}`,
-          { cause: error },
-        )
+        console.warn(`MCP Auth: Failed to open browser for ${serverName}; waiting for manual callback`, { error })
       }
 
       // Wait for callback
@@ -318,12 +421,7 @@ export async function authenticate(
       return await completeAuth(serverName, code)
     } catch (error) {
       cancelPendingCallback(oauthState)
-      await clearOAuthState(serverName)
-      const pendingTransport = pendingTransports.get(serverName)
-      if (pendingTransport) {
-        pendingTransports.delete(serverName)
-        await pendingTransport.close().catch(() => {})
-      }
+      await clearPendingAuth(serverName, oauthState)
       throw error
     }
   })()
@@ -418,11 +516,7 @@ export async function removeAuth(serverName: string): Promise<void> {
   if (oauthState) {
     cancelPendingCallback(oauthState)
   }
-  const pendingTransport = pendingTransports.get(serverName)
-  if (pendingTransport) {
-    pendingTransports.delete(serverName)
-    await pendingTransport.close().catch(() => {})
-  }
+  await clearPendingAuth(serverName, oauthState)
   clearAllCredentials(serverName)
   await clearOAuthState(serverName)
   console.log(`MCP Auth: Removed credentials for ${serverName}`)
@@ -458,5 +552,8 @@ export async function initializeOAuth(): Promise<void> {}
  * Stops the callback server and cancels pending auths.
  */
 export async function shutdownOAuth(): Promise<void> {
+  for (const serverName of Array.from(pendingTransports.keys())) {
+    await clearPendingAuth(serverName)
+  }
   await stopCallbackServer()
 }

package/mcp-oauth-provider.ts

@@ -5,7 +5,7 @@
  * Handles OAuth client registration, token storage, and authorization redirection.
  */
 
-import type { OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js"
+import type { AddClientAuthentication, OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js"
 import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js"
 import type {
   OAuthClientMetadata,
@@ -135,6 +135,7 @@ export class McpOAuthProvider implements OAuthClientProvider {
       grant_types: ["authorization_code", "refresh_token"],
       response_types: ["code"],
       token_endpoint_auth_method: this.config.clientSecret ? "client_secret_post" : "none",
+      ...(this.config.scope !== undefined ? { scope: this.config.scope } : {}),
     }
   }
 
@@ -305,6 +306,52 @@ export class McpOAuthProvider implements OAuthClientProvider {
     }
   }
 
+  /**
+   * Adds configured authorization-code scope without replacing the SDK's
+   * default token endpoint authentication behavior.
+   */
+  addClientAuthentication: AddClientAuthentication = async (headers, params, _url, metadata) => {
+    if (params.get("grant_type") === "authorization_code" && !params.has("scope") && this.config.scope) {
+      params.set("scope", this.config.scope)
+    }
+
+    const clientInfo = await this.clientInformation()
+    if (!clientInfo) {
+      return
+    }
+
+    const supportedMethods = metadata?.token_endpoint_auth_methods_supported ?? []
+    const hasClientSecret = clientInfo.client_secret !== undefined
+    let authMethod: "client_secret_basic" | "client_secret_post" | "none"
+
+    if (supportedMethods.length === 0) {
+      authMethod = hasClientSecret ? "client_secret_post" : "none"
+    } else if (hasClientSecret && supportedMethods.includes("client_secret_basic")) {
+      authMethod = "client_secret_basic"
+    } else if (hasClientSecret && supportedMethods.includes("client_secret_post")) {
+      authMethod = "client_secret_post"
+    } else if (supportedMethods.includes("none")) {
+      authMethod = "none"
+    } else {
+      authMethod = hasClientSecret ? "client_secret_post" : "none"
+    }
+
+    if (authMethod === "client_secret_basic") {
+      if (!clientInfo.client_secret) {
+        throw new Error("client_secret_basic authentication requires a client_secret")
+      }
+      headers.set("Authorization", `Basic ${Buffer.from(`${clientInfo.client_id}:${clientInfo.client_secret}`).toString("base64")}`)
+      return
+    }
+
+    if (!params.has("client_id")) {
+      params.set("client_id", clientInfo.client_id)
+    }
+    if (authMethod === "client_secret_post" && clientInfo.client_secret && !params.has("client_secret")) {
+      params.set("client_secret", clientInfo.client_secret)
+    }
+  }
+
   prepareTokenRequest(scope?: string): URLSearchParams | undefined {
     if (!this.usesClientCredentials) {
       return undefined

package/mcp-panel.ts

@@ -1,4 +1,5 @@
 import { matchesKey, truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
+import { createPanelKeys, type PanelKeybindings, type PanelKeys } from "./panel-keys.ts";
 import { isToolExcluded } from "./types.ts";
 import type { McpConfig, McpPanelCallbacks, McpPanelResult, ServerProvenance } from "./types.ts";
 import { resourceNameToToolName } from "./resource-tools.ts";
@@ -126,6 +127,7 @@ class McpPanel {
   private tui: { requestRender(): void };
   private t = DEFAULT_THEME;
   private authOnly: boolean;
+  private keys: PanelKeys;
 
   private static readonly MAX_VISIBLE = 12;
   private static readonly INACTIVITY_MS = 60_000;
@@ -137,11 +139,12 @@ class McpPanel {
     private callbacks: McpPanelCallbacks,
     tui: { requestRender(): void },
     private done: (result: McpPanelResult) => void,
-    options: { noticeLines?: string[]; authOnly?: boolean } = {},
+    options: { noticeLines?: string[]; authOnly?: boolean; keybindings?: PanelKeybindings } = {},
   ) {
     this.tui = tui;
     this.noticeLines = options.noticeLines ?? [];
     this.authOnly = options.authOnly === true;
+    this.keys = createPanelKeys(options.keybindings);
     this.prefix = config.settings?.toolPrefix ?? "server";
 
     for (const [serverName, definition] of Object.entries(config.mcpServers)) {
@@ -318,7 +321,7 @@ class McpPanel {
 
     // Modal description search mode
     if (this.descSearchActive) {
-      if (matchesKey(data, "escape") || matchesKey(data, "return")) {
+      if (matchesKey(data, "escape") || this.keys.selectConfirm(data)) {
         this.descSearchActive = false;
         this.descQuery = "";
         this.rebuildVisibleItems();
@@ -333,8 +336,8 @@ class McpPanel {
         }
         return;
       }
-      if (matchesKey(data, "up")) { this.moveCursor(-1); return; }
-      if (matchesKey(data, "down")) { this.moveCursor(1); return; }
+      if (this.keys.selectUp(data)) { this.moveCursor(-1); return; }
+      if (this.keys.selectDown(data)) { this.moveCursor(1); return; }
       if (matchesKey(data, "space")) {
         // Toggle even while in desc search
         const item = this.visibleItems[this.cursorIndex];
@@ -367,8 +370,8 @@ class McpPanel {
       return;
     }
 
-    if (matchesKey(data, "up")) { this.moveCursor(-1); return; }
-    if (matchesKey(data, "down")) { this.moveCursor(1); return; }
+    if (this.keys.selectUp(data)) { this.moveCursor(-1); return; }
+    if (this.keys.selectDown(data)) { this.moveCursor(1); return; }
 
     if (matchesKey(data, "space")) {
       const item = this.visibleItems[this.cursorIndex];
@@ -376,7 +379,7 @@ class McpPanel {
       return;
     }
 
-    if (matchesKey(data, "return")) {
+    if (this.keys.selectConfirm(data)) {
       const item = this.visibleItems[this.cursorIndex];
       if (!item) return;
       const server = this.servers[item.serverIndex];
@@ -518,7 +521,7 @@ class McpPanel {
       this.confirmingDiscard = false;
       return;
     }
-    if (matchesKey(data, "return")) {
+    if (this.keys.selectConfirm(data)) {
       if (this.discardSelected === 0) {
         this.cleanup();
         this.done({ cancelled: true, changes: new Map() });
@@ -820,7 +823,7 @@ export function createMcpPanel(
   callbacks: McpPanelCallbacks,
   tui: { requestRender(): void },
   done: (result: McpPanelResult) => void,
-  options?: { noticeLines?: string[]; authOnly?: boolean },
+  options?: { noticeLines?: string[]; authOnly?: boolean; keybindings?: PanelKeybindings },
 ): McpPanel & { dispose(): void } {
   return new McpPanel(config, cache, provenance, callbacks, tui, done, options ?? {});
 }

package/mcp-setup-panel.ts

@@ -1,4 +1,5 @@
 import { matchesKey, truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
+import { createPanelKeys, type PanelKeybindings, type PanelKeys } from "./panel-keys.ts";
 import type { ImportKind } from "./types.ts";
 import type { ConfigWritePreview, McpDiscoverySummary } from "./config.ts";
 import type { McpOnboardingState } from "./onboarding-state.ts";
@@ -59,6 +60,7 @@ export interface SetupPanelCallbacks {
 export interface SetupPanelOptions {
   mode: "empty" | "setup";
   onboardingState: McpOnboardingState;
+  keybindings?: PanelKeybindings;
 }
 
 type Screen = "empty" | "setup" | "imports" | "paths";
@@ -89,6 +91,7 @@ export class McpSetupPanel {
   private notice: { text: string; tone: "success" | "warning" | "muted" } | null = null;
   private tui: { requestRender(): void };
   private t = DEFAULT_THEME;
+  private keys: PanelKeys;
   private inactivityTimeout: ReturnType<typeof setTimeout> | null = null;
   private static readonly INACTIVITY_MS = 60_000;
 
@@ -100,6 +103,7 @@ export class McpSetupPanel {
     private done: () => void,
   ) {
     this.tui = tui;
+    this.keys = createPanelKeys(options.keybindings);
     this.screen = options.mode;
     for (const entry of discovery.imports) {
       this.selectedImports.add(entry.kind);
@@ -191,17 +195,17 @@ export class McpSetupPanel {
     }
 
     const actions = this.getActions();
-    if (matchesKey(data, "up")) {
+    if (this.keys.selectUp(data)) {
       this.actionCursor = Math.max(0, this.actionCursor - 1);
       this.tui.requestRender();
       return;
     }
-    if (matchesKey(data, "down")) {
+    if (this.keys.selectDown(data)) {
       this.actionCursor = Math.min(actions.length - 1, this.actionCursor + 1);
       this.tui.requestRender();
       return;
     }
-    if (matchesKey(data, "return")) {
+    if (this.keys.selectConfirm(data)) {
       const selected = this.getSelectedAction();
       if (selected) void this.runAction(selected.id);
     }
@@ -209,12 +213,12 @@ export class McpSetupPanel {
 
   private handleImportsInput(data: string): void {
     const imports = this.discovery.imports;
-    if (matchesKey(data, "up")) {
+    if (this.keys.selectUp(data)) {
       this.importCursor = Math.max(0, this.importCursor - 1);
       this.tui.requestRender();
       return;
     }
-    if (matchesKey(data, "down")) {
+    if (this.keys.selectDown(data)) {
       this.importCursor = Math.min(imports.length - 1, this.importCursor + 1);
       this.tui.requestRender();
       return;
@@ -230,24 +234,24 @@ export class McpSetupPanel {
       this.tui.requestRender();
       return;
     }
-    if (matchesKey(data, "return")) {
+    if (this.keys.selectConfirm(data)) {
       void this.applySelectedImports();
     }
   }
 
   private handlePathsInput(data: string): void {
     const paths = this.getDetectedPaths();
-    if (matchesKey(data, "up")) {
+    if (this.keys.selectUp(data)) {
       this.pathCursor = Math.max(0, this.pathCursor - 1);
       this.tui.requestRender();
       return;
     }
-    if (matchesKey(data, "down")) {
+    if (this.keys.selectDown(data)) {
       this.pathCursor = Math.min(paths.length - 1, this.pathCursor + 1);
       this.tui.requestRender();
       return;
     }
-    if (matchesKey(data, "return")) {
+    if (this.keys.selectConfirm(data)) {
       const selected = paths[this.pathCursor];
       if (!selected) return;
       void this.runBusy(async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-mcp-adapter",
-  "version": "2.8.0",
+  "version": "2.10.0",
   "description": "MCP (Model Context Protocol) adapter extension for Pi coding agent",
   "type": "module",
   "license": "MIT",
@@ -54,6 +54,7 @@
     "config.ts",
     "server-manager.ts",
     "sampling-handler.ts",
+    "elicitation-handler.ts",
     "tool-registrar.ts",
     "tool-result-renderer.ts",
     "resource-tools.ts",
@@ -71,6 +72,7 @@
     "mcp-callback-server.ts",
     "mcp-auth-flow.ts",
     "mcp-panel.ts",
+    "panel-keys.ts",
     "logger.ts",
     "errors.ts",
     "app-bridge.bundle.js",
@@ -93,7 +95,7 @@
     "zod": "^3.25.0 || ^4.0.0"
   },
   "devDependencies": {
-    "@earendil-works/pi-coding-agent": "^0.74.0",
+    "@earendil-works/pi-coding-agent": "^0.79.1",
     "@types/bun": "^1.0.0",
     "@types/node": "^20.0.0",
     "@types/open": "^6.2.1",

package/panel-keys.ts

@@ -0,0 +1,37 @@
+import { matchesKey } from "@earendil-works/pi-tui";
+
+/** The `tui.select.*` keybinding ids the adapter panels resolve. */
+export type PanelSelectKeybinding =
+  | "tui.select.up"
+  | "tui.select.down"
+  | "tui.select.confirm";
+
+/** Structural subset of pi-tui's `KeybindingsManager` (which satisfies it). */
+export interface PanelKeybindings {
+  matches(data: string, keybinding: PanelSelectKeybinding): boolean;
+}
+
+/**
+ * Key matchers for list navigation: user's `tui.select.*` bindings when a
+ * manager is provided, otherwise the previous hardcoded defaults.
+ */
+export interface PanelKeys {
+  selectUp(data: string): boolean;
+  selectDown(data: string): boolean;
+  selectConfirm(data: string): boolean;
+}
+
+export function createPanelKeys(keybindings?: PanelKeybindings): PanelKeys {
+  if (keybindings) {
+    return {
+      selectUp: (data) => keybindings.matches(data, "tui.select.up"),
+      selectDown: (data) => keybindings.matches(data, "tui.select.down"),
+      selectConfirm: (data) => keybindings.matches(data, "tui.select.confirm"),
+    };
+  }
+  return {
+    selectUp: (data) => matchesKey(data, "up"),
+    selectDown: (data) => matchesKey(data, "down"),
+    selectConfirm: (data) => matchesKey(data, "return"),
+  };
+}