pi-mcp-extension 1.11.5 → 1.11.6

package/README.md

@@ -163,7 +163,7 @@ For Pi 1.x compatibility, server entries also accept `type` as an alias for `tra
 | `cwd` | `string` | session working directory | Working directory for a `stdio` server (rejected on `streamable-http` / `sse`). A relative path resolves against the session working directory and a leading `~` expands to your home directory |
 | `env` | `Record<string, string>` | — | Extra environment variables for the child process (literal values, no `${VAR}` interpolation) |
 | `url` | `string` | — | Server URL (**required** for `streamable-http` and `sse`) |
-| `headers` | `Record<string, string>` | — | Static headers sent with `streamable-http` and `sse` requests |
+| `headers` | `Record<string, string>` | — | Static headers sent with `streamable-http` and `sse` requests. When `auth` is set, OAuth owns `Authorization`, so an `Authorization` entry here is ignored (other headers still apply) |
 | `auth` (or `oauth`) | `object` | — | OAuth 2.1 configuration described below and in [OAUTH.md](./OAUTH.md) (`streamable-http` / `sse` only) |
 | `lifecycle` | `"eager" \| "lazy"` | `"lazy"` (`"eager"` for `pi.registerMcpServer()` unless `enabled: false`) | `eager` = auto-start on `session_start`, `lazy` = connect on request via `mcp_connect`, `/mcp:start`, or `/mcp:auth` |
 | `enabled` | `boolean` | `true` | Pi 1.3.0 switch: `false` keeps the entry configured but out of the eager set (normalized to `lifecycle: "lazy"`, even when `lifecycle: "eager"` is also set) |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-mcp-extension",
-  "version": "1.11.5",
+  "version": "1.11.6",
   "description": "MCP (Model Context Protocol) client extension for the Pi coding agent — connect Pi to any MCP server",
   "type": "module",
   "keywords": [

package/src/auth-challenge.ts

@@ -20,6 +20,31 @@ export interface ManualAuthChallengeOptions {
   signal?: AbortSignal | undefined;
 }
 
+/**
+ * Drop any `Authorization` header (any casing) from a configured static header set.
+ *
+ * WHY: `Authorization` is the one header an OAuth server owns. The MCP SDK builds it from the
+ * OAuth provider's access token and then spreads `requestInit.headers` on top, so an exact-case
+ * `Authorization` key silently replaces the token, while `authorization` in any other casing
+ * survives as a second entry that `new Headers()` comma-joins into one malformed value. The same
+ * static value would also ride along on the OAuth discovery, registration, and token requests
+ * made through `createHeadersFetch`, leaking a resource-server credential to the authorization
+ * server. Drop it (and only it) whenever OAuth is configured; every other static header
+ * (tenant keys, gateways) still applies.
+ */
+export function stripAuthorizationHeader(
+  headers: Record<string, string> | undefined,
+): Record<string, string> | undefined {
+  if (!headers) return undefined;
+  const kept = Object.entries(headers).filter(([name]) => !isAuthorizationHeader(name));
+  return kept.length > 0 ? Object.fromEntries(kept) : undefined;
+}
+
+/** Case-insensitive test for the single header an OAuth server owns. */
+export function isAuthorizationHeader(name: string): boolean {
+  return name.toLowerCase() === "authorization";
+}
+
 /**
  * Wrap a fetch implementation so configured server headers are attached as
  * defaults on every request (e.g. during SDK OAuth metadata discovery and

package/src/authorize-flow.ts

@@ -9,6 +9,7 @@ import { isSafeAuthorizationUrl } from "./callback-url.js";
 import {
   discoverManualAuthChallenge,
   createHeadersFetch,
+  stripAuthorizationHeader,
   type ManualAuthChallenge,
 } from "./auth-challenge.js";
 import {
@@ -629,16 +630,22 @@ export async function authorize(
     // if empty, which the callback server then rejects as a CSRF error.
     authProvider.setState(oauthState);
 
+    // WHY: `Authorization` belongs to the OAuth flow here. Filter the same set the transport
+    // uses, so this flow's own challenge probe and its SDK `fetchFn` (metadata, registration,
+    // token) never carry a static credential that was configured for the MCP server — the
+    // authorization server is usually a different origin.
+    const staticHeaders = stripAuthorizationHeader(config.headers);
+
     const authChallenge = await discoverChallengeWithFallback({
       serverName,
       serverUrl,
-      headers: config.headers,
+      headers: staticHeaders,
       signal,
     });
     assertActive();
 
     const callbackPromise = registerCallbackPromise(callbackServer, oauthState);
-    const customFetch = config.headers ? createHeadersFetch(config.headers) : undefined;
+    const customFetch = staticHeaders ? createHeadersFetch(staticHeaders) : undefined;
 
     const authResult = await runInitialSdkAuth(
       authProvider,

package/src/config.ts

@@ -187,7 +187,9 @@ export const ServerConfigSchema = z.preprocess(
       /**
        * Static HTTP headers to include with every request (streamable-http / sse only).
        * Useful for API-key-based auth (e.g. { "Authorization": "Bearer <key>" }).
-       * For OAuth2, use the "auth" field instead.
+       * For OAuth2, use the "auth" field instead: when "auth" is set, OAuth owns the
+       * Authorization header and any Authorization entry here is ignored (other headers
+       * still apply).
        */
       headers: z.record(z.string(), z.string()).optional(),
       /**

package/src/transport-factory.ts

@@ -16,6 +16,8 @@ import type { OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.
 import { McpError } from "./errors.js";
 import type { ServerConfig } from "./config.js";
 import { McpOAuthProvider } from "./oauth-provider.js";
+import { isAuthorizationHeader, stripAuthorizationHeader } from "./auth-challenge.js";
+import { reportDiagnostic } from "./debug-log.js";
 import { createLineSplitter } from "./stdio-process.js";
 import { sanitizeTerminalText } from "./terminal-text.js";
 
@@ -32,9 +34,9 @@ function resolveEnv(extra?: Record<string, string>): Record<string, string> {
   return env;
 }
 
-function createRequestInit(config: ServerConfig): RequestInit | undefined {
+function createRequestInit(headers: Record<string, string> | undefined): RequestInit | undefined {
   // Build requestInit for static headers (API keys, etc.)
-  return config.headers ? { headers: config.headers } : undefined;
+  return headers ? { headers } : undefined;
 }
 
 function createOAuthProvider(
@@ -188,7 +190,18 @@ export function createTransport(
 ): Transport {
   const cwd = typeof cwdOrOnStderr === "string" ? cwdOrOnStderr : cwdArg;
   const onStderr = typeof cwdOrOnStderr === "function" ? cwdOrOnStderr : undefined;
-  const requestInit = createRequestInit(config);
+  // WHY: with OAuth configured the SDK owns `Authorization` (see stripAuthorizationHeader);
+  // a leftover static header is a migration artifact, so drop it and record that we did.
+  const staticHeaders = config.auth ? stripAuthorizationHeader(config.headers) : config.headers;
+  if (config.auth && config.headers && Object.keys(config.headers).some(isAuthorizationHeader)) {
+    reportDiagnostic({
+      level: "info",
+      event: "config.static_authorization_ignored",
+      server: serverName,
+      message: `Ignoring the static Authorization header for "${serverName}": OAuth is configured, so requests carry the OAuth access token instead.`,
+    });
+  }
+  const requestInit = createRequestInit(staticHeaders);
   const authProvider = createOAuthProvider(serverName, config, storageDir);
 
   switch (config.transport) {