pi-mcp-extension 1.7.1 → 1.7.2

package/README.md

@@ -63,7 +63,7 @@ Config files are loaded from two locations. **Project config overrides global co
 
 | Location | Scope |
 |---|---|
-| `~/.pi/agent/mcp.json` | Global — applies to all projects |
+| `~/.pi/agent/mcp.json` | Global — applies to all projects (honors `$PI_CODING_AGENT_DIR` when set: `<agent dir>/mcp.json`) |
 | `.pi/mcp.json` | Project — overrides global per-server |
 
 ### Full Example

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-mcp-extension",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "description": "MCP (Model Context Protocol) client extension for the Pi coding agent — connect Pi to any MCP server",
   "type": "module",
   "keywords": [

package/src/callback-server.ts

@@ -193,7 +193,11 @@ export function callbackServerConfigFromRedirectUrl(redirectUrl?: string): Callb
     throw new Error(`Local OAuth redirect URL must use path ${CALLBACK_PATH}`);
   }
 
-  const preferredPort = Number(url.port || "80");
+  if (!url.port) {
+    throw new Error("Manual OAuth redirect URL must include an explicit port (e.g. http://127.0.0.1:19876/callback)");
+  }
+
+  const preferredPort = Number(url.port);
   if (preferredPort === 0) {
     throw new Error("Manual OAuth redirect URL must use a fixed non-zero port");
   }

package/src/index.ts

@@ -418,9 +418,12 @@ export default async function (pi: ExtensionAPI, paths: { bootstrapCwd?: string;
           () => signal.aborted,
         );
 
-        // Set the state before auth() builds the authorization URL.
+        // Why set state before calling auth(): the SDK reads provider.state() while
+        // building the authorization URL inside auth(), and omits the state parameter
+        // if empty, which the callback server then rejects as a CSRF error.
         authProvider.setState(oauthState);
 
+        // 4. Discover protected-resource challenge metadata from the server.
         const authChallenge: ManualAuthChallenge = await discoverManualAuthChallenge(config.url, {
           headers: config.headers,
         }).catch((): ManualAuthChallenge => {
@@ -430,7 +433,7 @@ export default async function (pi: ExtensionAPI, paths: { bootstrapCwd?: string;
           return {};
         });
 
-        // Register the callback immediately before auth() can open the browser.
+        // 5. Register the callback immediately before auth() can open the browser.
         // Attach a catch handler so cancellation after immediate authorization
         // does not produce an unhandled rejection.
         const callbackPromise = waitForCallback(oauthState);
@@ -448,7 +451,11 @@ export default async function (pi: ExtensionAPI, paths: { bootstrapCwd?: string;
           authOptions.scope = authChallenge.scope;
         }
 
-        // Start the auth flow. REDIRECT means browser interaction is required.
+        // 6. Start the auth flow.
+        // Why branch on the return value: the SDK auth() call returns "AUTHORIZED" when
+        // stored or refreshed tokens already succeeded without opening a browser, or
+        // "REDIRECT" after invoking redirectToAuthorization(), in which case we must
+        // wait for the callback code and call auth() a second time with authorizationCode.
         const authResult = await auth(authProvider, authOptions);
         if (signal.aborted) throw new AuthCancelledError(serverName);
 
@@ -462,7 +469,7 @@ export default async function (pi: ExtensionAPI, paths: { bootstrapCwd?: string;
             "info",
           );
 
-          // 6. Wait for the callback while giving the user an escape hatch.
+          // 7. Wait for the callback while giving the user an escape hatch.
           const code = await waitForOAuthCallback(
             serverName,
             callbackPromise,
@@ -483,7 +490,7 @@ export default async function (pi: ExtensionAPI, paths: { bootstrapCwd?: string;
             `pi-mcp: Authorization callback received for ${serverName}. Exchanging token...`,
             "info",
           );
-          // 7. Complete the OAuth flow with the authorization code
+          // 8. Complete the OAuth flow with the authorization code
           const finishAuthOptions: {
             serverUrl: string;
             authorizationCode: string;

package/src/oauth-provider.ts

@@ -405,7 +405,12 @@ export async function getAuthStatus(serverName: string, storageDir?: string): Pr
  * Used to force re-authorization on next connection.
  */
 export async function resetAuth(serverName: string, storageDir?: string): Promise<void> {
-  await unlink(statePath(serverName, storageDir)).catch(() => {});
+  try {
+    await unlink(statePath(serverName, storageDir));
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code === "ENOENT") return;
+    throw err;
+  }
 }
 
 export class AuthRequiredError extends Error {

package/src/server-manager.ts

@@ -25,7 +25,16 @@ import {
 import { McpError } from "./errors.js";
 import type { McpConfig, ServerConfig, Settings } from "./config.js";
 import { McpOAuthProvider, AuthRequiredError, getAuthStatus, resetAuth } from "./oauth-provider.js";
-import type { OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
+import { UnauthorizedError, type OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
+
+export function isOAuthUnauthorizedError(error: unknown): boolean {
+  return (
+    error instanceof AuthRequiredError ||
+    error instanceof UnauthorizedError ||
+    (typeof (error as { code?: unknown })?.code === "number" && (error as { code: number }).code === 401) ||
+    /\b(401|Unauthorized)\b/i.test(error instanceof Error ? error.message : String(error))
+  );
+}
 
 // ─── Types ────────────────────────────────────────────────────────────────────
 
@@ -356,7 +365,7 @@ export class ServerManager {
     try {
       await client.connect(transport);
       if (signal.aborted) throw new Error("Connection cancelled");
-      if (server.config.transport === "stdio") server.childPid = (transport as any).process?.pid ?? null;
+      server.childPid = transport instanceof StdioClientTransport ? transport.pid : null;
       // Readiness includes tool discovery, not just the MCP handshake.
       if (this.onToolRefresh) await this.onToolRefresh(server.name, client);
       if (signal.aborted) throw new Error("Connection cancelled");
@@ -388,10 +397,16 @@ export class ServerManager {
       if (signal.aborted) throw new Error("Connection cancelled");
       const error = err instanceof Error ? err : new Error(String(err));
       server.lastError = error;
-      if (error instanceof AuthRequiredError || error instanceof McpError && error.code === "protocol") {
+      if (error instanceof AuthRequiredError || (error instanceof McpError && error.code === "protocol")) {
         server.state = "stopped";
         throw error;
       }
+      if (Boolean(server.config.auth) && server.config.transport !== "stdio" && isOAuthUnauthorizedError(error)) {
+        const authError = new AuthRequiredError(server.name);
+        server.lastError = authError;
+        server.state = "stopped";
+        throw authError;
+      }
       if (server.retryCount >= this.settings.maxRetries) {
         server.state = "stopped";
         throw new McpError(`Connection failed after ${server.retryCount} retries: ${error.message}`, server.name, "connection", err);