pi-mcp-extension 1.9.9 → 1.9.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-mcp-extension",
-  "version": "1.9.9",
+  "version": "1.9.11",
   "description": "MCP (Model Context Protocol) client extension for the Pi coding agent — connect Pi to any MCP server",
   "type": "module",
   "keywords": [
@@ -34,7 +34,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.32.1",
-    "zod": "^3.25.0"
+    "zod": "^4.6.5"
   },
   "peerDependencies": {
     "@earendil-works/pi-ai": "*",
@@ -45,6 +45,7 @@
     "@eslint/js": "^10.0.1",
     "@types/node": "^26.6.5",
     "eslint": "^10.13.0",
+    "fast-check": "^4.10.2",
     "tsx": "^4.19.4",
     "typescript": "^5.7.0",
     "typescript-eslint": "^8.71.2"

package/src/index.ts

@@ -614,14 +614,22 @@ export default async function (pi: ExtensionAPI, paths: { bootstrapCwd?: string;
   }
 
   manager.setToolRefreshCallback(async (serverName, client, options) => {
+    const server = manager.getServer(serverName);
+    const requestTimeoutMs =
+      options?.requestTimeoutMs ??
+      server?.config.requestTimeoutMs ??
+      config.settings.requestTimeoutMs;
     await bridge.refreshTools(
       serverName,
       client,
       () => {
-        const server = manager.getServer(serverName);
-        return server?.client === client && server.state !== "stopped";
+        const current = manager.getServer(serverName);
+        return current?.client === client && current.state !== "stopped";
+      },
+      {
+        ...options,
+        requestTimeoutMs,
       },
-      options,
     );
   });
   manager.setServerStoppedCallback((name) => bridge.deactivateServer(name));

package/src/server-manager.ts

@@ -29,16 +29,10 @@ import { McpError, AuthCancelledError } from "./errors.js";
 import type { McpConfig, ServerConfig, Settings } from "./config.js";
 import { McpOAuthProvider, AuthRequiredError, getAuthStatus, resetAuth, invalidateStoredTokens } from "./oauth-provider.js";
 import { UnauthorizedError, type OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
-import {
-  setClientDefaultOptions,
-  getClientDefaultOptions,
-  type ToolRefreshOptions,
-} from "./tool-bridge.js";
+import type { ToolRefreshOptions } from "./tool-bridge.js";
 import { sanitizeTerminalText, type SanitizeTerminalTextOptions } from "./terminal-text.js";
 
 export {
-  setClientDefaultOptions,
-  getClientDefaultOptions,
   type ToolRefreshOptions,
   AuthCancelledError,
   sanitizeTerminalText,
@@ -99,7 +93,7 @@ export function isOAuthUnauthorizedError(error: unknown, seen = new Set<unknown>
 
   // Reject messages that explicitly report a non-401/403 HTTP status code
   const httpStatusMatch = msg.match(
-    /\b(?:HTTP\s+|status(?:\s+code)?[:\s]+|(?:POSTing|GETting|connecting)\s+to\s+\S+:\s*|(?:Non-200\s+status\s+code\s*\())(\d{3})\b/i,
+    /\b(?:HTTP(?:\/\d(?:\.\d)?)?\s+|status(?:\s+code)?[:\s]+|(?:POSTing|GETting|connecting)\s+to\s+\S+:\s*|(?:Non-200\s+status\s+code\s*\())(\d{3})\b/i,
   );
   if (httpStatusMatch) {
     const status = Number(httpStatusMatch[1]);
@@ -112,18 +106,17 @@ export function isOAuthUnauthorizedError(error: unknown, seen = new Set<unknown>
     // nosemgrep: pi-mcp.no-401-substring -- WHY: intentional message-text fallback after structured checks for SDK paths that only surface text
     /^\s*401\s*$/.test(msg) ||
     // nosemgrep: pi-mcp.no-401-substring -- WHY: intentional message-text fallback after structured checks for SDK paths that only surface text
-    /\bHTTP\s+401\b/i.test(msg) ||
+    /\bHTTP(?:\/\d(?:\.\d)?)?[:\s]+401\b/i.test(msg) ||
     // nosemgrep: pi-mcp.no-401-substring -- WHY: intentional message-text fallback after structured checks for SDK paths that only surface text
     /\bstatus(?:\s+code)?[:\s(]+401\b/i.test(msg) ||
     // nosemgrep: pi-mcp.no-401-substring -- WHY: intentional message-text fallback after structured checks for SDK paths that only surface text
+    /\b(?:POSTing|GETting|connecting)\s+to\s+\S+:\s*401\b/i.test(msg) ||
+    // nosemgrep: pi-mcp.no-401-substring -- WHY: intentional message-text fallback after structured checks for SDK paths that only surface text
     /\breturned\s+401\b/i.test(msg) ||
     // nosemgrep: pi-mcp.no-401-substring -- WHY: intentional message-text fallback after structured checks for SDK paths that only surface text
     /\b401\s+Unauthorized\b/i.test(msg) ||
     // nosemgrep: pi-mcp.no-401-substring -- WHY: intentional message-text fallback after structured checks for SDK paths that only surface text
-    /:\s*401\b/.test(msg) ||
-    // nosemgrep: pi-mcp.no-401-substring -- WHY: intentional message-text fallback after structured checks for SDK paths that only surface text
     /\(401\)/.test(msg) ||
-    /\bUnauthorized\b/i.test(msg) ||
     /\binvalid_token\b/i.test(msg)
   ) {
     return true;
@@ -820,10 +813,6 @@ export class ServerManager {
         if (!signal.aborted && this.onToolRefresh && server.state === "ready" && server.client === client) {
           try {
             const refreshTimeoutMs = this._resolveTimeoutMs(server);
-            setClientDefaultOptions(server.client, {
-              requestTimeoutMs: refreshTimeoutMs,
-              signal,
-            });
             await this.onToolRefresh(server.name, server.client, {
               requestTimeoutMs: refreshTimeoutMs,
               signal,
@@ -860,7 +849,6 @@ export class ServerManager {
         server.childPid = transport.pid;
       }
       // Readiness includes tool discovery, not just the MCP handshake.
-      setClientDefaultOptions(client, { requestTimeoutMs: timeoutMs, signal });
       if (this.onToolRefresh) {
         await this.onToolRefresh(server.name, client, {
           requestTimeoutMs: timeoutMs,

package/src/tool-bridge.ts

@@ -32,26 +32,6 @@ export type ToolRefreshOptions = {
   signal?: AbortSignal | undefined;
 };
 
-// WHY: Store per-client default { requestTimeoutMs, signal } in a WeakMap so 2-argument
-// onToolRefresh callbacks ((name, client) => bridge.refreshTools(name, client)) still
-// inherit the server's configured requestTimeoutMs and handshake AbortSignal.
-const clientRefreshDefaults = new WeakMap<Client, ToolRefreshOptions>();
-
-export function setClientDefaultOptions(client: Client, options: ToolRefreshOptions): void {
-  if (client && typeof client === "object") {
-    clientRefreshDefaults.set(client, options);
-  }
-}
-
-export function getClientDefaultOptions(client: Client): ToolRefreshOptions | undefined {
-  if (client && typeof client === "object") {
-    return clientRefreshDefaults.get(client);
-  }
-  return undefined;
-}
-
-
-
 // ─── Schema Conversion ────────────────────────────────────────────────────────
 
 const KIND_SYMBOL = Symbol.for("TypeBox.Kind");
@@ -785,10 +765,9 @@ export class ToolBridge {
   ): Promise<void> {
     const isCurrent = typeof isCurrentOrOptions === "function" ? isCurrentOrOptions : () => true;
     const options = typeof isCurrentOrOptions === "object" ? isCurrentOrOptions : maybeOptions;
-    const defaults = getClientDefaultOptions(client);
-    const explicitTimeoutMs = options?.requestTimeoutMs ?? defaults?.requestTimeoutMs;
+    const explicitTimeoutMs = options?.requestTimeoutMs;
     const effectiveTimeoutMs = explicitTimeoutMs ?? this.settings.requestTimeoutMs;
-    const effectiveSignal = options?.signal ?? defaults?.signal;
+    const effectiveSignal = options?.signal;
     if (explicitTimeoutMs !== undefined) {
       this.serverTimeouts.set(serverName, explicitTimeoutMs);
     } else {