dostuff 0.2.1__tar.gz → 0.2.2__tar.gz

{dostuff-0.2.1 → dostuff-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dostuff
-Version: 0.2.1
+Version: 0.2.2
 Summary: DoStuff - a terminal coding agent for any LLM: TUI and headless mode, permissions, MCP, skills, web tools, sessions and git worktrees
 Author-email: Varun Kumawat <varunkumawatleap2@gmail.com>
 License-Expression: MIT
@@ -32,6 +32,7 @@ Requires-Dist: opentelemetry-api>=1.20
 Requires-Dist: opentelemetry-sdk>=1.20
 Requires-Dist: textual>=0.50.0
 Requires-Dist: opentelemetry-exporter-otlp-proto-grpc>=1.20
+Requires-Dist: keyring>=24
 Provides-Extra: memory
 Requires-Dist: chromadb>=1.5.0; extra == "memory"
 Provides-Extra: search
@@ -40,8 +41,6 @@ Provides-Extra: full
 Requires-Dist: dostuff[memory,search]; extra == "full"
 Requires-Dist: onnxruntime>=1.16; extra == "full"
 Requires-Dist: grpcio>=1.52; extra == "full"
-Provides-Extra: keyring
-Requires-Dist: keyring>=24; extra == "keyring"
 Provides-Extra: dev
 Requires-Dist: pytest>=8; extra == "dev"
 Requires-Dist: mypy>=1.10; extra == "dev"
@@ -110,15 +109,19 @@ pip install dostuff
 
 This installs the `dostuff` command on your `PATH`. Done.
 
-Long-term memory (the agent remembers facts and past decisions across sessions) needs ChromaDB,
-a large download, so it's an extra:
+Optional features come as extras:
 
-```bash
-pip install "dostuff[memory]"
-```
+| Install | Adds |
+|---|---|
+| `pip install dostuff` | Everything except the extras below, including MCP (with OAuth tokens kept in the OS keyring) |
+| `pip install "dostuff[memory]"` | Long-term memory (facts and past decisions across sessions) and semantic MCP tool search, via ChromaDB. Large download |
+| `pip install "dostuff[search]"` | Steadier `web_search` through the `ddgs` package (several engines) instead of DuckDuckGo's HTML page |
+| `pip install "dostuff[full]"` | `memory` + `search` |
+| `pip install "dostuff[dev]"` | `pytest` and `mypy`, for working on dostuff itself |
 
-Without it everything else works: the memory tools are hidden from the model and MCP tool search
-matches keywords instead of meaning. `dostuff doctor` shows whether memory is on.
+Extras combine, e.g. `pip install "dostuff[memory,search]"`. Without `memory` everything else
+works: the memory tools are hidden from the model and MCP tool search matches keywords instead of
+meaning. `dostuff doctor` shows whether memory is on.
 
 ### Other install methods
 
@@ -126,6 +129,7 @@ For an isolated install with [pipx](https://pypa.github.io/pipx/):
 
 ```bash
 pipx install dostuff
+pipx install "dostuff[full]"   # with extras
 ```
 
 For development (editable mode, from a clone):
@@ -135,8 +139,8 @@ git clone https://github.com/kVarunkk/DoStuff.git
 cd DoStuff
 pip install -e .           # core
 pip install -e ".[memory]" # + long-term memory (chromadb)
-pip install -e ".[full]"   # + memory + onnxruntime + grpcio
-pip install -e ".[keyring]" # persist MCP OAuth tokens in the OS keyring
+pip install -e ".[search]" # + ddgs web search
+pip install -e ".[full]"   # + memory + search
 pip install -e ".[dev]"    # + pytest + mypy
 
 python -m pytest -q tests
@@ -462,7 +466,7 @@ MCP servers connect concurrently in the background, so the TUI never blanks duri
 
 MCP tools are named `<server>__<tool>` (e.g. `github__create_issue`), so two servers can expose a tool with the same name. `search_mcp_tools` only returns tools of servers that are connected right now.
 
-**OAuth (HTTP servers):** a browser login opens when the server answers 401. The flow uses PKCE, a random `state` and an RFC 8707 `resource` indicator; the local callback on port 8085 times out after 120 s. Tokens are kept in memory, or in the OS keyring if you install `dostuff[keyring]`, never in a plain file. A tool call that fails with 401 re-authenticates once and retries.
+**OAuth (HTTP servers):** a browser login opens when the server answers 401. The flow uses PKCE, a random `state` and an RFC 8707 `resource` indicator; the local callback on port 8085 times out after 120 s. Tokens are stored in the OS keyring (memory only if no keyring backend is available), never in a plain file. Expired access tokens are refreshed with the refresh token, before a request or after a 401, without opening the browser; you sign in again only when the refresh token itself is rejected.
 
 To force a re-registration, delete:
 

{dostuff-0.2.1 → dostuff-0.2.2}/README.md

@@ -61,15 +61,19 @@ pip install dostuff
 
 This installs the `dostuff` command on your `PATH`. Done.
 
-Long-term memory (the agent remembers facts and past decisions across sessions) needs ChromaDB,
-a large download, so it's an extra:
+Optional features come as extras:
 
-```bash
-pip install "dostuff[memory]"
-```
+| Install | Adds |
+|---|---|
+| `pip install dostuff` | Everything except the extras below, including MCP (with OAuth tokens kept in the OS keyring) |
+| `pip install "dostuff[memory]"` | Long-term memory (facts and past decisions across sessions) and semantic MCP tool search, via ChromaDB. Large download |
+| `pip install "dostuff[search]"` | Steadier `web_search` through the `ddgs` package (several engines) instead of DuckDuckGo's HTML page |
+| `pip install "dostuff[full]"` | `memory` + `search` |
+| `pip install "dostuff[dev]"` | `pytest` and `mypy`, for working on dostuff itself |
 
-Without it everything else works: the memory tools are hidden from the model and MCP tool search
-matches keywords instead of meaning. `dostuff doctor` shows whether memory is on.
+Extras combine, e.g. `pip install "dostuff[memory,search]"`. Without `memory` everything else
+works: the memory tools are hidden from the model and MCP tool search matches keywords instead of
+meaning. `dostuff doctor` shows whether memory is on.
 
 ### Other install methods
 
@@ -77,6 +81,7 @@ For an isolated install with [pipx](https://pypa.github.io/pipx/):
 
 ```bash
 pipx install dostuff
+pipx install "dostuff[full]"   # with extras
 ```
 
 For development (editable mode, from a clone):
@@ -86,8 +91,8 @@ git clone https://github.com/kVarunkk/DoStuff.git
 cd DoStuff
 pip install -e .           # core
 pip install -e ".[memory]" # + long-term memory (chromadb)
-pip install -e ".[full]"   # + memory + onnxruntime + grpcio
-pip install -e ".[keyring]" # persist MCP OAuth tokens in the OS keyring
+pip install -e ".[search]" # + ddgs web search
+pip install -e ".[full]"   # + memory + search
 pip install -e ".[dev]"    # + pytest + mypy
 
 python -m pytest -q tests
@@ -413,7 +418,7 @@ MCP servers connect concurrently in the background, so the TUI never blanks duri
 
 MCP tools are named `<server>__<tool>` (e.g. `github__create_issue`), so two servers can expose a tool with the same name. `search_mcp_tools` only returns tools of servers that are connected right now.
 
-**OAuth (HTTP servers):** a browser login opens when the server answers 401. The flow uses PKCE, a random `state` and an RFC 8707 `resource` indicator; the local callback on port 8085 times out after 120 s. Tokens are kept in memory, or in the OS keyring if you install `dostuff[keyring]`, never in a plain file. A tool call that fails with 401 re-authenticates once and retries.
+**OAuth (HTTP servers):** a browser login opens when the server answers 401. The flow uses PKCE, a random `state` and an RFC 8707 `resource` indicator; the local callback on port 8085 times out after 120 s. Tokens are stored in the OS keyring (memory only if no keyring backend is available), never in a plain file. Expired access tokens are refreshed with the refresh token, before a request or after a 401, without opening the browser; you sign in again only when the refresh token itself is rejected.
 
 To force a re-registration, delete:
 

dostuff-0.2.2/dostuff/helpers/mcp/token_store.py

@@ -0,0 +1,81 @@
+"""OAuth token persistence in the OS keyring.
+
+If `keyring` can't be imported or has no usable backend, tokens live in memory only; they are
+never written to a plaintext file.
+
+Windows Credential Manager caps a secret at 2560 bytes (1280 UTF-16 chars) and JWT access plus
+refresh tokens easily exceed that, so long values are split across `<url>#<i>` entries and the
+main entry holds `chunks:<n>`.
+"""
+import json
+from typing import Any
+
+SERVICE = "dostuff-mcp"
+CHUNK_CHARS = 1000
+_CHUNK_PREFIX = "chunks:"
+
+try:
+    import keyring as _keyring
+except ImportError:  # a required dependency, but don't crash a broken install
+    _keyring = None  # type: ignore[assignment]
+
+
+def keyring_available() -> bool:
+    return _keyring is not None
+
+
+def _chunk_count(head: str | None) -> int:
+    if head and head.startswith(_CHUNK_PREFIX):
+        try:
+            return int(head[len(_CHUNK_PREFIX):])
+        except ValueError:
+            return 0
+    return 0
+
+
+def load_token(server_url: str) -> dict[str, Any] | None:
+    if _keyring is None:
+        return None
+    try:
+        raw = _keyring.get_password(SERVICE, server_url)
+        if n := _chunk_count(raw):
+            parts = [_keyring.get_password(SERVICE, f"{server_url}#{i}") for i in range(n)]
+            chunks = [p for p in parts if p is not None]
+            raw = "".join(chunks) if len(chunks) == n else None
+        data = json.loads(raw) if raw else None
+    except Exception:
+        return None
+    return data if isinstance(data, dict) and data.get("access_token") else None
+
+
+def save_token(server_url: str, token: dict[str, Any]) -> bool:
+    """True when the token reached the keyring."""
+    if _keyring is None:
+        return False
+    raw = json.dumps(token)
+    try:
+        delete_token(server_url)
+        if len(raw) <= CHUNK_CHARS:
+            _keyring.set_password(SERVICE, server_url, raw)
+            return True
+        parts = [raw[i:i + CHUNK_CHARS] for i in range(0, len(raw), CHUNK_CHARS)]
+        for i, part in enumerate(parts):
+            _keyring.set_password(SERVICE, f"{server_url}#{i}", part)
+        _keyring.set_password(SERVICE, server_url, f"{_CHUNK_PREFIX}{len(parts)}")  # last: marks it complete
+        return True
+    except Exception:
+        return False  # no usable keyring backend; keep the in-memory token
+
+
+def delete_token(server_url: str) -> None:
+    if _keyring is None:
+        return
+    try:
+        n = _chunk_count(_keyring.get_password(SERVICE, server_url))
+    except Exception:
+        n = 0
+    for name in [server_url, *(f"{server_url}#{i}" for i in range(n))]:
+        try:
+            _keyring.delete_password(SERVICE, name)
+        except Exception:
+            pass

{dostuff-0.2.1 → dostuff-0.2.2}/dostuff/lib/mcp/mcp_client.py

@@ -46,12 +46,35 @@ class _ServerConnection:
         self.stop = asyncio.Event()
 
 
+class _OAuthBearer(httpx2.Auth):
+    """Puts a current access token on every request and refreshes it (no browser) when it is
+    about to expire or the server answers 401, so a session outlives its first token."""
+
+    def __init__(self, client: "MCPClient", server_name: str, url: str) -> None:
+        self._client = client
+        self._server_name = server_name
+        self._url = url
+
+    async def async_auth_flow(self, request):
+        token = await self._client._valid_token(self._server_name, self._url)
+        if token:
+            request.headers["Authorization"] = f"Bearer {token}"
+        response = yield request
+        if response.status_code == 401:
+            fresh = await self._client._refresh(self._server_name, self._url, rejected=token)
+            if fresh:
+                request.headers["Authorization"] = f"Bearer {fresh}"
+                yield request
+
+
 class MCPClient:
     def __init__(self, registration_store: MCPClientRegistrationStore, tool_registry_store: MCPToolRegistryStore | None):
         self.servers: dict[str, ClientSession] = {}
         # server__tool -> {"server_name", "tool_name", "schema"}
         self.mcp_tools: dict[str, dict[str, Any]] = {}
         self._tokens: dict[str, dict] = {}
+        self._refresh_locks: dict[str, asyncio.Lock] = {}
+        self._warned_unsaved = False
         self.server_meta: dict[str, dict] = {}
         self._connections: dict[str, _ServerConnection] = {}
         self.registration_store = registration_store
@@ -86,20 +109,19 @@ class MCPClient:
             "args": args,
             "env": env,
         }
+        auth: _OAuthBearer | None = None
         if transport in HTTP_TRANSPORTS or url:
             if not url:
                 raise ValueError(f"Server '{server_name}' requires a 'url' for transport '{transport}'.")
-            if "Authorization" not in req_headers:
-                token = await self._get_or_refresh_token(server_name, url)
-                if token:
-                    req_headers["Authorization"] = f"Bearer {token}"
+            if "Authorization" not in req_headers and await self._get_or_refresh_token(server_name, url):
+                auth = _OAuthBearer(self, server_name, url)
         elif not command:
             raise ValueError(f"Server '{server_name}' requires a 'command' for stdio transport.")
 
         conn = _ServerConnection()
         ready: asyncio.Future[ClientSession] = asyncio.get_running_loop().create_future()
         conn.task = asyncio.create_task(
-            self._serve(server_name, transport, url, req_headers, command, args, env, ready, conn.stop),
+            self._serve(server_name, transport, url, req_headers, auth, command, args, env, ready, conn.stop),
             name=f"mcp:{server_name}",
         )
         self._connections[server_name] = conn
@@ -133,17 +155,17 @@ class MCPClient:
                 },
             }
 
-    async def _serve(self, server_name, transport, url, req_headers, command, args, env, ready: asyncio.Future, stop: asyncio.Event) -> None:
+    async def _serve(self, server_name, transport, url, req_headers, auth, command, args, env, ready: asyncio.Future, stop: asyncio.Event) -> None:
         """Owns one server's transports: opens them, hands back the session, closes on stop."""
         try:
             async with AsyncExitStack() as stack:
                 if transport in HTTP_TRANSPORTS or url:
                     if transport in ("http", "streamable-http"):
-                        http_client = await stack.enter_async_context(httpx2.AsyncClient(headers=req_headers, timeout=timeout, event_hooks={"response": [self._log_response]}))
+                        http_client = await stack.enter_async_context(httpx2.AsyncClient(headers=req_headers, auth=auth, timeout=timeout, event_hooks={"response": [self._log_response]}))
                         self.server_meta[server_name]["http_client"] = http_client
                         read, write, *_ = await stack.enter_async_context(streamable_http_client(url=url, http_client=http_client))
                     else:
-                        read, write = await stack.enter_async_context(sse_client(url=url, headers=req_headers))
+                        read, write = await stack.enter_async_context(sse_client(url=url, headers=req_headers, auth=auth))
                 else:
                     merged_env = os.environ.copy()
                     if env:
@@ -188,12 +210,15 @@ class MCPClient:
             await asyncio.gather(conn.task, return_exceptions=True)
 
     async def reauthenticate(self, server_name: str) -> None:
-        """Drop the cached token and reconnect (runs the OAuth flow again if needed)."""
+        """Reconnect with a new token: refreshed while the refresh token still works, otherwise
+        the cached token is dropped and the OAuth flow runs again."""
         meta = self.server_meta.get(server_name, {})
         url = meta.get("url")
-        self._tokens.pop(server_name, None)
         if url:
-            token_store.delete_token(url)
+            cached = self._cached_token(server_name, url)
+            if await self._refresh(server_name, url, rejected=cached["access_token"] if cached else None) is None:
+                self._tokens.pop(server_name, None)
+                token_store.delete_token(url)
         headers = dict(meta.get("headers") or {})
         headers.pop("Authorization", None)
         await self.connect_to_server(
@@ -209,30 +234,9 @@ class MCPClient:
     async def _get_or_refresh_token(self, server_name: str, url: str) -> str | None:
         """Cached (memory, then keyring) token, refreshed if expired; else probe the server and
         run the OAuth flow when it answers 401."""
-        cached = self._tokens.get(server_name) or token_store.load_token(url)
-
-        if cached:
-            if time.time() < cached["expires_at"] - 60:  # 60s safety margin
-                self._tokens[server_name] = cached
-                return cached["access_token"]
-            if cached.get("refresh_token"):
-                # A confidential client (e.g. Supabase) refreshes with the secret from its registration
-                registration = await self.registration_store.get(server_name) or {}
-                same_client = registration.get("client_id") == cached.get("client_id")
-                try:
-                    token_data = await refresh_access_token(
-                        cached["token_endpoint"], cached["refresh_token"],
-                        client_id=cached.get("client_id"), resource=cached.get("resource"),
-                        client_secret=registration.get("client_secret") if same_client else None,
-                        auth_method=registration.get("token_endpoint_auth_method") if same_client else None,
-                    )
-                    token_data.setdefault("refresh_token", cached["refresh_token"])
-                    token_data["client_id"] = cached.get("client_id")
-                    token_data["resource"] = cached.get("resource")
-                    self._store_token(server_name, url, cached["token_endpoint"], token_data)
-                    return token_data["access_token"]
-                except httpx.HTTPError:
-                    pass  # refresh token expired/revoked: fall through to a fresh flow
+        token = await self._valid_token(server_name, url)
+        if token:
+            return token
 
         try:
             async with httpx.AsyncClient() as probe_client:
@@ -249,6 +253,52 @@ class MCPClient:
             return token_data["access_token"]
         return None
 
+    def _cached_token(self, server_name: str, url: str) -> dict | None:
+        cached = self._tokens.get(server_name) or token_store.load_token(url)
+        if cached:
+            self._tokens[server_name] = cached
+        return cached
+
+    async def _valid_token(self, server_name: str, url: str) -> str | None:
+        """The cached access token, refreshed if it is about to expire. Never opens a browser."""
+        cached = self._cached_token(server_name, url)
+        if cached is None:
+            return None
+        if time.time() < cached["expires_at"] - 60:  # 60s safety margin
+            return cached["access_token"]
+        return await self._refresh(server_name, url, rejected=cached["access_token"])
+
+    async def _refresh(self, server_name: str, url: str, rejected: str | None) -> str | None:
+        """Trade the refresh token for a new access token; None when there is none or the server
+        refuses it. `rejected` is the token that just failed: if a concurrent request already
+        replaced it, the newer one is returned instead of refreshing twice."""
+        async with self._refresh_locks.setdefault(server_name, asyncio.Lock()):
+            cached = self._cached_token(server_name, url)
+            if cached is None:
+                return None
+            if cached["access_token"] != rejected and time.time() < cached["expires_at"] - 60:
+                return cached["access_token"]
+            if not cached.get("refresh_token"):
+                return None
+            # A confidential client (e.g. Supabase) refreshes with the secret from its registration
+            registration = await self.registration_store.get(server_name) or {}
+            same_client = registration.get("client_id") == cached.get("client_id")
+            try:
+                token_data = await refresh_access_token(
+                    cached["token_endpoint"], cached["refresh_token"],
+                    client_id=cached.get("client_id"), resource=cached.get("resource"),
+                    client_secret=registration.get("client_secret") if same_client else None,
+                    auth_method=registration.get("token_endpoint_auth_method") if same_client else None,
+                )
+                access_token = token_data["access_token"]
+            except (httpx.HTTPError, KeyError, ValueError):
+                return None  # refresh token expired/revoked
+            token_data.setdefault("refresh_token", cached["refresh_token"])
+            token_data["client_id"] = cached.get("client_id")
+            token_data["resource"] = cached.get("resource")
+            self._store_token(server_name, url, cached["token_endpoint"], token_data)
+            return access_token
+
     def _store_token(self, server_name: str, url: str, token_endpoint: str, token_data: dict) -> None:
         token = {
             "access_token": token_data["access_token"],
@@ -259,7 +309,11 @@ class MCPClient:
             "resource": token_data.get("resource"),
         }
         self._tokens[server_name] = token
-        token_store.save_token(url, token)
+        if not token_store.save_token(url, token) and not self._warned_unsaved:
+            self._warned_unsaved = True
+            from dostuff.helpers.ui.emit import emit
+            why = "the OS keyring refused it" if token_store.keyring_available() else "`keyring` isn't importable; reinstall dostuff"
+            emit(f"MCP sign-in for '{server_name}' is kept in memory only ({why}); you will sign in again next start.", msg_type="system")
 
     async def cleanup(self) -> None:
         """Close every server connection (each in the task that opened it)."""

{dostuff-0.2.1 → dostuff-0.2.2}/dostuff.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dostuff
-Version: 0.2.1
+Version: 0.2.2
 Summary: DoStuff - a terminal coding agent for any LLM: TUI and headless mode, permissions, MCP, skills, web tools, sessions and git worktrees
 Author-email: Varun Kumawat <varunkumawatleap2@gmail.com>
 License-Expression: MIT
@@ -32,6 +32,7 @@ Requires-Dist: opentelemetry-api>=1.20
 Requires-Dist: opentelemetry-sdk>=1.20
 Requires-Dist: textual>=0.50.0
 Requires-Dist: opentelemetry-exporter-otlp-proto-grpc>=1.20
+Requires-Dist: keyring>=24
 Provides-Extra: memory
 Requires-Dist: chromadb>=1.5.0; extra == "memory"
 Provides-Extra: search
@@ -40,8 +41,6 @@ Provides-Extra: full
 Requires-Dist: dostuff[memory,search]; extra == "full"
 Requires-Dist: onnxruntime>=1.16; extra == "full"
 Requires-Dist: grpcio>=1.52; extra == "full"
-Provides-Extra: keyring
-Requires-Dist: keyring>=24; extra == "keyring"
 Provides-Extra: dev
 Requires-Dist: pytest>=8; extra == "dev"
 Requires-Dist: mypy>=1.10; extra == "dev"
@@ -110,15 +109,19 @@ pip install dostuff
 
 This installs the `dostuff` command on your `PATH`. Done.
 
-Long-term memory (the agent remembers facts and past decisions across sessions) needs ChromaDB,
-a large download, so it's an extra:
+Optional features come as extras:
 
-```bash
-pip install "dostuff[memory]"
-```
+| Install | Adds |
+|---|---|
+| `pip install dostuff` | Everything except the extras below, including MCP (with OAuth tokens kept in the OS keyring) |
+| `pip install "dostuff[memory]"` | Long-term memory (facts and past decisions across sessions) and semantic MCP tool search, via ChromaDB. Large download |
+| `pip install "dostuff[search]"` | Steadier `web_search` through the `ddgs` package (several engines) instead of DuckDuckGo's HTML page |
+| `pip install "dostuff[full]"` | `memory` + `search` |
+| `pip install "dostuff[dev]"` | `pytest` and `mypy`, for working on dostuff itself |
 
-Without it everything else works: the memory tools are hidden from the model and MCP tool search
-matches keywords instead of meaning. `dostuff doctor` shows whether memory is on.
+Extras combine, e.g. `pip install "dostuff[memory,search]"`. Without `memory` everything else
+works: the memory tools are hidden from the model and MCP tool search matches keywords instead of
+meaning. `dostuff doctor` shows whether memory is on.
 
 ### Other install methods
 
@@ -126,6 +129,7 @@ For an isolated install with [pipx](https://pypa.github.io/pipx/):
 
 ```bash
 pipx install dostuff
+pipx install "dostuff[full]"   # with extras
 ```
 
 For development (editable mode, from a clone):
@@ -135,8 +139,8 @@ git clone https://github.com/kVarunkk/DoStuff.git
 cd DoStuff
 pip install -e .           # core
 pip install -e ".[memory]" # + long-term memory (chromadb)
-pip install -e ".[full]"   # + memory + onnxruntime + grpcio
-pip install -e ".[keyring]" # persist MCP OAuth tokens in the OS keyring
+pip install -e ".[search]" # + ddgs web search
+pip install -e ".[full]"   # + memory + search
 pip install -e ".[dev]"    # + pytest + mypy
 
 python -m pytest -q tests
@@ -462,7 +466,7 @@ MCP servers connect concurrently in the background, so the TUI never blanks duri
 
 MCP tools are named `<server>__<tool>` (e.g. `github__create_issue`), so two servers can expose a tool with the same name. `search_mcp_tools` only returns tools of servers that are connected right now.
 
-**OAuth (HTTP servers):** a browser login opens when the server answers 401. The flow uses PKCE, a random `state` and an RFC 8707 `resource` indicator; the local callback on port 8085 times out after 120 s. Tokens are kept in memory, or in the OS keyring if you install `dostuff[keyring]`, never in a plain file. A tool call that fails with 401 re-authenticates once and retries.
+**OAuth (HTTP servers):** a browser login opens when the server answers 401. The flow uses PKCE, a random `state` and an RFC 8707 `resource` indicator; the local callback on port 8085 times out after 120 s. Tokens are stored in the OS keyring (memory only if no keyring backend is available), never in a plain file. Expired access tokens are refreshed with the refresh token, before a request or after a 401, without opening the browser; you sign in again only when the refresh token itself is rejected.
 
 To force a re-registration, delete:
 

{dostuff-0.2.1 → dostuff-0.2.2}/dostuff.egg-info/requires.txt

@@ -12,6 +12,7 @@ opentelemetry-api>=1.20
 opentelemetry-sdk>=1.20
 textual>=0.50.0
 opentelemetry-exporter-otlp-proto-grpc>=1.20
+keyring>=24
 
 [dev]
 pytest>=8
@@ -22,9 +23,6 @@ dostuff[memory,search]
 onnxruntime>=1.16
 grpcio>=1.52
 
-[keyring]
-keyring>=24
-
 [memory]
 chromadb>=1.5.0
 

{dostuff-0.2.1 → dostuff-0.2.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "dostuff"
-version = "0.2.1"
+version = "0.2.2"
 description = "DoStuff - a terminal coding agent for any LLM: TUI and headless mode, permissions, MCP, skills, web tools, sessions and git worktrees"
 readme = "README.md"
 license = "MIT"
@@ -38,6 +38,8 @@ dependencies = [
     "opentelemetry-sdk>=1.20",
     "textual>=0.50.0",
     "opentelemetry-exporter-otlp-proto-grpc>=1.20",
+    # MCP OAuth tokens persist in the OS keyring; without it every start opens the browser
+    "keyring>=24",
 ]
 
 [project.urls]
@@ -63,10 +65,6 @@ full = [
     "onnxruntime>=1.16",
     "grpcio>=1.52",
 ]
-# Persist MCP OAuth tokens in the OS keyring (otherwise they live in memory only)
-keyring = [
-    "keyring>=24",
-]
 dev = [
     "pytest>=8",
     "mypy>=1.10",

{dostuff-0.2.1 → dostuff-0.2.2}/tests/test_mcp_oauth.py

@@ -2,13 +2,17 @@
 import asyncio
 import base64
 import json
+import time
 import urllib.parse
 
 import httpx
+import httpx2
 import pytest
 
-from dostuff.helpers.mcp import mcp_oauth
+from dostuff.helpers.mcp import mcp_oauth, token_store
 from dostuff.helpers.mcp.mcp_oauth import OAuthError, authenticate_via_oauth, refresh_access_token, with_client_auth
+from dostuff.lib.mcp import mcp_client as mcp_client_mod
+from dostuff.lib.mcp.mcp_client import MCPClient, _OAuthBearer
 from dostuff.lib.mcp.mcp_client_registration_store import MCPClientRegistrationStore
 
 MCP_URL = "https://mcp.example.com/mcp"
@@ -113,3 +117,108 @@ def test_refresh_sends_the_secret(oauth_env):
 def test_public_client_sends_no_secret():
     body, auth = with_client_auth({"client_id": "c"}, None, None)
     assert body == {"client_id": "c"} and type(auth) is httpx.Auth
+
+
+# --- token persistence and refresh ---------------------------------------------------------
+
+class FakeKeyring:
+    """Like Windows Credential Manager: refuses secrets over 1280 chars."""
+    def __init__(self):
+        self.items: dict[tuple[str, str], str] = {}
+
+    def get_password(self, service, name):
+        return self.items.get((service, name))
+
+    def set_password(self, service, name, value):
+        if len(value) > 1280:
+            raise OSError("The stub received bad data.")
+        self.items[(service, name)] = value
+
+    def delete_password(self, service, name):
+        if (service, name) not in self.items:
+            raise KeyError(name)
+        del self.items[(service, name)]
+
+
+@pytest.fixture
+def fake_keyring(monkeypatch):
+    ring = FakeKeyring()
+    monkeypatch.setattr(token_store, "_keyring", ring)
+    return ring
+
+
+def test_long_token_is_split_across_entries(fake_keyring):
+    token = {"access_token": "a" * 3000, "refresh_token": "r" * 1500}
+    assert token_store.save_token(MCP_URL, token)
+    assert token_store.load_token(MCP_URL) == token
+    assert len(fake_keyring.items) > 1
+    token_store.save_token(MCP_URL, {"access_token": "short"})  # replaces the chunks
+    assert token_store.load_token(MCP_URL) == {"access_token": "short"} and len(fake_keyring.items) == 1
+    token_store.delete_token(MCP_URL)
+    assert fake_keyring.items == {}
+
+
+def make_client(tmp_path, monkeypatch, access_token="old", expires_in=3600, refresh=None):
+    monkeypatch.setattr(token_store, "_keyring", FakeKeyring())
+    client = MCPClient(MCPClientRegistrationStore(path=str(tmp_path / "reg.json")), None)
+    client._tokens["srv"] = {
+        "access_token": access_token, "refresh_token": "ref", "expires_at": time.time() + expires_in,
+        "token_endpoint": f"{AS}/token", "client_id": "c", "resource": None,
+    }
+    calls = []
+
+    async def fake_refresh(endpoint, refresh_token, **kw):
+        calls.append(refresh_token)
+        if refresh is None:
+            return {"access_token": "new", "expires_in": 3600}
+        raise refresh
+
+    async def no_browser(*a, **kw):
+        raise AssertionError("the browser flow ran")
+    monkeypatch.setattr(mcp_client_mod, "refresh_access_token", fake_refresh)
+    monkeypatch.setattr(mcp_client_mod, "authenticate_via_oauth", no_browser)
+    return client, calls
+
+
+def test_expired_token_is_refreshed_without_a_browser(tmp_path, monkeypatch):
+    client, calls = make_client(tmp_path, monkeypatch, expires_in=-10)
+    assert asyncio.run(client._get_or_refresh_token("srv", MCP_URL)) == "new"
+    assert calls == ["ref"] and token_store.load_token(MCP_URL)["refresh_token"] == "ref"
+
+
+def test_401_mid_session_refreshes_and_retries(tmp_path, monkeypatch):
+    client, calls = make_client(tmp_path, monkeypatch)
+    seen = []
+
+    def handler(request):
+        seen.append(request.headers["authorization"])
+        return httpx2.Response(200 if request.headers["authorization"] == "Bearer new" else 401)
+
+    async def go():
+        async with httpx2.AsyncClient(auth=_OAuthBearer(client, "srv", MCP_URL), transport=httpx2.MockTransport(handler)) as http:
+            return (await http.post(MCP_URL, json={})).status_code
+    assert asyncio.run(go()) == 200
+    assert seen == ["Bearer old", "Bearer new"] and calls == ["ref"]
+
+
+def test_reauthenticate_refreshes_before_signing_in_again(tmp_path, monkeypatch):
+    client, calls = make_client(tmp_path, monkeypatch)
+    client.server_meta["srv"] = {"url": MCP_URL, "transport": "streamable-http", "headers": {}}
+    reconnects = []
+
+    async def fake_connect(**kw):
+        reconnects.append(kw["server_name"])
+    monkeypatch.setattr(client, "connect_to_server", fake_connect)
+    asyncio.run(client.reauthenticate("srv"))
+    assert calls == ["ref"] and client._tokens["srv"]["access_token"] == "new" and reconnects == ["srv"]
+
+
+def test_reauthenticate_drops_a_dead_refresh_token(tmp_path, monkeypatch):
+    client, calls = make_client(tmp_path, monkeypatch, refresh=httpx.HTTPError("invalid_grant"))
+    client.server_meta["srv"] = {"url": MCP_URL, "transport": "streamable-http", "headers": {}}
+
+    async def fake_connect(**kw):
+        pass
+    monkeypatch.setattr(client, "connect_to_server", fake_connect)
+    asyncio.run(client.reauthenticate("srv"))
+    assert "srv" not in client._tokens

dostuff-0.2.1/dostuff/helpers/mcp/token_store.py

@@ -1,46 +0,0 @@
-"""Optional OAuth token persistence in the OS keyring (`pip install dostuff[keyring]`).
-
-Without `keyring`, tokens live in memory only; they are never written to a plaintext file.
-"""
-import json
-from typing import Any
-
-SERVICE = "dostuff-mcp"
-
-try:
-    import keyring as _keyring
-except ImportError:  # optional dependency
-    _keyring = None
-
-
-def keyring_available() -> bool:
-    return _keyring is not None
-
-
-def load_token(server_url: str) -> dict[str, Any] | None:
-    if _keyring is None:
-        return None
-    try:
-        raw = _keyring.get_password(SERVICE, server_url)
-        data = json.loads(raw) if raw else None
-    except Exception:
-        return None
-    return data if isinstance(data, dict) and data.get("access_token") else None
-
-
-def save_token(server_url: str, token: dict[str, Any]) -> None:
-    if _keyring is None:
-        return
-    try:
-        _keyring.set_password(SERVICE, server_url, json.dumps(token))
-    except Exception:
-        pass  # no usable keyring backend; keep the in-memory token
-
-
-def delete_token(server_url: str) -> None:
-    if _keyring is None:
-        return
-    try:
-        _keyring.delete_password(SERVICE, server_url)
-    except Exception:
-        pass