mcp2cli 3.2.0__tar.gz → 3.3.0__tar.gz

{mcp2cli-3.2.0 → mcp2cli-3.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcp2cli
-Version: 3.2.0
+Version: 3.3.0
 Summary: Turn any MCP server or OpenAPI spec into a CLI
 Author: Stephan Fitzpatrick
 Author-email: Stephan Fitzpatrick <stephan@knowsuchagency.com>

{mcp2cli-3.2.0 → mcp2cli-3.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mcp2cli"
-version = "3.2.0"
+version = "3.3.0"
 description = "Turn any MCP server or OpenAPI spec into a CLI"
 readme = "README.md"
 license = "MIT"

{mcp2cli-3.2.0 → mcp2cli-3.3.0}/src/mcp2cli/__init__.py

@@ -668,6 +668,62 @@ def _find_free_port() -> int:
         return s.getsockname()[1]
 
 
+
+
+def _get_cached_redirect_uri(storage: "FileTokenStorage") -> str | None:
+    """Return the cached client's redirect_uri, if any.
+
+    Reads client.json from disk without async. Returns None when
+    no cached client exists or the redirect_uri cannot be parsed.
+
+    Used by build_oauth_provider to reuse the registered redirect
+    port from a prior DCR run (issue #54).
+    """
+    if not storage._client_path.exists():
+        return None
+    try:
+        data = json.loads(storage._client_path.read_text())
+        uris = data.get("redirect_uris") or []
+        if uris:
+            return uris[0]
+    except Exception:
+        pass
+    return None
+
+
+def _port_available(host: str, port: int) -> bool:
+    """Check whether *port* is free on *host*.
+
+    Note: this is a best-effort probe — a TOCTOU race exists where another
+    process could bind the port between this check and the caller's use.
+    Callers must handle bind failures gracefully.
+    """
+    try:
+        with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
+            s.bind((host, port))
+            return True
+    except OSError:
+        return False
+
+
+def _restore_token_expiry_from_sidecar(context) -> None:
+    """Recompute ``token_expiry_time`` from the persisted ``expires_at`` sidecar.
+
+    The upstream SDK's ``_initialize`` reloads ``current_tokens`` from disk but
+    never restores ``token_expiry_time`` — the persisted ``OAuthToken`` only
+    carries the relative ``expires_in``. Without this, ``is_token_valid()``
+    treats an already-expired access token as valid on a fresh process and
+    sends a stale Bearer, wasting a 401 round-trip before re-auth (issues #50
+    and #57). Shared by the authorization-code and client-credentials
+    providers.
+    """
+    storage = context.storage
+    if isinstance(storage, FileTokenStorage) and context.current_tokens:
+        expires_at = storage.get_expires_at()
+        if expires_at is not None:
+            context.token_expiry_time = expires_at
+
+
 def build_oauth_provider(
     server_url: str,
     *,
@@ -708,7 +764,22 @@ def build_oauth_provider(
             ClientCredentialsOAuthProvider,
         )
 
-        return ClientCredentialsOAuthProvider(
+        class _RobustClientCredentialsProvider(ClientCredentialsOAuthProvider):
+            """Client-credentials provider that restores expiry across restarts.
+
+            Issue #57: the upstream ``_initialize`` reloads tokens from disk
+            without recomputing ``token_expiry_time``, so an expired access
+            token looks valid after a process restart and a stale Bearer is
+            sent — triggering a 401 before the provider re-authenticates.
+            Restore the expiry from the sidecar so expired tokens are detected
+            proactively.
+            """
+
+            async def _initialize(self) -> None:
+                await super()._initialize()
+                _restore_token_expiry_from_sidecar(self.context)
+
+        return _RobustClientCredentialsProvider(
             server_url=server_url,
             storage=storage,
             client_id=client_id,
@@ -746,13 +817,19 @@ def build_oauth_provider(
 
         async def _initialize(self) -> None:
             await super()._initialize()
-            storage = self.context.storage
-            if isinstance(storage, FileTokenStorage) and self.context.current_tokens:
-                expires_at = storage.get_expires_at()
-                if expires_at is not None:
-                    self.context.token_expiry_time = expires_at
+            _restore_token_expiry_from_sidecar(self.context)
 
         async def _handle_refresh_response(self, response) -> bool:
+            # Issue #58: RFC 6749 §5.1 permits a refresh response to omit
+            # refresh_token, in which case the previously issued one stays
+            # valid. The upstream SDK replaces current_tokens wholesale, so
+            # refresh_token becomes None and every later refresh fails for
+            # the lack of one. Remember the old token to carry it forward.
+            old_refresh_token = (
+                self.context.current_tokens.refresh_token
+                if self.context.current_tokens
+                else None
+            )
             ok = await super()._handle_refresh_response(response)
             if not ok:
                 # Refresh failed. The cached DCR client_id may have been
@@ -764,6 +841,16 @@ def build_oauth_provider(
                 if isinstance(storage, FileTokenStorage):
                     storage.clear_client_info()
                     storage.clear_tokens()
+                return ok
+            # Carry the prior refresh token forward when the server did not
+            # issue a new one, then re-persist so it survives a restart.
+            tokens = self.context.current_tokens
+            if tokens is not None and not tokens.refresh_token and old_refresh_token:
+                tokens = tokens.model_copy(update={"refresh_token": old_refresh_token})
+                self.context.current_tokens = tokens
+                storage = self.context.storage
+                if isinstance(storage, FileTokenStorage):
+                    await storage.set_tokens(tokens)
             return ok
 
     _LOOPBACK_HOSTS = {"localhost", "127.0.0.1", "::1"}
@@ -794,9 +881,36 @@ def build_oauth_provider(
         callback_host = parsed.hostname
         port = parsed.port
     else:
-        port = _find_free_port()
-        callback_host = "127.0.0.1"
-        redirect_uri = f"http://127.0.0.1:{port}/callback"
+        # Issue #54: When DCR is used without an explicit redirect_uri,
+        # _find_free_port() picks a new random port on every run.  If a
+        # cached client.json already exists (from a prior run), its
+        # registered redirect_uris[0] carries the ORIGINAL port.  Sending
+        # an auth request with a different port causes the auth server to
+        # reject the mismatch ("callback URL is invalid").
+        #
+        # Fix: reuse the cached redirect_uri if its port is still available.
+        # If the cached port is occupied (unlikely for loopback), clear the
+        # stale client so DCR re-registers with the fresh port.
+        cached_uri = _get_cached_redirect_uri(storage)
+        if cached_uri is not None:
+            from urllib.parse import urlparse as _urlparse
+            _parsed = _urlparse(cached_uri)
+            _cached_port = _parsed.port
+            _cached_host = _parsed.hostname or "127.0.0.1"
+            if _cached_port and _port_available(_cached_host, _cached_port):
+                callback_host = _cached_host
+                port = _cached_port
+                redirect_uri = cached_uri
+            else:
+                # Port no longer free — clear stale client and re-register
+                storage.clear_client_info()
+                port = _find_free_port()
+                callback_host = "127.0.0.1"
+                redirect_uri = f"http://127.0.0.1:{port}/callback"
+        else:
+            port = _find_free_port()
+            callback_host = "127.0.0.1"
+            redirect_uri = f"http://127.0.0.1:{port}/callback"
 
     client_metadata = OAuthClientMetadata(
         client_name=client_name,
@@ -846,7 +960,7 @@ def build_oauth_provider(
         server = HTTPServer((callback_host, port), _CallbackHandler)
 
     async def redirect_handler(auth_url: str) -> None:
-        print(f"Opening browser for authorization...", file=sys.stderr)
+        print("Opening browser for authorization...", file=sys.stderr)
         print(f"If browser doesn't open, visit: {auth_url}", file=sys.stderr)
         webbrowser.open(auth_url)
 
@@ -2732,6 +2846,8 @@ def _session_meta_path(name: str) -> Path:
 def _session_sock_path(name: str) -> Path:
     return SESSIONS_DIR / f"{name}.sock"
 
+def _session_log_path(name: str) -> Path:
+    return SESSIONS_DIR / f"{name}.log"
 
 def _session_is_alive(meta: dict) -> bool:
     pid = meta.get("pid")
@@ -2765,6 +2881,7 @@ def session_stop(name: str):
     """Stop a named session."""
     meta_path = _session_meta_path(name)
     sock_path = _session_sock_path(name)
+    log_path = _session_log_path(name)
     if meta_path.exists():
         try:
             meta = json.loads(meta_path.read_text())
@@ -2782,6 +2899,7 @@ def session_stop(name: str):
             pass
         meta_path.unlink(missing_ok=True)
     sock_path.unlink(missing_ok=True)
+    log_path.unlink(missing_ok=True)
 
 
 def session_start(
@@ -2824,6 +2942,7 @@ def session_start(
         }
     )
 
+    log_path = _session_log_path(name)
     proc = subprocess.Popen(
         [
             sys.executable,
@@ -2832,7 +2951,7 @@ def session_start(
         ],
         start_new_session=True,
         stdout=subprocess.DEVNULL,
-        stderr=subprocess.DEVNULL,
+        stderr=open(log_path, "a"),
         stdin=subprocess.DEVNULL,
     )