mcp2cli 3.2.0__tar.gz → 3.3.1__tar.gz

{mcp2cli-3.2.0 → mcp2cli-3.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcp2cli
-Version: 3.2.0
+Version: 3.3.1
 Summary: Turn any MCP server or OpenAPI spec into a CLI
 Author: Stephan Fitzpatrick
 Author-email: Stephan Fitzpatrick <stephan@knowsuchagency.com>

{mcp2cli-3.2.0 → mcp2cli-3.3.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mcp2cli"
-version = "3.2.0"
+version = "3.3.1"
 description = "Turn any MCP server or OpenAPI spec into a CLI"
 readme = "README.md"
 license = "MIT"

{mcp2cli-3.2.0 → mcp2cli-3.3.1}/src/mcp2cli/__init__.py

@@ -668,6 +668,62 @@ def _find_free_port() -> int:
         return s.getsockname()[1]
 
 
+
+
+def _get_cached_redirect_uri(storage: "FileTokenStorage") -> str | None:
+    """Return the cached client's redirect_uri, if any.
+
+    Reads client.json from disk without async. Returns None when
+    no cached client exists or the redirect_uri cannot be parsed.
+
+    Used by build_oauth_provider to reuse the registered redirect
+    port from a prior DCR run (issue #54).
+    """
+    if not storage._client_path.exists():
+        return None
+    try:
+        data = json.loads(storage._client_path.read_text())
+        uris = data.get("redirect_uris") or []
+        if uris:
+            return uris[0]
+    except Exception:
+        pass
+    return None
+
+
+def _port_available(host: str, port: int) -> bool:
+    """Check whether *port* is free on *host*.
+
+    Note: this is a best-effort probe — a TOCTOU race exists where another
+    process could bind the port between this check and the caller's use.
+    Callers must handle bind failures gracefully.
+    """
+    try:
+        with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
+            s.bind((host, port))
+            return True
+    except OSError:
+        return False
+
+
+def _restore_token_expiry_from_sidecar(context) -> None:
+    """Recompute ``token_expiry_time`` from the persisted ``expires_at`` sidecar.
+
+    The upstream SDK's ``_initialize`` reloads ``current_tokens`` from disk but
+    never restores ``token_expiry_time`` — the persisted ``OAuthToken`` only
+    carries the relative ``expires_in``. Without this, ``is_token_valid()``
+    treats an already-expired access token as valid on a fresh process and
+    sends a stale Bearer, wasting a 401 round-trip before re-auth (issues #50
+    and #57). Shared by the authorization-code and client-credentials
+    providers.
+    """
+    storage = context.storage
+    if isinstance(storage, FileTokenStorage) and context.current_tokens:
+        expires_at = storage.get_expires_at()
+        if expires_at is not None:
+            context.token_expiry_time = expires_at
+
+
 def build_oauth_provider(
     server_url: str,
     *,
@@ -708,7 +764,22 @@ def build_oauth_provider(
             ClientCredentialsOAuthProvider,
         )
 
-        return ClientCredentialsOAuthProvider(
+        class _RobustClientCredentialsProvider(ClientCredentialsOAuthProvider):
+            """Client-credentials provider that restores expiry across restarts.
+
+            Issue #57: the upstream ``_initialize`` reloads tokens from disk
+            without recomputing ``token_expiry_time``, so an expired access
+            token looks valid after a process restart and a stale Bearer is
+            sent — triggering a 401 before the provider re-authenticates.
+            Restore the expiry from the sidecar so expired tokens are detected
+            proactively.
+            """
+
+            async def _initialize(self) -> None:
+                await super()._initialize()
+                _restore_token_expiry_from_sidecar(self.context)
+
+        return _RobustClientCredentialsProvider(
             server_url=server_url,
             storage=storage,
             client_id=client_id,
@@ -739,31 +810,93 @@ def build_oauth_provider(
            and the CLI hangs on the callback.
 
         We patch both by restoring ``token_expiry_time`` from a sidecar
-        we persist in :class:`FileTokenStorage`, and by wiping the cached
-        ``client_info`` from disk and memory whenever a refresh fails so
-        the subsequent re-auth performs fresh Dynamic Client Registration.
+        we persist in :class:`FileTokenStorage`, and — only when the token
+        endpoint *definitively* rejects the client or grant — by wiping the
+        cached ``client_info`` from disk and memory so the subsequent re-auth
+        performs fresh Dynamic Client Registration.
+
+        Issue #59: the wipe must NOT fire on a transient refresh failure (a
+        brief 5xx, clock skew, a momentarily-unhappy token endpoint). Erasing
+        ``client.json``/``tokens.json`` on a transient blip forces a full
+        interactive ``authorization_code`` consent on the next call, which
+        permanently bricks any headless/scheduled run that has no browser. We
+        therefore preserve the persisted OAuth state on anything that isn't a
+        clean ``invalid_client``/``invalid_grant`` so a later retry can refresh
+        again on its own.
         """
 
         async def _initialize(self) -> None:
             await super()._initialize()
-            storage = self.context.storage
-            if isinstance(storage, FileTokenStorage) and self.context.current_tokens:
-                expires_at = storage.get_expires_at()
-                if expires_at is not None:
-                    self.context.token_expiry_time = expires_at
+            _restore_token_expiry_from_sidecar(self.context)
+
+        @staticmethod
+        async def _refresh_failure_is_definitive(response) -> bool:
+            """Return True only when a failed refresh means the cached client
+            or grant is genuinely dead and must be discarded to recover.
+
+            Distinguishes a definitive ``invalid_client`` / ``invalid_grant``
+            rejection (RFC 6749 §5.2) from a transient transport/server error.
+            Returns False — i.e. "keep the persisted state" — for a 5xx, a
+            malformed body, or any other failure a later retry might survive
+            (issue #59).
+            """
+            status = getattr(response, "status_code", None)
+            # Per RFC 6749 §5.2 a 401 from the token endpoint means client
+            # authentication failed (invalid_client) even when the body
+            # carries no machine-readable error code — definitive.
+            if status == 401:
+                return True
+            # Anything that isn't an OAuth 400/401 error response (notably a
+            # 5xx) is transient: keep the cache so the next run can retry.
+            if status != 400:
+                return False
+            try:
+                error = json.loads(await response.aread()).get("error")
+            except Exception:
+                # Unparseable body on a 400 — be conservative and preserve.
+                return False
+            return error in ("invalid_client", "invalid_grant", "unauthorized_client")
 
         async def _handle_refresh_response(self, response) -> bool:
+            # Issue #58: RFC 6749 §5.1 permits a refresh response to omit
+            # refresh_token, in which case the previously issued one stays
+            # valid. The upstream SDK replaces current_tokens wholesale, so
+            # refresh_token becomes None and every later refresh fails for
+            # the lack of one. Remember the old token to carry it forward.
+            old_refresh_token = (
+                self.context.current_tokens.refresh_token
+                if self.context.current_tokens
+                else None
+            )
             ok = await super()._handle_refresh_response(response)
             if not ok:
-                # Refresh failed. The cached DCR client_id may have been
-                # forgotten by the auth server too; clear it so the
-                # subsequent 401 fallback performs a fresh registration
-                # instead of /authorize?client_id=<stale> → opaque 500.
-                self.context.client_info = None
+                # Refresh failed. Only when the token endpoint *definitively*
+                # rejects us (invalid_client / invalid_grant) do we wipe the
+                # cached DCR client_id + tokens so the subsequent 401 fallback
+                # performs a fresh registration instead of
+                # /authorize?client_id=<stale> → opaque 500 (issue #54).
+                #
+                # A transient failure (5xx, blip, clock skew) must NOT erase
+                # the cache — doing so would force an interactive consent that
+                # no headless/scheduled run can complete (issue #59). Leaving
+                # client.json/tokens.json in place lets the next run simply
+                # retry the refresh.
+                if await self._refresh_failure_is_definitive(response):
+                    self.context.client_info = None
+                    storage = self.context.storage
+                    if isinstance(storage, FileTokenStorage):
+                        storage.clear_client_info()
+                        storage.clear_tokens()
+                return ok
+            # Carry the prior refresh token forward when the server did not
+            # issue a new one, then re-persist so it survives a restart.
+            tokens = self.context.current_tokens
+            if tokens is not None and not tokens.refresh_token and old_refresh_token:
+                tokens = tokens.model_copy(update={"refresh_token": old_refresh_token})
+                self.context.current_tokens = tokens
                 storage = self.context.storage
                 if isinstance(storage, FileTokenStorage):
-                    storage.clear_client_info()
-                    storage.clear_tokens()
+                    await storage.set_tokens(tokens)
             return ok
 
     _LOOPBACK_HOSTS = {"localhost", "127.0.0.1", "::1"}
@@ -794,9 +927,36 @@ def build_oauth_provider(
         callback_host = parsed.hostname
         port = parsed.port
     else:
-        port = _find_free_port()
-        callback_host = "127.0.0.1"
-        redirect_uri = f"http://127.0.0.1:{port}/callback"
+        # Issue #54: When DCR is used without an explicit redirect_uri,
+        # _find_free_port() picks a new random port on every run.  If a
+        # cached client.json already exists (from a prior run), its
+        # registered redirect_uris[0] carries the ORIGINAL port.  Sending
+        # an auth request with a different port causes the auth server to
+        # reject the mismatch ("callback URL is invalid").
+        #
+        # Fix: reuse the cached redirect_uri if its port is still available.
+        # If the cached port is occupied (unlikely for loopback), clear the
+        # stale client so DCR re-registers with the fresh port.
+        cached_uri = _get_cached_redirect_uri(storage)
+        if cached_uri is not None:
+            from urllib.parse import urlparse as _urlparse
+            _parsed = _urlparse(cached_uri)
+            _cached_port = _parsed.port
+            _cached_host = _parsed.hostname or "127.0.0.1"
+            if _cached_port and _port_available(_cached_host, _cached_port):
+                callback_host = _cached_host
+                port = _cached_port
+                redirect_uri = cached_uri
+            else:
+                # Port no longer free — clear stale client and re-register
+                storage.clear_client_info()
+                port = _find_free_port()
+                callback_host = "127.0.0.1"
+                redirect_uri = f"http://127.0.0.1:{port}/callback"
+        else:
+            port = _find_free_port()
+            callback_host = "127.0.0.1"
+            redirect_uri = f"http://127.0.0.1:{port}/callback"
 
     client_metadata = OAuthClientMetadata(
         client_name=client_name,
@@ -846,7 +1006,7 @@ def build_oauth_provider(
         server = HTTPServer((callback_host, port), _CallbackHandler)
 
     async def redirect_handler(auth_url: str) -> None:
-        print(f"Opening browser for authorization...", file=sys.stderr)
+        print("Opening browser for authorization...", file=sys.stderr)
         print(f"If browser doesn't open, visit: {auth_url}", file=sys.stderr)
         webbrowser.open(auth_url)
 
@@ -2732,6 +2892,8 @@ def _session_meta_path(name: str) -> Path:
 def _session_sock_path(name: str) -> Path:
     return SESSIONS_DIR / f"{name}.sock"
 
+def _session_log_path(name: str) -> Path:
+    return SESSIONS_DIR / f"{name}.log"
 
 def _session_is_alive(meta: dict) -> bool:
     pid = meta.get("pid")
@@ -2765,6 +2927,7 @@ def session_stop(name: str):
     """Stop a named session."""
     meta_path = _session_meta_path(name)
     sock_path = _session_sock_path(name)
+    log_path = _session_log_path(name)
     if meta_path.exists():
         try:
             meta = json.loads(meta_path.read_text())
@@ -2782,6 +2945,7 @@ def session_stop(name: str):
             pass
         meta_path.unlink(missing_ok=True)
     sock_path.unlink(missing_ok=True)
+    log_path.unlink(missing_ok=True)
 
 
 def session_start(
@@ -2824,6 +2988,7 @@ def session_start(
         }
     )
 
+    log_path = _session_log_path(name)
     proc = subprocess.Popen(
         [
             sys.executable,
@@ -2832,7 +2997,7 @@ def session_start(
         ],
         start_new_session=True,
         stdout=subprocess.DEVNULL,
-        stderr=subprocess.DEVNULL,
+        stderr=open(log_path, "a"),
         stdin=subprocess.DEVNULL,
     )