fix(cli): report MCP stream errors

.changeset/clean-mcp-streams.md

@@ -0,0 +1,5 @@
+---
+'@inflowpayai/inflow': patch
+---
+
+Report errors returned by streaming MCP commands and close interrupted command streams.

.changeset/safe-secret-lifecycle-recovery.md

@@ -0,0 +1,6 @@
+---
+'@inflowpayai/inflow-core': patch
+'@inflowpayai/inflow': patch
+---
+
+Preserve recoverable credential lifecycle state when secure storage deletion is temporarily unavailable.

packages/cli/test/unit/mcp-stream-errors.test.ts

@@ -0,0 +1,75 @@
+import { Mcp } from 'incur';
+import { describe, expect, it, vi } from 'vitest';
+
+function streamingTool(run: (context: { error: (input: { code: string; message: string }) => never }) => unknown) {
+  return {
+    name: 'streaming_test',
+    description: 'Streaming MCP test command',
+    inputSchema: { type: 'object' as const, properties: {} },
+    command: { run },
+  };
+}
+
+describe('MCP streaming command errors', () => {
+  it('surfaces a generator return c.error as an MCP tool error', async () => {
+    const result = await Mcp.callTool(
+      streamingTool(async function* (context) {
+        await Promise.resolve();
+        yield { phase: 'started' };
+        return context.error({ code: 'VAULT_LOCKED', message: 'The InFlow vault is locked.' });
+      }),
+      {},
+    );
+
+    expect(result).toMatchObject({
+      content: [{ type: 'text', text: 'The InFlow vault is locked.' }],
+      isError: true,
+    });
+  });
+
+  it('continues to buffer successful generator chunks', async () => {
+    const result = await Mcp.callTool(
+      streamingTool(async function* () {
+        await Promise.resolve();
+        yield { phase: 'started' };
+        yield { phase: 'complete' };
+      }),
+      {},
+    );
+
+    expect(result).toEqual({
+      content: [
+        {
+          type: 'text',
+          text: '[{"phase":"started"},{"phase":"complete"}]',
+        },
+      ],
+    });
+  });
+
+  it('closes the generator when a progress notification fails', async () => {
+    let finalized = false;
+    const result = await Mcp.callTool(
+      streamingTool(async function* () {
+        try {
+          await Promise.resolve();
+          yield { phase: 'started' };
+          yield { phase: 'complete' };
+        } finally {
+          finalized = true;
+        }
+      }),
+      {},
+      {
+        extra: { mcpReq: { _meta: { progressToken: 'progress-1' } } },
+        sendNotification: vi.fn().mockRejectedValue(new Error('progress delivery failed')),
+      },
+    );
+
+    expect(result).toMatchObject({
+      content: [{ type: 'text', text: 'progress delivery failed' }],
+      isError: true,
+    });
+    expect(finalized).toBe(true);
+  });
+});

packages/core/src/secure-storage/lifecycle.ts

@@ -1,11 +1,11 @@
+import { SecureStorageError } from './errors.js';
 import type {
   SecretReference,
   SecretReferenceManifest,
   SecureSecretStore,
   SyncSecretReferenceManifest,
   SyncSecureSecretStore,
 } from './secret-store.js';
-import { SecureStorageError } from './errors.js';
 import type { SecureSqliteRepository } from './sqlite.js';
 
 function errorFromCause(cause: unknown): Error {

packages/core/test/unit/secure-storage/lifecycle.test.ts

@@ -139,6 +139,17 @@ describe('SecureSecretLifecycleCoordinator', () => {
     expect(repository.listSecretLifecycle('deleting')).toEqual([]);
   });
 
+  it('completes a retried asynchronous delete when the secret is already absent', async () => {
+    const reference = { purpose: 'api-key', reference: 'missing-delete' };
+    await coordinator.create(reference, Buffer.from('secret'), null);
+    await store.delete(reference);
+
+    await coordinator.delete(reference);
+
+    expect(repository.listSecretLifecycle('deleting')).toEqual([]);
+    expect(await manifest.read()).toEqual([]);
+  });
+
   it('preserves interrupted work when the asynchronous secret store is temporarily unavailable', async () => {
     const pending = { purpose: 'api-key', reference: 'locked-pending' };
     repository.beginSecretLifecycle(pending, null);
@@ -152,7 +163,6 @@ describe('SecureSecretLifecycleCoordinator', () => {
     await expect(lockedCoordinator.recoverInterruptedWork()).rejects.toMatchObject({
       secureStorageCode: 'vault_locked',
     });
-
     expect(repository.listSecretLifecycle('pending')).toEqual([pending]);
   });
 
@@ -225,6 +235,20 @@ describe('SecureSecretLifecycleCoordinator', () => {
     expect(repository.listSecretLifecycle('deleting')).toEqual([]);
   });
 
+  it('completes a retried synchronous delete when the secret is already absent', () => {
+    const syncStore = new SyncMemorySecretStore();
+    const syncManifest = new SyncSecretReferenceManifestStore(syncStore);
+    const syncCoordinator = new SyncSecureSecretLifecycleCoordinator(repository, syncStore, syncManifest);
+    const reference = { purpose: 'api-key', reference: 'sync-missing-delete' };
+    syncCoordinator.create(reference, Buffer.from('secret'), null);
+    syncStore.delete(reference);
+
+    syncCoordinator.delete(reference);
+
+    expect(repository.listSecretLifecycle('deleting')).toEqual([]);
+    expect(syncManifest.read()).toEqual([]);
+  });
+
   it('preserves interrupted work when the synchronous secret store is temporarily unavailable', () => {
     const pending = { purpose: 'api-key', reference: 'sync-locked-pending' };
     repository.beginSecretLifecycle(pending, null);

patches/incur.patch

@@ -85,31 +85,79 @@
              : []),
 --- a/dist/Mcp.js
 +++ b/dist/Mcp.js
-@@ -130,6 +130,7 @@
+@@ -69,18 +69,46 @@
+         const progressToken = options.extra?.mcpReq?._meta?.progressToken;
+         let i = 0;
++        const iterator = result.stream[Symbol.asyncIterator]();
++        let completed = false;
+         try {
+-            for await (const chunk of result.stream) {
++            while (true) {
++                const item = await iterator.next();
++                if (item.done) {
++                    completed = true;
++                    const returned = item.value;
++                    if (returned !== null &&
++                        typeof returned === 'object' &&
++                        returned[Symbol.for('incur.sentinel')] === 'error') {
++                        const cta = formatCtaBlock(options.name ?? tool.name, returned.cta);
++                        const text = returned.message ?? 'Command failed';
++                        return {
++                            content: [{ type: 'text', text: cta ? `${text}\n\n${renderCtaText(cta)}` : text }],
++                            ...(cta ? { _meta: { cta } } : undefined),
++                            isError: true,
++                        };
++                    }
++                    break;
++                }
++                const chunk = item.value;
+                 chunks.push(chunk);
+                 if (progressToken !== undefined && options.sendNotification)
+                     await options.sendNotification({
+                         method: 'notifications/progress',
+                         params: { progressToken, progress: ++i, message: Json.stringify(chunk) },
+                     });
+             }
+         }
+         catch (err) {
+             return {
+                 content: [{ type: 'text', text: err instanceof Error ? err.message : String(err) }],
+                 isError: true,
+             };
+         }
++        finally {
++            if (!completed && iterator.return) {
++                try {
++                    await iterator.return();
++                }
++                catch { }
++            }
++        }
+@@ -130,6 +158,7 @@
      const hasInput = Object.keys(mergedShape).length > 0;
      server.registerTool(tool.name, {
          ...(tool.description ? { description: tool.description } : undefined),
 +        ...(tool.title ? { title: tool.title } : undefined),
          ...(hasInput ? { inputSchema: z.object(mergedShape) } : undefined),
          ...(tool.outputSchema
              ? { outputSchema: options.fromJsonSchema(tool.outputSchema) }
-@@ -159,6 +160,7 @@
+@@ -159,6 +188,7 @@
          return toolResult({
              tools: page.map((tool) => ({
                  name: tool.name,
 +                ...(tool.title ? { title: tool.title } : undefined),
                  ...(tool.description ? { description: tool.description } : undefined),
                  ...(tool.annotations ? { annotations: tool.annotations } : undefined),
              })),
-@@ -177,6 +179,7 @@
+@@ -177,6 +207,7 @@
              return toolError(`Unknown tool: ${params.name}`);
          return toolResult({
              name: tool.name,
 +            ...(tool.title ? { title: tool.title } : undefined),
              ...(tool.description ? { description: tool.description } : undefined),
              inputSchema: tool.inputSchema,
              ...(tool.outputSchema ? { outputSchema: tool.outputSchema } : undefined),
-@@ -284,7 +287,8 @@
+@@ -284,7 +315,8 @@
  export function collectTools(commands, prefix, parentMiddlewares = [], filter) {
      const tools = filterTools(collectToolEntries(commands, prefix, parentMiddlewares), filter);
      assertUniqueToolNames(tools);
@@ -119,7 +167,7 @@
  }
  function collectToolEntries(commands, prefix, parentMiddlewares = []) {
      const result = [];
-@@ -306,6 +310,7 @@
+@@ -306,6 +338,7 @@
              const outputSchema = entry.output ? mcpOutputSchema(entry.output) : undefined;
              result.push({
                  name: mcp?.name ?? path.join('_'),