@agentwares/agentguard 0.1.6 → 0.1.7

package/CHANGELOG.md

@@ -3,6 +3,20 @@
 `@agentwares/agentguard`, the CLI and MCP proxy. A tag `agentguard-v<version>` publishes the
 GitHub Release for a version with its section below as the notes.
 
+## 0.1.7 — 2026-10-07
+
+### Fixed
+
+- **No endless loop on an upstream that repeats its `tools/list` cursor.** The proxy followed
+  `nextCursor` with no bound, so an upstream that handed back the cursor it was given (or cycled
+  through a few) kept the proxy asking for the same page forever, its tool table growing with
+  every answer. It now reads every page to the end, stops at a cursor it has already followed, and
+  reads at most 20 pages and 2,000 tools per upstream.
+- **A failed or partial `tools/list` no longer empties an upstream's tools.** If a refresh errors,
+  or stops at that ceiling, the proxy keeps the upstream's last good list and logs why
+  (`tools/list for "<upstream>" not applied: … ; keeping the last good list (N tools)`). It used
+  to drop every tool of that upstream on any `tools/list` error.
+
 ## 0.1.6 — 2026-10-07
 
 ### Added

package/dist/cli.js

@@ -1918,6 +1918,48 @@ function localhostHosts(port) {
   return [...hosts, ...hosts.map((h) => `${h}:${port}`)];
 }
 
+// ../../packages/mcp-kit/dist/chunk-M567BWMA.js
+var LIST_MAX_PAGES = 20;
+var LIST_MAX_ITEMS = 2e3;
+async function readAllPages(fetchPage, opts = {}) {
+  const maxPages = opts.maxPages ?? LIST_MAX_PAGES;
+  const maxItems = opts.maxItems ?? LIST_MAX_ITEMS;
+  const method = opts.method ?? "tools/list";
+  const items = [];
+  const followed = /* @__PURE__ */ new Set();
+  let cursor;
+  for (let page = 1; ; page++) {
+    const res = await fetchPage(cursor, page);
+    if (Array.isArray(res.items)) items.push(...res.items);
+    const next = res.nextCursor;
+    const more = typeof next === "string" && next !== "";
+    if (items.length > maxItems) {
+      return {
+        items,
+        pages: page,
+        truncated: {
+          ceiling: "items",
+          reason: `${method} listed more than ${maxItems} items in ${page} page${page === 1 ? "" : "s"}${more ? " and had more" : ""}; at most ${maxItems} are read`
+        }
+      };
+    }
+    if (!more) return { items, pages: page };
+    if (followed.has(next)) return { items, pages: page, repeatedCursor: true };
+    if (page >= maxPages) {
+      return {
+        items,
+        pages: page,
+        truncated: {
+          ceiling: "pages",
+          reason: `${method} had more than ${maxPages} pages (${items.length} items read); at most ${maxPages} pages are read`
+        }
+      };
+    }
+    followed.add(next);
+    cursor = next;
+  }
+}
+
 // ../../packages/mcp-kit/dist/index.js
 import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
 async function serveStdio(serverOrOpts) {
@@ -3557,6 +3599,13 @@ var ProxyRuntime = class {
       }
     }
   }
+  /**
+   * Re-read an upstream's tools, every page (mcp-kit's `readAllPages`): at most 20 requests, each
+   * under the upstream's `timeout_ms`, ending at a cursor already followed. It used to follow
+   * `nextCursor` with no bound, so an upstream that echoed its cursor kept the proxy asking for
+   * the same page forever. A refresh that fails, or stops at the 20-page / 2,000-tool ceiling,
+   * changes nothing: the agent keeps the last good list, and the log says why.
+   */
   async refreshTools(name) {
     const conn = this.connections.get(name);
     if (!conn?.connected) return;
@@ -3564,22 +3613,23 @@ var ProxyRuntime = class {
       conn.tools = [];
       return;
     }
+    const kept = () => `keeping the last good list (${conn.tools.length} tool${conn.tools.length === 1 ? "" : "s"})`;
     try {
-      const tools = [];
-      let cursor;
-      do {
+      const read = await readAllPages(async (cursor) => {
         const page = await conn.client.listTools(cursor ? { cursor } : void 0, {
           timeout: conn.upstream.timeout_ms
         });
-        tools.push(...page.tools);
-        cursor = page.nextCursor;
-      } while (cursor);
-      conn.tools = tools;
+        return { items: page.tools, nextCursor: page.nextCursor };
+      });
+      if (read.truncated) {
+        this.log(`tools/list for "${name}" not applied: ${read.truncated.reason}; ${kept()}`);
+        return;
+      }
+      conn.tools = read.items;
     } catch (err) {
       this.log(
-        `tools/list failed for "${name}": ${err instanceof Error ? err.message : String(err)}`
+        `tools/list failed for "${name}": ${err instanceof Error ? err.message : String(err)}; ${kept()}`
       );
-      conn.tools = [];
     }
   }
   rebuildExposed() {