@alfe.ai/mcp-bundler 0.3.2 → 0.4.1

package/dist/index.js

@@ -1,5 +1,6 @@
-import { closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, watch, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { dirname, isAbsolute, join } from "node:path";
+import { closeSync, constants, fchmodSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, watch, writeFileSync } from "node:fs";
+import { createHash, randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 //#region src/tool-naming.ts
 /**
@@ -19,11 +20,15 @@ function sanitizeNameSegment(value) {
 	return value.replace(DISALLOWED, "_");
 }
 function buildNamespacedToolName(server, tool) {
-	const base = `${sanitizeNameSegment(server)}${SEPARATOR}${sanitizeNameSegment(tool)}`;
+	const sanitizedServer = sanitizeNameSegment(server);
+	const sanitizedTool = sanitizeNameSegment(tool);
+	const serverBudget = MAX_LEN - 2 - 1;
+	const boundedServer = sanitizedServer.slice(0, serverBudget);
+	const base = `${boundedServer}${SEPARATOR}${sanitizedTool}`;
 	if (base.length <= MAX_LEN) return base;
-	const reservedForServer = sanitizeNameSegment(server).length + 2;
+	const reservedForServer = boundedServer.length + 2;
 	const toolBudget = Math.max(1, MAX_LEN - reservedForServer);
-	return `${sanitizeNameSegment(server)}${SEPARATOR}${sanitizeNameSegment(tool).slice(0, toolBudget)}`;
+	return `${boundedServer}${SEPARATOR}${sanitizedTool.slice(0, toolBudget)}`;
 }
 /**
 * Disambiguate a candidate name against an existing set by appending `-2`, `-3`, etc.
@@ -32,16 +37,231 @@ function buildNamespacedToolName(server, tool) {
 */
 function disambiguateAgainst(candidate, taken) {
 	if (!taken.has(candidate)) return candidate;
-	for (let i = 2; i < 1e3; i += 1) {
+	for (let i = 2; i <= taken.size + 2; i += 1) {
 		const suffix = `-${i.toString()}`;
 		const room = MAX_LEN - suffix.length;
 		const next = `${candidate.length > room ? candidate.slice(0, room) : candidate}${suffix}`;
 		if (!taken.has(next)) return next;
 	}
-	return `${candidate.slice(0, MAX_LEN - 6)}-x${(taken.size % 1e3).toString().padStart(3, "0")}`;
+	throw new Error("unable to disambiguate MCP tool name");
+}
+//#endregion
+//#region src/validation.ts
+const MAX_SERVERS = 256;
+const MAX_TOOLS_PER_SERVER = 512;
+const MAX_SCHEMA_BYTES = 512 * 1024;
+const MAX_ARGUMENT_BYTES = 2 * 1024 * 1024;
+const MAX_RESULT_BYTES = 5 * 1024 * 1024;
+const MAX_JSON_DEPTH = 64;
+const MAX_JSON_NODES = 5e4;
+const MAX_DESCRIPTION_LENGTH = 2e4;
+const SERVER_ID = /^[A-Za-z0-9][A-Za-z0-9._:@#-]{0,127}$/;
+const TOOL_NAME = /^[A-Za-z0-9_.:-]{1,128}$/;
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const HEADER_NAME = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+const UNSAFE_KEYS = new Set([
+	"__proto__",
+	"prototype",
+	"constructor"
+]);
+function validateServerId(id, label = "server id") {
+	if (typeof id !== "string" || !SERVER_ID.test(id) || UNSAFE_KEYS.has(id)) throw new Error(`${label} must match ${SERVER_ID.source}`);
+	return id;
+}
+function validateServerCount(count) {
+	if (count > MAX_SERVERS) throw new Error(`MCP store exceeds the ${MAX_SERVERS.toString()} server limit`);
+}
+function validateServerConfig(value, label = "server config") {
+	const config = requireRecord(value, label);
+	const hasCommand = Object.hasOwn(config, "command");
+	if (hasCommand === Object.hasOwn(config, "url")) throw new Error(`${label} must contain exactly one of command or url`);
+	return hasCommand ? validateStdioConfig(config, label) : validateRemoteConfig(config, label);
+}
+function normalizeChildCatalog(server, advertised) {
+	validateServerId(server);
+	if (!Array.isArray(advertised)) throw new Error(`server "${server}" returned a non-array tool catalog`);
+	if (advertised.length > MAX_TOOLS_PER_SERVER) throw new Error(`server "${server}" advertised ${advertised.length.toString()} tools; limit is ${MAX_TOOLS_PER_SERVER.toString()}`);
+	const originals = /* @__PURE__ */ new Set();
+	return advertised.map((raw, index) => {
+		const tool = requireRecord(raw, `server "${server}" tool ${index.toString()}`);
+		const name = tool.name;
+		if (typeof name !== "string" || !TOOL_NAME.test(name)) throw new Error(`server "${server}" advertised an invalid tool name at index ${index.toString()}`);
+		if (originals.has(name)) throw new Error(`server "${server}" advertised duplicate tool "${name}"`);
+		originals.add(name);
+		const description = tool.description === void 0 ? "" : requireBoundedString(tool.description, `server "${server}" tool "${name}" description`, MAX_DESCRIPTION_LENGTH);
+		const parameters = cloneBoundedJson(tool.inputSchema, `server "${server}" tool "${name}" input schema`, MAX_SCHEMA_BYTES);
+		if (!isRecord$1(parameters)) throw new Error(`server "${server}" tool "${name}" input schema must be an object`);
+		return {
+			prefixed: buildNamespacedToolName(server, name),
+			server,
+			original: name,
+			label: (description || name).slice(0, 80),
+			description,
+			parameters
+		};
+	});
+}
+function validateToolArguments(args) {
+	if (args === void 0) return void 0;
+	const cloned = cloneBoundedJson(args, "MCP tool arguments", MAX_ARGUMENT_BYTES);
+	if (!isRecord$1(cloned)) throw new Error("MCP tool arguments must be an object");
+	return cloned;
+}
+function normalizeToolResult(result) {
+	const cloned = cloneBoundedJson(result, "MCP tool result", MAX_RESULT_BYTES);
+	if (!isRecord$1(cloned) || !Array.isArray(cloned.content)) throw new Error("MCP tool result must be an object with a content array");
+	for (const [index, item] of cloned.content.entries()) if (!isRecord$1(item)) throw new Error(`MCP tool result content[${index.toString()}] must be an object`);
+	if (cloned.isError !== void 0 && typeof cloned.isError !== "boolean") throw new Error("MCP tool result isError must be a boolean when present");
+	if (cloned.structuredContent !== void 0 && !isRecord$1(cloned.structuredContent)) throw new Error("MCP tool result structuredContent must be an object when present");
+	return cloned;
+}
+function redactErrorResult(result, config) {
+	if (!result.isError) return result;
+	return {
+		...result,
+		content: result.content.map((item) => item.type === "text" && typeof item.text === "string" ? {
+			...item,
+			text: redactSensitiveText(item.text, config)
+		} : item)
+	};
+}
+function cloneToolDescriptor(tool) {
+	return {
+		...tool,
+		parameters: cloneBoundedJson(tool.parameters, `tool "${tool.prefixed}" schema`, MAX_SCHEMA_BYTES)
+	};
+}
+function redactSensitiveText(text, config) {
+	let output = String(text).slice(0, MAX_DESCRIPTION_LENGTH).replace(/\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/gi, "$1 [REDACTED]").replace(/\b(api[_-]?key|access[_-]?token|refresh[_-]?token|secret|password)\s*[=:]\s*[^\s,;]+/gi, "$1=[REDACTED]").replace(/\balfe_[A-Za-z0-9_-]{8,}/g, "[REDACTED]");
+	for (const secret of configSecrets(config)) {
+		if (secret.length < 4) continue;
+		output = output.split(secret).join("[REDACTED]");
+	}
+	return output;
+}
+function validateStdioConfig(config, label) {
+	const command = requireBoundedString(config.command, `${label}.command`, 4096);
+	rejectControlCharacters(command, `${label}.command`);
+	const result = { command };
+	if (config.args !== void 0) {
+		if (!Array.isArray(config.args) || config.args.length > 256) throw new Error(`${label}.args must be an array with at most 256 entries`);
+		result.args = config.args.map((arg, index) => {
+			const checked = requireBoundedString(arg, `${label}.args[${index.toString()}]`, 32 * 1024);
+			rejectNul(checked, `${label}.args[${index.toString()}]`);
+			return checked;
+		});
+	}
+	if (config.env !== void 0) result.env = validateStringMap(config.env, `${label}.env`, ENV_NAME, 256, 64 * 1024);
+	if (config.cwd !== void 0) {
+		const cwd = requireBoundedString(config.cwd, `${label}.cwd`, 4096);
+		rejectNul(cwd, `${label}.cwd`);
+		if (!isAbsolute(cwd)) throw new Error(`${label}.cwd must be an absolute path`);
+		result.cwd = cwd;
+	}
+	if (config.connectionTimeoutMs !== void 0) result.connectionTimeoutMs = validateTimeout(config.connectionTimeoutMs, `${label}.connectionTimeoutMs`);
+	return result;
+}
+function validateRemoteConfig(config, label) {
+	const rawUrl = requireBoundedString(config.url, `${label}.url`, 4096);
+	let parsed;
+	try {
+		parsed = new URL(rawUrl);
+	} catch {
+		throw new Error(`${label}.url must be an absolute URL`);
+	}
+	if (!["http:", "https:"].includes(parsed.protocol)) throw new Error(`${label}.url must use http or https`);
+	if (parsed.protocol === "http:" && !isLoopbackHost(parsed.hostname)) throw new Error(`${label}.url must use https unless it targets loopback`);
+	if (parsed.username || parsed.password) throw new Error(`${label}.url must not contain credentials`);
+	if (parsed.hash) throw new Error(`${label}.url must not contain a fragment`);
+	const result = { url: parsed.toString() };
+	if (config.transport !== void 0) {
+		if (config.transport !== "sse" && config.transport !== "streamable-http") throw new Error(`${label}.transport must be sse or streamable-http`);
+		result.transport = config.transport;
+	}
+	if (config.headers !== void 0) result.headers = validateStringMap(config.headers, `${label}.headers`, HEADER_NAME, 64, 32 * 1024, true);
+	if (config.connectionTimeoutMs !== void 0) result.connectionTimeoutMs = validateTimeout(config.connectionTimeoutMs, `${label}.connectionTimeoutMs`);
+	return result;
+}
+function validateStringMap(value, label, keyPattern, maxEntries, maxValueLength, rejectControls = false) {
+	const record = requireRecord(value, label);
+	const entries = Object.entries(record);
+	if (entries.length > maxEntries) throw new Error(`${label} has too many entries`);
+	const result = {};
+	for (const [key, raw] of entries) {
+		if (!keyPattern.test(key) || UNSAFE_KEYS.has(key)) throw new Error(`${label} contains invalid key "${key}"`);
+		const checked = requireBoundedString(raw, `${label}.${key}`, maxValueLength);
+		rejectNul(checked, `${label}.${key}`);
+		if (rejectControls) rejectControlCharacters(checked, `${label}.${key}`);
+		result[key] = checked;
+	}
+	return result;
+}
+function validateTimeout(value, label) {
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0 || value > 3e5) throw new Error(`${label} must be an integer from 0 to 300000`);
+	return value;
+}
+function cloneBoundedJson(value, label, maxBytes) {
+	let nodes = 0;
+	const seen = /* @__PURE__ */ new WeakSet();
+	const visit = (item, depth) => {
+		nodes += 1;
+		if (nodes > MAX_JSON_NODES) throw new Error(`${label} exceeds the JSON node limit`);
+		if (depth > MAX_JSON_DEPTH) throw new Error(`${label} exceeds the JSON depth limit`);
+		if (item === null || typeof item === "boolean" || typeof item === "number") {
+			if (typeof item === "number" && !Number.isFinite(item)) throw new Error(`${label} contains a non-finite number`);
+			return;
+		}
+		if (typeof item === "string") {
+			if (Buffer.byteLength(item, "utf8") > maxBytes) throw new Error(`${label} contains an oversized string`);
+			return;
+		}
+		if (typeof item !== "object") throw new Error(`${label} contains a non-JSON value`);
+		if (seen.has(item)) throw new Error(`${label} contains a cycle`);
+		seen.add(item);
+		if (!Array.isArray(item) && Object.getPrototypeOf(item) !== Object.prototype && Object.getPrototypeOf(item) !== null) throw new Error(`${label} contains a non-plain object`);
+		for (const [key, child] of Object.entries(item)) {
+			if (UNSAFE_KEYS.has(key)) throw new Error(`${label} contains unsafe key "${key}"`);
+			visit(child, depth + 1);
+		}
+	};
+	visit(value, 0);
+	const serialized = JSON.stringify(value);
+	if (Buffer.byteLength(serialized, "utf8") > maxBytes) throw new Error(`${label} exceeds the byte limit`);
+	return JSON.parse(serialized);
+}
+function requireRecord(value, label) {
+	if (!isRecord$1(value)) throw new Error(`${label} must be an object`);
+	for (const key of Object.keys(value)) if (UNSAFE_KEYS.has(key)) throw new Error(`${label} contains unsafe key "${key}"`);
+	return value;
+}
+function isRecord$1(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+}
+function requireBoundedString(value, label, maxLength) {
+	if (typeof value !== "string" || value.length === 0 || value.length > maxLength) throw new Error(`${label} must be a non-empty string of at most ${maxLength.toString()} characters`);
+	return value;
+}
+function rejectNul(value, label) {
+	if (value.includes("\0")) throw new Error(`${label} must not contain NUL`);
+}
+function rejectControlCharacters(value, label) {
+	for (const char of value) {
+		const code = char.charCodeAt(0);
+		if (code <= 31 || code === 127) throw new Error(`${label} must not contain control characters`);
+	}
+}
+function configSecrets(config) {
+	if (!config) return [];
+	return "command" in config ? Object.values(config.env ?? {}) : [...Object.values(config.headers ?? {}), new URL(config.url).password].filter(Boolean);
+}
+function isLoopbackHost(hostname) {
+	return hostname === "localhost" || hostname === "[::1]" || /^127(?:\.[0-9]{1,3}){3}$/.test(hostname);
 }
 //#endregion
 //#region src/connection.ts
+const MAX_STDERR_LINE_LENGTH = 16 * 1024;
 /** Env keys OpenClaw rejects from stdio MCP env blocks. Filter them out before spawning. */
 const STDIO_ENV_DENYLIST = new Set([
 	"NODE_OPTIONS",
@@ -89,17 +309,21 @@ var Connection = class Connection {
 	static RECONNECT_BACKOFF_MAX_MS = 3e4;
 	onUnexpectedClose;
 	onStderrLine;
+	connectTimeoutMs;
+	/** Whether any connect has ever been attempted — drives the eager retry sweep. */
+	connectAttempted = false;
 	constructor(params) {
-		this.name = params.name;
-		this.config = params.config;
+		this.name = validateServerId(params.name);
+		this.config = validateServerConfig(params.config);
 		this.deps = params.deps;
 		this.logger = params.logger;
 		this.onUnexpectedClose = params.onUnexpectedClose;
 		this.onStderrLine = params.onStderrLine;
+		this.connectTimeoutMs = params.connectTimeoutMs ?? 0;
 	}
 	/** Returns the most recent known tool list. May be empty if the server hasn't connected yet. */
 	snapshotTools() {
-		return this.tools;
+		return this.tools.map(cloneToolDescriptor);
 	}
 	/** Whether an MCP child process / remote connection has been established. */
 	isConnected() {
@@ -117,6 +341,15 @@ var Connection = class Connection {
 	lastErrorMessage() {
 		return this.lastError;
 	}
+	/**
+	* Whether a connect was ever attempted (success or failure). A reconciled
+	* connection that was never warmed has neither a client nor a `lastError` —
+	* this flag lets an eager host's retry sweep find it without also
+	* resurrecting cleanly-closed (idle-reaped) connections.
+	*/
+	hasConnectAttempted() {
+		return this.connectAttempted;
+	}
 	/** Idle timestamp for reaping. */
 	idleSinceMs() {
 		return Date.now() - this.lastUsedAt;
@@ -135,46 +368,66 @@ var Connection = class Connection {
 		return this.connectInFlight;
 	}
 	async connectAndDiscover() {
+		this.connectAttempted = true;
 		const safeConfig = "command" in this.config ? {
 			...this.config,
 			env: sanitizeStdioEnv(this.config.env)
 		} : this.config;
 		this.logger?.debug(`[mcp-bundler] connecting server "${this.name}"`);
-		let client;
-		try {
-			client = await this.deps.connect(safeConfig, {
+		const attempt = (async () => {
+			const c = await this.deps.connect(safeConfig, {
 				serverName: this.name,
 				onStderrLine: this.onStderrLine
 			});
-			const advertised = await client.listTools();
-			const connected = client;
-			this.client = connected;
+			try {
+				return {
+					client: c,
+					advertised: await c.listTools()
+				};
+			} catch (err) {
+				await c.close().catch(() => void 0);
+				throw err;
+			}
+		})();
+		try {
+			const { client, advertised } = await this.raceConnectTimeout(attempt);
+			this.client = client;
 			this.closing = false;
-			connected.onClose?.(() => {
-				this.handleUnexpectedClose(connected);
+			client.onClose?.(() => {
+				this.handleUnexpectedClose(client);
 			});
-			this.tools = advertised.map((t) => ({
-				prefixed: buildNamespacedToolName(this.name, t.name),
-				server: this.name,
-				original: t.name,
-				label: (t.description ?? t.name).slice(0, 80),
-				description: t.description ?? "",
-				parameters: t.inputSchema
-			}));
+			this.tools = normalizeChildCatalog(this.name, advertised);
 			this.lastUsedAt = Date.now();
 			this.consecutiveFailures = 0;
 			this.lastError = void 0;
 			this.reconnectBlockedUntilMs = 0;
 			this.logger?.info(`[mcp-bundler] server "${this.name}" connected, ${this.tools.length.toString()} tool(s)`);
 		} catch (err) {
-			if (client) await client.close().catch(() => void 0);
+			attempt.then(({ client }) => client.close()).catch(() => void 0);
 			this.consecutiveFailures += 1;
-			this.lastError = err instanceof Error ? err.message : String(err);
+			this.lastError = redactSensitiveText(err instanceof Error ? err.message : String(err), this.config);
 			const backoff = Math.min(Connection.RECONNECT_BACKOFF_BASE_MS * 2 ** (this.consecutiveFailures - 1), Connection.RECONNECT_BACKOFF_MAX_MS);
 			this.reconnectBlockedUntilMs = Date.now() + backoff;
 			throw err;
 		}
 	}
+	/** Race the attempt against `connectTimeoutMs`; 0 disables the bound. */
+	async raceConnectTimeout(attempt) {
+		const ms = this.connectTimeoutMs;
+		if (ms <= 0) return attempt;
+		let timer;
+		const timeout = new Promise((_, reject) => {
+			timer = setTimeout(() => {
+				reject(/* @__PURE__ */ new Error(`server "${this.name}" connect timed out after ${ms.toString()}ms — spawned but did not complete the MCP handshake/discovery`));
+			}, ms);
+			if (typeof timer === "object" && "unref" in timer) timer.unref();
+		});
+		try {
+			return await Promise.race([attempt, timeout]);
+		} finally {
+			clearTimeout(timer);
+		}
+	}
 	/**
 	* Handle an unexpected transport close (crash / network drop). Clears the
 	* dead client + tools so the next `ensureConnected` re-spawns. No-op if we
@@ -185,6 +438,7 @@ var Connection = class Connection {
 		this.logger?.warn(`[mcp-bundler] server "${this.name}" connection closed unexpectedly; will re-spawn on next use`);
 		this.client = void 0;
 		this.tools = [];
+		handle.close().catch(() => void 0);
 		try {
 			this.onUnexpectedClose?.();
 		} catch {}
@@ -202,14 +456,10 @@ var Connection = class Connection {
 		}
 		this.refreshInFlight = true;
 		try {
-			this.tools = (await this.client.listTools()).map((t) => ({
-				prefixed: buildNamespacedToolName(this.name, t.name),
-				server: this.name,
-				original: t.name,
-				label: (t.description ?? t.name).slice(0, 80),
-				description: t.description ?? "",
-				parameters: t.inputSchema
-			}));
+			const handle = this.client;
+			const advertised = await handle.listTools();
+			if (this.client !== handle) return;
+			this.tools = normalizeChildCatalog(this.name, advertised);
 			this.logger?.debug(`[mcp-bundler] server "${this.name}" refreshed, ${this.tools.length.toString()} tool(s)`);
 		} finally {
 			this.refreshInFlight = false;
@@ -225,7 +475,8 @@ var Connection = class Connection {
 		await this.ensureConnected();
 		if (!this.client) throw new Error(`server "${this.name}" failed to connect`);
 		this.lastUsedAt = Date.now();
-		return this.client.callTool(originalName, args, signal ? { signal } : void 0);
+		const checkedArgs = validateToolArguments(args);
+		return normalizeToolResult(await this.client.callTool(originalName, checkedArgs, signal ? { signal } : void 0));
 	}
 	/**
 	* Close the underlying transport. Idempotent. If a connect is in flight
@@ -274,16 +525,26 @@ async function defaultConnect(server, ctx) {
 		});
 		if (onStderrLine) {
 			let carry = "";
+			const emitLine = (raw) => {
+				if (raw.trim() === "") return;
+				const line = raw.length > MAX_STDERR_LINE_LENGTH ? `${raw.slice(0, MAX_STDERR_LINE_LENGTH)}…[truncated]` : raw;
+				try {
+					onStderrLine(line);
+				} catch {}
+			};
 			transport.stderr?.on("data", (chunk) => {
 				const parts = (carry + chunk.toString()).split("\n");
 				carry = parts.pop() ?? "";
-				for (const line of parts) {
-					if (line.trim() === "") continue;
-					try {
-						onStderrLine(line);
-					} catch {}
+				for (const line of parts) emitLine(line);
+				if (carry.length > MAX_STDERR_LINE_LENGTH) {
+					emitLine(carry);
+					carry = "";
 				}
 			});
+			transport.stderr?.on("end", () => {
+				emitLine(carry);
+				carry = "";
+			});
 		}
 		await client.connect(transport);
 	} else {
@@ -306,7 +567,7 @@ async function defaultConnect(server, ctx) {
 		closeHandler?.();
 	};
 	client.onclose = fireClose;
-	client.onerror = fireClose;
+	client.onerror = () => void 0;
 	return {
 		async listTools() {
 			return (await client.listTools()).tools.map((t) => ({
@@ -335,6 +596,7 @@ async function defaultConnect(server, ctx) {
 const DEFAULT_IDLE_TTL_MS = 600 * 1e3;
 const DEFAULT_IDLE_SWEEP_INTERVAL_MS = 60 * 1e3;
 const DEFAULT_RETRY_SWEEP_INTERVAL_MS = 60 * 1e3;
+const DEFAULT_CONNECT_TIMEOUT_MS = 120 * 1e3;
 /** First text content of an error result, for host error reporting. */
 function extractErrorText(result) {
 	for (const item of result.content) if (item.type === "text" && typeof item.text === "string") return item.text.slice(0, 500);
@@ -358,6 +620,8 @@ var McpBundler = class {
 	retrySweepIntervalMs;
 	retrySweepTimer;
 	retrySweepInFlight = false;
+	connectTimeoutMs;
+	retryNeverConnected;
 	deps;
 	onToolError;
 	onServerCrash;
@@ -366,9 +630,11 @@ var McpBundler = class {
 	reconcileLatch = Promise.resolve();
 	constructor(opts = {}, deps) {
 		this.logger = opts.logger;
-		this.idleTtlMs = opts.idleTtlMs ?? DEFAULT_IDLE_TTL_MS;
-		this.idleSweepIntervalMs = opts.idleSweepIntervalMs ?? DEFAULT_IDLE_SWEEP_INTERVAL_MS;
-		this.retrySweepIntervalMs = opts.retrySweepIntervalMs ?? DEFAULT_RETRY_SWEEP_INTERVAL_MS;
+		this.idleTtlMs = checkedDuration(opts.idleTtlMs ?? DEFAULT_IDLE_TTL_MS, "idleTtlMs");
+		this.idleSweepIntervalMs = checkedDuration(opts.idleSweepIntervalMs ?? DEFAULT_IDLE_SWEEP_INTERVAL_MS, "idleSweepIntervalMs");
+		this.retrySweepIntervalMs = checkedDuration(opts.retrySweepIntervalMs ?? DEFAULT_RETRY_SWEEP_INTERVAL_MS, "retrySweepIntervalMs");
+		this.connectTimeoutMs = checkedDuration(opts.connectTimeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS, "connectTimeoutMs", 3e5);
+		this.retryNeverConnected = opts.retryNeverConnected ?? false;
 		this.deps = deps ?? { connect: defaultConnect };
 		this.onToolError = opts.onToolError;
 		this.onServerCrash = opts.onServerCrash;
@@ -385,11 +651,12 @@ var McpBundler = class {
 			config,
 			deps: this.deps,
 			logger: this.logger,
+			connectTimeoutMs: config.connectionTimeoutMs ?? this.connectTimeoutMs,
 			...crash ? { onUnexpectedClose: () => {
 				crash(name);
 			} } : {},
 			...stderr ? { onStderrLine: (line) => {
-				stderr(name, line);
+				stderr(name, redactSensitiveText(line, config));
 			} } : {}
 		});
 	}
@@ -416,7 +683,11 @@ var McpBundler = class {
 	}
 	async doReconcile(desired) {
 		if (this.disposed) throw new Error("McpBundler: disposed");
-		const desiredNames = new Set(Object.keys(desired));
+		const desiredEntries = Object.entries(desired);
+		validateServerCount(desiredEntries.length);
+		const checkedDesired = {};
+		for (const [name, config] of desiredEntries) checkedDesired[validateServerId(name)] = validateServerConfig(config, `server "${name}" config`);
+		const desiredNames = new Set(Object.keys(checkedDesired));
 		const currentNames = new Set(this.connections.keys());
 		const added = [];
 		const removed = [];
@@ -428,7 +699,7 @@ var McpBundler = class {
 			if (conn) await conn.close();
 			removed.push(name);
 		}
-		for (const [name, config] of Object.entries(desired)) {
+		for (const [name, config] of Object.entries(checkedDesired)) {
 			const existing = this.connections.get(name);
 			if (!existing) {
 				this.connections.set(name, this.buildConnection(name, config));
@@ -464,17 +735,7 @@ var McpBundler = class {
 	* so cross-server name clashes never produce duplicate registrations.
 	*/
 	listTools() {
-		const seen = /* @__PURE__ */ new Set();
-		const out = [];
-		for (const conn of this.connections.values()) for (const tool of conn.snapshotTools()) {
-			const finalName = disambiguateAgainst(tool.prefixed, seen);
-			seen.add(finalName);
-			out.push(finalName === tool.prefixed ? tool : {
-				...tool,
-				prefixed: finalName
-			});
-		}
-		return out;
+		return this.resolvedCatalog().map(({ descriptor }) => cloneToolDescriptor(descriptor));
 	}
 	/**
 	* Eagerly connect to every configured server and discover tools. Used by
@@ -503,15 +764,20 @@ var McpBundler = class {
 	* 500ms → 30s cap). A server that keeps `exit(1)`-ing fast-fails while in
 	* backoff, so repeated sweeps are cheap and never become a tight crash-loop
 	* — the backoff widens with each failure. Servers that connect on their
-	* first warm, and lazily-added servers that never warmed (no `lastError`),
-	* are left alone.
+	* first warm are left alone, as are cleanly-closed (idle-reaped) ones.
+	*
+	* Lazily-added servers that were NEVER attempted (no client, no
+	* `lastError`) are also left alone by default — but with
+	* `retryNeverConnected` (the daemon's eager mode) the sweep picks them up,
+	* so a server added after the host's warmup pass self-heals within one
+	* sweep instead of stranding its tools until a restart.
 	*
 	* Returns the statuses of the servers it attempted (empty if none needed a
 	* retry). Never throws — per-server failures are reflected in the status.
 	*/
 	async retryFailed() {
 		if (this.disposed) return [];
-		const targets = Array.from(this.connections.values()).filter((conn) => !conn.isConnected() && conn.lastErrorMessage() !== void 0);
+		const targets = Array.from(this.connections.values()).filter((conn) => !conn.isConnected() && (conn.lastErrorMessage() !== void 0 || this.retryNeverConnected && !conn.hasConnectAttempted()));
 		if (targets.length === 0) return [];
 		return (await Promise.allSettled(targets.map(async (conn) => {
 			try {
@@ -551,10 +817,11 @@ var McpBundler = class {
 		if (this.disposed) return void 0;
 		const conn = this.connections.get(name);
 		if (!conn) return void 0;
+		const checkedTimeout = timeoutMs === void 0 ? void 0 : checkedDuration(timeoutMs, "warmServer timeoutMs", 3e5);
 		const connect = conn.ensureConnected();
 		connect.catch(() => void 0);
 		try {
-			if (timeoutMs !== void 0 && timeoutMs > 0) await this.raceTimeout(connect, timeoutMs, name);
+			if (checkedTimeout !== void 0 && checkedTimeout > 0) await this.raceTimeout(connect, checkedTimeout, name);
 			else await connect;
 		} catch (err) {
 			const status = this.statusOf(conn);
@@ -596,7 +863,7 @@ var McpBundler = class {
 			isError: true,
 			content: [{
 				type: "text",
-				text: `unknown tool: ${prefixed}`
+				text: `unknown MCP tool: ${prefixed.slice(0, 128)}`
 			}]
 		};
 		try {
@@ -606,11 +873,11 @@ var McpBundler = class {
 				tool: route.original,
 				prefixed,
 				kind: "result-error",
-				message: extractErrorText(result)
+				message: redactSensitiveText(extractErrorText(result), route.connection.config)
 			});
-			return result;
+			return redactErrorResult(result, route.connection.config);
 		} catch (err) {
-			const msg = err instanceof Error ? err.message : String(err);
+			const msg = redactSensitiveText(err instanceof Error ? err.message : String(err), route.connection.config);
 			this.logger?.error(`[mcp-bundler] tool call failed for "${prefixed}"`, { err: msg });
 			this.reportToolError({
 				server: route.connection.name,
@@ -633,10 +900,32 @@ var McpBundler = class {
 	* tool name. Returns undefined if the tool is not currently advertised.
 	*/
 	routeToolName(prefixed) {
-		for (const conn of this.connections.values()) for (const tool of conn.snapshotTools()) if (tool.prefixed === prefixed) return {
-			connection: conn,
-			original: tool.original
-		};
+		const match = this.resolvedCatalog().find(({ descriptor }) => descriptor.prefixed === prefixed);
+		return match ? {
+			connection: match.connection,
+			original: match.descriptor.original
+		} : void 0;
+	}
+	/**
+	* Build one collision-resolved catalog used by BOTH registration and
+	* routing. Keeping these views together prevents an advertised `-2` name
+	* from becoming uncallable when two child names sanitize to the same key.
+	*/
+	resolvedCatalog() {
+		const seen = /* @__PURE__ */ new Set();
+		const resolved = [];
+		for (const conn of this.connections.values()) for (const tool of conn.snapshotTools()) {
+			const finalName = disambiguateAgainst(tool.prefixed, seen);
+			seen.add(finalName);
+			resolved.push({
+				connection: conn,
+				descriptor: finalName === tool.prefixed ? tool : {
+					...tool,
+					prefixed: finalName
+				}
+			});
+		}
+		return resolved;
 	}
 	/**
 	* Tear down all connections and stop background tasks. Idempotent.
@@ -695,6 +984,10 @@ var McpBundler = class {
 		await Promise.allSettled(targets.map((c) => c.close()));
 	}
 };
+function checkedDuration(value, label, max = 864e5) {
+	if (!Number.isSafeInteger(value) || value < 0 || value > max) throw new Error(`McpBundler ${label} must be an integer from 0 to ${max.toString()}`);
+	return value;
+}
 //#endregion
 //#region src/store.ts
 const DEFAULT_STORE_PATH = join(join(homedir(), ".alfe", "mcp"), "servers.json");
@@ -702,6 +995,7 @@ const DEFAULT_STORE_PATH = join(join(homedir(), ".alfe", "mcp"), "servers.json")
 const LOCK_WAIT_MS = 5e3;
 const LOCK_RETRY_INTERVAL_MS = 25;
 const LOCK_STALE_MS = 1e4;
+const MAX_STORE_BYTES = 1024 * 1024;
 /**
 * On-disk source of truth for the bundler's configured servers.
 *
@@ -720,22 +1014,36 @@ var Store = class {
 	rewatchTimer;
 	constructor(opts = {}) {
 		this.storePath = opts.path ?? DEFAULT_STORE_PATH;
+		if (!isAbsolute(this.storePath)) throw new Error("Store path must be absolute");
 		this.logger = opts.logger;
 	}
 	get path() {
 		return this.storePath;
 	}
 	read() {
-		if (!existsSync(this.storePath)) return cloneEmpty();
+		let fd = -1;
 		try {
-			const raw = readFileSync(this.storePath, "utf8");
+			try {
+				fd = openSync(this.storePath, constants.O_RDONLY | constants.O_NOFOLLOW);
+			} catch (err) {
+				if (err.code === "ENOENT") return cloneEmpty();
+				throw err;
+			}
+			const stat = fstatSync(fd);
+			if (!stat.isFile()) throw new Error("store path is not a regular file");
+			if (typeof process.getuid === "function" && stat.uid !== process.getuid()) throw new Error("store file is not owned by the current user");
+			if ((stat.mode & 63) !== 0) fchmodSync(fd, 384);
+			if (stat.size > MAX_STORE_BYTES) throw new Error(`store exceeds the ${MAX_STORE_BYTES.toString()} byte limit`);
+			const raw = readFileSync(fd, "utf8");
 			return normalize(JSON.parse(raw));
 		} catch (err) {
-			this.logger?.warn("[mcp-bundler/store] failed to read store; returning empty", {
+			this.logger?.warn("[mcp-bundler/store] rejected unreadable or invalid store", {
 				err: errMsg$1(err),
 				path: this.storePath
 			});
-			return cloneEmpty();
+			throw new Error(`Store.read: rejected ${this.storePath}: ${errMsg$1(err)}`, { cause: err });
+		} finally {
+			if (fd >= 0) closeSync(fd);
 		}
 	}
 	/**
@@ -748,8 +1056,8 @@ var Store = class {
 	* The lock guards the read-then-rename window so two processes
 	* (e.g. two `alfe mcp add` shells, or the CLI racing the daemon)
 	* can't drop each other's writes. The lock file is at
-	* `<storePath>.lock`; stale locks (older than `LOCK_STALE_MS`) are
-	* stolen so a crashed writer doesn't wedge the store.
+	* `<storePath>.lock`; locks whose recorded writer process is no longer
+	* alive are reclaimed so a crashed writer doesn't wedge the store.
 	*
 	* Pure-function shape (instead of a `read()` then `write(next)`
 	* pair) intentionally — it keeps the read-modify-write contract
@@ -757,18 +1065,27 @@ var Store = class {
 	* other's partial state.
 	*/
 	update(fn) {
-		mkdirSync(dirname(this.storePath), { recursive: true });
+		mkdirSync(dirname(this.storePath), {
+			recursive: true,
+			mode: 448
+		});
 		const release = this.acquireLock();
 		try {
-			const next = fn(this.read());
-			const tempPath = `${this.storePath}.${String(process.pid)}.${String(Date.now())}.tmp`;
-			writeFileSync(tempPath, JSON.stringify(next, null, 2), {
-				encoding: "utf8",
-				mode: 384
-			});
+			const next = normalize(fn(this.read()));
+			const payload = JSON.stringify(next, null, 2);
+			if (Buffer.byteLength(payload, "utf8") > MAX_STORE_BYTES) throw new Error(`Store.update: result exceeds the ${MAX_STORE_BYTES.toString()} byte limit`);
+			const tempPath = `${this.storePath}.${String(process.pid)}.${randomUUID()}.tmp`;
+			let tempFd = -1;
 			try {
+				tempFd = openSync(tempPath, "wx", 384);
+				writeFileSync(tempFd, payload, { encoding: "utf8" });
+				fsyncSync(tempFd);
+				closeSync(tempFd);
+				tempFd = -1;
 				renameSync(tempPath, this.storePath);
+				this.fsyncParentDirectory();
 			} catch (err) {
+				if (tempFd >= 0) closeSync(tempFd);
 				try {
 					unlinkSync(tempPath);
 				} catch {}
@@ -781,11 +1098,11 @@ var Store = class {
 	}
 	/**
 	* Acquire an inter-process file lock by atomically creating a
-	* sentinel via `openSync(lockPath, 'wx')`. Spins with bounded
-	* backoff up to `LOCK_WAIT_MS`. If the lock file is older than
-	* `LOCK_STALE_MS` it's assumed orphaned (writer crashed mid-update)
-	* and stolen — the write window is sub-second in practice, so
-	* holding the lock for >5s means something went wrong.
+	* sentinel via `openSync(lockPath, 'wx')`. Waits with bounded
+	* backoff up to `LOCK_WAIT_MS`. A structured lock is reclaimed only when
+	* its writer process is no longer alive; age alone cannot steal a lock
+	* from a slow but valid writer. Old malformed/legacy locks retain a
+	* conservative age fallback.
 	*
 	* Returns the release function. Single-process callers are
 	* unaffected — re-entering the same process spins briefly while
@@ -795,20 +1112,33 @@ var Store = class {
 		const lockPath = `${this.storePath}.lock`;
 		const deadline = Date.now() + LOCK_WAIT_MS;
 		let fd = -1;
+		let heldDevice = -1;
+		let heldInode = -1;
 		for (;;) try {
 			fd = openSync(lockPath, "wx", 384);
+			const token = randomUUID();
+			writeFileSync(fd, JSON.stringify({
+				pid: process.pid,
+				token,
+				createdAt: (/* @__PURE__ */ new Date()).toISOString()
+			}), "utf8");
+			fsyncSync(fd);
+			const stat = fstatSync(fd);
+			heldDevice = stat.dev;
+			heldInode = stat.ino;
 			break;
 		} catch (err) {
 			if (err.code !== "EEXIST") throw err;
-			if (this.lockIsStale(lockPath)) {
+			const stale = this.inspectStaleLock(lockPath);
+			if (stale) {
 				try {
-					unlinkSync(lockPath);
+					const current = lstatSync(lockPath);
+					if (current.dev === stale.device && current.ino === stale.inode) unlinkSync(lockPath);
 				} catch {}
 				continue;
 			}
 			if (Date.now() >= deadline) throw new Error(`Store.update: timed out waiting for ${lockPath} (held by another writer or stale lock)`);
-			const sleepUntil = Date.now() + LOCK_RETRY_INTERVAL_MS;
-			while (Date.now() < sleepUntil);
+			sleepSync(LOCK_RETRY_INTERVAL_MS);
 		}
 		const held = fd;
 		return () => {
@@ -816,16 +1146,56 @@ var Store = class {
 				closeSync(held);
 			} catch {}
 			try {
-				unlinkSync(lockPath);
+				const current = lstatSync(lockPath);
+				if (current.dev === heldDevice && current.ino === heldInode) unlinkSync(lockPath);
 			} catch {}
 		};
 	}
-	lockIsStale(lockPath) {
+	inspectStaleLock(lockPath) {
+		let fd = -1;
+		let modifiedAt;
+		let device;
+		let inode;
 		try {
-			const st = statSync(lockPath);
-			return Date.now() - st.mtimeMs > LOCK_STALE_MS;
+			fd = openSync(lockPath, constants.O_RDONLY | constants.O_NOFOLLOW);
+			const stat = fstatSync(fd);
+			modifiedAt = stat.mtimeMs;
+			device = stat.dev;
+			inode = stat.ino;
+			if (!stat.isFile() || stat.size > 4096) return Date.now() - stat.mtimeMs > LOCK_STALE_MS ? {
+				device,
+				inode
+			} : void 0;
+			const parsed = JSON.parse(readFileSync(fd, "utf8"));
+			if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return Date.now() - stat.mtimeMs > LOCK_STALE_MS ? {
+				device,
+				inode
+			} : void 0;
+			const pid = parsed.pid;
+			if (!Number.isSafeInteger(pid) || pid <= 0) return Date.now() - stat.mtimeMs > LOCK_STALE_MS ? {
+				device,
+				inode
+			} : void 0;
+			return !processIsAlive(pid) ? {
+				device,
+				inode
+			} : void 0;
 		} catch {
-			return false;
+			return modifiedAt !== void 0 && device !== void 0 && inode !== void 0 && Date.now() - modifiedAt > LOCK_STALE_MS ? {
+				device,
+				inode
+			} : void 0;
+		} finally {
+			if (fd >= 0) closeSync(fd);
+		}
+	}
+	fsyncParentDirectory() {
+		let fd = -1;
+		try {
+			fd = openSync(dirname(this.storePath), constants.O_RDONLY);
+			fsyncSync(fd);
+		} catch {} finally {
+			if (fd >= 0) closeSync(fd);
 		}
 	}
 	/**
@@ -849,7 +1219,10 @@ var Store = class {
 	}
 	ensureWatcher() {
 		if (this.watcher) return;
-		mkdirSync(dirname(this.storePath), { recursive: true });
+		mkdirSync(dirname(this.storePath), {
+			recursive: true,
+			mode: 448
+		});
 		const dir = dirname(this.storePath);
 		const basename = this.storePath.slice(dir.length + 1);
 		let pending;
@@ -898,43 +1271,60 @@ var Store = class {
 function defaultStorePath() {
 	return DEFAULT_STORE_PATH;
 }
+/**
+* One-way launch-identity fingerprint for cache invalidation across IPC.
+* Store entries contain credentials in env/headers, so consumers that only
+* need equality receive this digest rather than the executable configuration.
+*/
+function serverLaunchFingerprint(entry) {
+	const identity = {
+		config: toServerConfig(entry),
+		version: entry.version ?? null
+	};
+	return `sha256:${createHash("sha256").update(stableJson(identity)).digest("hex")}`;
+}
 /** Pull the runtime config (transport + transport-specific fields) out of a stored entry. */
 function toServerConfig(entry) {
 	if (entry.transport === "stdio") {
-		const { command, args, env, cwd } = entry;
+		const { command, args, env, cwd, connectionTimeoutMs } = entry;
 		const cfg = { command };
-		if (args) cfg.args = args;
-		if (env) cfg.env = env;
+		if (args) cfg.args = [...args];
+		if (env) cfg.env = { ...env };
 		if (cwd) cfg.cwd = cwd;
-		return cfg;
+		if (connectionTimeoutMs !== void 0) cfg.connectionTimeoutMs = connectionTimeoutMs;
+		return validateServerConfig(cfg);
 	}
 	const { url, transport, headers, connectionTimeoutMs } = entry;
 	const cfg = {
 		url,
 		transport
 	};
-	if (headers) cfg.headers = headers;
+	if (headers) cfg.headers = { ...headers };
 	if (connectionTimeoutMs !== void 0) cfg.connectionTimeoutMs = connectionTimeoutMs;
-	return cfg;
+	return validateServerConfig(cfg);
 }
 /** Build a stored entry from a runtime config + ownership metadata. */
 function toStoredEntry(config, meta) {
+	validateOwner(meta.owner);
+	const checked = validateServerConfig(config);
 	const addedAt = meta.addedAt ?? (/* @__PURE__ */ new Date()).toISOString();
-	if ("command" in config) return {
+	validateTimestamp(addedAt, "addedAt");
+	if (meta.version !== void 0) validateVersion(meta.version);
+	if ("command" in checked) return {
 		transport: "stdio",
 		owner: meta.owner,
 		addedAt,
 		...meta.version !== void 0 ? { version: meta.version } : {},
-		...config
+		...checked
 	};
-	const transport = meta.transport ?? config.transport ?? "sse";
+	const transport = meta.transport ?? checked.transport ?? "sse";
 	if (transport === "stdio") throw new Error("toStoredEntry: transport=stdio specified but config is remote-shaped");
 	return {
-		transport,
 		owner: meta.owner,
 		addedAt,
 		...meta.version !== void 0 ? { version: meta.version } : {},
-		...config
+		...checked,
+		transport
 	};
 }
 function cloneEmpty() {
@@ -945,17 +1335,90 @@ function cloneEmpty() {
 	};
 }
 function normalize(raw) {
-	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return cloneEmpty();
+	if (!raw || typeof raw !== "object" || Array.isArray(raw)) throw new Error("store root must be an object");
 	const r = raw;
+	const rawServers = r.servers;
+	if (!rawServers || typeof rawServers !== "object" || Array.isArray(rawServers)) throw new Error("store.servers must be an object");
+	const serverEntries = Object.entries(rawServers);
+	validateServerCount(serverEntries.length);
+	const servers = {};
+	for (const [id, rawEntry] of serverEntries) {
+		validateServerId(id);
+		if (!rawEntry || typeof rawEntry !== "object" || Array.isArray(rawEntry)) throw new Error(`store server "${id}" must be an object`);
+		const entry = rawEntry;
+		validateOwner(entry.owner);
+		validateTimestamp(entry.addedAt, `store server "${id}" addedAt`);
+		if (entry.version !== void 0) validateVersion(entry.version);
+		if (![
+			"stdio",
+			"sse",
+			"streamable-http"
+		].includes(String(entry.transport))) throw new Error(`store server "${id}" has an invalid transport`);
+		servers[id] = toStoredEntry(entry.transport === "stdio" ? validateServerConfig(entry, `store server "${id}"`) : validateServerConfig({
+			...entry,
+			transport: entry.transport
+		}, `store server "${id}"`), {
+			owner: entry.owner,
+			transport: entry.transport,
+			addedAt: entry.addedAt,
+			version: entry.version
+		});
+	}
+	const rawConfig = r.config ?? {};
+	if (!rawConfig || typeof rawConfig !== "object" || Array.isArray(rawConfig)) throw new Error("store.config must be an object");
+	const config = {};
+	const ttl = rawConfig.sessionIdleTtlMs;
+	if (ttl !== void 0) {
+		if (typeof ttl !== "number" || !Number.isSafeInteger(ttl) || ttl < 0 || ttl > 864e5) throw new Error("store.config.sessionIdleTtlMs must be an integer from 0 to 86400000");
+		config.sessionIdleTtlMs = ttl;
+	}
+	const rawOwned = r._ownedOpenclawKeys;
+	if (rawOwned !== void 0 && !Array.isArray(rawOwned)) throw new Error("store._ownedOpenclawKeys must be an array");
+	const owned = [...new Set((rawOwned ?? []).map((value) => validateServerId(value, "store._ownedOpenclawKeys entry")))];
+	validateServerCount(owned.length);
 	return {
-		servers: r.servers && typeof r.servers === "object" ? r.servers : {},
-		config: r.config && typeof r.config === "object" ? r.config : {},
-		_ownedOpenclawKeys: Array.isArray(r._ownedOpenclawKeys) ? r._ownedOpenclawKeys.slice() : []
+		servers,
+		config,
+		_ownedOpenclawKeys: owned
 	};
 }
+function validateOwner(owner) {
+	if (owner === "cli" || owner === "manual") return;
+	if (typeof owner === "string" && owner.startsWith("integration:")) {
+		validateServerId(owner.slice(12), "integration owner id");
+		return;
+	}
+	throw new Error("server owner must be cli, manual, or integration:<id>");
+}
+function validateTimestamp(value, label) {
+	if (typeof value !== "string" || !Number.isFinite(Date.parse(value))) throw new Error(`${label} must be an ISO timestamp`);
+}
+function validateVersion(value) {
+	if (typeof value !== "string" || !/^[0-9A-Za-z][0-9A-Za-z.+-]{0,127}$/.test(value)) throw new Error("server version is invalid");
+}
+function processIsAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (err) {
+		return err.code !== "ESRCH";
+	}
+}
+const sleepBuffer = new Int32Array(new SharedArrayBuffer(4));
+function sleepSync(ms) {
+	Atomics.wait(sleepBuffer, 0, 0, ms);
+}
 function errMsg$1(err) {
 	return err instanceof Error ? err.message : String(err);
 }
+function stableJson(value) {
+	if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+	if (value !== null && typeof value === "object") {
+		const record = value;
+		return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableJson(record[key])}`).join(",")}}`;
+	}
+	return value === void 0 ? "null" : JSON.stringify(value);
+}
 //#endregion
 //#region src/manager.ts
 /**
@@ -975,11 +1438,13 @@ function errMsg$1(err) {
 */
 var Manager = class {
 	store;
+	ownsStore;
 	logger;
 	bundler;
 	changeListeners = /* @__PURE__ */ new Set();
 	storeUnsubscribe;
 	constructor(opts = {}) {
+		this.ownsStore = opts.store === void 0;
 		this.store = opts.store ?? new Store({ logger: opts.logger });
 		this.logger = opts.logger;
 	}
@@ -990,11 +1455,14 @@ var Manager = class {
 	/**
 	* Register or overwrite a server entry. Mutation lands in the store
 	* synchronously; if a bundler has been attached via `loadIntoBundler`,
-	* it gets re-reconciled in the background (errors logged, never
-	* thrown — the store is the source of truth, the bundler is derived).
+	* it is re-reconciled BEFORE `onChange` listeners fire. A reconcile error is
+	* logged and does not roll back the durable store mutation, but listeners do
+	* not fire against stale live state. The ordering is load-bearing: the daemon's `onChange`
+	* handler warms the bundler's current connections, so the just-added
+	* server must already have its Connection object or it is never warmed.
 	*/
 	async addServer(config, opts) {
-		if (!opts.id) throw new Error("Manager.addServer: id is required");
+		validateServerId(opts.id, "Manager.addServer id");
 		const owner = opts.owner ?? "manual";
 		this.store.update((cur) => {
 			const previousAddedAt = lookupAddedAt(cur.servers, opts.id);
@@ -1012,9 +1480,7 @@ var Manager = class {
 				}
 			};
 		});
-		this.scheduleBundlerReconcile();
-		this.fireChange();
-		return Promise.resolve();
+		if (await this.reconcileBundlerLogged()) this.fireChange();
 	}
 	/**
 	* Remove a single server entry. No-op if the id isn't in the store.
@@ -1022,17 +1488,22 @@ var Manager = class {
 	* when supplied — the CLI uses this to guard `alfe mcp remove` from
 	* accidentally clobbering integration- or cli-owned entries.
 	*/
-	removeServer(id, opts = {}) {
-		const existing = lookupEntry(this.store.read().servers, id);
-		if (!existing) return Promise.resolve(false);
-		if (opts.expectedOwner && existing.owner !== opts.expectedOwner) return Promise.reject(/* @__PURE__ */ new Error(`Manager.removeServer: server "${id}" is owned by "${existing.owner}", not "${opts.expectedOwner}"`));
-		this.store.update((cur) => ({
-			...cur,
-			servers: Object.fromEntries(Object.entries(cur.servers).filter(([k]) => k !== id))
-		}));
-		this.scheduleBundlerReconcile();
-		this.fireChange();
-		return Promise.resolve(true);
+	async removeServer(id, opts = {}) {
+		validateServerId(id, "Manager.removeServer id");
+		const outcome = { removed: false };
+		this.store.update((cur) => {
+			const existing = lookupEntry(cur.servers, id);
+			if (!existing) return cur;
+			if (opts.expectedOwner && existing.owner !== opts.expectedOwner) throw new Error(`Manager.removeServer: server "${id}" is owned by "${existing.owner}", not "${opts.expectedOwner}"`);
+			outcome.removed = true;
+			return {
+				...cur,
+				servers: Object.fromEntries(Object.entries(cur.servers).filter(([key]) => key !== id))
+			};
+		});
+		if (!outcome.removed) return false;
+		if (await this.reconcileBundlerLogged()) this.fireChange();
+		return true;
 	}
 	/** Drop every entry whose owner matches — used by integration uninstall. */
 	async removeServersByOwner(owner) {
@@ -1048,10 +1519,9 @@ var Manager = class {
 			};
 		});
 		if (removed.length > 0) {
-			this.scheduleBundlerReconcile();
-			this.fireChange();
+			if (await this.reconcileBundlerLogged()) this.fireChange();
 		}
-		return Promise.resolve(removed);
+		return removed;
 	}
 	/** Read-only snapshot for `alfe mcp list` and similar UIs. */
 	listServers() {
@@ -1082,8 +1552,14 @@ var Manager = class {
 	*/
 	async warmServer(id, timeoutMs) {
 		if (!this.bundler) return null;
-		await this.reconcileBundler();
-		return await this.bundler.warmServer(id, timeoutMs) ?? null;
+		try {
+			validateServerId(id, "Manager.warmServer id");
+			await this.reconcileBundler();
+			return await this.bundler.warmServer(id, timeoutMs) ?? null;
+		} catch (err) {
+			this.logger?.warn("[mcp-bundler/manager] warm reconcile failed", { err: errMsg(err) });
+			return null;
+		}
 	}
 	/**
 	* Push the current store contents into a bundler instance (which owns
@@ -1108,24 +1584,34 @@ var Manager = class {
 	}
 	/**
 	* Detach from the bundler and stop watching the store. Safe to call
-	* multiple times. Does not dispose the underlying `Store` so the
-	* shared instance survives multi-manager environments (rare).
+	* multiple times. An injected Store remains owned by its caller; a Store
+	* constructed by this manager is disposed here.
 	*/
 	async dispose() {
 		if (this.storeUnsubscribe) {
 			this.storeUnsubscribe();
 			this.storeUnsubscribe = void 0;
 		}
-		this.store.dispose();
+		if (this.ownsStore) this.store.dispose();
 		this.changeListeners.clear();
 		this.bundler = void 0;
 		return Promise.resolve();
 	}
-	scheduleBundlerReconcile() {
-		if (!this.bundler) return;
-		this.reconcileBundler().catch((err) => {
+	/**
+	* Awaited by every mutator so `onChange` listeners observe a bundler
+	* that already contains the mutation. Reconcile failures are logged and
+	* return false so callers preserve the durable mutation without notifying
+	* listeners against stale derived state.
+	*/
+	async reconcileBundlerLogged() {
+		if (!this.bundler) return true;
+		try {
+			await this.reconcileBundler();
+			return true;
+		} catch (err) {
 			this.logger?.warn("[mcp-bundler/manager] bundler reconcile failed", { err: errMsg(err) });
-		});
+			return false;
+		}
 	}
 	async reconcileBundler() {
 		if (!this.bundler) return;
@@ -1172,15 +1658,17 @@ function lookupAddedAt(servers, id) {
 */
 function checkPatternA(tools, options) {
 	const selectorNames = typeof options.selector === "string" ? [options.selector] : options.selector;
+	if (selectorNames.length === 0 || selectorNames.some((name) => typeof name !== "string" || name.length === 0)) throw new Error("Pattern A selector must contain at least one non-empty property name");
 	const exempt = new Set(options.exempt ?? []);
 	const violations = [];
 	for (const tool of tools) {
 		if (exempt.has(tool.name)) continue;
-		const schema = tool.parameters;
-		const properties = schema.properties ?? {};
-		const required = schema.required ?? [];
-		const matched = selectorNames.find((name) => name in properties);
-		if (!matched) {
+		const schema = isRecord(tool.parameters) ? tool.parameters : {};
+		const rawProperties = schema.properties;
+		const properties = isRecord(rawProperties) ? rawProperties : {};
+		const required = Array.isArray(schema.required) ? schema.required.filter((value) => typeof value === "string") : [];
+		const present = selectorNames.filter((name) => Object.hasOwn(properties, name));
+		if (present.length === 0) {
 			violations.push({
 				tool: tool.name,
 				reason: "missing-selector-property",
@@ -1188,20 +1676,29 @@ function checkPatternA(tools, options) {
 			});
 			continue;
 		}
-		if (!required.includes(matched)) {
+		const requiredSelectors = present.filter((name) => required.includes(name));
+		if (requiredSelectors.length === 0) {
 			violations.push({
 				tool: tool.name,
 				reason: "selector-not-required",
-				detail: `selector "${matched}" present in properties but missing from inputSchema.required`
+				detail: `selector [${present.join(", ")}] present in properties but missing from inputSchema.required`
 			});
 			continue;
 		}
-		const type = properties[matched].type;
-		if (type !== "string") violations.push({
-			tool: tool.name,
-			reason: "selector-property-not-string",
-			detail: `selector "${matched}" must be JSON Schema type=string (found ${JSON.stringify(type)})`
-		});
+		if (!requiredSelectors.find((name) => {
+			const property = properties[name];
+			return isRecord(property) && property.type === "string";
+		})) {
+			const foundTypes = requiredSelectors.map((name) => {
+				const property = properties[name];
+				return `${name}=${JSON.stringify(isRecord(property) ? property.type : void 0)}`;
+			});
+			violations.push({
+				tool: tool.name,
+				reason: "selector-property-not-string",
+				detail: `at least one required selector must be JSON Schema type=string (found ${foundTypes.join(", ")})`
+			});
+		}
 	}
 	return violations;
 }
@@ -1212,7 +1709,7 @@ function checkPatternA(tools, options) {
 function assertPatternA(tools, options) {
 	const violations = checkPatternA(tools, options);
 	if (violations.length === 0) return;
-	const lines = violations.map((v) => `  - [${v.reason}] ${v.tool}: ${v.detail}`);
+	const lines = violations.map((violation) => `  - [${violation.reason}] ${violation.tool}: ${violation.detail}`);
 	throw new Error(`Pattern A validation failed for ${String(violations.length)} tool(s):\n${lines.join("\n")}`);
 }
 /**
@@ -1227,7 +1724,10 @@ function fromMcpDescriptor(descriptor) {
 		parameters: descriptor.parameters
 	};
 }
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
 //#endregion
-export { Connection, Manager, McpBundler, STDIO_ENV_DENYLIST, Store, assertPatternA, buildNamespacedToolName, checkPatternA, defaultConnect, defaultStorePath, disambiguateAgainst, fromMcpDescriptor, sanitizeNameSegment, sanitizeStdioEnv, toServerConfig, toStoredEntry };
+export { Connection, Manager, McpBundler, STDIO_ENV_DENYLIST, Store, assertPatternA, buildNamespacedToolName, checkPatternA, defaultConnect, defaultStorePath, disambiguateAgainst, fromMcpDescriptor, sanitizeNameSegment, sanitizeStdioEnv, serverLaunchFingerprint, toServerConfig, toStoredEntry };
 
 //# sourceMappingURL=index.js.map