@chrischall/eventbrite-mcp 0.3.2 → 0.3.3

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Eventbrite — your tickets and orders, organizer data, and public event discovery",
-    "version": "0.3.2"
+    "version": "0.3.3"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Eventbrite",
       "source": "./",
       "description": "MCP server for Eventbrite — tickets, orders, organizer data, and public event search. Account tools use a personal API token; discovery search routes through the user's signed-in eventbrite.com tab via the fetchproxy bridge, reusing their authenticated session.",
-      "version": "0.3.2",
+      "version": "0.3.3",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "eventbrite-mcp",
   "displayName": "Eventbrite",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "MCP server for Eventbrite — your tickets and orders, organizer data, and public event discovery",
   "author": {
     "name": "Chris Hall",

package/dist/bundle.js

@@ -11085,7 +11085,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes, createHash } = __require("crypto");
+    var { randomBytes: randomBytes2, createHash } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -11623,7 +11623,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes(16).toString("base64");
+      const key = randomBytes2(16).toString("base64");
       const request = isSecure ? https.request : http.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -12636,9 +12636,29 @@ var init_session = __esm({
       outboundSeq = 0;
       lastInboundSeq = 0;
       inflightInbound = /* @__PURE__ */ new Set();
+      saturationWarned = false;
       constructor(sessionKey) {
         this.sessionKey = sessionKey;
       }
+      /**
+       * Whether the caller holding this claim verdict should log saturation now.
+       * True only on the TRANSITION into it: a line per dropped frame turned a
+       * flood — or a set that never drains — into a log flood amplifying the very
+       * condition it reported (#376). An `'ok'` claim re-arms the latch, since it
+       * is the one signal every caller sees that the set has drained below the
+       * bound; a replay needs no capacity and leaves it alone. Latched per
+       * session, so a renegotiated one starts armed. A set hovering at the bound
+       * can still alternate ok/saturated, but that logs at the rate frames finish
+       * opening, not the rate they arrive.
+       */
+      saturationWarningDue(claim2) {
+        if (claim2 === "ok")
+          this.saturationWarned = false;
+        if (claim2 !== "saturated" || this.saturationWarned)
+          return false;
+        this.saturationWarned = true;
+        return true;
+      }
       nextOutboundSeq() {
         this.outboundSeq += 1;
         return this.outboundSeq;
@@ -12649,19 +12669,21 @@ var init_session = __esm({
        * the first `await` of the receive path, or a duplicate frame read in the
        * same pass will be judged against a counter neither frame has moved yet.
        *
-       * Answering false means "not this frame's to process" — replayed, or a
-       * duplicate of one still in flight. Every true MUST be answered by exactly
-       * one {@link commitInboundSeq} or {@link releaseInboundSeq}.
+       * Anything but `'ok'` means "not this frame's to process": `'replay'` for
+       * a spent seq or a duplicate of one still in flight, `'saturated'` when the
+       * in-flight bound is full. Replay is checked first, since refusing a stale
+       * seq needs no capacity. Every `'ok'` MUST be answered by exactly one
+       * {@link commitInboundSeq} or {@link releaseInboundSeq}.
        */
       claimInboundSeq(seq) {
         if (seq <= this.lastInboundSeq)
-          return false;
+          return "replay";
         if (this.inflightInbound.has(seq))
-          return false;
+          return "replay";
         if (this.inflightInbound.size >= MAX_INFLIGHT_INBOUND_SEQS)
-          return false;
+          return "saturated";
         this.inflightInbound.add(seq);
-        return true;
+        return "ok";
       }
       /**
        * Give a claim back without spending the seq — for a frame that did not
@@ -12763,7 +12785,8 @@ var init_session_ready = __esm({
 });
 
 // node_modules/@fetchproxy/server/dist/identity.js
-import { readFile, writeFile, mkdir, chmod } from "node:fs/promises";
+import { readFile, readdir, writeFile, mkdir, chmod, rename, rm, unlink } from "node:fs/promises";
+import { randomBytes } from "node:crypto";
 import { isAbsolute, join as join2 } from "node:path";
 import { homedir } from "node:os";
 function envIdentityDir() {
@@ -12817,16 +12840,45 @@ function parseIdentity(text) {
     createdAt: j.createdAt
   };
 }
+async function openIdentityDir(dir) {
+  await mkdir(dir, { recursive: true, mode: 448 });
+  try {
+    await chmod(dir, 448);
+  } catch (e) {
+    const code = e.code;
+    if (code !== "EROFS" && code !== "EPERM")
+      throw e;
+  }
+}
+async function sweepStagingFiles(dir, serverName) {
+  const base = safeIdentityFileBase(serverName).replace(/[.]/g, "\\.");
+  const staging = new RegExp(`^${base}\\.json\\.[0-9a-f]{${STAGING_BYTES * 2}}\\.tmp$`);
+  let names;
+  try {
+    names = await readdir(dir);
+  } catch {
+    return;
+  }
+  await Promise.all(names.filter((name) => staging.test(name)).map((name) => unlink(join2(dir, name)).catch(() => void 0)));
+}
 async function writeIdentityFile(dir, serverName, id) {
   const path = identityFilePath(dir, serverName);
-  await mkdir(dir, { recursive: true, mode: 448 });
-  await writeFile(path, serializeIdentity(id), { mode: 384 });
-  await chmod(path, 384);
+  await openIdentityDir(dir);
+  await sweepStagingFiles(dir, serverName);
+  const tmp = `${path}.${randomBytes(STAGING_BYTES).toString("hex")}.tmp`;
+  try {
+    await writeFile(tmp, serializeIdentity(id), { mode: 384, flag: "wx" });
+    await chmod(tmp, 384);
+    await rename(tmp, path);
+  } catch (e) {
+    await rm(tmp, { force: true });
+    throw e;
+  }
   return path;
 }
 async function loadOrCreateIdentity(serverName, dir = defaultIdentityDir()) {
   const path = identityFilePath(dir, serverName);
-  await mkdir(dir, { recursive: true, mode: 448 });
+  await openIdentityDir(dir);
   try {
     return parseIdentity(await readFile(path, "utf8"));
   } catch (e) {
@@ -12837,17 +12889,18 @@ async function loadOrCreateIdentity(serverName, dir = defaultIdentityDir()) {
   await writeIdentityFile(dir, serverName, id);
   return id;
 }
-var SAFE_PLAIN, SAFE_SCOPED;
+var SAFE_PLAIN, SAFE_SCOPED, STAGING_BYTES;
 var init_identity = __esm({
   "node_modules/@fetchproxy/server/dist/identity.js"() {
     init_dist();
     SAFE_PLAIN = /^[A-Za-z0-9._-]+$/;
     SAFE_SCOPED = /^@[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
+    STAGING_BYTES = 6;
   }
 });
 
 // node_modules/@fetchproxy/server/dist/extension-trust.js
-import { readFile as readFile2, writeFile as writeFile2, rename, unlink, mkdir as mkdir2, chmod as chmod2 } from "node:fs/promises";
+import { readFile as readFile2, writeFile as writeFile2, rename as rename2, unlink as unlink2, mkdir as mkdir2, chmod as chmod2 } from "node:fs/promises";
 import { isAbsolute as isAbsolute2, join as join3 } from "node:path";
 function envTrustDir(env = process.env) {
   const raw = env[TRUST_DIR_ENV];
@@ -12947,7 +13000,7 @@ async function writeExtensionPin(serverName, pin, dir = defaultTrustDir()) {
   const tmp = `${path}.tmp`;
   await writeFile2(tmp, JSON.stringify(pin, null, 2), { mode: 384 });
   await chmod2(tmp, 384);
-  await rename(tmp, path);
+  await rename2(tmp, path);
 }
 var TRUST_DIR_ENV, TRUST_NEW_EXTENSION_ENV;
 var init_extension_trust = __esm({
@@ -13302,7 +13355,11 @@ async function startHost(opts) {
               const session = ownSession;
               if (!session)
                 return;
-              if (!session.claimInboundSeq(frame.seq))
+              const claim2 = session.claimInboundSeq(frame.seq);
+              if (session.saturationWarningDue(claim2)) {
+                console.warn(`[fetchproxy] ${opts.ownServerName}: dropped an inbound frame (seq ${frame.seq}) unread \u2014 too many frames from the extension are still being opened (inbound claims saturated). Not a replay. Further drops are not logged until the in-flight set drains.`);
+              }
+              if (claim2 !== "ok")
                 return;
               let inner;
               try {
@@ -13450,7 +13507,9 @@ var init_host = __esm({
 
 // node_modules/@fetchproxy/server/dist/peer.js
 async function startPeer(opts) {
-  const ws = new import_websocket.default(`ws://${opts.host}:${opts.port}`);
+  const ws = new import_websocket.default(`ws://${opts.host}:${opts.port}`, {
+    maxPayload: opts.maxPayloadBytes ?? MAX_PAYLOAD_BYTES
+  });
   await new Promise((resolve, reject) => {
     const onOpen = () => {
       cleanup();
@@ -13688,7 +13747,11 @@ async function startPeer(opts) {
         const inboundSession = session;
         if (!inboundSession)
           return;
-        if (!inboundSession.claimInboundSeq(frame.seq))
+        const claim2 = inboundSession.claimInboundSeq(frame.seq);
+        if (inboundSession.saturationWarningDue(claim2)) {
+          console.warn(`[fetchproxy] ${opts.serverName}: dropped an inbound frame (seq ${frame.seq}) unread \u2014 too many frames from the extension are still being opened (inbound claims saturated). Not a replay. Further drops are not logged until the in-flight set drains.`);
+        }
+        if (claim2 !== "ok")
           return;
         let result;
         try {
@@ -13779,6 +13842,7 @@ var init_peer = __esm({
     init_dist();
     init_build_server_hello();
     init_frame_size();
+    init_host();
     init_session();
     init_session_ready();
     init_extension_trust();
@@ -45673,7 +45737,7 @@ var pageSchema = {
 init_errors();
 
 // src/version.ts
-var VERSION = "0.3.2";
+var VERSION = "0.3.3";
 
 // src/client.ts
 import { dirname, join } from "path";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = '0.3.2'; // x-release-please-version
+export const VERSION = '0.3.3'; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrischall/eventbrite-mcp",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "mcpName": "io.github.chrischall/eventbrite-mcp",
   "description": "Eventbrite MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -46,7 +46,7 @@
   },
   "dependencies": {
     "@chrischall/mcp-utils": "^0.26.1",
-    "@fetchproxy/server": "^3.0.0",
+    "@fetchproxy/server": "^3.0.1",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "dotenv": "^17.4.0",
     "zod": "^4.5.4"

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/eventbrite-mcp",
     "source": "github"
   },
-  "version": "0.3.2",
+  "version": "0.3.3",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@chrischall/eventbrite-mcp",
-      "version": "0.3.2",
+      "version": "0.3.3",
       "transport": {
         "type": "stdio"
       },