@cyanheads/mcp-ts-core 0.13.1 → 0.13.3

package/scripts/build.ts

@@ -14,7 +14,7 @@
  */
 
 import { execFile } from 'node:child_process';
-import { readFileSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { readdir, stat } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -22,6 +22,32 @@ import { fileURLToPath } from 'node:url';
 const ROOT_DIR = join(dirname(fileURLToPath(import.meta.url)), '..');
 const DIST_DIR = join(ROOT_DIR, 'dist');
 
+/** Where `bunx @cyanheads/mcp-ts-core init` writes the build tsconfig. */
+const SCAFFOLD_BUILD_PROJECT = 'tsconfig.build.json';
+
+/**
+ * Build tsconfig locations, in precedence order. A project may keep its project
+ * tsconfigs in `config/` or at the root, and this script ships to both
+ * verbatim, so the default is probed rather than hardcoded.
+ */
+const BUILD_PROJECT_CANDIDATES = ['config/tsconfig.build.json', SCAFFOLD_BUILD_PROJECT];
+
+/**
+ * The tsconfig to build: an explicit `--project <path>` verbatim — a missing
+ * one still reaches the compiler and fails there — otherwise the first
+ * candidate location present. With neither present the scaffold's layout is
+ * named, so the compiler error points at the file the project should have.
+ */
+function resolveProject(argv: string[]): string {
+  const flagIndex = argv.indexOf('--project');
+  const explicit = flagIndex === -1 ? undefined : argv[flagIndex + 1];
+  if (explicit !== undefined) return explicit;
+  return (
+    BUILD_PROJECT_CANDIDATES.find((candidate) => existsSync(join(ROOT_DIR, candidate))) ??
+    SCAFFOLD_BUILD_PROJECT
+  );
+}
+
 async function exec(
   cmd: string[],
   label: string,
@@ -92,11 +118,7 @@ function formatBytes(bytes: number): string {
 async function main() {
   // Read package info
   const pkg = JSON.parse(readFileSync(join(ROOT_DIR, 'package.json'), 'utf-8'));
-  const projectIdx = process.argv.indexOf('--project');
-  const project =
-    projectIdx !== -1
-      ? (process.argv[projectIdx + 1] ?? 'config/tsconfig.build.json')
-      : 'config/tsconfig.build.json';
+  const project = resolveProject(process.argv);
 
   console.log(`\x1b[1mBuilding ${pkg.name}@${pkg.version}\x1b[0m`);
   console.log(`\x1b[2m  tsconfig: ${project}\x1b[0m`);

package/scripts/clean-mcpb.ts

@@ -33,7 +33,10 @@ import { fileURLToPath } from 'node:url';
 /**
  * Agent-doc entries under `node_modules/` that must not ship in a bundle.
  * KEEP IN SYNC with `AGENT_DOC_ENTRY` in `scripts/lint-packaging.ts`
- * (post-bundle content check) — a unit test asserts the two are identical.
+ * (post-bundle content check) — edit both literals together. The assertion that
+ * they match lives in the mcp-ts-core repository's own test suite; `tests/` is
+ * not part of the published package, so nothing enforces the pair in a server
+ * these scripts were copied into.
  */
 export const AGENT_DOC_ENTRY =
   /^node_modules\/.*(?:\/framework-skills\/|\/skills\/|\/\.claude\/|\/\.agents\/|\/SKILL\.md$)/;
@@ -41,7 +44,10 @@ export const AGENT_DOC_ENTRY =
 /**
  * Platform-specific native binding packages, which must not ship in a bundle.
  * KEEP IN SYNC with `NATIVE_BINDING_ENTRY` in `scripts/lint-packaging.ts`
- * (post-bundle content check) — a unit test asserts the two are identical.
+ * (post-bundle content check) — edit both literals together. The assertion that
+ * they match lives in the mcp-ts-core repository's own test suite; `tests/` is
+ * not part of the published package, so nothing enforces the pair in a server
+ * these scripts were copied into.
  *
  * `mcpb pack` archives the whole project directory, so a native dependency
  * contributes the build host's platform slice and nothing else — for

package/scripts/clean.ts

@@ -1,12 +1,16 @@
 /**
  * @fileoverview Utility script to clean build artifacts and temporary directories.
  * @module scripts/clean
- *   By default, it removes the 'dist' and 'logs' directories.
- *   Custom directories can be specified as command-line arguments.
+ *   By default, it removes the 'dist' and 'logs' directories plus every
+ *   TypeScript build-info file the project's tsconfigs write — in the root and
+ *   in 'config/', where a tsconfig kept there resolves its relative
+ *   `tsBuildInfoFile` against itself.
+ *   Custom directories can be specified as command-line arguments, which
+ *   replace the default set entirely.
  *   Works on all platforms using Node.js path normalization.
  *
  * @example
- * // Default directories (dist, logs):
+ * // Default targets (dist, logs, build info):
  * // bun run scripts/clean.ts
  *
  * // Custom directories:
@@ -21,6 +25,38 @@ interface CleanResult {
   status: 'cleaned' | 'skipped' | 'error';
 }
 
+/**
+ * A TypeScript build-info file: the plain `.tsbuildinfo`, a `<name>.tsbuildinfo`,
+ * and the lane-suffixed `.tsbuildinfo.<lane>` forms a multi-tsconfig project
+ * writes (`tsBuildInfoFile: ".tsbuildinfo.worker"`).
+ */
+const BUILD_INFO_FILE = /\.tsbuildinfo(\.[^.]*)?$/;
+
+/**
+ * Directories a tsconfig may write its build info into. A `tsBuildInfoFile` is
+ * resolved against the tsconfig that declares it, so a project keeping its
+ * tsconfigs in `config/` leaves build info there rather than at the root.
+ */
+const BUILD_INFO_DIRS = ['.', 'config'];
+
+/** Every build-info file under the scanned directories, as root-relative paths. */
+async function findBuildInfoFiles(root: string): Promise<string[]> {
+  const found = await Promise.all(
+    BUILD_INFO_DIRS.map(async (dir) => {
+      let entries: string[];
+      try {
+        entries = await readdir(resolve(root, dir));
+      } catch {
+        return []; // directory absent — nothing to clean there
+      }
+      return entries
+        .filter((entry) => BUILD_INFO_FILE.test(entry))
+        .map((entry) => (dir === '.' ? entry : `${dir}/${entry}`));
+    }),
+  );
+  return found.flat();
+}
+
 /**
  * Validates that a resolved path stays within the project root.
  * Rejects absolute paths, '..' traversal, and paths that escape cwd.
@@ -46,7 +82,7 @@ const clean = async (): Promise<void> => {
   try {
     const root = process.cwd();
     const args = process.argv.slice(2);
-    const buildInfoFiles = (await readdir(root)).filter((f) => f.endsWith('.tsbuildinfo'));
+    const buildInfoFiles = await findBuildInfoFiles(root);
     const dirsToClean = [...new Set(args.length > 0 ? args : ['dist', 'logs', ...buildInfoFiles])];
 
     console.log(`Cleaning directories: ${dirsToClean.join(', ')}`);

package/scripts/devcheck.ts

@@ -624,6 +624,13 @@ function classifyAuditVulns(output: string): { direct: string[]; upstream: strin
 // Define file extensions for linting and formatting
 const LINT_EXTS = ['.ts', '.tsx', '.js', '.jsx'];
 
+/**
+ * Worker tsconfig locations, in precedence order. A project keeps its project
+ * tsconfigs in `config/` or at the root — the `init` scaffold writes the root
+ * form — and this script ships to both verbatim.
+ */
+const WORKER_PROJECT_CANDIDATES = ['config/tsconfig.worker.json', 'tsconfig.worker.json'];
+
 const ALL_CHECKS: Check[] = [
   // Fast checks first (local operations, no network)
   {
@@ -703,18 +710,23 @@ const ALL_CHECKS: Check[] = [
     flag: '--no-packaging',
     canFix: false,
     // Validates env var alignment between manifest.json (MCPB bundle) and
-    // server.json (MCP Registry), plus plugin marketplace manifests (#240), and
-    // the bundle-content guards on .mcpbignore (#343). Runs when any of those
-    // inputs is present; skipped cleanly when none exist — consumers on an
-    // HTTP-only deploy are unaffected.
+    // server.json (MCP Registry), plus plugin marketplace manifests (#240), the
+    // bundle-content guards on .mcpbignore (#343), and the README version badge
+    // (#418). Runs when any of those inputs is present; skipped cleanly when
+    // none exist — consumers on an HTTP-only deploy are unaffected. README.md is
+    // a trigger in its own right: the badge check must gate a project that
+    // carries no bundle or plugin metadata at all, which the other three inputs
+    // only covered incidentally.
     getCommand: () => {
-      const hasManifest = existsSync(path.join(ROOT_DIR, 'manifest.json'));
-      const hasPluginManifest =
-        existsSync(path.join(ROOT_DIR, '.claude-plugin/plugin.json')) ||
-        existsSync(path.join(ROOT_DIR, '.codex-plugin/plugin.json')) ||
-        existsSync(path.join(ROOT_DIR, '.codex-plugin/mcp.json'));
-      const hasMcpbIgnore = existsSync(path.join(ROOT_DIR, '.mcpbignore'));
-      if (!hasManifest && !hasPluginManifest && !hasMcpbIgnore) return null;
+      const inputs = [
+        'manifest.json',
+        '.claude-plugin/plugin.json',
+        '.codex-plugin/plugin.json',
+        '.codex-plugin/mcp.json',
+        '.mcpbignore',
+        'README.md',
+      ];
+      if (!inputs.some((input) => existsSync(path.join(ROOT_DIR, input)))) return null;
       return ['bun', 'run', 'scripts/lint-packaging.ts'];
     },
     tip: (c) =>
@@ -864,14 +876,20 @@ const ALL_CHECKS: Check[] = [
     canFix: false,
     // The workerd type environment is its own program: Cloudflare's ambient
     // globals cannot share one with @types/node's (#397). It reads the built
-    // declarations, so it only has something to check after a build.
+    // declarations, so it only has something to check after a build. The
+    // tsconfig is looked for in both supported layouts — `config/` and the
+    // project root, which is where the `init` scaffold writes its tsconfigs
+    // (#440) — and the step skips only when neither carries one.
     getCommand: (ctx) => {
-      if (!existsSync(path.join(ctx.rootDir, 'config', 'tsconfig.worker.json'))) return null;
+      const project = WORKER_PROJECT_CANDIDATES.find((candidate) =>
+        existsSync(path.join(ctx.rootDir, candidate)),
+      );
+      if (!project) return null;
       if (!existsSync(path.join(ctx.rootDir, 'dist'))) return null;
       return [
         path.join(ctx.rootDir, 'node_modules', '.bin', 'tsc'),
         '--project',
-        'config/tsconfig.worker.json',
+        project,
         '--noEmit',
       ];
     },
@@ -1030,8 +1048,21 @@ const UI = {
     return `${c.bold(c.yellow(`🔶 Skipping ${check.name}...`))}${c.dim(` (${reason})`)}`;
   },
 
+  /**
+   * The running-log line for a finished step. A result `isSuccess` demoted to a
+   * warning is reported as one here too, on `printSummary`'s own guard
+   * (`exitCode === 0 && warning`), so the two surfaces cannot disagree about a
+   * single outcome (#344). A `{ success: false, warning }` return keeps its
+   * non-zero exit and so still renders as a failure.
+   */
   formatCheckResult(result: CommandResult, _mode: UIMode): string {
-    const { checkName, exitCode, duration } = result;
+    const { checkName, exitCode, duration, warning } = result;
+    if (exitCode === 0 && warning) {
+      return [
+        `${c.bold(c.yellow('⚠️'))} ${c.yellow(checkName)} ${c.yellow(`finished with a warning in ${duration}ms.`)}`,
+        c.yellow(warning.replace(/^/gm, '   | ')),
+      ].join('\n');
+    }
     if (exitCode === 0) {
       return `${c.bold(c.green('✅'))} ${c.yellow(checkName)} ${c.green(`finished successfully in ${duration}ms.`)}`;
     }

package/scripts/lint-packaging.ts

@@ -54,6 +54,11 @@
  *      path variables (the host delivers anything else as the literal string),
  *      and an optional string option has `"default": ""` so a blank answer
  *      arrives as empty rather than as the unsubstituted placeholder.
+ *  12. README version badge parity: a shields.io `Version-<semver>-` badge in
+ *      `README.md` must carry the `package.json` `version`. The badge is the
+ *      package's headline version on GitHub and npmjs.com and ships in the
+ *      tarball, so a half-finished bump is publicly visible. Skipped when the
+ *      README, the badge, or the package version is absent (issue #418).
  *
  * Every check skips cleanly when its input is absent — consumers who deleted
  * `manifest.json` for an HTTP-only deploy, or who haven't built a bundle,
@@ -99,8 +104,10 @@ const USER_CONFIG_REF = /^\$\{user_config\.([\w-]+)\}$/;
 /**
  * Root dev directories the scaffold template excludes from the bundle, and
  * whose `.mcpbignore` patterns must be anchored with `/` to avoid also
- * stripping nested runtime paths like `node_modules/x/framework-skills/`. Keep in step
- * with the directory entries in `templates/_.mcpbignore`.
+ * stripping nested runtime paths like `node_modules/x/framework-skills/`. Keep
+ * in step with the directory entries in this project's `.mcpbignore` — seeded
+ * from the mcp-ts-core repository's `templates/_.mcpbignore`, whose `_` prefix
+ * `init` drops on copy.
  */
 export const KNOWN_DEV_DIRS = ['framework-skills/', '.agents/', '.claude/'];
 
@@ -121,7 +128,10 @@ export const CRITICAL_RUNTIME_PATHS = [
  * `framework-skills/` is this framework's tree; `skills/` covers any other
  * dependency that vendors agent skills.
  * KEEP IN SYNC with `AGENT_DOC_ENTRY` in `scripts/clean-mcpb.ts` (the strip
- * step this check verifies) — a unit test asserts the two are identical.
+ * step this check verifies) — edit both literals together. The assertion that
+ * they match lives in the mcp-ts-core repository's own test suite; `tests/` is
+ * not part of the published package, so nothing enforces the pair in a server
+ * these scripts were copied into.
  */
 export const AGENT_DOC_ENTRY =
   /^node_modules\/.*(?:\/framework-skills\/|\/skills\/|\/\.claude\/|\/\.agents\/|\/SKILL\.md$)/;
@@ -129,7 +139,10 @@ export const AGENT_DOC_ENTRY =
 /**
  * Platform-specific native binding packages that must not ship in a bundle.
  * KEEP IN SYNC with `NATIVE_BINDING_ENTRY` in `scripts/clean-mcpb.ts` (the
- * strip step this check verifies) — a unit test asserts the two are identical.
+ * strip step this check verifies) — edit both literals together. The assertion
+ * that they match lives in the mcp-ts-core repository's own test suite;
+ * `tests/` is not part of the published package, so nothing enforces the pair
+ * in a server these scripts were copied into.
  */
 export const NATIVE_BINDING_ENTRY = /^node_modules\/@duckdb\/node-bindings-[^/]+\//;
 
@@ -673,6 +686,62 @@ export function checkPluginManifests(
   return errors;
 }
 
+/**
+ * The shields.io static version badge, anchored on the `Version-` label and the
+ * `-` that closes the version segment. A literal `-` inside a badge segment is
+ * escaped as `--`, so the segment is "runs of non-dash characters joined by
+ * escaped dashes" — which also keeps the scan linear, since the alternation
+ * cannot match the same character two ways. Anchoring on the label and the
+ * trailing `-` tolerates colour, extension, and query-string variation without
+ * enumerating them, and matches no other badge: a live `img.shields.io/npm/v/…`
+ * badge has no `badge/Version-` path.
+ */
+const README_VERSION_BADGE = /img\.shields\.io\/badge\/Version-([^-]*(?:--[^-]*)*)-/;
+
+/**
+ * A version the badge can be compared against once its `--` escapes are
+ * decoded: the semver core, then at most one `-` prerelease segment and one
+ * `+` build segment. The two are separate optionals rather than one repeated
+ * `(?:[-+]…)*`, because `-` is itself a member of the segment character class
+ * — a repeated group can split a run of dashes two ways and backtracks
+ * exponentially on a segment the check is about to reject (CodeQL `js/redos`,
+ * CWE-1333). `+` is outside the class, so each segment's end is determined and
+ * the scan stays linear.
+ */
+const READABLE_VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+
+/**
+ * Check 12: README version badge parity. When `README.md` carries a shields.io
+ * `Version-<semver>-` badge, its version must equal `package.json` `version` —
+ * the badge is the package's headline version on GitHub and npmjs.com, and it
+ * ships in the tarball, so a half-finished bump is publicly visible.
+ *
+ * Skipped when the README, the badge, or the package version is absent: a
+ * server that replaced the static badge with a live `npm/v` one has nothing to
+ * check, and a version-less `package.json` is the same fail-safe the
+ * plugin-manifest parity check applies. A badge that exists but cannot be read
+ * is drift the check cannot rule out, so it fails rather than skips.
+ */
+export function checkReadmeVersionBadge(readme: string, packageVersion?: string): string[] {
+  if (!packageVersion) return [];
+
+  const segment = README_VERSION_BADGE.exec(readme)?.[1];
+  if (segment === undefined) return [];
+
+  const badgeVersion = segment.replaceAll('--', '-');
+  if (!READABLE_VERSION.test(badgeVersion)) {
+    return [
+      `README.md version badge segment is "${segment}" — not a readable version, so it cannot be ` +
+        `checked against the package.json version "${packageVersion}"; write the badge as ` +
+        `"Version-${packageVersion.replaceAll('-', '--')}-"`,
+    ];
+  }
+  if (badgeVersion === packageVersion) return [];
+  return [
+    `README.md version badge is "${badgeVersion}" — must equal the package.json version "${packageVersion}"`,
+  ];
+}
+
 /** Read `packaging.pluginManifests` from devcheck.config.json; default on. */
 function pluginManifestsEnabled(): boolean {
   const cfg = tryReadJson<{ packaging?: { pluginManifests?: boolean } }>(
@@ -805,6 +874,12 @@ async function main(): Promise<void> {
     }
   }
 
+  // ── README version badge (check 12) ──
+  const readmePath = resolve('README.md');
+  if (existsSync(readmePath)) {
+    errors.push(...checkReadmeVersionBadge(readFileSync(readmePath, 'utf-8'), pkg?.version));
+  }
+
   // ── Plugin marketplace manifests (check 10) ──
   if (unscopedName && pkg?.name) {
     if (pluginManifestsEnabled()) {

package/templates/.github/workflows/codeql.yml

@@ -0,0 +1,39 @@
+# CodeQL static analysis — the one workflow every server carries.
+# Verification (typecheck, lint, tests) is local; this file exists because CodeQL
+# is GitHub-owned end to end and a workflow file is visible in the repo where a
+# repo-level "default setup" is not. Default setup must be OFF for this to run.
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '30 6 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: javascript-typescript, actions
+          build-mode: none
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4

package/templates/AGENTS.md

@@ -311,7 +311,7 @@ Available skills:
 | `code-simplifier` | Post-session cleanup against `git diff` — modernize syntax, consolidate duplication, align with the codebase |
 | `polish-docs-meta` | Finalize docs, README, metadata, and agent protocol for shipping |
 | `git-wrapup` | Land working-tree changes as a commit stack — version bump, changelog, verify, commit by concern, release commit on top. No tag, no push to main; opens the release PR when the project declares release PR mode |
-| `release-pr-review` | Review pass on an open release PR — simplifier + correctness review, fixup commits autosquashed into the stack, PR body kept in sync. Release PR mode only |
+| `release-pr-review` | Review pass on an open release PR — simplifier + correctness review, fixes as ordinary commits on top of the stack, PR body kept in sync. Release PR mode only |
 | `release-and-publish` | Fast-forward merge (release PR mode) + tag + push + npm + MCP Registry + GH Release + Docker. Picks up from `git-wrapup` |
 | `maintenance` | Investigate changelogs, adopt upstream changes, sync skills to agent dirs |
 | `orchestrations` | Chain task skills into a gated multi-phase pipeline — build-out, QA-fix, update-ship — when you can spawn sub-agents |
@@ -362,6 +362,8 @@ When you complete a skill's checklist, check the boxes and add a completion time
 | `bun run changelog:check` | Verify `CHANGELOG.md` is in sync (used by devcheck) |
 | `bun run bundle` | Build, pack, and clean a `.mcpb` for one-click Claude Desktop install |
 
+**CI is one file.** `.github/workflows/codeql.yml` (scaffolded) is the only GitHub Actions workflow: CodeQL is GitHub-owned end to end, and the file runs only while the repo's CodeQL *default setup* is turned off. Verification — `devcheck`, tests, the release gates — runs locally; don't add a workflow that re-runs it.
+
 ---
 
 ## Bundling

package/templates/CLAUDE.md

@@ -311,7 +311,7 @@ Available skills:
 | `code-simplifier` | Post-session cleanup against `git diff` — modernize syntax, consolidate duplication, align with the codebase |
 | `polish-docs-meta` | Finalize docs, README, metadata, and agent protocol for shipping |
 | `git-wrapup` | Land working-tree changes as a commit stack — version bump, changelog, verify, commit by concern, release commit on top. No tag, no push to main; opens the release PR when the project declares release PR mode |
-| `release-pr-review` | Review pass on an open release PR — simplifier + correctness review, fixup commits autosquashed into the stack, PR body kept in sync. Release PR mode only |
+| `release-pr-review` | Review pass on an open release PR — simplifier + correctness review, fixes as ordinary commits on top of the stack, PR body kept in sync. Release PR mode only |
 | `release-and-publish` | Fast-forward merge (release PR mode) + tag + push + npm + MCP Registry + GH Release + Docker. Picks up from `git-wrapup` |
 | `maintenance` | Investigate changelogs, adopt upstream changes, sync skills to agent dirs |
 | `orchestrations` | Chain task skills into a gated multi-phase pipeline — build-out, QA-fix, update-ship — when you can spawn sub-agents |
@@ -362,6 +362,8 @@ When you complete a skill's checklist, check the boxes and add a completion time
 | `bun run changelog:check` | Verify `CHANGELOG.md` is in sync (used by devcheck) |
 | `bun run bundle` | Build, pack, and clean a `.mcpb` for one-click Claude Desktop install |
 
+**CI is one file.** `.github/workflows/codeql.yml` (scaffolded) is the only GitHub Actions workflow: CodeQL is GitHub-owned end to end, and the file runs only while the repo's CodeQL *default setup* is turned off. Verification — `devcheck`, tests, the release gates — runs locally; don't add a workflow that re-runs it.
+
 ---
 
 ## Bundling

package/templates/package.json

@@ -72,8 +72,8 @@
     "@vitest/coverage-istanbul": "4.1.11",
     "depcheck": "^1.4.7",
     "fast-check": "^4.9.0",
-    "ignore": "^7.0.7",
-    "tsc-alias": "^1.9.2",
+    "ignore": "^7.0.9",
+    "tsc-alias": "^1.9.5",
     "typescript": "^7.0.2",
     "vitest": "^4.1.11"
   }

package/templates/src/index.ts

@@ -17,9 +17,10 @@ await createApp({
   tools: [echoTool, echoAppTool],
   resources: [echoResource, echoAppUiResource],
   prompts: [echoPrompt],
-  // instructions: 'Server-level orientation forwarded to the model on every initialize.\n' +
-  //   '- Use shortcut `X` for the most common case\n' +
-  //   '- Tools require auth via the `inventory:read` scope',
+  // Server-level orientation forwarded to the model on every initialize: two to three
+  // cohesive sentences in one string literal, written for the calling agent (which tool
+  // opens a workflow, what chains into what). Operator configuration stays in the README.
+  // instructions: 'Resolve a name to an id with example_search, then pass that id to example_get for the full record. Results are paged; follow nextOffset until it is absent.',
 
   // Session posture in code rather than in a Dockerfile. MCP_SESSION_MODE still
   // wins when it is set. Add `require: 'stateful'` — `{ default: 'stateful',