@deepseek-ai/dsh-mcp-client 0.1.5-alpha.1 → 0.1.5-alpha.2

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/mcp/mcp-client/README.md
-README.md: 112f477556d1b8ee2788c9b96251b6969c617f62
-README.zh.md: e642c7e130510cd717342a2e879c26396c77d55d
+README.md: de646256888f1c271ad94a4c863338dfb02551e6
+README.zh.md: 2c71060ec309e823ff3456207881e27ab9aca553

package/README.md

@@ -76,6 +76,7 @@ The model sees each tool under a stable server-qualified name: `mcp__<serverName
 - Two servers publishing the same tool name (for example `search`) coexist under their own namespaces.
 - Two entries using the same server name: the later one fails to load with a clear error.
 - A server that lists the same tool twice gets its tool list rejected as invalid, and the previous tool set stays active.
+- A repeated non-empty `tools/list` continuation cursor rejects that update immediately, including cycles through empty pages; the previous tool set stays active and later updates can still succeed.
 - An update that conflicts with an already-registered tool name is rejected entirely — you never get a partial tool set from that server.
 
 ### Calling tools and reading results

package/README.zh.md

@@ -76,6 +76,7 @@ kind: "package-reference"
 - 发布相同工具名称（例如 `search`）的两个服务器会在各自的 namespace 下共存。
 - 两条配置项使用相同的服务器名称时，后加载的一条会在加载时以明确错误失败。
 - 服务器在工具列表中两次列出同一工具时，其工具列表会被作为无效列表拒绝，上一组工具保持可用。
+- `tools/list` 返回重复的非空续传游标时会立即拒绝本次更新，包括经过空页的循环；上一组工具保持可用，后续更新仍可成功。
 - 工具更新与已有工具名称冲突时，该更新会被整体拒绝——绝不会得到该服务器的部分工具集。
 
 ### 调用工具与读取结果

package/lib/index.js

@@ -131,8 +131,8 @@ function publicToolName(serverName, rawName) {
 *
 * 1. Fetch: drain uncached `tools/list` pagination and build the full next
 *    generation of `ToolDefinition`s under public names. Any failure here
-*    (network error, duplicate raw name in the server's list) rejects and
-*    leaves the previous generation registered untouched.
+*    (network error, duplicate raw name, repeated continuation cursor) rejects
+*    and leaves the previous generation registered untouched.
 * 2. Swap: dispose the previous generation, register the new one. A registry
 *    conflict here can only mean a foreign registration squats on this
 *    server's `mcp__<serverName>__` namespace — the partial generation is
@@ -150,6 +150,7 @@ function publicToolName(serverName, rawName) {
 */
 async function syncTools(client, ctx, opts, previous) {
 	const definitions = /* @__PURE__ */ new Map();
+	const seenCursors = /* @__PURE__ */ new Set();
 	let cursor;
 	do {
 		const response = await listToolsUncached(client, cursor);
@@ -159,6 +160,10 @@ async function syncTools(client, ctx, opts, previous) {
 			definitions.set(publicName, createDefinition(client, ctx, publicName, tool.name, tool.description ?? "", tool.inputSchema, supportedOutputSchema(tool.outputSchema), tool.execution?.taskSupport === "required", opts));
 		}
 		cursor = response.nextCursor;
+		if (cursor) {
+			if (seenCursors.has(cursor)) throw new Error(`mcp-client(${opts.serverName}): server repeated a tools/list continuation cursor — invalid tool list`);
+			seenCursors.add(cursor);
+		}
 	} while (cursor);
 	for (const dispose of previous.values()) dispose();
 	const disposers = /* @__PURE__ */ new Map();

package/lib/types/tools.d.ts

@@ -50,8 +50,8 @@ export declare function publicToolName(serverName: string, rawName: string): str
  *
  * 1. Fetch: drain uncached `tools/list` pagination and build the full next
  *    generation of `ToolDefinition`s under public names. Any failure here
- *    (network error, duplicate raw name in the server's list) rejects and
- *    leaves the previous generation registered untouched.
+ *    (network error, duplicate raw name, repeated continuation cursor) rejects
+ *    and leaves the previous generation registered untouched.
  * 2. Swap: dispose the previous generation, register the new one. A registry
  *    conflict here can only mean a foreign registration squats on this
  *    server's `mcp__<serverName>__` namespace — the partial generation is

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-mcp-client",
   "description": "MCP client bridge: connects to MCP servers and registers their tools on ctx.tools",
-  "version": "0.1.5-alpha.1",
+  "version": "0.1.5-alpha.2",
   "publishConfig": {
     "access": "public"
   },
@@ -27,13 +27,13 @@
   ],
   "license": "MIT",
   "peerDependencies": {
-    "@deepseek-ai/dsh-llm": "^0.1.5-alpha.1",
-    "@deepseek-ai/dsh-scope": "^0.1.5-alpha.1",
-    "@deepseek-ai/dsh-subprocess": "^0.1.5-alpha.1",
-    "@deepseek-ai/dsh-timeout": "^0.1.5-alpha.1",
-    "@deepseek-ai/dsh-tools": "^0.1.5-alpha.1",
-    "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-attachment": "^0.1.5-alpha.1"
+    "@deepseek-ai/dsh-llm": "^0.1.5-alpha.2",
+    "@deepseek-ai/dsh-attachment": "^0.1.5-alpha.2",
+    "@deepseek-ai/dsh-scope": "^0.1.5-alpha.2",
+    "@deepseek-ai/dsh-subprocess": "^0.1.5-alpha.2",
+    "@deepseek-ai/dsh-tools": "^0.1.5-alpha.2",
+    "@deepseek-ai/dsh-timeout": "^0.1.5-alpha.2",
+    "@deepseek-ai/cordis": "^4.0.2"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.12.0",
@@ -43,14 +43,14 @@
   "devDependencies": {
     "@modelcontextprotocol/server-everything": "^2026.7.4",
     "@modelcontextprotocol/server-filesystem": "^2026.7.4",
-    "@deepseek-ai/dsh-attachment": "^0.1.5-alpha.1",
-    "@deepseek-ai/dsh-attachment-local": "^0.1.5-alpha.1",
-    "@deepseek-ai/dsh-llm": "^0.1.5-alpha.1",
-    "@deepseek-ai/dsh-scope": "^0.1.5-alpha.1",
-    "@deepseek-ai/dsh-subprocess": "^0.1.5-alpha.1",
-    "@deepseek-ai/dsh-tools": "^0.1.5-alpha.1",
-    "@deepseek-ai/dsh-timeout": "^0.1.5-alpha.1",
+    "@deepseek-ai/dsh-attachment": "^0.1.5-alpha.2",
+    "@deepseek-ai/dsh-attachment-local": "^0.1.5-alpha.2",
+    "@deepseek-ai/dsh-llm": "^0.1.5-alpha.2",
+    "@deepseek-ai/dsh-scope": "^0.1.5-alpha.2",
+    "@deepseek-ai/dsh-subprocess": "^0.1.5-alpha.2",
+    "@deepseek-ai/dsh-timeout": "^0.1.5-alpha.2",
+    "@deepseek-ai/dsh-tools": "^0.1.5-alpha.2",
     "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-http-proxy": "^0.1.5-alpha.1"
+    "@deepseek-ai/dsh-http-proxy": "^0.1.5-alpha.2"
   }
 }