@dpesch/mantisbt-mcp-server 1.14.0 → 1.15.0

package/dist/deprecation.js

@@ -0,0 +1,9 @@
+/** Major version in which deprecated tools are removed (see versioning rules in CLAUDE.md). */
+export const REMOVAL_VERSION = '2.0.0';
+/**
+ * First line of the description of a deprecated tool. Keeping the wording in
+ * one place keeps README, CHANGELOG and tests consistent.
+ */
+export function deprecationNote(tool, replacement) {
+    return `Deprecated: use ${replacement} instead — ${tool} will be removed in ${REMOVAL_VERSION}.`;
+}

package/dist/index.js

@@ -10,19 +10,8 @@ import { getConfig, getStartupConfig, assertHttpAuthConfigured } from './config.
 import { MantisClient } from './client.js';
 import { VersionHintService, setGlobalVersionHint } from './version-hint.js';
 import { MetadataCache } from './cache.js';
-import { registerIssueTools } from './tools/issues.js';
-import { registerNoteTools } from './tools/notes.js';
-import { registerFileTools } from './tools/files.js';
-import { registerRelationshipTools } from './tools/relationships.js';
-import { registerMonitorTools } from './tools/monitors.js';
-import { registerProjectTools } from './tools/projects.js';
-import { registerProjectVersionTools } from './tools/project-versions.js';
-import { registerUserTools } from './tools/users.js';
-import { registerFilterTools } from './tools/filters.js';
-import { registerConfigTools } from './tools/config.js';
-import { registerMetadataTools } from './tools/metadata.js';
-import { registerTagTools } from './tools/tags.js';
-import { registerVersionTools } from './tools/version.js';
+import { registerAllTools } from './tools/index.js';
+import { filterToolRegistration } from './toolsets.js';
 import { registerPrompts } from './prompts/index.js';
 import { registerResources } from './resources/index.js';
 // ---------------------------------------------------------------------------
@@ -55,26 +44,26 @@ async function createMcpServer(transport) {
         name: 'mantisbt-mcp-server',
         version,
     });
-    registerIssueTools(server, client, cache);
-    registerNoteTools(server, client);
-    registerFileTools(server, client, startupConfig.uploadDir, transport);
-    registerRelationshipTools(server, client);
-    registerMonitorTools(server, client);
-    registerProjectTools(server, client, cache);
-    registerProjectVersionTools(server, client, cache);
-    registerUserTools(server, client);
-    registerFilterTools(server, client);
-    registerConfigTools(server, client, cache);
-    registerMetadataTools(server, client, cache);
-    registerTagTools(server, client);
-    registerVersionTools(server, client, versionHint, version);
+    // Tools register through a filter for MANTIS_TOOLSETS / MANTIS_DISABLE_DESTRUCTIVE;
+    // prompts and resources use the server directly.
+    const tools = filterToolRegistration(server, startupConfig);
+    // Optional: Semantic search module — needs MANTIS_SEARCH_ENABLED=true and the
+    // "search" tool group (skipping it avoids loading the model and the index).
+    // Initialized first so get_metadata can report the index status.
+    const searchIndexStatus = startupConfig.search.enabled && startupConfig.toolsets.has('search')
+        ? await (await import('./search/index.js')).initializeSearchModule(tools, client, startupConfig.search)
+        : undefined;
+    registerAllTools(tools, {
+        client,
+        cache,
+        versionHint,
+        version,
+        uploadDir: startupConfig.uploadDir,
+        transport,
+        searchIndexStatus,
+    });
     registerPrompts(server);
     registerResources(server, client, cache, startupConfig.testEnvironment);
-    // Optional: Semantic search module
-    if (startupConfig.search.enabled) {
-        const { initializeSearchModule } = await import('./search/index.js');
-        await initializeSearchModule(server, client, startupConfig.search);
-    }
     return server;
 }
 // ---------------------------------------------------------------------------

package/dist/issue-enrich.js

@@ -0,0 +1,23 @@
+import { buildAttachmentDownloadUrl, buildIssueViewUrl, buildNoteViewUrl } from './client.js';
+/**
+ * Adds the links MantisBT's REST API leaves out: view_url for the issue and
+ * each note, download_url for each attachment (REST sends it only via SOAP).
+ * issueId is the fallback when a select projection excluded the id field.
+ */
+export function enrichIssue(issue, baseUrl, issueId) {
+    const id = issue.id ?? issueId;
+    if (id === undefined)
+        return issue;
+    return {
+        ...issue,
+        view_url: buildIssueViewUrl(baseUrl, id),
+        notes: issue.notes?.map(note => ({
+            ...note,
+            view_url: buildNoteViewUrl(baseUrl, id, note.id),
+        })),
+        attachments: issue.attachments?.map(file => ({
+            ...file,
+            download_url: buildAttachmentDownloadUrl(baseUrl, file.id),
+        })),
+    };
+}

package/dist/issue-envelope.js

@@ -0,0 +1,4 @@
+/** The issue from a MantisBT issue response, whichever of the two envelopes it uses. */
+export function firstIssue(response) {
+    return response?.issues?.[0] ?? response?.issue;
+}

package/dist/prompts/index.js

@@ -16,7 +16,7 @@ export function registerPrompts(server) {
         description: 'Guide the creation of a complete bug report in MantisBT. Project, category, summary, and description are required.',
         argsSchema: {
             project_id: z.coerce.number().int().positive().describe('Numeric project ID'),
-            category: z.string().describe('Issue category (call get_project_categories to list valid values)'),
+            category: z.string().describe('Issue category (call get_project with include: ["categories"] to list valid values)'),
             summary: z.string().describe('Short, descriptive summary of the bug'),
             description: z.string().describe('Detailed description of the bug'),
             steps_to_reproduce: z.string().optional().describe('Step-by-step reproduction instructions'),
@@ -46,7 +46,7 @@ export function registerPrompts(server) {
         if (environment) {
             lines.push(``, `Environment:`, environment);
         }
-        lines.push(``, `Use the create_issue tool to submit this bug report.`, `Call get_issue_enums first if you need to look up valid severity and priority values.`, `Default to severity "minor" and priority "normal" unless the user specifies otherwise.`);
+        lines.push(``, `Use the create_issue tool to submit this bug report.`, `Call get_issue_schema first if you need to look up valid severity and priority values.`, `Default to severity "minor" and priority "normal" unless the user specifies otherwise.`);
         return userMessage(lines.join('\n'));
     });
     // ---------------------------------------------------------------------------
@@ -57,7 +57,7 @@ export function registerPrompts(server) {
         description: 'Guide the creation of a feature request in MantisBT. Project, category, summary, and description are required.',
         argsSchema: {
             project_id: z.coerce.number().int().positive().describe('Numeric project ID'),
-            category: z.string().describe('Issue category (call get_project_categories to list valid values)'),
+            category: z.string().describe('Issue category (call get_project with include: ["categories"] to list valid values)'),
             summary: z.string().describe('Short description of the requested feature'),
             description: z.string().describe('Detailed description of the feature'),
             use_case: z.string().optional().describe('Business use case or motivation for the feature'),
@@ -75,7 +75,7 @@ export function registerPrompts(server) {
         if (use_case) {
             lines.push(``, `Use case / motivation:`, use_case);
         }
-        lines.push(``, `Use the create_issue tool to submit this feature request.`, `Call get_issue_enums first to look up valid severity values — use severity "feature" and priority "normal" unless the user specifies otherwise.`);
+        lines.push(``, `Use the create_issue tool to submit this feature request.`, `Call get_issue_schema first to look up valid severity values — use severity "feature" and priority "normal" unless the user specifies otherwise.`);
         return userMessage(lines.join('\n'));
     });
     // ---------------------------------------------------------------------------

package/dist/resources/index.js

@@ -1,7 +1,6 @@
 import { ResourceTemplate } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { fetchIssueEnums } from '../tools/config.js';
-import { normalizeProject } from '../tools/metadata.js';
-import { ALL_PROJECTS_PREFIX } from '../constants.js';
+import { normalizeProject, stripAllProjectsPrefix } from '../tools/metadata.js';
 function jsonResource(uri, data) {
     return {
         contents: [{ uri: uri.href, mimeType: 'application/json', text: JSON.stringify(data) }],
@@ -21,7 +20,7 @@ export function registerResources(server, client, cache, testEnvironment = false
     }, async (uri) => jsonResource(uri, await client.get('users/me')));
     server.registerResource('projects', 'mantis://projects', {
         title: 'Projects',
-        description: 'All MantisBT projects accessible to the current API user. Served from local cache when fresh; falls back to live fetch. Refresh via the sync_metadata tool.',
+        description: 'All MantisBT projects accessible to the current API user. Served from local cache when fresh; falls back to live fetch. Refresh via get_metadata with refresh: true.',
         mimeType: 'application/json',
     }, async (uri) => jsonResource(uri, await loadProjects()));
     server.registerResource('project-detail', new ResourceTemplate('mantis://projects/{id}', {
@@ -40,7 +39,7 @@ export function registerResources(server, client, cache, testEnvironment = false
         },
     }), {
         title: 'Project Detail',
-        description: 'Combined project view: fields (status, view_state, access_level, description) plus all associated users, versions, and categories. Served from local cache when fresh; falls back to live API fetch. Refresh via the sync_metadata tool.',
+        description: 'Combined project view: fields (status, view_state, access_level, description) plus all associated users, versions, and categories. Served from local cache when fresh; falls back to live API fetch. Refresh via get_metadata with refresh: true.',
         mimeType: 'application/json',
     }, async (uri, { id }) => {
         const numId = Number(id);
@@ -66,10 +65,7 @@ export function registerResources(server, client, cache, testEnvironment = false
             project = raw ? normalizeProject(raw) : undefined;
             users = usersResult.users ?? [];
             versions = versionsResult.versions ?? [];
-            categories = (raw?.categories ?? []).map((c) => ({
-                ...c,
-                name: c.name.startsWith(ALL_PROJECTS_PREFIX) ? c.name.slice(ALL_PROJECTS_PREFIX.length) : c.name,
-            }));
+            categories = stripAllProjectsPrefix(raw?.categories ?? []);
         }
         if (!project) {
             throw new Error(`Project ${numId} not found`);

package/dist/search/embedder.js

@@ -6,17 +6,51 @@
 // @huggingface/transformers is an optional dependency. The import is
 // guarded with a try/catch so the server starts without it.
 // ---------------------------------------------------------------------------
+// A loaded model takes ~0.9 GB RAM, and every client session runs its own
+// server process. An idle process releases the model; the next use reloads it.
+const IDLE_UNLOAD_MS = 10 * 60 * 1000;
 export class Embedder {
     modelName;
     numThreads;
     pipe = null;
+    running = 0;
+    idleTimer = null;
     constructor(modelName, numThreads = 1) {
         this.modelName = modelName;
         this.numThreads = numThreads;
     }
+    async withPipeline(fn) {
+        this.running++;
+        if (this.idleTimer) {
+            clearTimeout(this.idleTimer);
+            this.idleTimer = null;
+        }
+        try {
+            if (!this.pipe) {
+                const loading = this.load();
+                // Never keep a failed load around — the next call retries.
+                loading.catch(() => { if (this.pipe === loading)
+                    this.pipe = null; });
+                this.pipe = loading;
+            }
+            return await fn(await this.pipe);
+        }
+        finally {
+            // The timer only runs while nothing is embedding; unref() keeps it from
+            // holding the process alive.
+            if (--this.running === 0 && this.pipe) {
+                this.idleTimer = setTimeout(() => void this.unload(), IDLE_UNLOAD_MS).unref();
+            }
+        }
+    }
+    async unload() {
+        const pipe = this.pipe;
+        this.idleTimer = null;
+        this.pipe = null;
+        process.stderr.write(`[mantisbt-search] Unloading idle embedding model ${this.modelName}\n`);
+        await (await pipe).dispose?.();
+    }
     async load() {
-        if (this.pipe)
-            return this.pipe;
         process.stderr.write(`[mantisbt-search] Loading embedding model ${this.modelName} (threads: ${this.numThreads})...\n`);
         let transformers;
         try {
@@ -27,29 +61,30 @@ export class Embedder {
             const msg = err instanceof Error ? err.message : String(err);
             throw new Error(`Failed to load @huggingface/transformers: ${msg}`);
         }
-        this.pipe = await transformers.pipeline('feature-extraction', this.modelName, {
+        return transformers.pipeline('feature-extraction', this.modelName, {
             session_options: {
                 intra_op_num_threads: this.numThreads,
                 inter_op_num_threads: 1, // Transformer graphs are sequential — no benefit from inter-op parallelism
             },
         });
-        return this.pipe;
     }
     async embed(text) {
-        const extractor = await this.load();
-        const output = await extractor(text, { pooling: 'mean', normalize: true });
-        return extractVector(output);
+        return this.withPipeline(async (extractor) => {
+            const output = await extractor(text, { pooling: 'mean', normalize: true });
+            return extractVector(output);
+        });
     }
     async embedBatch(texts) {
         if (texts.length === 0)
             return [];
-        const extractor = await this.load();
-        const output = await extractor(texts, { pooling: 'mean', normalize: true });
-        if (Array.isArray(output)) {
-            return output.map(extractVector);
-        }
-        // Some versions return a single tensor for batch input
-        return extractBatchVectors(output, texts.length);
+        return this.withPipeline(async (extractor) => {
+            const output = await extractor(texts, { pooling: 'mean', normalize: true });
+            if (Array.isArray(output)) {
+                return output.map(extractVector);
+            }
+            // Some versions return a single tensor for batch input
+            return extractBatchVectors(output, texts.length);
+        });
     }
 }
 // ---------------------------------------------------------------------------

package/dist/search/index.js

@@ -1,25 +1,32 @@
 import { createVectorStore } from './store.js';
 import { Embedder } from './embedder.js';
-import { registerSearchTools } from './tools.js';
-import { SearchSyncService } from './sync.js';
+import { registerSearchTools, getSearchIndexStatus } from './tools.js';
+import { SearchSyncService, SyncLockedError } from './sync.js';
 // ---------------------------------------------------------------------------
 // initializeSearchModule
 // ---------------------------------------------------------------------------
 export async function initializeSearchModule(server, client, config) {
-    if (!config.enabled)
-        return;
     const store = createVectorStore(config.backend, config.dir);
     const embedder = new Embedder(config.modelName, config.numThreads);
-    registerSearchTools(server, client, store, embedder);
-    // Pre-initialize lastKnownTotal so get_search_index_status shows a value
+    registerSearchTools(server, client, store, embedder, config.dir);
+    // Pre-initialize lastKnownTotal so the index status (get_metadata) shows a value
     // immediately on startup, even while the background sync is still running.
-    const [startupCount, startupTotal] = await Promise.all([store.count(), store.getLastKnownTotal()]);
-    if (startupTotal === null && startupCount > 0) {
-        await store.setLastKnownTotal(startupCount);
+    // count() loads the whole index into memory, and this runs before the server
+    // connects — so only do it when there is no stored total yet.
+    if (await store.getLastKnownTotal() === null) {
+        const startupCount = await store.count();
+        if (startupCount > 0)
+            await store.setLastKnownTotal(startupCount);
     }
-    // Non-blocking background sync on startup
-    const syncService = new SearchSyncService(client, store, embedder);
+    // Non-blocking background sync on startup. If another server process (another
+    // client session) is already syncing the shared index, this one skips it.
+    const syncService = new SearchSyncService(client, store, embedder, config.dir);
     syncService.sync().catch((err) => {
+        if (err instanceof SyncLockedError) {
+            console.error('[mantisbt-search] another process is syncing the index, skipping startup sync');
+            return;
+        }
         console.error('[mantisbt-search] sync error:', err instanceof Error ? err.message : String(err));
     });
+    return () => getSearchIndexStatus(store);
 }

package/dist/search/store.js

@@ -1,4 +1,4 @@
-import { readFile, writeFile, rename, mkdir, unlink } from 'node:fs/promises';
+import { readFile, writeFile, rename, mkdir, unlink, stat } from 'node:fs/promises';
 import { join } from 'node:path';
 // ---------------------------------------------------------------------------
 // VectraStore
@@ -10,19 +10,39 @@ export class VectraStore {
     lastTotalFile;
     items = new Map();
     loaded = false;
+    // Version of index.json the in-memory items correspond to (null: no file).
+    // Every client session runs its own server process on the same index, so
+    // another process may have rewritten the file since it was loaded.
+    loadedVersion = null;
+    // Unflushed addBatch() changes — never discard them by reloading.
+    dirty = false;
     constructor(dir) {
         this.dir = dir;
         this.vectraDir = join(dir, 'vectra');
         this.lastSyncFile = join(dir, 'last_sync.txt');
         this.lastTotalFile = join(dir, 'last_total.txt');
     }
+    get indexFile() {
+        return join(this.vectraDir, 'index.json');
+    }
+    async fileVersion() {
+        try {
+            const { mtimeMs, size } = await stat(this.indexFile);
+            return `${mtimeMs}:${size}`;
+        }
+        catch {
+            return null;
+        }
+    }
     async ensureLoaded() {
-        if (this.loaded)
+        if (this.loaded && this.dirty)
+            return;
+        const version = await this.fileVersion();
+        if (this.loaded && version === this.loadedVersion)
             return;
         await mkdir(this.vectraDir, { recursive: true });
-        const indexFile = join(this.vectraDir, 'index.json');
         try {
-            const raw = await readFile(indexFile, 'utf-8');
+            const raw = await readFile(this.indexFile, 'utf-8');
             const parsed = JSON.parse(raw);
             this.items = new Map(parsed.map(item => [item.id, item]));
         }
@@ -31,13 +51,15 @@ export class VectraStore {
             this.items = new Map();
         }
         this.loaded = true;
+        this.loadedVersion = version;
     }
     async persist() {
-        const indexFile = join(this.vectraDir, 'index.json');
-        const tmpFile = indexFile + '.tmp';
+        const tmpFile = this.indexFile + '.tmp';
         const data = JSON.stringify([...this.items.values()]);
         await writeFile(tmpFile, data, 'utf-8');
-        await rename(tmpFile, indexFile);
+        await rename(tmpFile, this.indexFile);
+        this.loadedVersion = await this.fileVersion();
+        this.dirty = false;
     }
     async add(item) {
         await this.ensureLoaded();
@@ -49,6 +71,7 @@ export class VectraStore {
         for (const item of items) {
             this.items.set(item.id, item);
         }
+        this.dirty = items.length > 0 || this.dirty;
         // No persist() here — call flush() once after all batches are processed.
     }
     async flush() {

package/dist/search/sync-lock.js

@@ -0,0 +1,66 @@
+import { open, readFile, unlink, mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+// ---------------------------------------------------------------------------
+// Sync lock
+// ---------------------------------------------------------------------------
+// Every MCP client session starts its own server process, and all of them share
+// one index directory. The lock makes sure only one process syncs at a time —
+// concurrent syncs would overwrite each other's index.json.
+const LOCK_FILE = 'sync.lock';
+// Fallback for a lock whose PID was reused by an unrelated process.
+const STALE_AFTER_MS = 2 * 60 * 60 * 1000;
+function isProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        // EPERM: the process exists but belongs to another user.
+        return err.code === 'EPERM';
+    }
+}
+async function isStale(lockFile) {
+    try {
+        const content = JSON.parse(await readFile(lockFile, 'utf-8'));
+        const age = Date.now() - new Date(content.started_at).getTime();
+        return !isProcessAlive(content.pid) || Number.isNaN(age) || age >= STALE_AFTER_MS;
+    }
+    catch {
+        // Unreadable, half-written or already removed — safe to (re)try taking it.
+        return true;
+    }
+}
+/**
+ * Tries to take the sync lock in `dir`. Returns a release function, or null if
+ * another live process currently holds the lock. Stale locks are taken over.
+ */
+export async function acquireSyncLock(dir) {
+    await mkdir(dir, { recursive: true });
+    const lockFile = join(dir, LOCK_FILE);
+    const content = { pid: process.pid, started_at: new Date().toISOString() };
+    for (let attempt = 0; attempt < 2; attempt++) {
+        try {
+            const handle = await open(lockFile, 'wx');
+            await handle.writeFile(JSON.stringify(content), 'utf-8');
+            await handle.close();
+            return () => unlinkIfExists(lockFile);
+        }
+        catch (err) {
+            if (err.code !== 'EEXIST')
+                throw err;
+            if (!(await isStale(lockFile)))
+                return null;
+            await unlinkIfExists(lockFile);
+        }
+    }
+    return null;
+}
+async function unlinkIfExists(file) {
+    try {
+        await unlink(file);
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT')
+            throw err;
+    }
+}

package/dist/search/sync.js

@@ -1,19 +1,50 @@
+import { acquireSyncLock } from './sync-lock.js';
 // ---------------------------------------------------------------------------
 // SearchSyncService
 // ---------------------------------------------------------------------------
 const PAGE_SIZE = 50;
 const EMBED_BATCH_SIZE = 10;
 const CHECKPOINT_INTERVAL = 100; // flush to disk every N indexed issues
+export class SyncLockedError extends Error {
+    constructor() {
+        super('A search index sync is already running — try again once it has finished');
+        this.name = 'SyncLockedError';
+    }
+}
 export class SearchSyncService {
     client;
     store;
     embedder;
-    constructor(client, store, embedder) {
+    lockDir;
+    constructor(client, store, embedder, lockDir) {
         this.client = client;
         this.store = store;
         this.embedder = embedder;
+        this.lockDir = lockDir;
+    }
+    /**
+     * Indexes all issues changed since the last sync. With `full`, the index is
+     * cleared first — inside the lock, so a running sync of another process is
+     * never wiped underneath it.
+     */
+    async sync(projectId, { full = false } = {}) {
+        if (this.lockDir === undefined)
+            return this.syncUnlocked(projectId, full);
+        const release = await acquireSyncLock(this.lockDir);
+        if (!release)
+            throw new SyncLockedError();
+        try {
+            return await this.syncUnlocked(projectId, full);
+        }
+        finally {
+            await release();
+        }
     }
-    async sync(projectId) {
+    async syncUnlocked(projectId, full) {
+        if (full) {
+            await this.store.clear();
+            await this.store.resetLastSyncedAt();
+        }
         const lastSyncedAt = await this.store.getLastSyncedAt();
         const { issues: allIssues, totalFromApi } = await this.fetchAllIssues(lastSyncedAt ?? undefined, projectId);
         let indexed = 0;
@@ -28,6 +59,9 @@ export class SearchSyncService {
                     skipped++;
                     continue;
                 }
+                if (issue.updated_at && (await this.store.getItem(issue.id))?.metadata.updated_at === issue.updated_at) {
+                    continue; // already indexed in this exact version
+                }
                 const text = `${issue.summary}\n${issue.description ?? ''}`.trim();
                 toEmbed.push({ issue, text });
             }
@@ -57,19 +91,28 @@ export class SearchSyncService {
         if (indexedSinceCheckpoint > 0) {
             await this.store.flush();
         }
-        await this.store.setLastSyncedAt(new Date().toISOString());
+        // The watermark is the newest updated_at the server reported, not the local
+        // clock: a client clock running ahead of the server would otherwise skip
+        // changes for good. A project-scoped sync must not move the shared watermark,
+        // since changes in the other projects were not looked at.
+        const newestUpdatedAt = allIssues.find(issue => issue.updated_at)?.updated_at;
+        if (projectId === undefined && newestUpdatedAt && newestUpdatedAt !== lastSyncedAt) {
+            await this.store.setLastSyncedAt(newestUpdatedAt);
+        }
         // Persist the best known total for get_search_index_status.
         // Priority: API total_count > full-rebuild count > current store size.
         // The store size fallback handles MantisBT installations that never return
         // total_count and ensures the status tool never shows "total unknown" after
         // any sync has completed.
         const storeCount = await this.store.count();
-        const total = totalFromApi ?? (lastSyncedAt === null ? indexed + skipped : storeCount);
+        const total = totalFromApi ?? (lastSyncedAt === null ? allIssues.length : storeCount);
         await this.store.setLastKnownTotal(total);
         return { indexed, skipped, total };
     }
     async fetchAllIssues(updatedAfter, projectId) {
-        const allIssues = [];
+        const changedIssues = [];
+        const updatedAfterMs = updatedAfter ? new Date(updatedAfter).getTime() : undefined;
+        let fetchedCount = 0;
         let totalFromApi = null;
         let page = 1;
         while (true) {
@@ -88,16 +131,31 @@ export class SearchSyncService {
             }
             const response = await this.client.get('issues', params);
             const pageIssues = response.issues ?? [];
-            allIssues.push(...pageIssues);
+            fetchedCount += pageIssues.length;
+            // The MantisBT REST API ignores updated_after, sort and direction (they are
+            // still sent for API versions that honour them). It always returns issues
+            // ordered by last_updated DESC without pulling sticky issues to the top
+            // (see filter_get_default() and mc_filter_get_issues()), so the first issue
+            // older than the watermark marks the end of the changes. Ties are kept:
+            // timestamps have one-second resolution, and sync() skips issues whose
+            // indexed version is already current.
+            const cut = updatedAfterMs === undefined
+                ? -1
+                : pageIssues.findIndex(issue => issue.updated_at && new Date(issue.updated_at).getTime() < updatedAfterMs);
+            const reachedWatermark = cut !== -1;
+            changedIssues.push(...(reachedWatermark ? pageIssues.slice(0, cut) : pageIssues));
             // Capture total_count from the first page that provides it
             if (totalFromApi === null && response.total_count != null) {
                 totalFromApi = response.total_count;
             }
-            // Stop when we have fetched all issues:
+            // Stop when we have fetched all changed issues:
+            // - the watermark was reached on this page, or
             // - total_count is provided and reached, or
             // - page returned fewer items than requested (last page)
+            if (reachedWatermark)
+                break;
             if (totalFromApi !== null) {
-                if (allIssues.length >= totalFromApi)
+                if (fetchedCount >= totalFromApi)
                     break;
             }
             else if (pageIssues.length < PAGE_SIZE) {
@@ -105,6 +163,6 @@ export class SearchSyncService {
             }
             page++;
         }
-        return { issues: allIssues, totalFromApi };
+        return { issues: changedIssues, totalFromApi };
     }
 }