@j0hanz/filesystem-mcp 1.17.0 → 1.18.0

package/dist/completions.js

@@ -1,5 +1,6 @@
-import { readdir, stat } from 'node:fs/promises';
+import { readdir, realpath, stat } from 'node:fs/promises';
 import { basename, dirname, isAbsolute, join, parse, resolve, sep, } from 'node:path';
+import { z } from 'zod';
 import { getAllowedDirectories, isPathWithinDirectories, normalizePath, toPosixPath, } from './lib/paths.js';
 import { isRecord } from './lib/utils.js';
 import { getSortedToolContracts } from './resources/tool-info.js';
@@ -46,9 +47,63 @@ const PATH_ARGUMENTS = new Set([
 const DESTINATION_CONTEXT_KEYS = ['source', 'path', 'cwd', 'root'];
 const PRIMARY_PATH_CONTEXT_KEYS = ['path', 'cwd', 'root'];
 const DEFAULT_CONTEXT_KEYS = ['path', 'source', 'cwd', 'root'];
-const ENUM_ARGUMENT_VALUES = new Map([
-    ['sortby', ['modified', 'name', 'path', 'size', 'type']],
-]);
+function extractEnumValuesFromSchema(argumentName, schema) {
+    const properties = getInputSchemaProperties(schema);
+    if (!properties || typeof properties !== 'object')
+        return undefined;
+    for (const [key, value] of Object.entries(properties)) {
+        if (key.toLowerCase() !== argumentName)
+            continue;
+        if (value === null || typeof value !== 'object' || !('enum' in value)) {
+            return undefined;
+        }
+        const enumValues = value.enum;
+        if (!Array.isArray(enumValues))
+            return undefined;
+        const stringValues = enumValues.filter((entry) => typeof entry === 'string');
+        return stringValues.length > 0 ? stringValues : undefined;
+    }
+    return undefined;
+}
+function getInputSchemaProperties(schema) {
+    const { properties } = z.toJSONSchema(schema, { io: 'input' });
+    if (!properties || typeof properties !== 'object')
+        return undefined;
+    return properties;
+}
+function intersectEnumValueSets(valueSets) {
+    const [firstSet, ...restSets] = valueSets;
+    if (!firstSet)
+        return [];
+    return firstSet.filter((value) => restSets.every((candidateSet) => candidateSet.includes(value)));
+}
+function buildEnumArgumentValues() {
+    const valuesByArgument = new Map();
+    for (const contract of getSortedToolContracts()) {
+        const properties = getInputSchemaProperties(contract.inputSchema);
+        if (!properties || typeof properties !== 'object')
+            continue;
+        for (const key of Object.keys(properties)) {
+            const normalizedKey = key.toLowerCase();
+            const values = extractEnumValuesFromSchema(normalizedKey, contract.inputSchema);
+            if (!values)
+                continue;
+            const existing = valuesByArgument.get(normalizedKey) ?? [];
+            existing.push(values);
+            valuesByArgument.set(normalizedKey, existing);
+        }
+    }
+    const result = new Map();
+    for (const [argumentName, valueSets] of valuesByArgument) {
+        const values = valueSets.length === 1
+            ? (valueSets[0] ?? [])
+            : intersectEnumValueSets(valueSets);
+        if (values.length > 0) {
+            result.set(argumentName, values);
+        }
+    }
+    return result;
+}
 function isPathLikeArgumentName(argName) {
     return (PATH_ARGUMENTS.has(argName) ||
         argName.endsWith('paths') ||
@@ -58,8 +113,8 @@ function isPathLikeArgumentName(argName) {
         argName.endsWith('dirs') ||
         argName.endsWith('dir'));
 }
-function getEnumCompletions(argName, currentValue) {
-    const values = ENUM_ARGUMENT_VALUES.get(argName);
+function getEnumCompletions(argName, currentValue, enumArgumentValues) {
+    const values = enumArgumentValues.get(argName);
     if (!values)
         return undefined;
     const prefix = currentValue.toLowerCase();
@@ -267,18 +322,29 @@ function resolveContextCandidatePath(candidate, allowed) {
     return resolveNamedRootPath(candidate, allowed);
 }
 async function toAllowedContextDirectory(resolved, allowed) {
-    if (!isPathWithinDirectories(resolved, allowed))
-        return undefined;
+    const parent = dirname(resolved);
+    if (await isAllowedCompletionDirectory(resolved, allowed)) {
+        return resolved;
+    }
+    return (await isAllowedCompletionDirectory(parent, allowed))
+        ? parent
+        : undefined;
+}
+async function isAllowedCompletionDirectory(path, allowed) {
+    if (!isPathWithinDirectories(path, allowed))
+        return false;
     try {
-        const stats = await stat(resolved);
-        if (stats.isDirectory())
-            return resolved;
+        const [stats, resolvedRealPath] = await Promise.all([
+            stat(path),
+            realpath(path),
+        ]);
+        if (!stats.isDirectory())
+            return false;
+        return isPathWithinDirectories(normalizePath(resolvedRealPath), allowed);
     }
     catch {
-        // Fall back to parent path best-effort resolution.
+        return false;
     }
-    const parent = dirname(resolved);
-    return isPathWithinDirectories(parent, allowed) ? parent : undefined;
 }
 async function resolveContextBaseDirectory(argumentName, contextArguments, allowed) {
     if (!hasContextArguments(contextArguments)) {
@@ -371,7 +437,7 @@ function getSearchContext(currentValue, allowed, contextBase) {
 }
 async function findMatchesInDirectory(searchDir, prefix, allowed) {
     const matches = [];
-    if (!isPathWithinDirectories(searchDir, allowed)) {
+    if (!(await isAllowedCompletionDirectory(searchDir, allowed))) {
         return matches;
     }
     try {
@@ -460,6 +526,7 @@ function handleTopicAndToolCompletions(ref, argName, argumentValue, topicValues,
 export function registerCompletions(server, instructions = '') {
     const topicValues = extractTopicCompletions(instructions);
     const toolNameValues = extractToolNameCompletions();
+    const enumArgumentValues = buildEnumArgumentValues();
     server.server.setRequestHandler('completion/complete', async (request) => {
         const { params } = request;
         const { argument, ref } = params;
@@ -467,7 +534,7 @@ export function registerCompletions(server, instructions = '') {
         const predef = handleTopicAndToolCompletions(ref, argName, argument.value, topicValues, toolNameValues);
         if (predef)
             return predef;
-        const enumResult = getEnumCompletions(argName, argument.value);
+        const enumResult = getEnumCompletions(argName, argument.value, enumArgumentValues);
         if (enumResult) {
             return buildCompletionResponse(enumResult);
         }

package/dist/lib/constants.d.ts

@@ -5,9 +5,11 @@ export declare const DEFAULT_TASK_TTL_MS: number;
 export declare const MAX_TASK_TTL_MS: number;
 export declare const MAX_CONCURRENT_TASKS: number;
 export declare const TASK_CANCEL_POLL_MS = 2000;
-export declare const INIT_HANDSHAKE_TIMEOUT_MS: number;
+export declare function getInitHandshakeTimeoutMs(): number;
 export declare const INIT_TIMEOUT_CLOSE: boolean;
-export declare const TASK_POLL_INTERVAL_MS = 100;
+export declare const TASK_POLL_INTERVAL_MS = 500;
+/** How long cancelled-task results are retained before lazy eviction. */
+export declare const CANCELLED_RESULT_TTL_MS: number;
 export declare const PARALLEL_CONCURRENCY: number;
 export declare const MAX_SEARCHABLE_FILE_SIZE: number;
 export declare const MAX_TEXT_FILE_SIZE: number;

package/dist/lib/constants.js

@@ -76,9 +76,13 @@ export const DEFAULT_TASK_TTL_MS = 5 * 60 * 1000;
 export const MAX_TASK_TTL_MS = parseEnvInt('FILESYSTEM_MCP_MAX_TASK_TTL_MS', 60 * 60 * 1000, 1_000, 24 * 60 * 60 * 1000);
 export const MAX_CONCURRENT_TASKS = parseEnvInt('FILESYSTEM_MCP_MAX_CONCURRENT_TASKS', 100, 1, 10_000);
 export const TASK_CANCEL_POLL_MS = 2_000;
-export const INIT_HANDSHAKE_TIMEOUT_MS = parseEnvInt('FS_INIT_HANDSHAKE_TIMEOUT_MS', 30_000, 1_000, 300_000);
+export function getInitHandshakeTimeoutMs() {
+    return parseEnvInt('FS_INIT_HANDSHAKE_TIMEOUT_MS', 30_000, 1_000, 300_000);
+}
 export const INIT_TIMEOUT_CLOSE = parseTrueEnvFlag(process.env['FS_INIT_TIMEOUT_CLOSE']);
-export const TASK_POLL_INTERVAL_MS = 100;
+export const TASK_POLL_INTERVAL_MS = 500;
+/** How long cancelled-task results are retained before lazy eviction. */
+export const CANCELLED_RESULT_TTL_MS = 2 * 60 * 1_000; // 2 minutes
 // Auto-tuned parallelism based on CPU cores (no env override)
 const BYTES_PER_PARALLEL_TASK = 64 * MIB;
 const BYTES_PER_SEARCH_WORKER = 128 * MIB;

package/dist/lib/errors.d.ts

@@ -22,6 +22,7 @@ export declare class McpError extends Error {
     static accessDenied(message: string, path?: string, details?: Record<string, unknown>, cause?: unknown): McpError;
     static timeout(message: string, path?: string, details?: Record<string, unknown>, cause?: unknown): McpError;
 }
+export declare function classifyError(error: unknown): ErrorCode;
 export declare function createDetailedError(error: unknown, path?: string, additionalDetails?: Record<string, unknown>): DetailedError;
 export declare function formatDetailedError(error: DetailedError): string;
 export declare function getSuggestion(code: ErrorCode): string | undefined;

package/dist/lib/errors.js

@@ -236,7 +236,7 @@ function classifyMessageError(error) {
     }
     return undefined;
 }
-function classifyError(error) {
+export function classifyError(error) {
     let timeoutCode;
     let fallbackCode;
     const terminalCode = walkErrorChain(error, (candidate) => {

package/dist/lib/fs-helpers.d.ts

@@ -1,4 +1,4 @@
-import type { Stats } from 'node:fs';
+import { type Stats } from 'node:fs';
 import { type FileHandle } from 'node:fs/promises';
 import type { FileType } from '../config.js';
 interface ParallelResult<R> {
@@ -12,6 +12,7 @@ export declare function processInParallel<T, R>(items: T[], processor: (item: T)
 export declare function getFileType(stats: Stats): FileType;
 export declare function isHidden(name: string): boolean;
 export declare function isProbablyBinary(filePath: string, existingHandle?: FileHandle, signal?: AbortSignal): Promise<boolean>;
+export declare function calculateFileContentHash(filePath: string, signal?: AbortSignal): Promise<string>;
 type ReadMode = 'head' | 'full' | 'range' | 'tail';
 interface ReadFileOptions {
     encoding?: BufferEncoding;

package/dist/lib/fs-helpers.js

@@ -51,9 +51,11 @@ var __disposeResources = (this && this.__disposeResources) || (function (Suppres
     return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
 });
 import { isUtf8 } from 'node:buffer';
-import { randomUUID } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
+import { createReadStream } from 'node:fs';
 import { open, rename, stat, unlink, writeFile, } from 'node:fs/promises';
 import { extname } from 'node:path';
+import { pipeline } from 'node:stream/promises';
 import { assertNotAborted, withAbort } from './abort.js';
 import { BINARY_CHECK_BUFFER_SIZE, KNOWN_BINARY_EXTENSIONS, MAX_TEXT_FILE_SIZE, PARALLEL_CONCURRENCY, } from './constants.js';
 import { ErrorCode, McpError, normalizeUnknownError } from './errors.js';
@@ -192,6 +194,11 @@ function isBinarySlice(slice) {
         return true;
     return !isUtf8(slice);
 }
+export async function calculateFileContentHash(filePath, signal) {
+    const hasher = createHash('sha256');
+    await pipeline(createReadStream(filePath, { signal, highWaterMark: STREAM_CHUNK_SIZE }), hasher, { signal });
+    return hasher.digest('hex');
+}
 function validateReadOptions(options) {
     const hasHead = options.head !== undefined;
     const hasTail = options.tail !== undefined;
@@ -298,24 +305,6 @@ async function readFileBufferWithLimit(handle, maxSize, requestedPath, signal) {
     }
     return Buffer.concat(chunks, totalSize);
 }
-async function headFile(handle, numLines, encoding = 'utf-8', maxBytesRead, signal) {
-    assertNotAborted(signal);
-    const lines = [];
-    let estimatedBytes = 0;
-    const hasMaxBytes = maxBytesRead !== undefined;
-    const newlineBytes = Buffer.byteLength('\n', encoding);
-    for await (const line of handle.readLines({ encoding, signal })) {
-        lines.push(line);
-        if (lines.length >= numLines)
-            break;
-        if (!hasMaxBytes)
-            continue;
-        estimatedBytes += Buffer.byteLength(line, encoding) + newlineBytes;
-        if (estimatedBytes >= maxBytesRead)
-            break;
-    }
-    return lines.join('\n');
-}
 function countLines(content) {
     if (content.length === 0)
         return 0;
@@ -327,9 +316,37 @@ function countLines(content) {
     return count;
 }
 async function readHeadContent(handle, head, options) {
-    const content = await headFile(handle, head, options.encoding, options.maxSize, options.signal);
-    const linesRead = countLines(content);
-    const hasMoreLines = linesRead >= head;
+    assertNotAborted(options.signal);
+    const lines = [];
+    let estimatedBytes = 0;
+    const newlineBytes = Buffer.byteLength('\n', options.encoding);
+    const iterator = handle
+        .readLines({ encoding: options.encoding, signal: options.signal })[Symbol.asyncIterator]();
+    let hasMoreLines = false;
+    let next = await iterator.next();
+    try {
+        while (!next.done) {
+            const line = next.value;
+            lines.push(line);
+            estimatedBytes +=
+                Buffer.byteLength(line, options.encoding) + newlineBytes;
+            if (estimatedBytes >= options.maxSize) {
+                hasMoreLines = true;
+                break;
+            }
+            if (lines.length === head) {
+                const peek = await iterator.next();
+                hasMoreLines = !peek.done;
+                break;
+            }
+            next = await iterator.next();
+        }
+    }
+    finally {
+        await iterator.return?.();
+    }
+    const content = lines.join('\n');
+    const linesRead = lines.length;
     return {
         content,
         truncated: hasMoreLines,

package/dist/prompts.js

@@ -57,6 +57,10 @@ export function registerGetHelpPrompt(server, instructions, iconInfo) {
                     content: {
                         type: 'text',
                         text,
+                        annotations: {
+                            audience: ['assistant'],
+                            priority: 1,
+                        },
                     },
                 },
             ],
@@ -81,6 +85,10 @@ export function registerCompareFilesPrompt(server, iconInfo) {
                 content: {
                     type: 'text',
                     text: `Compare files and explain differences.\n\n1. Call \`diff_files\` with:\n   - original: ${original}\n   - modified: ${modified}\n2. Summarize: additions, deletions, and semantic changes.\n3. Flag any potential issues (conflicts, regressions, breaking changes).`,
+                    annotations: {
+                        audience: ['assistant'],
+                        priority: 1,
+                    },
                 },
             },
         ],
@@ -103,6 +111,10 @@ export function registerAnalyzePathPrompt(server, iconInfo) {
                 content: {
                     type: 'text',
                     text: `Analyze the path: ${targetPath}\n\n1. Call \`stat\` to determine if it is a file or directory.\n2. If file: call \`read\` with \`includeHash: true\` and summarize contents.\n3. If directory: call \`tree\` (maxDepth: 3) and \`ls\` to summarize structure.\n4. Report: type, size, permissions, key observations.`,
+                    annotations: {
+                        audience: ['assistant'],
+                        priority: 1,
+                    },
                 },
             },
         ],
@@ -138,6 +150,10 @@ export function registerGetToolHelpPrompt(server, iconInfo) {
                         type: 'text',
                         text: `Use the embedded contract for \`${toolName}\` as the authoritative reference. ` +
                             'Summarize when to use it, its key constraints, and the safest next action.',
+                        annotations: {
+                            audience: ['assistant'],
+                            priority: 1,
+                        },
                     },
                 },
                 {
@@ -149,6 +165,10 @@ export function registerGetToolHelpPrompt(server, iconInfo) {
                             mimeType: 'text/markdown',
                             text: toolInfo,
                         },
+                        annotations: {
+                            audience: ['assistant'],
+                            priority: 1,
+                        },
                     },
                 },
             ],

package/dist/server/bootstrap.js

@@ -1,10 +1,11 @@
 import { NodeStreamableHTTPServerTransport } from '@modelcontextprotocol/node';
-import { InMemoryTaskMessageQueue, isInitializeRequest, LATEST_PROTOCOL_VERSION, localhostAllowedHostnames, McpServer, StdioServerTransport, SUPPORTED_PROTOCOL_VERSIONS, validateHostHeader, } from '@modelcontextprotocol/server';
+import { InMemoryTaskMessageQueue, isInitializeRequest, localhostAllowedHostnames, McpServer, StdioServerTransport, validateHostHeader, } from '@modelcontextprotocol/server';
 import { createHash, randomUUID, timingSafeEqual } from 'node:crypto';
 import { channel } from 'node:diagnostics_channel';
 import { readFile } from 'node:fs/promises';
 import { createServer as createHttpServer, } from 'node:http';
-import { DEFAULT_LOG_LEVEL, INIT_HANDSHAKE_TIMEOUT_MS, INIT_TIMEOUT_CLOSE, parseEnvInt, } from '../lib/constants.js';
+import { inspect } from 'node:util';
+import { DEFAULT_LOG_LEVEL, getInitHandshakeTimeoutMs, INIT_TIMEOUT_CLOSE, parseEnvInt, } from '../lib/constants.js';
 import { formatUnknownErrorMessage } from '../lib/errors.js';
 import { createLoggingState, Logger, logToMcp, SessionContext, } from '../lib/logger.js';
 import { withAllowedDirectoriesState } from '../lib/paths.js';
@@ -16,6 +17,7 @@ import { registerInstructionResource, registerMetricsResource, registerResultRes
 import { buildServerInstructions } from '../resources/generated-instructions.js';
 import { registerAllTools } from '../tools.js';
 import { withDefaultIcons } from '../tools/shared.js';
+import { InMemoryEventStore } from './event-store.js';
 import { RootsManager } from './roots-manager.js';
 import { createTaskStore } from './task-store.js';
 function buildServerCapabilities(options = {}) {
@@ -44,9 +46,17 @@ const activeServers = new Map();
 // For stdio (single session without a specific ID)
 let stdioServer;
 function stringifyData(data) {
-    if (!data)
+    if (data === undefined)
         return '';
-    return ` ${typeof data === 'string' ? data : JSON.stringify(data)}`;
+    if (typeof data === 'string')
+        return ` ${data}`;
+    if (data === null ||
+        typeof data === 'number' ||
+        typeof data === 'boolean' ||
+        typeof data === 'bigint') {
+        return ` ${String(data)}`;
+    }
+    return ` ${inspect(data, { depth: 4, colors: false, compact: 3 })}`;
 }
 channel('filesystem-mcp:log').subscribe((message) => {
     const event = message;
@@ -212,7 +222,7 @@ async function readRequestBody(req) {
         req.on('error', reject);
     });
 }
-async function createHttpSession(options, sessions, negotiatedProtocolVersion) {
+async function createHttpSession(options, sessions, eventStore) {
     const mcpServer = await createServer(options);
     const rootsManager = getRootsManager(mcpServer);
     rootsManager.registerHandlers(mcpServer);
@@ -226,6 +236,7 @@ async function createHttpSession(options, sessions, negotiatedProtocolVersion) {
         if (sessionId) {
             sessions.delete(sessionId);
             activeServers.delete(sessionId);
+            eventStore.delete(sessionId);
         }
         rootsManager.destroy();
     };
@@ -235,12 +246,12 @@ async function createHttpSession(options, sessions, negotiatedProtocolVersion) {
     };
     const transport = new NodeStreamableHTTPServerTransport({
         sessionIdGenerator: () => randomUUID(),
+        eventStore,
         onsessioninitialized: (sessionId) => {
             sessions.set(sessionId, {
                 server: mcpServer,
                 rootsManager,
                 transport,
-                negotiatedProtocolVersion,
                 createdAt: Date.now(),
                 cleanup,
                 close,
@@ -258,7 +269,6 @@ async function createHttpSession(options, sessions, negotiatedProtocolVersion) {
         server: mcpServer,
         rootsManager,
         transport,
-        negotiatedProtocolVersion,
         createdAt: Date.now(),
         cleanup,
         close,
@@ -309,29 +319,6 @@ function getSessionId(req) {
         ? rawSessionId
         : undefined;
 }
-function getProtocolVersionHeader(req) {
-    const rawProtocolVersion = req.headers['mcp-protocol-version'];
-    return typeof rawProtocolVersion === 'string'
-        ? rawProtocolVersion
-        : undefined;
-}
-function resolveNegotiatedProtocolVersion(requestedVersion) {
-    return SUPPORTED_PROTOCOL_VERSIONS.includes(requestedVersion)
-        ? requestedVersion
-        : LATEST_PROTOCOL_VERSION;
-}
-function ensureSessionProtocolVersion(req, res, session) {
-    const protocolVersion = getProtocolVersionHeader(req);
-    if (!protocolVersion) {
-        sendJsonRpcError(res, 400, JSON_RPC_SERVER_ERROR, 'Bad Request: Missing MCP-Protocol-Version header');
-        return false;
-    }
-    if (protocolVersion !== session.negotiatedProtocolVersion) {
-        sendJsonRpcError(res, 400, JSON_RPC_SERVER_ERROR, `Bad Request: MCP-Protocol-Version must match negotiated version ${session.negotiatedProtocolVersion}`);
-        return false;
-    }
-    return true;
-}
 function isAuthorizedBearer(apiKey, authHeader) {
     const bearerPrefix = 'Bearer ';
     if (typeof authHeader !== 'string' || !authHeader.startsWith(bearerPrefix)) {
@@ -451,6 +438,7 @@ function handleHttpRequestError(error, res) {
 }
 export async function startHttpServer(port, options) {
     const sessions = new Map();
+    const eventStore = new InMemoryEventStore();
     const httpHost = process.env['FILESYSTEM_MCP_HTTP_HOST'] ?? '127.0.0.1';
     assertHttpBindingSecurity(httpHost);
     let closingSessions;
@@ -460,6 +448,7 @@ export async function startHttpServer(port, options) {
         closingSessions = (async () => {
             const activeSessions = [...sessions.values()];
             sessions.clear();
+            eventStore.clear();
             await Promise.allSettled(activeSessions.map((session) => session.close()));
         })();
         await closingSessions;
@@ -471,10 +460,6 @@ export async function startHttpServer(port, options) {
                 discardRequestBody(req);
                 return;
             }
-            if (!ensureSessionProtocolVersion(req, res, session)) {
-                discardRequestBody(req);
-                return;
-            }
             const body = await readRequestBody(req);
             await handleSessionTransportRequest(session, req, res, body);
             return;
@@ -486,7 +471,7 @@ export async function startHttpServer(port, options) {
                 sendJsonRpcError(res, 503, JSON_RPC_SERVER_ERROR, 'Too many sessions');
                 return;
             }
-            const session = await createHttpSession(options, sessions, resolveNegotiatedProtocolVersion(body.params.protocolVersion));
+            const session = await createHttpSession(options, sessions, eventStore);
             await handleSessionTransportRequest(session, req, res, body);
             return;
         }
@@ -501,8 +486,6 @@ export async function startHttpServer(port, options) {
         const session = getSessionOrRespondNotFound(sessions, sessionId, res);
         if (!session)
             return;
-        if (!ensureSessionProtocolVersion(req, res, session))
-            return;
         await handleSessionTransportRequest(session, req, res);
     }
     async function dispatchMcpMethod(method, req, res, sessionId) {
@@ -533,14 +516,15 @@ export async function startHttpServer(port, options) {
             handleHttpRequestError(error, res);
         }
     }
-    const SWEEP_INTERVAL_MS = INIT_HANDSHAKE_TIMEOUT_MS * 2;
+    const initHandshakeTimeoutMs = getInitHandshakeTimeoutMs();
+    const SWEEP_INTERVAL_MS = initHandshakeTimeoutMs * 2;
     const sweepTimer = setInterval(() => {
         const now = Date.now();
         for (const [sessionId, session] of sessions) {
             if (!session.rootsManager.isInitialized() &&
-                now - session.createdAt > INIT_HANDSHAKE_TIMEOUT_MS) {
+                now - session.createdAt > initHandshakeTimeoutMs) {
                 Logger.warn(`[HTTP] Evicting stale session ${sessionId}: client never sent notifications/initialized`);
-                session.server.close().catch((err) => {
+                session.close().catch((err) => {
                     Logger.error(`[HTTP] Error closing stale session ${sessionId}:`, formatUnknownErrorMessage(err));
                 });
             }

package/dist/server/event-store.d.ts

@@ -0,0 +1,18 @@
+import type { JSONRPCMessage } from '@modelcontextprotocol/server';
+export declare class InMemoryEventStore {
+    private streams;
+    private eventIdToStreamId;
+    storeEvent(streamId: string, message: JSONRPCMessage): Promise<string>;
+    getStreamIdForEventId(eventId: string): Promise<string | undefined>;
+    replayEventsAfter(lastEventId: string, callbacks: {
+        send: (eventId: string, message: JSONRPCMessage) => Promise<void>;
+    }): Promise<string>;
+    /**
+     * Cleans up all events for a given streamId.
+     */
+    delete(streamId: string): void;
+    /**
+     * Cleans up all streams.
+     */
+    clear(): void;
+}

package/dist/server/event-store.js

@@ -0,0 +1,71 @@
+import { randomUUID } from 'node:crypto';
+const MAX_EVENTS_PER_STREAM = 1000;
+export class InMemoryEventStore {
+    // Map of streamId -> StoredEvent[]
+    streams = new Map();
+    // Map of eventId -> streamId for fast lookup
+    eventIdToStreamId = new Map();
+    storeEvent(streamId, message) {
+        const eventId = randomUUID();
+        let stream = this.streams.get(streamId);
+        if (!stream) {
+            stream = [];
+            this.streams.set(streamId, stream);
+        }
+        // Add new event
+        stream.push({ id: eventId, message });
+        this.eventIdToStreamId.set(eventId, streamId);
+        // Enforce limits
+        if (stream.length > MAX_EVENTS_PER_STREAM) {
+            const removed = stream.shift();
+            if (removed) {
+                this.eventIdToStreamId.delete(removed.id);
+            }
+        }
+        return Promise.resolve(eventId);
+    }
+    getStreamIdForEventId(eventId) {
+        return Promise.resolve(this.eventIdToStreamId.get(eventId));
+    }
+    async replayEventsAfter(lastEventId, callbacks) {
+        const streamId = this.eventIdToStreamId.get(lastEventId);
+        if (!streamId) {
+            throw new Error(`Event ID ${lastEventId} not found or expired`);
+        }
+        const stream = this.streams.get(streamId);
+        if (!stream) {
+            throw new Error(`Stream ${streamId} not found`);
+        }
+        const eventIndex = stream.findIndex((e) => e.id === lastEventId);
+        if (eventIndex === -1) {
+            throw new Error(`Event ID ${lastEventId} not found in stream ${streamId}`);
+        }
+        // Replay all events after the found index
+        for (let i = eventIndex + 1; i < stream.length; i++) {
+            const event = stream[i];
+            if (event) {
+                await callbacks.send(event.id, event.message);
+            }
+        }
+        return streamId;
+    }
+    /**
+     * Cleans up all events for a given streamId.
+     */
+    delete(streamId) {
+        const stream = this.streams.get(streamId);
+        if (stream) {
+            for (const event of stream) {
+                this.eventIdToStreamId.delete(event.id);
+            }
+            this.streams.delete(streamId);
+        }
+    }
+    /**
+     * Cleans up all streams.
+     */
+    clear() {
+        this.streams.clear();
+        this.eventIdToStreamId.clear();
+    }
+}

package/dist/server/roots-manager.js

@@ -3,7 +3,7 @@ import { channel } from 'node:diagnostics_channel';
 import { realpath } from 'node:fs/promises';
 import { z } from 'zod';
 import { assertNotAborted, createTimedAbortSignal, withAbort, } from '../lib/abort.js';
-import { INIT_HANDSHAKE_TIMEOUT_MS } from '../lib/constants.js';
+import { getInitHandshakeTimeoutMs } from '../lib/constants.js';
 import { formatUnknownErrorMessage } from '../lib/errors.js';
 import { Logger, logToMcp } from '../lib/logger.js';
 import { getValidRootDirectories, isPathWithinDirectories, normalizePath, resolveAllowedDirectoriesState, setAllowedDirectoriesStateResolved, } from '../lib/paths.js';
@@ -128,6 +128,7 @@ export class RootsManager {
         }
     }
     registerHandlers(server, onInitTimeout) {
+        const initHandshakeTimeoutMs = getInitHandshakeTimeoutMs();
         server.server.setNotificationHandler('notifications/initialized', async () => {
             if (this.initTimer) {
                 clearTimeout(this.initTimer);
@@ -146,14 +147,14 @@ export class RootsManager {
                 if (LIFECYCLE_CHANNEL.hasSubscribers) {
                     LIFECYCLE_CHANNEL.publish({
                         phase: 'init_timeout',
-                        timeoutMs: INIT_HANDSHAKE_TIMEOUT_MS,
+                        timeoutMs: initHandshakeTimeoutMs,
                     });
                 }
-                logToMcp(server, 'warning', `Client did not send notifications/initialized within ${String(INIT_HANDSHAKE_TIMEOUT_MS)}ms`, this.loggingState.minimumLevel);
+                logToMcp(server, 'warning', `Client did not send notifications/initialized within ${String(initHandshakeTimeoutMs)}ms`, this.loggingState.minimumLevel);
                 onInitTimeout?.();
             }
             this.initTimer = undefined;
-        }, INIT_HANDSHAKE_TIMEOUT_MS);
+        }, initHandshakeTimeoutMs);
         this.initTimer.unref();
     }
     async recomputeAllowedDirectories() {

package/dist/server/task-store.d.ts

@@ -1,6 +1,7 @@
 import { InMemoryTaskStore, type Result, type Task } from '@modelcontextprotocol/server';
 export declare class ResultAwareInMemoryTaskStore extends InMemoryTaskStore {
     private readonly cancelledResults;
+    private evictExpired;
     getTaskResult(taskId: string, sessionId?: string): Promise<Result>;
     storeTaskResult(taskId: string, status: 'completed' | 'failed', result: Result, sessionId?: string): Promise<void>;
     updateTaskStatus(taskId: string, status: Task['status'], statusMessage?: string, sessionId?: string): Promise<void>;