@ni-c/mcp-hub 0.11.0 → 0.11.2

package/dist/auth/session.js

@@ -2,6 +2,20 @@ import { sign, signatureMatches } from './signed-token.js';
 /** Deliberately short: it only has to outlive a connector's authorization. */
 export const SESSION_TTL_MS = 30 * 60_000;
 export const SESSION_COOKIE = 'mcp_hub_session';
+/**
+ * The cookie's name, which behind HTTPS carries the `__Host-` prefix.
+ *
+ * The prefix is a promise the browser enforces: such a cookie is only accepted
+ * from a secure origin, with `Path=/` and without a `Domain`, and can therefore
+ * not be planted by a sibling subdomain or over plain http on the same host.
+ * The value is signed either way, so a planted cookie could not be a forged
+ * session — but it could be a *real* one an attacker obtained, fixed into
+ * somebody else's browser. Behind plain http (a development hub, the test
+ * suite) the prefix is not settable at all, so the bare name is used there.
+ */
+export function sessionCookieName(secure) {
+    return secure ? `__Host-${SESSION_COOKIE}` : SESSION_COOKIE;
+}
 /**
  * The operator's browser session, carried entirely by the client.
  *
@@ -19,13 +33,26 @@ export function createSessionCookie(secret) {
     const expires = String(Date.now() + SESSION_TTL_MS);
     return `${expires}.${sign(expires, secret)}`;
 }
-/** The verified cookie value, or undefined when absent, forged or expired. */
-export function readSessionCookie(cookieHeader, secret) {
-    const match = cookieHeader?.match(new RegExp(`(?:^|;\\s*)${SESSION_COOKIE}=([^;]+)`));
+/**
+ * The verified cookie value, or undefined when absent, forged or expired.
+ *
+ * Only the name for this deployment is read: behind HTTPS the bare name is not
+ * the session cookie, whatever it carries.
+ */
+export function readSessionCookie(cookieHeader, secret, secure = false) {
+    const match = cookieHeader?.match(new RegExp(`(?:^|;\\s*)${sessionCookieName(secure)}=([^;]+)`));
     if (!match)
         return undefined;
-    const value = decodeURIComponent(match[1]);
-    const [expires, signature] = value.split('.');
+    let value;
+    try {
+        value = decodeURIComponent(match[1]);
+    }
+    catch {
+        return undefined;
+    }
+    const [expires, signature, extra] = value.split('.');
+    if (extra !== undefined)
+        return undefined;
     if (!expires || !signature)
         return undefined;
     if (!signatureMatches(expires, signature, secret))

package/dist/auth/signed-token.js

@@ -21,7 +21,9 @@ export function sign(value, secret) {
  */
 export function signatureMatches(value, signature, secret) {
     const expected = sign(value, secret);
-    if (signature.length !== expected.length)
+    // Character lengths alone do not bound the UTF-8 buffers timingSafeEqual
+    // compares. A multibyte forgery must be refused, never throw a RangeError.
+    if (!/^[A-Za-z0-9_-]{43}$/.test(signature))
         return false;
     return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
 }
@@ -34,7 +36,9 @@ export function signPayload(payload, secret) {
 /** Undefined for anything that was not signed with this secret, or is not the
  *  shape it claims. Never throws on malformed input. */
 export function readSignedPayload(token, secret) {
-    const [encoded, signature] = token.split('.');
+    const [encoded, signature, extra] = token.split('.');
+    if (extra !== undefined)
+        return undefined;
     if (!encoded || !signature)
         return undefined;
     if (!signatureMatches(encoded, signature, secret))

package/dist/auth/store.js

@@ -1,6 +1,7 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
+import { logSafe } from './text.js';
 export const DEFAULT_CLIENT_LIMITS = {
     maxClients: 500,
     pendingTtlSeconds: 24 * 3600,
@@ -60,6 +61,23 @@ const LOCK_WAIT_MS = 10_000;
 const STALE_LOCK_MS = 30_000;
 const LOCK_POLL_MS = 10;
 const lockSleep = new Int32Array(new SharedArrayBuffer(4));
+/**
+ * A map keyed by something a caller chose, with nothing inherited to find.
+ *
+ * Every map in the state file is indexed by an identifier from outside — a
+ * `client_id` from a registration or a URL, a token id from a request, a server
+ * name — and `JSON.parse` hands them back as ordinary objects whose prototype
+ * answers to `constructor`, `hasOwnProperty` and `__proto__`. Looked up that
+ * way, `state.clients['constructor']` is `Object` itself: a truthy record that
+ * is not a client, handed to the authorization server as if it were one, which
+ * answered `500 server_error` to `/authorize?client_id=constructor` and logged
+ * a server fault for every such request. A null prototype leaves nothing to
+ * find, so an unknown name is `undefined` on every path without each of the
+ * forty lookups having to remember `Object.hasOwn`.
+ */
+function bare(record) {
+    return Object.assign(Object.create(null), record ?? {});
+}
 /**
  * All persistent auth state lives in two files under DATA_PATH:
  * jwt-key.pem (Ed25519 private key) and state.json (clients, refresh tokens,
@@ -103,19 +121,7 @@ export class AuthStore {
             this.privateKey = crypto.createPrivateKey(fs.readFileSync(keyPath, 'utf8'));
             this.publicKey = crypto.createPublicKey(this.privateKey);
             const restored = AuthStore.readState(this.statePath);
-            this.state = restored ?? {
-                cookieSecret: crypto.randomBytes(32).toString('base64url'),
-                clients: {},
-                refreshTokens: {},
-                approvals: {},
-                consumedRefreshTokens: {},
-                revokedBefore: {},
-                apiTokens: {},
-                clientLifecycle: {},
-                upstreamCredentials: {},
-                upstreamLogins: {},
-                oidcArtifacts: {}
-            };
+            this.state = restored ?? AuthStore.normalize({ cookieSecret: crypto.randomBytes(32).toString('base64url') });
             if (restored)
                 this.signature = this.fileSignature();
             else
@@ -280,7 +286,9 @@ export class AuthStore {
                 this.persistUnlocked();
                 return;
             }
-            throw new Error(`cannot reload auth state while holding the mutation lock: ${error.message}`);
+            throw new Error(`cannot reload auth state while holding the mutation lock: ${error.message}`, {
+                cause: error
+            });
         }
         const next = AuthStore.normalize(parsed);
         if (!next)
@@ -300,16 +308,16 @@ export class AuthStore {
             return undefined;
         return {
             cookieSecret: state.cookieSecret,
-            clients: state.clients ?? {},
-            refreshTokens: state.refreshTokens ?? {},
-            approvals: state.approvals ?? {},
-            consumedRefreshTokens: state.consumedRefreshTokens ?? {},
-            revokedBefore: state.revokedBefore ?? {},
-            apiTokens: state.apiTokens ?? {},
-            clientLifecycle: state.clientLifecycle ?? {},
-            upstreamCredentials: state.upstreamCredentials ?? {},
-            upstreamLogins: state.upstreamLogins ?? {},
-            oidcArtifacts: state.oidcArtifacts ?? {},
+            clients: bare(state.clients),
+            refreshTokens: bare(state.refreshTokens),
+            approvals: bare(state.approvals),
+            consumedRefreshTokens: bare(state.consumedRefreshTokens),
+            revokedBefore: bare(state.revokedBefore),
+            apiTokens: bare(state.apiTokens),
+            clientLifecycle: bare(state.clientLifecycle),
+            upstreamCredentials: bare(state.upstreamCredentials),
+            upstreamLogins: bare(state.upstreamLogins),
+            oidcArtifacts: bare(Object.fromEntries(Object.entries(bare(state.oidcArtifacts)).map(([model, records]) => [model, bare(records)]))),
             ...(typeof state.externalUrl === 'string' ? { externalUrl: state.externalUrl } : {})
         };
     }
@@ -394,7 +402,7 @@ export class AuthStore {
             }
             const ids = Object.keys(records);
             if (ids.length > MAX_OIDC_ARTIFACTS_PER_MODEL) {
-                const byAge = ids.sort((a, b) => (records[a].expiresAt || Infinity) - (records[b].expiresAt || Infinity));
+                const byAge = ids.toSorted((a, b) => (records[a].expiresAt || Infinity) - (records[b].expiresAt || Infinity));
                 for (const id of byAge.slice(0, ids.length - MAX_OIDC_ARTIFACTS_PER_MODEL))
                     delete records[id];
             }
@@ -556,7 +564,7 @@ export class AuthStore {
             return true;
         const evictable = Object.values(this.state.clients)
             .filter(candidate => !this.state.approvals[candidate.client_id] && !this.isOperatorManagedUnderLock(candidate.client_id))
-            .sort((a, b) => (a.client_id_issued_at ?? 0) - (b.client_id_issued_at ?? 0));
+            .toSorted((a, b) => (a.client_id_issued_at ?? 0) - (b.client_id_issued_at ?? 0));
         for (const candidate of evictable) {
             this.forgetClient(candidate.client_id);
             if (fits())
@@ -621,7 +629,7 @@ export class AuthStore {
         }
         catch (error) {
             // Bookkeeping must never be the reason an authorization fails.
-            console.warn(`mcp-hub: could not record activity for client ${clientId}: ${error.message}`);
+            console.warn(`mcp-hub: could not record activity for client ${logSafe(clientId)}: ${error.message}`);
         }
     }
     /** Timing-safe check of an RFC 7592 registration access token. */
@@ -723,7 +731,7 @@ export class AuthStore {
     pruneUnapprovedClients() {
         const unapproved = Object.values(this.state.clients)
             .filter(c => !this.state.approvals[c.client_id] && !this.isOperatorManagedUnderLock(c.client_id))
-            .sort((a, b) => (a.client_id_issued_at ?? 0) - (b.client_id_issued_at ?? 0));
+            .toSorted((a, b) => (a.client_id_issued_at ?? 0) - (b.client_id_issued_at ?? 0));
         for (let i = 0; i < unapproved.length - MAX_UNAPPROVED_CLIENTS; i++) {
             this.forgetClient(unapproved[i].client_id);
         }
@@ -892,7 +900,7 @@ export class AuthStore {
     ]);
     oidcUpsert(model, id, payload, expiresInSeconds) {
         this.mutate(() => {
-            const records = (this.state.oidcArtifacts[model] ??= {});
+            const records = (this.state.oidcArtifacts[model] ??= bare());
             const key = AuthStore.artifactKey(id);
             const stored = AuthStore.CREDENTIAL_MODELS.has(model) ? { ...payload, jti: undefined } : payload;
             if (AuthStore.CREDENTIAL_MODELS.has(model))

package/dist/child-text.js

@@ -0,0 +1,39 @@
+import { sanitiseText } from './elicitation.js';
+/**
+ * A string a child server wrote, on its way into a tool result the model reads.
+ *
+ * The meta-tools answer with the hub's own words — `list_servers`, `list_tools`
+ * and `get_tool_schema` are built from the hub's snapshot — and until now they
+ * carried a child's `title`, `description` and error message into that answer
+ * untouched. Those are the one channel a child has into a conversation it is
+ * not part of: a bidi override reverses the line, a zero-width character hides
+ * what a model still reads, an ESC sequence lands in whatever terminal shows
+ * the transcript, and a description of any length crowds out the tools next
+ * to it. Stripped of the characters that let text lie about its shape (the
+ * same set an elicitation prompt loses), and cut to a size that fits the field.
+ *
+ * Deliberately not applied to `inputSchema`, `outputSchema` or `annotations`:
+ * those are documents the client validates against and the hub passes on
+ * verbatim by contract — hub-tools.md says whose word they are.
+ */
+export function childText(value, max) {
+    if (typeof value !== 'string')
+        return '';
+    const clean = sanitiseText(value);
+    if (clean.length <= max)
+        return clean;
+    let cut = clean.slice(0, Math.max(0, max - 1));
+    // A cut can split a surrogate pair; a lone half serialises as an escape and
+    // fails a Python client's UTF-8 encoder.
+    const last = cut.charCodeAt(cut.length - 1);
+    if (last >= 0xd800 && last <= 0xdbff)
+        cut = cut.slice(0, -1);
+    return `${cut}…`;
+}
+/** What a child's error message may say inside the hub's own error sentence. */
+export const MAX_CHILD_ERROR_CHARS = 500;
+/** A title or a server's display name. */
+export const MAX_CHILD_TITLE_CHARS = 200;
+/** A full tool description, as `get_tool_schema` hands it on. */
+export const MAX_CHILD_DESCRIPTION_CHARS = 16 * 1024;
+//# sourceMappingURL=child-text.js.map

package/dist/config.js

@@ -412,12 +412,8 @@ function parseServer(name, entry, env, options) {
         }
         const headers = requireStringRecord(name, 'headers', entry.headers ?? {});
         const url = expand(entry.url);
-        try {
-            new URL(url);
-        }
-        catch {
+        if (!URL.canParse(url))
             throw new ConfigError(`Server "${name}": "url" is not a valid URL`);
-        }
         const oauth = parseUpstreamOAuth(name, entry.oauth, expand);
         if (oauth && Object.keys(headers).some(key => key.toLowerCase() === 'authorization')) {
             // The transport merges requestInit headers last, so the static one would

package/dist/docker-proxy/index.js

@@ -5,7 +5,7 @@ import { ConfigWatcher, loadConfig, warnMutableDockerImages } from '../config.js
 import { installFileLogging } from '../logfile.js';
 import { VERSION } from '../version.js';
 import { containerName } from '../sandbox/container-spec.js';
-import { createDockerProxy, recreateSandbox } from './server.js';
+import { createDockerProxy, parseSocketMode, recreateSandbox } from './server.js';
 import { SecretsWatcher } from './secrets-watcher.js';
 import { SecretStore, validateConfigSecrets } from './secrets.js';
 import { warnSingleFileMount } from '../mount-check.js';
@@ -28,7 +28,14 @@ const configPath = env('CONFIG_PATH', '/config/mcp.json');
 const listenSocket = env('LISTEN_SOCKET', '/run/proxy/docker.sock');
 const dockerSocket = env('DOCKER_SOCKET', '/var/run/docker.sock');
 const secretsDir = env('SANDBOX_SECRETS_DIR', '/run/secrets');
-const socketMode = Number.parseInt(env('SOCKET_MODE', '0660'), 8);
+let socketMode;
+try {
+    socketMode = parseSocketMode(env('SOCKET_MODE', '0660'));
+}
+catch (error) {
+    console.error(`mcp-hub-docker-proxy: ${error.message}`);
+    process.exit(1);
+}
 if (process.env.LOG_FILE) {
     installFileLogging(process.env.LOG_FILE);
 }

package/dist/docker-proxy/secrets-watcher.js

@@ -21,7 +21,7 @@ import { SecretError } from './secrets.js';
 const DEBOUNCE_MS = 1_000;
 /** Content identity of a secret set: key order and formatting do not matter. */
 function fingerprint(secrets) {
-    return JSON.stringify(Object.entries(secrets).sort(([a], [b]) => a.localeCompare(b)));
+    return JSON.stringify(Object.entries(secrets).toSorted(([a], [b]) => a.localeCompare(b)));
 }
 /** All docker servers that reference a given secret set. */
 function referencingServers(config, set) {

package/dist/docker-proxy/secrets.js

@@ -18,7 +18,11 @@ export class SecretError extends Error {
 export function parseEnvFile(content) {
     if (content.includes('\0'))
         throw new SecretError('contains a NUL byte');
-    const result = {};
+    // Null prototype: `KEY_PATTERN` admits `__proto__`, and on an ordinary object
+    // `result['__proto__'] = value` replaces the prototype instead of adding a
+    // key — the variable vanished without a word, and the duplicate check two
+    // lines up could not see it either. With nothing inherited it is a key.
+    const result = Object.create(null);
     let entries = 0;
     for (const [index, raw] of content.split('\n').entries()) {
         const line = raw.trim();

package/dist/docker-proxy/server.js

@@ -7,6 +7,20 @@ const MAX_BODY_BYTES = 1024 * 1024;
 const UPSTREAM_TIMEOUT_MS = 15 * 60_000;
 const POLICY_CHECK_TIMEOUT_MS = 5_000;
 const MAX_INSPECT_BYTES = 1024 * 1024;
+/**
+ * The mode of the listening socket, from SOCKET_MODE.
+ *
+ * `parseInt(value, 8)` read `abc` as NaN and `0777x` as 0777, and the NaN
+ * reached chmodSync inside the listen callback — an uncaught exception at
+ * startup with a stack trace where a sentence should be. Three or four octal
+ * digits, nothing else; the value is never echoed, it is one line below the
+ * secrets directory in every compose file.
+ */
+export function parseSocketMode(value) {
+    if (!/^[0-7]{3,4}$/.test(value))
+        throw new Error(`SOCKET_MODE must be three or four octal digits such as 0660 (${value.length} characters given)`);
+    return Number.parseInt(value, 8);
+}
 function refuse(response, status, reason, closeConnection = false) {
     const body = JSON.stringify({ message: `mcp-hub-docker-proxy: ${reason}` });
     response.writeHead(status, {

package/dist/hub.js

@@ -6,6 +6,7 @@ import { loggableToolName, toolAllowed } from './tool-filter.js';
 import { booleanEnv } from './mcp-limits.js';
 import { REFUSAL_REASON, decidePassthrough } from './elicitation.js';
 import { REVISION } from './proxy.js';
+import { MAX_CHILD_DESCRIPTION_CHARS, MAX_CHILD_ERROR_CHARS, MAX_CHILD_TITLE_CHARS, childText } from './child-text.js';
 /**
  * A meta-tool answer, in both channels at once.
  *
@@ -119,9 +120,13 @@ function toolError(message) {
 function firstLine(description) {
     if (!description)
         return '';
-    const line = description.split('\n', 1)[0].trim();
+    const line = childText(description, MAX_CHILD_DESCRIPTION_CHARS).split('\n', 1)[0].trim();
     return line.length > 120 ? `${line.slice(0, 117)}...` : line;
 }
+/** A child's failure, as the hub's own error sentence may quote it. */
+function reason(error) {
+    return childText(error instanceof Error ? error.message : String(error), MAX_CHILD_ERROR_CHARS);
+}
 /**
  * The four hints the three reading meta-tools carry.
  *
@@ -212,7 +217,7 @@ export function buildHubServer(supervisor, secret, era) {
                 await managed.wake();
             }
             catch (error) {
-                return toolError(`Server "${managed.name}" failed to start: ${error.message}`);
+                return toolError(`Server "${managed.name}" failed to start: ${reason(error)}`);
             }
         }
         else if (managed.state === 'sleeping') {
@@ -230,7 +235,9 @@ export function buildHubServer(supervisor, secret, era) {
     }, async () => structured({
         servers: [...supervisor.servers.values()].map(s => ({
             name: s.name,
-            description: s.serverInfo?.title ?? s.serverInfo?.name ?? '',
+            // The child's own words, and the one field of this answer that is:
+            // cleaned and cut like a description, never carried verbatim.
+            description: childText(s.serverInfo?.title ?? s.serverInfo?.name, MAX_CHILD_TITLE_CHARS),
             status: s.state,
             toolCount: s.tools.length,
             ...(s.config.hub ? {} : { hidden: true })
@@ -302,7 +309,7 @@ export function buildHubServer(supervisor, secret, era) {
         return structured({
             server: managed.name,
             name: found.name,
-            description: found.description ?? '',
+            description: childText(found.description, MAX_CHILD_DESCRIPTION_CHARS),
             inputSchema: found.inputSchema,
             // The reason this tool exists twice over: call_tool hands back the
             // child's structuredContent, and until this line the caller had no way
@@ -362,7 +369,7 @@ export function buildHubServer(supervisor, secret, era) {
                 await managed.wake();
             }
             catch (error) {
-                return toolError(`Server "${server}" failed to start: ${error.message}`);
+                return toolError(`Server "${server}" failed to start: ${reason(error)}`);
             }
         }
         if (managed.state !== 'up' || !managed.client)
@@ -386,7 +393,7 @@ export function buildHubServer(supervisor, secret, era) {
             // Aggregate semantics: every failure here is a tool result, never a
             // protocol error, because six meta-tools stand in for every server and
             // one unreachable child must not look like a broken hub.
-            return toolError(`Tool call failed: ${error.message}`);
+            return toolError(`Tool call failed: ${reason(error)}`);
         }
     });
     hub.registerTool('wake_server', {
@@ -405,7 +412,7 @@ export function buildHubServer(supervisor, secret, era) {
             await managed.wake();
         }
         catch (error) {
-            return toolError(`Server "${server}" failed to start: ${error.message}`);
+            return toolError(`Server "${server}" failed to start: ${reason(error)}`);
         }
         managed.markUsed();
         return structured({ name: managed.name, status: managed.state, toolCount: managed.tools.length });

package/dist/index.js

@@ -15,6 +15,7 @@ import { mountOidcProvider } from './auth/oidc/mount.js';
 import { buildOidcProvider } from './auth/oidc/provider.js';
 import { OidcTokenVerifier } from './auth/oidc/verifier.js';
 import { authSecurityHeaders } from './auth/headers.js';
+import { operatorCredential } from './auth/password.js';
 import { createProtectedResourceRoutes } from './auth/protected-resource.js';
 import { createRegistrationManagementRoutes } from './auth/registration.js';
 import { createUpstreamRoutes } from './upstream/routes.js';
@@ -30,6 +31,13 @@ import { IDLE_TIMEOUT_MS } from './timings.js';
 const CLIENT_PRUNE_INTERVAL_MS = 15 * 60_000;
 export const CLIENT_REGISTRATION_MECHANISMS = ['cimd', 'dcr'];
 export async function createHub(options) {
+    // Said before anything else is built, so it is the first line an operator
+    // reads. The hub still starts: with no usable password nobody can approve a
+    // client, so nothing is reachable, and a process that runs and says why is
+    // more useful to a health check or a directory crawler than one that exits.
+    const credential = operatorCredential(options);
+    if (!credential.enabled)
+        console.warn(`mcp-hub: ${credential.problem}`);
     // Canonical issuer identifier: URL.href form ('https://host/' for a root
     // URL), so JWT iss/aud, AS metadata issuer and PRM authorization_servers all
     // match byte-for-byte — claude.ai compares these strictly.
@@ -346,16 +354,25 @@ function cimdAllowedOriginsEnv() {
             url = new URL(entry);
         }
         catch {
-            console.error(`mcp-hub: CIMD_ALLOWED_ORIGINS entry "${entry}" is not a URL`);
+            console.error(`mcp-hub: CIMD_ALLOWED_ORIGINS entry ${describeEntry(entry)} is not a URL`);
             process.exit(1);
         }
         if (url.protocol !== 'https:' || url.origin !== entry.replace(/\/$/, '')) {
-            console.error(`mcp-hub: CIMD_ALLOWED_ORIGINS entry "${entry}" must be a bare https origin, e.g. https://chatgpt.com`);
+            console.error(`mcp-hub: CIMD_ALLOWED_ORIGINS entry ${describeEntry(entry)} must be a bare https origin, e.g. https://chatgpt.com`);
             process.exit(1);
         }
     }
     return entries.map(entry => new URL(entry).origin);
 }
+/**
+ * A configuration value in a diagnostic, quoted only when it has the shape of
+ * one. CIMD_ALLOWED_ORIGINS sits a few lines from PASSWORD_HASH in every
+ * compose file, and a value that is not an origin is exactly what a secret
+ * pasted into the wrong line looks like.
+ */
+function describeEntry(entry) {
+    return /^https?:\/\/[^\s]{1,120}$/i.test(entry) ? `"${entry}"` : `(a ${entry.length}-character value that does not look like an origin)`;
+}
 function nonNegativeIntegerEnv(name, fallback) {
     const raw = process.env[name];
     if (raw === undefined)

package/dist/stdio.js

@@ -22,7 +22,6 @@ import { IDLE_TIMEOUT_MS } from './timings.js';
  */
 export function redirectStdoutLogging() {
     const original = { log: console.log, info: console.info };
-    const toStderr = (...args) => console.error(...args);
     console.log = toStderr;
     console.info = toStderr;
     return () => {
@@ -30,6 +29,9 @@ export function redirectStdoutLogging() {
         console.info = original.info;
     };
 }
+function toStderr(...args) {
+    console.error(...args);
+}
 /**
  * A stdio client has no config volume to mount and no way to see a startup
  * error, so an absent file is a warning and an empty hub — `list_servers`

package/dist/subscriptions.js

@@ -63,6 +63,14 @@ export const DEBOUNCE_MS = nonNegativeIntegerEnv('MCP_SUBSCRIPTION_DEBOUNCE_MS',
  * rather than dressed up as the graceful variant.
  */
 export const MAX_STREAM_MS = nonNegativeIntegerEnv('MCP_SUBSCRIPTION_MAX_MS', 30 * 60_000);
+/**
+ * Distinct events one debounce window may hold before it is flushed early.
+ *
+ * The window is keyed by event kind and, for `resources/updated`, by URI — and
+ * the URI is the child's. A child announcing a million distinct URIs inside one
+ * window would otherwise be a million map entries the hub holds for it.
+ */
+const MAX_PENDING_EVENTS = 1024;
 /** True unless an operator said otherwise, globally or for this server. */
 export function subscriptionsAllowed(config) {
     return SUBSCRIPTIONS_ENABLED && config.subscriptions !== 'off';
@@ -169,6 +177,8 @@ export class SubscriptionRegistry {
             this.deliver(event);
             return;
         }
+        if (this.pending.size >= MAX_PENDING_EVENTS)
+            this.flush();
         this.pending.set(event.kind === 'resource_updated' ? `${event.kind}:${event.uri}` : event.kind, event);
         if (this.timer)
             return;
@@ -198,6 +208,7 @@ export class SubscriptionRegistry {
             this.publish({ kind: 'resource_updated', uri });
     }
     flush() {
+        clearTimeout(this.timer);
         this.timer = undefined;
         const events = [...this.pending.values()];
         this.pending.clear();

package/dist/supervisor.js

@@ -6,12 +6,13 @@ import { MAX_TOOL_LIST_PAGES, MAX_TOOLS, MAX_TOOL_METADATA_BYTES, jsonSize } fro
 import { BACKOFF_INITIAL_MS, BACKOFF_MAX_MS, BACKOFF_RESET_AFTER_MS, IDLE_SWEEP_INTERVAL_MS, MAX_UNUSED_RESTARTS, PING_INTERVAL_MS, PING_TIMEOUT_MS, WAKE_TIMEOUT_MS } from './timings.js';
 import { SocketTransport } from './transports/socket.js';
 import { DockerTransport } from './transports/docker.js';
+import { setTransportHandlers } from './transports/stream.js';
 import { DockerClient, parseSandboxDockerHost } from './sandbox/docker-client.js';
 import { UpstreamAuth, UpstreamLoginRequiredError } from './upstream/auth.js';
-import { credentialFingerprint } from './upstream/provider.js';
 import { ToolCache } from './tool-cache.js';
 import { filterTools, hasToolFilter, unmatchedPatterns } from './tool-filter.js';
 import { subscriptionsAllowed } from './subscriptions.js';
+import { logSafe } from './auth/text.js';
 /**
  * Whether a failure is one a restart could fix.
  *
@@ -87,13 +88,15 @@ export function setDockerClient(client) {
 function sameFilter(a, b) {
     if (!a)
         return false;
-    // JSON rather than a joined string: with a plain separator, ['a b'] and
-    // ['a', 'b'] compare equal, and the hub would skip a reconcile it owed.
-    const uris = (filter) => JSON.stringify([...(filter.resourceSubscriptions ?? [])].sort());
     return ((a.toolsListChanged ?? false) === (b.toolsListChanged ?? false) &&
         (a.promptsListChanged ?? false) === (b.promptsListChanged ?? false) &&
         (a.resourcesListChanged ?? false) === (b.resourcesListChanged ?? false) &&
-        uris(a) === uris(b));
+        subscriptionUris(a) === subscriptionUris(b));
+}
+/** JSON rather than a joined string: with a plain separator, ['a b'] and
+ *  ['a', 'b'] compare equal, and the hub would skip a reconcile it owed. */
+function subscriptionUris(filter) {
+    return JSON.stringify((filter.resourceSubscriptions ?? []).toSorted());
 }
 /** Whether a filter asks for nothing at all, in which case nothing is held upstream. */
 function emptyFilter(filter) {
@@ -349,7 +352,7 @@ export class ManagedServer {
             // question on, not answer it.
             inputRequired: { autoFulfill: false }
         });
-        transport.onclose = () => this.onExit(this.exitReason(), generation);
+        setTransportHandlers(transport, { onclose: () => this.onExit(this.exitReason(), generation) });
         try {
             await client.connect(transport);
         }
@@ -371,7 +374,9 @@ export class ManagedServer {
         // The start itself opens a full idle window, so a pre-warmed server is not
         // swept away just before the tool call it was warmed for.
         this.lastUsedAt = this.startedAt;
-        console.log(`[${this.name}] up (${this.serverInfo?.name ?? 'unknown'} ${this.serverInfo?.version ?? ''})`.trim());
+        // The child's declared identity, on its way into a file LOG_FILE mirrors
+        // and fail2ban reads: escaped and bounded like any other stranger's text.
+        console.log(`[${this.name}] up (${logSafe(this.serverInfo?.name ?? 'unknown', 100)} ${logSafe(this.serverInfo?.version ?? '', 40)})`.trim());
         this.resolveWakeWaiters();
         if (this.capabilities?.tools) {
             client.setNotificationHandler('notifications/tools/list_changed', () => {
@@ -444,7 +449,7 @@ export class ManagedServer {
         }
         this.reconciling = true;
         void this.runReconcile()
-            .catch(error => console.error(`[${this.name}] could not update subscriptions: ${error.message}`))
+            .catch(error => console.error(`[${this.name}] could not update subscriptions: ${logSafe(error.message, 500)}`))
             .finally(() => {
             this.reconciling = false;
             if (!this.reconcileQueued)
@@ -563,7 +568,7 @@ export class ManagedServer {
             this.options.persist?.(this);
         }
         catch (error) {
-            console.error(`[${this.name}] failed to list tools: ${error.message}`);
+            console.error(`[${this.name}] failed to list tools: ${logSafe(error.message, 500)}`);
         }
     }
     async checkAlive() {
@@ -599,7 +604,7 @@ export class ManagedServer {
             await client.ping({ timeout: PING_TIMEOUT_MS });
         }
         catch (error) {
-            console.error(`[${this.name}] ping failed, restarting: ${error.message}`);
+            console.error(`[${this.name}] ping failed, restarting: ${logSafe(error.message, 500)}`);
             // close() triggers transport.onclose -> onExit -> restart with backoff.
             // Already-closed transports reject here; onExit has then run regardless.
             await client.close().catch(() => { });
@@ -629,7 +634,7 @@ export class ManagedServer {
             this.state = 'unauthorized';
             this.lastError = reason;
             this.rejectWakeWaiters(new Error(`Server "${this.name}" needs an upstream login`));
-            console.error(`[${this.name}] unauthorized (${reason}); run: mcp-hub-admin upstream login ${this.name}`);
+            console.error(`[${this.name}] unauthorized (${logSafe(reason, 500)}); run: mcp-hub-admin upstream login ${this.name}`);
             return;
         }
         this.state = 'down';
@@ -641,12 +646,12 @@ export class ManagedServer {
         if (this.onDemand && this.restartsSinceUse > (this.options.maxUnusedRestarts ?? MAX_UNUSED_RESTARTS)) {
             // A crash-looping server nobody asks for would occupy the machine
             // forever. Give up until the next wake, which starts fresh.
-            console.error(`[${this.name}] down (${reason}), giving up until next use after ${this.restartsSinceUse - 1} failed restarts`);
+            console.error(`[${this.name}] down (${logSafe(reason, 500)}), giving up until next use after ${this.restartsSinceUse - 1} failed restarts`);
             this.state = 'sleeping';
             this.rejectWakeWaiters(new Error(`Server "${this.name}" failed to start: ${reason}`));
             return;
         }
-        console.error(`[${this.name}] down (${reason}), restarting in ${Math.round(this.backoffMs / 1000)}s`);
+        console.error(`[${this.name}] down (${logSafe(reason, 500)}), restarting in ${Math.round(this.backoffMs / 1000)}s`);
         this.restartTimer = setTimeout(() => {
             this.restarts++;
             void this.start();
@@ -733,7 +738,10 @@ export class UpstreamAuthRegistry {
         if (!config.oauth)
             return undefined;
         const auth = new UpstreamAuth(name, config, this.store, this.externalUrl);
-        const fingerprint = credentialFingerprint(auth.identity);
+        // Manager identity includes live headers and authentication settings. The
+        // persisted credential fingerprint intentionally survives secret rotation;
+        // it must not keep the old in-memory configuration alive as well.
+        const fingerprint = JSON.stringify(config);
         const existing = this.managers.get(name);
         if (existing?.fingerprint === fingerprint)
             return existing.auth;
@@ -899,7 +907,7 @@ export class Supervisor {
                 if (!managed || managed.state !== 'sleeping')
                     continue;
             }
-            console.log(`mcp-hub: removing orphaned sandbox container ${container.name}`);
+            console.log(`mcp-hub: removing orphaned sandbox container ${logSafe(container.name)}`);
             await dockerClient().removeContainer(container.name);
         }
     }