@oss-scout/mcp 0.12.0 → 0.12.2

package/dist/index.d.ts

@@ -12,7 +12,7 @@ export { registerResources } from "./resources.js";
 /** Server identity, kept in one place for the bin and any embedding host. */
 export declare const SERVER_INFO: {
     readonly name: "oss-scout-mcp";
-    readonly version: "0.12.0";
+    readonly version: "0.12.2";
 };
 /**
  * Build a fully-wired MCP server (tools + resources) around a scout.

package/dist/index.js

@@ -15,7 +15,7 @@ export { registerResources } from "./resources.js";
 /** Server identity, kept in one place for the bin and any embedding host. */
 export const SERVER_INFO = {
     name: "oss-scout-mcp",
-    version: "0.12.0", // x-release-please-version
+    version: "0.12.2", // x-release-please-version
 };
 /**
  * Build a fully-wired MCP server (tools + resources) around a scout.

package/dist/mcp-server.bundle.cjs

@@ -7,7 +7,11 @@ var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -24420,7 +24424,7 @@ function object(shape, params) {
   return new ZodMiniObject(def);
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
 function isZ4Schema(s) {
   const schema = s;
   return !!schema._zod;
@@ -24504,17 +24508,33 @@ function normalizeObjectSchema(schema) {
   }
   return void 0;
 }
+function getDotPath(path5) {
+  if (path5.length === 0) {
+    return "object root";
+  }
+  return path5.reduce((acc, seg, index) => {
+    if (index === 0) {
+      return String(seg);
+    }
+    if (typeof seg === "number") {
+      return `${acc}[${seg}]`;
+    }
+    return `${acc}.${seg}`;
+  }, "");
+}
 function getParseErrorMessage(error48) {
   if (error48 && typeof error48 === "object") {
+    if ("issues" in error48 && Array.isArray(error48.issues) && error48.issues.length > 0) {
+      return error48.issues.map((i) => {
+        if (!i.path?.length) {
+          return i.message;
+        }
+        return `${i.message} at ${getDotPath(i.path)}`;
+      }).join("\n");
+    }
     if ("message" in error48 && typeof error48.message === "string") {
       return error48.message;
     }
-    if ("issues" in error48 && Array.isArray(error48.issues) && error48.issues.length > 0) {
-      const firstIssue = error48.issues[0];
-      if (firstIssue && typeof firstIssue === "object" && "message" in firstIssue) {
-        return String(firstIssue.message);
-      }
-    }
     try {
       return JSON.stringify(error48);
     } catch {
@@ -26710,7 +26730,7 @@ function date4(params) {
 // ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/classic/external.js
 config(en_default2());
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
 var LATEST_PROTOCOL_VERSION = "2025-11-25";
 var SUPPORTED_PROTOCOL_VERSIONS = [LATEST_PROTOCOL_VERSION, "2025-06-18", "2025-03-26", "2024-11-05", "2024-10-07"];
 var RELATED_TASK_META_KEY = "io.modelcontextprotocol/related-task";
@@ -26720,10 +26740,9 @@ var ProgressTokenSchema = union([string2(), number2().int()]);
 var CursorSchema = string2();
 var TaskCreationParamsSchema = looseObject({
   /**
-   * Time in milliseconds to keep task results available after completion.
-   * If null, the task has unlimited lifetime until manually cleaned up.
+   * Requested duration in milliseconds to retain task from creation.
    */
-  ttl: union([number2(), _null3()]).optional(),
+  ttl: number2().optional(),
   /**
    * Time in milliseconds to wait between task status requests.
    */
@@ -27023,7 +27042,11 @@ var ClientCapabilitiesSchema = object2({
   /**
    * Present if the client supports task creation.
    */
-  tasks: ClientTasksCapabilitySchema.optional()
+  tasks: ClientTasksCapabilitySchema.optional(),
+  /**
+   * Extensions that the client supports. Keys are extension identifiers (vendor-prefix/extension-name).
+   */
+  extensions: record(string2(), AssertObjectSchema).optional()
 });
 var InitializeRequestParamsSchema = BaseRequestParamsSchema.extend({
   /**
@@ -27084,7 +27107,11 @@ var ServerCapabilitiesSchema = object2({
   /**
    * Present if the server supports task creation.
    */
-  tasks: ServerTasksCapabilitySchema.optional()
+  tasks: ServerTasksCapabilitySchema.optional(),
+  /**
+   * Extensions that the server supports. Keys are extension identifiers (vendor-prefix/extension-name).
+   */
+  extensions: record(string2(), AssertObjectSchema).optional()
 });
 var InitializeResultSchema = ResultSchema.extend({
   /**
@@ -27276,6 +27303,12 @@ var ResourceSchema = object2({
    * The MIME type of this resource, if known.
    */
   mimeType: optional(string2()),
+  /**
+   * The size of the raw resource content, in bytes (i.e., before base64 encoding or any tokenization), if known.
+   *
+   * This can be used by Hosts to display file sizes and estimate context window usage.
+   */
+  size: optional(number2()),
   /**
    * Optional annotations for the client.
    */
@@ -28228,7 +28261,7 @@ var UrlElicitationRequiredError = class extends McpError {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
 function isTerminal(status) {
   return status === "completed" || status === "failed" || status === "cancelled";
 }
@@ -29517,7 +29550,7 @@ var zodToJsonSchema = (schema, options) => {
   return combined;
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
 function mapMiniTarget(t) {
   if (!t)
     return "draft-7";
@@ -29559,7 +29592,7 @@ function parseWithCompat(schema, data) {
   return result.data;
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
 var DEFAULT_REQUEST_TIMEOUT_MSEC = 6e4;
 var Protocol = class {
   constructor(_options) {
@@ -29600,6 +29633,9 @@ var Protocol = class {
       this.setRequestHandler(GetTaskPayloadRequestSchema, async (request2, extra) => {
         const handleTaskResult = async () => {
           const taskId = request2.params.taskId;
+          if (!await this._taskStore.getTask(taskId, extra.sessionId)) {
+            throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
+          }
           if (this._taskMessageQueue) {
             let queuedMessage;
             while (queuedMessage = await this._taskMessageQueue.dequeue(taskId, extra.sessionId)) {
@@ -29630,12 +29666,12 @@ var Protocol = class {
             throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
           }
           if (!isTerminal(task.status)) {
-            await this._waitForTaskUpdate(taskId, extra.signal);
+            await this._waitForTaskUpdate(taskId, extra.signal, extra.sessionId);
             return await handleTaskResult();
           }
           if (isTerminal(task.status)) {
             const result = await this._taskStore.getTaskResult(taskId, extra.sessionId);
-            this._clearTaskQueue(taskId);
+            this._clearTaskQueue(taskId, extra.sessionId);
             return {
               ...result,
               _meta: {
@@ -29672,7 +29708,7 @@ var Protocol = class {
             throw new McpError(ErrorCode.InvalidParams, `Cannot cancel task in terminal status: ${task.status}`);
           }
           await this._taskStore.updateTaskStatus(request2.params.taskId, "cancelled", "Client cancelled task execution.", extra.sessionId);
-          this._clearTaskQueue(request2.params.taskId);
+          this._clearTaskQueue(request2.params.taskId, extra.sessionId);
           const cancelledTask = await this._taskStore.getTask(request2.params.taskId, extra.sessionId);
           if (!cancelledTask) {
             throw new McpError(ErrorCode.InvalidParams, `Task not found after cancellation: ${request2.params.taskId}`);
@@ -29800,6 +29836,19 @@ var Protocol = class {
     const handler2 = this._requestHandlers.get(request2.method) ?? this.fallbackRequestHandler;
     const capturedTransport = this._transport;
     const relatedTaskId = request2.params?._meta?.[RELATED_TASK_META_KEY]?.taskId;
+    const sessionId = capturedTransport?.sessionId;
+    const store = this._taskStore;
+    let relatedTaskFound = true;
+    let relatedTaskLookup;
+    if (relatedTaskId && store && this._taskMessageQueue && sessionId !== void 0) {
+      relatedTaskFound = false;
+      relatedTaskLookup = (async () => {
+        if (!await store.getTask(relatedTaskId, sessionId)) {
+          throw new McpError(ErrorCode.InvalidParams, `Task not found: ${relatedTaskId}`);
+        }
+        relatedTaskFound = true;
+      })();
+    }
     if (handler2 === void 0) {
       const errorResponse = {
         jsonrpc: "2.0",
@@ -29809,7 +29858,10 @@ var Protocol = class {
           message: "Method not found"
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && relatedTaskLookup) {
+        const queuedError = { type: "error", message: errorResponse, timestamp: Date.now() };
+        relatedTaskLookup.then(() => this._enqueueTaskMessage(relatedTaskId, queuedError, sessionId), () => capturedTransport?.send(errorResponse)).catch((error48) => this._onerror(new Error(`Failed to send an error response: ${error48}`)));
+      } else if (relatedTaskId && this._taskMessageQueue) {
         this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -29860,7 +29912,10 @@ var Protocol = class {
       closeSSEStream: extra?.closeSSEStream,
       closeStandaloneSSEStream: extra?.closeStandaloneSSEStream
     };
-    Promise.resolve().then(() => {
+    (relatedTaskLookup ?? Promise.resolve()).then(() => {
+      if (relatedTaskLookup && abortController.signal.aborted) {
+        throw new McpError(ErrorCode.ConnectionClosed, "Request was cancelled");
+      }
       if (taskCreationParams) {
         this.assertTaskHandlerCapability(request2.method);
       }
@@ -29895,7 +29950,7 @@ var Protocol = class {
           ...error48["data"] !== void 0 && { data: error48["data"] }
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && this._taskMessageQueue && relatedTaskFound) {
         await this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -30375,7 +30430,7 @@ var Protocol = class {
       throw new Error("Cannot enqueue task message: taskStore and taskMessageQueue are not configured");
     }
     const maxQueueSize = this._options?.maxTaskQueueSize;
-    await this._taskMessageQueue.enqueue(taskId, message, sessionId, maxQueueSize);
+    await this._taskMessageQueue.enqueue(taskId, message, sessionId ?? this._transport?.sessionId, maxQueueSize);
   }
   /**
    * Clears the message queue for a task and rejects any pending request resolvers.
@@ -30404,12 +30459,13 @@ var Protocol = class {
    * Uses polling to check for updates at the task's configured poll interval.
    * @param taskId The task ID to wait for
    * @param signal Abort signal to cancel the wait
+   * @param sessionId Session of the request that waits, passed to the task store
    * @returns Promise that resolves when an update occurs or rejects if aborted
    */
-  async _waitForTaskUpdate(taskId, signal) {
+  async _waitForTaskUpdate(taskId, signal, sessionId) {
     let interval = this._options?.defaultTaskPollInterval ?? 1e3;
     try {
-      const task = await this._taskStore?.getTask(taskId);
+      const task = await this._taskStore?.getTask(taskId, sessionId);
       if (task?.pollInterval) {
         interval = task.pollInterval;
       }
@@ -30513,7 +30569,7 @@ function mergeCapabilities(base, additional) {
   return result;
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
 var import_ajv = __toESM(require_ajv(), 1);
 var import_ajv_formats = __toESM(require_dist(), 1);
 function createDefaultAjvInstance() {
@@ -30581,7 +30637,7 @@ var AjvJsonSchemaValidator = class {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
 var ExperimentalServerTasks = class {
   constructor(_server) {
     this._server = _server;
@@ -30794,7 +30850,7 @@ var ExperimentalServerTasks = class {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
 function assertToolsCallTaskCapability(requests, method, entityName) {
   if (!requests) {
     throw new Error(`${entityName} does not support task creation (required for ${method})`);
@@ -30829,7 +30885,7 @@ function assertClientRequestTaskCapability(requests, method, entityName) {
   }
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
 var Server = class extends Protocol {
   /**
    * Initializes this server with the given name and version information.
@@ -30895,16 +30951,7 @@ var Server = class extends Protocol {
     if (!methodSchema) {
       throw new Error("Schema is missing a method literal");
     }
-    let methodValue;
-    if (isZ4Schema(methodSchema)) {
-      const v4Schema = methodSchema;
-      const v4Def = v4Schema._zod?.def;
-      methodValue = v4Def?.value ?? v4Schema.value;
-    } else {
-      const v3Schema = methodSchema;
-      const legacyDef = v3Schema._def;
-      methodValue = legacyDef?.value ?? v3Schema.value;
-    }
+    const methodValue = getLiteralValue(methodSchema);
     if (typeof methodValue !== "string") {
       throw new Error("Schema method literal must be a string");
     }
@@ -31209,7 +31256,7 @@ var Server = class extends Protocol {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/completable.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/completable.js
 var COMPLETABLE_SYMBOL = /* @__PURE__ */ Symbol.for("mcp.completable");
 function isCompletable(schema) {
   return !!schema && typeof schema === "object" && COMPLETABLE_SYMBOL in schema;
@@ -31223,7 +31270,7 @@ var McpZodTypeKind;
   McpZodTypeKind2["Completable"] = "McpCompletable";
 })(McpZodTypeKind || (McpZodTypeKind = {}));
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/toolNameValidation.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/toolNameValidation.js
 var TOOL_NAME_REGEX = /^[A-Za-z0-9._-]{1,128}$/;
 function validateToolName(name) {
   const warnings = [];
@@ -31281,7 +31328,7 @@ function validateAndWarnToolName(name) {
   return result.isValid;
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/mcp-server.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/mcp-server.js
 var ExperimentalMcpServerTasks = class {
   constructor(_mcpServer) {
     this._mcpServer = _mcpServer;
@@ -31296,7 +31343,43 @@ var ExperimentalMcpServerTasks = class {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
+function toolInputElementCount(value, max) {
+  let count = 0;
+  const stack = [value];
+  while (stack.length > 0) {
+    const node = stack.pop();
+    if (node === null || typeof node !== "object")
+      continue;
+    if (Array.isArray(node)) {
+      for (const child of node) {
+        if (++count > max)
+          return count;
+        if (child !== null && typeof child === "object")
+          stack.push(child);
+      }
+    } else {
+      for (const key in node) {
+        if (!Object.prototype.hasOwnProperty.call(node, key))
+          continue;
+        if (++count > max)
+          return count;
+        const child = node[key];
+        if (child !== null && typeof child === "object")
+          stack.push(child);
+      }
+    }
+  }
+  return count;
+}
+function resolveMaxToolInputElements(value) {
+  if (value === void 0 || value === Infinity)
+    return void 0;
+  if (typeof value !== "number" || Number.isNaN(value) || value < 1) {
+    throw new RangeError(`maxToolInputElements must be a number of at least 1, or Infinity, got ${String(value)}`);
+  }
+  return value;
+}
 var McpServer = class {
   constructor(serverInfo, options) {
     this._registeredResources = {};
@@ -31308,6 +31391,7 @@ var McpServer = class {
     this._resourceHandlersInitialized = false;
     this._promptHandlersInitialized = false;
     this.server = new Server(serverInfo, options);
+    this._maxToolInputElements = resolveMaxToolInputElements(options?.maxToolInputElements);
   }
   /**
    * Access experimental features.
@@ -31438,12 +31522,15 @@ var McpServer = class {
    * Validates tool input arguments against the tool's input schema.
    */
   async validateToolInput(tool, args, toolName) {
+    if (this._maxToolInputElements !== void 0 && toolInputElementCount(args, this._maxToolInputElements) > this._maxToolInputElements) {
+      throw new McpError(ErrorCode.InvalidParams, `Invalid arguments for tool ${toolName}: arguments contain more than the maximum of ${this._maxToolInputElements} elements`);
+    }
     if (!tool.inputSchema) {
       return void 0;
     }
     const inputObj = normalizeObjectSchema(tool.inputSchema);
     const schemaToParse = inputObj ?? tool.inputSchema;
-    const parseResult = await safeParseAsync2(schemaToParse, args);
+    const parseResult = await safeParseAsync2(schemaToParse, args ?? {});
     if (!parseResult.success) {
       const error48 = "error" in parseResult ? parseResult.error : "Unknown error";
       const errorMessage2 = getParseErrorMessage(error48);
@@ -31681,7 +31768,7 @@ var McpServer = class {
       }
       if (prompt.argsSchema) {
         const argsObj = normalizeObjectSchema(prompt.argsSchema);
-        const parseResult = await safeParseAsync2(argsObj, request2.params.arguments);
+        const parseResult = await safeParseAsync2(argsObj, request2.params.arguments ?? {});
         if (!parseResult.success) {
           const error48 = "error" in parseResult ? parseResult.error : "Unknown error";
           const errorMessage2 = getParseErrorMessage(error48);
@@ -32088,12 +32175,21 @@ var EMPTY_COMPLETION_RESULT = {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 var import_node_process = __toESM(require("node:process"), 1);
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
+var STDIO_DEFAULT_MAX_BUFFER_SIZE = 10 * 1024 * 1024;
 var ReadBuffer = class {
+  constructor(options) {
+    this._maxBufferSize = options?.maxBufferSize ?? STDIO_DEFAULT_MAX_BUFFER_SIZE;
+  }
   append(chunk) {
+    const newSize = (this._buffer?.length ?? 0) + chunk.length;
+    if (newSize > this._maxBufferSize) {
+      this.clear();
+      throw new Error(`ReadBuffer exceeded maximum size of ${this._maxBufferSize} bytes`);
+    }
     this._buffer = this._buffer ? Buffer.concat([this._buffer, chunk]) : chunk;
   }
   readMessage() {
@@ -32119,20 +32215,26 @@ function serializeMessage(message) {
   return JSON.stringify(message) + "\n";
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.28.0_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.3.6/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 var StdioServerTransport = class {
-  constructor(_stdin = import_node_process.default.stdin, _stdout = import_node_process.default.stdout) {
+  constructor(_stdin = import_node_process.default.stdin, _stdout = import_node_process.default.stdout, options) {
     this._stdin = _stdin;
     this._stdout = _stdout;
-    this._readBuffer = new ReadBuffer();
     this._started = false;
     this._ondata = (chunk) => {
-      this._readBuffer.append(chunk);
-      this.processReadBuffer();
+      try {
+        this._readBuffer.append(chunk);
+        this.processReadBuffer();
+      } catch (error48) {
+        this.onerror?.(error48);
+        this.close().catch(() => {
+        });
+      }
     };
     this._onerror = (error48) => {
       this.onerror?.(error48);
     };
+    this._readBuffer = new ReadBuffer({ maxBufferSize: options?.maxBufferSize });
   }
   /**
    * Starts listening for messages on stdin.
@@ -36643,7 +36745,15 @@ var SkippedIssueSchema = external_exports3.looseObject({
   title: external_exports3.string(),
   skippedAt: external_exports3.string(),
   /** Why it was skipped: the vetter's reasons, or absent for a manual skip (#343). */
-  reason: external_exports3.string().optional()
+  reason: external_exports3.string().optional(),
+  /**
+   * Whether this entry is permanent. Manual skips are permanent (true); vetter-
+   * derived skips for transient conditions (linked PR closed, own PR in flight,
+   * accumulated soft-skips) are non-permanent (false) and eligible for
+   * cullExpiredSkips. Entries without this field (written before #348) default
+   * to true so they are never silently dropped.
+   */
+  permanent: external_exports3.boolean().default(true)
 });
 var HorizonSchema = external_exports3.enum(["quick-win", "bigger-bet"]);
 var SavedCandidateSchema = external_exports3.looseObject({
@@ -36745,8 +36855,17 @@ var ScoutPreferencesSchema = external_exports3.looseObject({
    */
   featuresSplitRatio: external_exports3.number().min(0).max(1).default(0.6)
 });
+var CURRENT_STATE_REVISION = 1;
 var ScoutStateSchema = external_exports3.looseObject({
   version: external_exports3.literal(1),
+  /**
+   * Highest compatible migration applied to this state (see
+   * `parseScoutState`). Unlike `version`, a bump here never locks out an
+   * older binary: the key round-trips through the loose schema, and every
+   * migration it tracks leaves the shape valid for version 1 readers.
+   * State written before the counter existed reads as 0.
+   */
+  stateRevision: external_exports3.number().int().min(0).default(CURRENT_STATE_REVISION),
   preferences: ScoutPreferencesSchema.default(() => ScoutPreferencesSchema.parse({})),
   repoScores: external_exports3.record(external_exports3.string(), RepoScoreSchema).default({}),
   starredRepos: external_exports3.array(external_exports3.string()).default([]),
@@ -36810,7 +36929,32 @@ var ScoutStateSchema = external_exports3.looseObject({
   }))
 });
 function parseScoutState(raw) {
-  return ScoutStateSchema.parse(raw);
+  return ScoutStateSchema.parse(migrateScoutState(raw));
+}
+var LEGACY_INTER_PHASE_DELAY_MS = 3e4;
+function migrateScoutState(raw) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    return raw;
+  }
+  const state = raw;
+  const revision = typeof state.stateRevision === "number" ? state.stateRevision : 0;
+  if (revision >= CURRENT_STATE_REVISION)
+    return raw;
+  let migrated = state;
+  if (revision < 1)
+    migrated = dropInheritedInterPhaseDelay(migrated);
+  return { ...migrated, stateRevision: CURRENT_STATE_REVISION };
+}
+function dropInheritedInterPhaseDelay(state) {
+  const prefs = state.preferences;
+  if (typeof prefs !== "object" || prefs === null || Array.isArray(prefs)) {
+    return state;
+  }
+  const preferences = prefs;
+  if (preferences.interPhaseDelayMs !== LEGACY_INTER_PHASE_DELAY_MS) {
+    return state;
+  }
+  return { ...state, preferences: { ...preferences, interPhaseDelayMs: 0 } };
 }
 
 // ../core/dist/core/issue-filtering.js
@@ -39213,7 +39357,7 @@ async function runPhase3(octokit, vetter, langQuery, minStars, projectCategories
   const pushedSince = thirtyDaysAgo.toISOString().split("T")[0];
   const categoryTopics = getTopicsForCategories(projectCategories);
   const topicQuery = categoryTopics.length > 0 ? `topic:${categoryTopics[0]}` : "";
-  const phase3Query = `is:issue is:open no:assignee ${langQuery} ${topicQuery} stars:>=${minStars} pushed:>=${pushedSince} archived:false`.replace(/  +/g, " ").trim();
+  const phase3Query = `is:issue is:open no:assignee ${langQuery} ${topicQuery} pushed:>=${pushedSince} archived:false`.replace(/  +/g, " ").trim();
   try {
     const data = await searchIssuesGraphQLFirst(octokit, {
       q: phase3Query,
@@ -40253,6 +40397,7 @@ function mergeStates(local, remote) {
     ...local,
     ...remote,
     version: 1,
+    stateRevision: Math.max(local.stateRevision, remote.stateRevision),
     preferences,
     preferencesUpdatedAt,
     tombstones,
@@ -40499,10 +40644,12 @@ var OssScout = class {
   }
   /**
    * Multi-strategy issue search. Returns scored, sorted candidates.
-   * Skipped issues are excluded; the skip list is permanent (#343).
+   * Skipped issues are excluded; permanent skips never re-surface; transient
+   * vetter skips age out after 90 days (#343, #348).
    */
   async search(options) {
     this.evictStaleCacheEntries();
+    this.cullExpiredSkips();
     const skippedUrls = new Set((this.state.skippedIssues ?? []).map((s) => s.url));
     if (options?.excludeRecentlySurfaced ?? true) {
       const ttlDays = options?.recentlySurfacedTtlDays ?? 7;
@@ -41005,11 +41152,17 @@ var OssScout = class {
     for (const c of candidates) {
       if (c.recommendation === "skip") {
         existing.delete(c.issue.url);
+        const TERMINAL_REASONS = /* @__PURE__ */ new Set([
+          "Issue is closed",
+          "Linked PR already merged"
+        ]);
+        const permanent = c.reasonsToSkip.some((r) => TERMINAL_REASONS.has(r));
         this.skipIssue(c.issue.url, {
           repo: c.issue.repo,
           number: c.issue.number,
           title: c.issue.title,
-          reason: c.reasonsToSkip.join("; ") || "vetter: skip"
+          reason: c.reasonsToSkip.join("; ") || "vetter: skip",
+          permanent
         });
         continue;
       }
@@ -41063,12 +41216,21 @@ var OssScout = class {
   }
   // ── Skip List ───────────────────────────────────────────────────────
   /**
-   * Skip an issue — excludes it from future searches permanently (#343).
+   * Skip an issue. Pass `permanent: false` for vetter-derived transient skips
+   * so they expire via cullExpiredSkips (#348); manual skips default to permanent.
    */
   skipIssue(url2, metadata) {
     const existing = this.state.skippedIssues ?? [];
-    if (existing.some((s) => s.url === url2))
+    const hit = existing.find((s) => s.url === url2);
+    if (hit) {
+      if (metadata?.permanent === true && hit.permanent !== true) {
+        hit.permanent = true;
+        hit.skippedAt = (/* @__PURE__ */ new Date()).toISOString();
+        this.dirty = true;
+      }
       return;
+    }
+    const permanent = metadata?.permanent ?? true;
     this.state.skippedIssues = [
       ...existing,
       {
@@ -41077,6 +41239,7 @@ var OssScout = class {
         number: metadata?.number ?? 0,
         title: metadata?.title ?? "",
         skippedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        permanent,
         ...metadata?.reason ? { reason: metadata.reason } : {}
       }
     ];
@@ -41110,25 +41273,35 @@ var OssScout = class {
     this.dirty = true;
   }
   /**
-   * Remove skipped issues older than maxDays (default 90). Not called by
-   * search since #343 (skips are permanent); available for an explicit prune.
+   * Remove non-permanent skipped issues older than maxDays (default 90).
+   * Called at the start of each search (#348) to re-surface issues whose
+   * transient block condition (closed competing PR, own in-flight PR, soft-skip
+   * accumulation) has aged out. Permanent entries (manual skips, terminal vetter
+   * reasons) are never touched. Culled URLs get deletion tombstones so a gist
+   * merge with another machine's older copy does not bring them back.
    * @returns The number of expired entries that were removed.
    */
   cullExpiredSkips(maxDays = 90) {
     const cutoff = /* @__PURE__ */ new Date();
     cutoff.setDate(cutoff.getDate() - maxDays);
-    const before = (this.state.skippedIssues ?? []).length;
+    const culledUrls = [];
     this.state.skippedIssues = (this.state.skippedIssues ?? []).filter((s) => {
+      if (s.permanent !== false)
+        return true;
       const d = new Date(s.skippedAt);
       if (isNaN(d.getTime())) {
         return true;
       }
-      return d >= cutoff;
+      if (d >= cutoff)
+        return true;
+      culledUrls.push(s.url);
+      return false;
     });
-    const culled = before - this.state.skippedIssues.length;
-    if (culled > 0)
+    if (culledUrls.length > 0) {
+      this.addTombstones(culledUrls);
       this.dirty = true;
-    return culled;
+    }
+    return culledUrls.length;
   }
   // ── Persistence ─────────────────────────────────────────────────────
   /**
@@ -41441,6 +41614,7 @@ function registerTools(server, scout) {
           ]
         };
       } catch (err) {
+        if (scout.isDirty()) await scout.checkpoint().catch(() => false);
         const msg = err instanceof Error ? err.message : String(err);
         return {
           content: [{ type: "text", text: `Error: ${msg}` }],
@@ -41720,7 +41894,7 @@ function registerResources(server, scout) {
 // src/index.ts
 var SERVER_INFO = {
   name: "oss-scout-mcp",
-  version: "0.12.0"
+  version: "0.12.2"
   // x-release-please-version
 };
 function createServer(scout) {

package/dist/tools.js

@@ -106,6 +106,12 @@ export function registerTools(server, scout) {
             };
         }
         catch (err) {
+            // State mutated before the failure (notably the search-rotation
+            // cursors, which advance even when a run finds nothing) would
+            // otherwise be dropped, so the same dry strategy/repo window leads
+            // every retry. The CLI persists this in its own catch; mirror it.
+            if (scout.isDirty())
+                await scout.checkpoint().catch(() => false);
             const msg = err instanceof Error ? err.message : String(err);
             return {
                 content: [{ type: "text", text: `Error: ${msg}` }],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oss-scout/mcp",
-  "version": "0.12.0",
+  "version": "0.12.2",
   "description": "MCP server for oss-scout — exposes issue discovery and vetting as MCP tools",
   "type": "module",
   "bin": {
@@ -16,18 +16,18 @@
     "dist/"
   ],
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.27.1",
+    "@modelcontextprotocol/sdk": "^1.32.1",
     "zod": "^4.3.6",
-    "@oss-scout/core": "^1.8.0"
+    "@oss-scout/core": "^1.8.2"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",
-    "@vitest/coverage-v8": "^4.1.4",
-    "esbuild": "^0.27.4",
-    "tsx": "^4.21.0",
+    "@vitest/coverage-v8": "^4.1.11",
+    "esbuild": "^0.28.1",
+    "tsx": "^4.23.15",
     "typescript": "^5.9.3",
     "vite": "^8.0.5",
-    "vitest": "^4.1.4"
+    "vitest": "^4.1.11"
   },
   "keywords": [
     "mcp",