@samanhappy/mcphub 1.0.27 → 1.0.29

package/dist/services/mcpService.js

@@ -11,6 +11,7 @@ import { StreamableHTTPClientTransport, } from '@modelcontextprotocol/sdk/client
 import { normalizeHeaders } from '@modelcontextprotocol/sdk/shared/transport.js';
 import { createFetchWithProxy, getProxyConfigFromEnv } from './proxy.js';
 import { assertSafeUrl, createRedirectValidatingFetch } from '../utils/ssrf.js';
+import { ResilientJsonSchemaValidator } from '../utils/jsonSchemaValidator.js';
 import { getUserDao } from '../dao/index.js';
 import { expandEnvVars, replaceEnvVars, getNameSeparator } from '../config/index.js';
 import config from '../config/index.js';
@@ -287,6 +288,11 @@ const cleanupIsolatedSession = (sessionId) => {
         }
         console.log(`Cleaned up isolated clients for session: ${sessionId}`);
     }
+    // Drop per-session OpenAPI cookie jars so authenticated state does not
+    // outlive the downstream session.
+    for (const serverInfo of serverInfos) {
+        serverInfo.openApiClient?.clearSessionCookies?.(sessionId);
+    }
 };
 /** Helper to write an isolated session upstream client into the tracking map. */
 const setSessionIsolatedClient = (sessionId, serverName, client, transport) => {
@@ -543,6 +549,7 @@ const createUpstreamMcpClient = (name, getServerInfo) => {
         version: '1.0.0',
     }, {
         capabilities: MCP_APPS_CAPABILITIES,
+        jsonSchemaValidator: new ResilientJsonSchemaValidator(),
         listChanged: {
             tools: {
                 onChanged: (error, tools) => {
@@ -1169,10 +1176,12 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                 });
                 continue;
             }
-            // On-demand servers: skip startup connect; spawn lazily on first tool call.
+            // On-demand stdio servers: skip startup connect; spawn lazily on first
+            // tool call. startOnDemand is a stdio-only optimisation - HTTP/SSE and
+            // OpenAPI servers have no deferred child process, so they connect normally.
             // Preserve existing runtime state (tools/prompts populated from a previous
             // connection) so the tool list stays visible to agents even while sleeping.
-            if (expandedConf.startOnDemand === true) {
+            if (expandedConf.startOnDemand === true && isStdioServer(expandedConf)) {
                 const existingOnDemand = existingServerInfos.find((s) => s.name === name);
                 nextServerInfos.push({
                     // Carry over cached tools/prompts/resources if the server was previously connected
@@ -1360,7 +1369,6 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                 serverInfo.oauth = {
                     authorizationUrl: pendingAuth.authorizationUrl,
                     state: pendingAuth.state,
-                    codeVerifier: pendingAuth.codeVerifier,
                 };
             }
             nextServerInfos.push(serverInfo);
@@ -1473,6 +1481,19 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
         throw error;
     }
     serverInfos = nextServerInfos;
+    // Populate the tool cache for on-demand stdio servers so their tools are
+    // visible to agents, then put them back to sleep. Running here (rather than
+    // only at startup) also covers servers added/enabled/reloaded after startup.
+    const primePromise = primeOnDemandServers();
+    // At full startup (no serverName) keep prime fire-and-forget so a slow or
+    // broken on-demand server does not block init. For a targeted reload/edit
+    // (serverName set), await it so the caller - and the dashboard refresh that
+    // follows the HTTP response - sees the cached tools immediately instead of an
+    // empty list that only fills in after the fire-and-forget prime completes and
+    // the next poll picks it up. See #1032.
+    if (serverName) {
+        await primePromise;
+    }
     return serverInfos;
 };
 // Register all MCP tools
@@ -1549,6 +1570,14 @@ export const getServersInfo = async (page, limit, user) => {
                 enabled: promptConfig?.enabled !== false, // Default to true if not explicitly disabled
             };
         });
+        const resourcesWithEnabled = resources.map((resource) => {
+            const resourceConfig = serverConfig?.resources?.[resource.uri];
+            return {
+                ...resource,
+                description: resolveDescriptionOverride(resource.description, resourceConfig),
+                enabled: resourceConfig?.enabled !== false,
+            };
+        });
         return {
             name,
             version,
@@ -1559,7 +1588,7 @@ export const getServersInfo = async (page, limit, user) => {
             error,
             tools: toolsWithEnabled,
             prompts: promptsWithEnabled,
-            resources,
+            resources: resourcesWithEnabled,
             createTime,
             enabled,
             oauth: oauth || oauthConnected
@@ -1568,6 +1597,7 @@ export const getServersInfo = async (page, limit, user) => {
                         ? {
                             authorizationUrl: oauth.authorizationUrl,
                             state: oauth.state,
+                            ...(oauth.clientIdConfigured ? { clientIdConfigured: true } : {}),
                             // Don't expose codeVerifier to frontend for security
                         }
                         : {}),
@@ -1688,7 +1718,7 @@ const filterToolsByConfig = async (serverName, tools) => {
 };
 // Get server by tool name
 const getServerByTool = (toolName) => {
-    return serverInfos.find((serverInfo) => serverInfo.tools.some((tool) => tool.name === toolName));
+    return serverInfos.find((serverInfo) => serverInfo.enabled !== false && serverInfo.tools.some((tool) => tool.name === toolName));
 };
 // Add new server
 export const addServer = async (name, config) => {
@@ -1847,30 +1877,160 @@ const scheduleIdleShutdown = (serverInfo) => {
 };
 /**
  * Ensures an on-demand server is connected before a tool call proceeds.
- * Uses a singleton promise so concurrent callers wait for the same spawn
- * instead of triggering duplicate process launches.
+ *
+ * Performs a direct, awaited wake-up that mutates the existing `serverInfo`
+ * in place (preserving the reference callers hold), rather than going through
+ * `reconnectServer` -> `initializeClientsFromSettings`. The latter skips the
+ * connect for on-demand servers, resolves before the fire-and-forget handshake
+ * completes, and rebuilds `serverInfos` (leaving callers with a stale object) -
+ * so it could never actually wake a sleeping server. See #1029.
+ *
+ * Concurrent callers coalesce on `spawningPromise` so only one spawn runs.
  */
 const ensureServerReady = async (serverInfo) => {
     if (serverInfo.status === 'connected')
         return;
-    // Another call is already spawning — wait for it
+    // Another call is already spawning - wait for it
     if (serverInfo.spawningPromise) {
         await serverInfo.spawningPromise;
         return;
     }
-    console.log(`[${serverInfo.name}] Cold-starting on-demand server…`);
     const spawnStart = Date.now();
-    const spawnPromise = reconnectServer(serverInfo.name).then(() => {
-        console.log(`[${serverInfo.name}] On-demand server ready in ${Date.now() - spawnStart}ms`);
-    });
+    const spawnPromise = (async () => {
+        // Load the config fresh from the DAO for the expanded transport config and
+        // to read the server name. See #1029.
+        const rawConfig = await getServerDao().findById(serverInfo.name);
+        if (!rawConfig) {
+            throw new Error('Server configuration not found for on-demand wake');
+        }
+        if (rawConfig.enabled === false) {
+            throw new Error(`Cannot start disabled on-demand server: ${rawConfig.name}`);
+        }
+        const expandedConf = replaceEnvVars(rawConfig);
+        // startOnDemand is a stdio-only optimisation; OpenAPI/HTTP servers have no
+        // deferred process to spawn, so there is nothing to wake.
+        if (expandedConf.type === 'openapi') {
+            return;
+        }
+        const name = rawConfig.name;
+        console.log(`[${name}] Cold-starting on-demand server…`);
+        const transport = await createTransportFromConfig(name, expandedConf);
+        const client = createUpstreamMcpClient(name, () => serverInfo);
+        const serverRequestOptions = expandedConf.options || {};
+        const defaultRequestTimeout = Number(process.env.DEFAULT_REQUEST_TIMEOUT) || 60000;
+        const requestOptions = {
+            timeout: serverRequestOptions.timeout || defaultRequestTimeout,
+            resetTimeoutOnProgress: serverRequestOptions.resetTimeoutOnProgress ?? true,
+            maxTotalTimeout: serverRequestOptions.maxTotalTimeout,
+        };
+        await connectClientWithDiagnostics(client, transport, requestOptions);
+        // Mutate in place so every holder of this serverInfo (resolution paths,
+        // the caller about to invoke the tool) sees the live client/status.
+        serverInfo.client = client;
+        serverInfo.transport = transport;
+        serverInfo.options = requestOptions;
+        serverInfo.version = client.getServerVersion?.()?.version;
+        serverInfo.instructions = client.getInstructions?.();
+        serverInfo.config = expandedConf;
+        serverInfo.status = 'connected';
+        serverInfo.error = null;
+        let toolCount = 0;
+        let promptCount = 0;
+        let resourceCount = 0;
+        const capabilities = client.getServerCapabilities?.();
+        if (capabilities?.tools) {
+            try {
+                const tools = await client.listTools({}, requestOptions);
+                toolCount = tools.tools.length;
+                updateServerToolsCache(serverInfo, tools.tools);
+                broadcastToolListChanged();
+            }
+            catch (error) {
+                console.warn(`[${name}] Failed to list tools during wake`, {
+                    error: summarizeErrorForLogging(error),
+                });
+            }
+        }
+        if (capabilities?.prompts) {
+            try {
+                const prompts = await client.listPrompts({}, requestOptions);
+                promptCount = prompts.prompts.length;
+                updateServerPromptsCache(serverInfo, prompts.prompts);
+            }
+            catch (error) {
+                console.warn(`[${name}] Failed to list prompts during wake`, {
+                    error: summarizeErrorForLogging(error),
+                });
+            }
+        }
+        if (capabilities?.resources) {
+            try {
+                const resources = await client.listResources({}, requestOptions);
+                resourceCount = resources.resources.length;
+                updateServerResourcesCache(serverInfo, resources.resources);
+            }
+            catch (error) {
+                console.warn(`[${name}] Failed to list resources during wake`, {
+                    error: summarizeErrorForLogging(error),
+                });
+            }
+        }
+        // No-op for stdio transports; only SSE/streamable-http opt in via enableKeepAlive.
+        setupServerKeepAlive(serverInfo, expandedConf);
+        console.log(`[${name}] On-demand server ready in ${Date.now() - spawnStart}ms` +
+            ` (${toolCount} tools, ${promptCount} prompts, ${resourceCount} resources)`);
+    })();
     serverInfo.spawningPromise = spawnPromise;
     try {
         await spawnPromise;
     }
+    catch (error) {
+        serverInfo.status = 'disconnected';
+        serverInfo.error = `Failed to start on-demand server: ${formatErrorForLogging(error)}`;
+        throw error;
+    }
     finally {
         serverInfo.spawningPromise = undefined;
     }
 };
+// stdio servers are the only ones that benefit from deferred spawning; HTTP/SSE
+// and OpenAPI servers have no long-lived child process to skip.
+const isStdioServer = (conf) => !!conf && (conf.type === 'stdio' || (!conf.type && !!conf.command));
+/**
+ * Connects each on-demand stdio server once to populate its tool cache, then
+ * shuts the child back down (keeping the cache). Run after startup init so the
+ * tools are advertised immediately and a later `tools/call` can wake the server.
+ *
+ * Returns a promise so a targeted reload/edit can await it (via
+ * initializeClientsFromSettings) and surface the populated tool cache before
+ * the HTTP response - otherwise the dashboard refresh that follows the edit
+ * sees an empty list until the next poll. At full startup the caller still
+ * ignores the promise (fire-and-forget) so a slow or broken on-demand server
+ * does not block init. Each server is isolated so one failure does not affect
+ * the others. See #1029 / #1032.
+ */
+const primeOnDemandServers = () => {
+    const targets = serverInfos.filter((si) => si.config?.startOnDemand === true &&
+        isStdioServer(si.config) &&
+        si.tools.length === 0 &&
+        si.enabled !== false);
+    if (targets.length === 0)
+        return Promise.resolve();
+    console.log(`Priming ${targets.length} on-demand server(s) for tool discovery…`);
+    return Promise.allSettled(targets.map(async (si) => {
+        try {
+            await ensureServerReady(si);
+            // Sleep the child but keep the cached tool list visible to agents.
+            shutdownOnDemandServer(si);
+            console.log('On-demand server primed and asleep');
+        }
+        catch (error) {
+            console.warn('Failed to prime on-demand server', {
+                error: summarizeErrorForLogging(error),
+            });
+        }
+    })).then(() => undefined);
+};
 export const resetServerOAuthConnection = (name) => {
     const serverInfo = serverInfos.find((serverInfo) => serverInfo.name === name);
     if (!serverInfo) {
@@ -2063,7 +2223,11 @@ const resolveToolInGroup = async (group, toolName, allowRawName) => {
     }
     const { filteredServerInfos, serverConfigsByName } = await getFilteredServerInfosForGroup(lookupGroup);
     for (const serverInfo of filteredServerInfos) {
-        if (serverInfo.status !== 'connected' || serverInfo.enabled === false) {
+        // A disconnected on-demand server may still have a cached tool list from a
+        // previous wake-up; allow it through so it can be selected and woken by the
+        // caller. Other disconnected servers cannot serve the request. See #1029.
+        if ((serverInfo.status !== 'connected' && !serverInfo.config?.startOnDemand) ||
+            serverInfo.enabled === false) {
             continue;
         }
         const serverConfig = serverConfigsByName.get(serverInfo.name);
@@ -2135,6 +2299,14 @@ export const handleListToolsRequest = async (_, extra) => {
     }
     const { filteredServerInfos, serverConfigsByName } = await getFilteredServerInfosForGroup(group);
     const appsRouteContext = await getMcpAppsRouteContext(sessionId, group);
+    // If the startup prime of an on-demand server is still in flight, wait for it
+    // so this list reflects the freshly cached tools instead of returning empty.
+    // No wake is triggered from list itself; the prime handles that. See #1029.
+    await Promise.allSettled(filteredServerInfos
+        .filter((si) => si.config?.startOnDemand === true &&
+        si.tools.length === 0 &&
+        si.spawningPromise)
+        .map((si) => si.spawningPromise));
     const allTools = [];
     for (const serverInfo of filteredServerInfos) {
         if (serverInfo.tools && serverInfo.tools.length > 0) {
@@ -2170,6 +2342,18 @@ export const handleCallToolRequest = async (request, extra) => {
     const requestContextService = RequestContextService.getInstance();
     const bearerKeyContext = requestContextService.getBearerKeyContext();
     const sessionId = extra.sessionId || '';
+    // For OpenAPI cookie-session isolation, use a real per-caller session id.
+    // Direct API controllers fall back to shared synthetic ids ('api-session' /
+    // 'openapi-session') when x-session-id is absent, which would leak cookies
+    // across callers, so only accept an explicitly-provided session header or a
+    // non-synthetic extra.sessionId. Fail-safe (undefined) otherwise.
+    const isSyntheticSessionFallback = (id) => id === 'api-session' || id === 'openapi-session';
+    const explicitXSessionId = extra?.headers?.['x-session-id'];
+    const cookieSessionId = [
+        requestContextService.getSessionId(),
+        typeof explicitXSessionId === 'string' ? explicitXSessionId : undefined,
+        typeof extra?.sessionId === 'string' ? extra.sessionId : undefined,
+    ].find((id) => typeof id === 'string' && id.length > 0 && !isSyntheticSessionFallback(id));
     // Extract group and key info from request context (set by SSE/HTTP handlers)
     // Fallback to extra for backward compatibility (e.g., direct API calls)
     const group = requestContextService.getGroupContext() || extra?.group || getGroup(sessionId) || undefined;
@@ -2305,7 +2489,7 @@ export const handleCallToolRequest = async (request, extra) => {
                     }
                 }
                 await reserveHostedIfNeeded(targetServerInfo.name, cleanToolName);
-                const result = await openApiClient.callTool(cleanToolName, finalArgs, passthroughHeaders);
+                const result = await openApiClient.callTool(cleanToolName, finalArgs, passthroughHeaders, false, cookieSessionId);
                 await settleHostedIfNeeded({
                     success: true,
                     requestContent: finalArgs,
@@ -2427,6 +2611,13 @@ export const handleCallToolRequest = async (request, extra) => {
             throw new Error(`Server not found: ${request.params.name}`);
         }
         assertToolAvailableForRoute(tool, appsRouteContext);
+        // Wake the on-demand server before invoking the tool. It may be asleep with
+        // a cached tool list (visible above) but no live client. Mirrors the
+        // $smart call_tool path. See #1029.
+        if (serverInfo.config?.startOnDemand && serverInfo.status !== 'connected') {
+            await ensureServerReady(serverInfo);
+        }
+        serverInfo.lastUsedAt = Date.now();
         // Handle OpenAPI servers differently
         if (serverInfo.openApiClient) {
             // For OpenAPI servers, use the OpenAPI client
@@ -2464,7 +2655,7 @@ export const handleCallToolRequest = async (request, extra) => {
             }
             const finalArgs = request.params.arguments || {};
             await reserveHostedIfNeeded(serverInfo.name, cleanToolName);
-            const result = await openApiClient.callTool(cleanToolName, finalArgs, passthroughHeaders);
+            const result = await openApiClient.callTool(cleanToolName, finalArgs, passthroughHeaders, false, cookieSessionId);
             await settleHostedIfNeeded({
                 success: true,
                 requestContent: finalArgs,
@@ -2526,6 +2717,8 @@ export const handleCallToolRequest = async (request, extra) => {
             toolName: cleanToolName,
             result: summarizeToolResultForLogging(result),
         });
+        // Reset idle-shutdown timer for on-demand servers after each successful call
+        scheduleIdleShutdown(serverInfo);
         // Log successful activity
         const duration = Date.now() - startTime;
         await activityLogger.logToolCall({