@samanhappy/mcphub 1.0.43 → 1.0.45

package/dist/services/mcpService.js

@@ -702,6 +702,65 @@ const getVisibleServerByName = (name) => {
 const sessionIsolatedClients = new Map();
 // Locks to prevent concurrent creation of the same isolated client
 const isolatedClientCreationLocks = new Map();
+// Explicit application state for modern clients, independent of MCP transports.
+// Active calls pin entries; idle state expires and admission is bounded.
+const CLIENT_STATE_IDLE_MS = 30 * 60 * 1000;
+const MAX_CLIENT_STATES = 1000;
+const clientStates = new Map();
+let clientStateSweep;
+const removeClientState = (id) => {
+    const state = clientStates.get(id);
+    if (!state)
+        return;
+    clientStates.delete(id);
+    cleanupIsolatedSession(id);
+    for (const client of state.cookieClients)
+        client.clearSessionCookies(id);
+};
+const acquireClientState = (serverInfo) => {
+    const contextService = RequestContextService.getInstance();
+    const scope = contextService.getRequestContext()?.clientStateScope;
+    const handle = contextService.getHeader('x-mcphub-state-id');
+    if (!scope ||
+        typeof handle !== 'string' ||
+        !/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(handle)) {
+        throw new Error('Stateful tools on stateless MCP require authenticated bearer access and X-MCPHub-State-Id (UUID v4)');
+    }
+    const id = `client-state:${scope}:${handle.toLowerCase()}`;
+    let state = clientStates.get(id);
+    if (state && state.active === 0 && Date.now() - state.lastUsed >= CLIENT_STATE_IDLE_MS) {
+        removeClientState(id);
+        state = undefined;
+    }
+    if (!state) {
+        if (clientStates.size >= MAX_CLIENT_STATES) {
+            throw new Error('Client state capacity reached; retry after idle state expires');
+        }
+        state = { active: 0, lastUsed: Date.now(), cookieClients: new Set() };
+        clientStates.set(id, state);
+    }
+    if (!clientStateSweep) {
+        clientStateSweep = setInterval(() => {
+            for (const [key, entry] of clientStates) {
+                if (entry.active === 0 && Date.now() - entry.lastUsed >= CLIENT_STATE_IDLE_MS) {
+                    removeClientState(key);
+                }
+            }
+        }, 60 * 1000);
+        clientStateSweep.unref();
+    }
+    if (serverInfo.openApiClient)
+        state.cookieClients.add(serverInfo.openApiClient);
+    state.active++;
+    const entry = state;
+    return {
+        id,
+        release: () => {
+            entry.active--;
+            entry.lastUsed = Date.now();
+        },
+    };
+};
 export const connectClientWithDiagnostics = async (client, transport, options) => {
     try {
         await client.connect(transport, options);
@@ -839,6 +898,11 @@ export const connected = () => {
 // Global cleanup function to close all connections
 export const cleanupAllServers = () => {
     stopPackageUpdateSweep();
+    if (clientStateSweep)
+        clearInterval(clientStateSweep);
+    clientStateSweep = undefined;
+    for (const id of clientStates.keys())
+        removeClientState(id);
     principalRuntimes.invalidate();
     for (const serverInfo of serverInfos) {
         try {
@@ -1275,7 +1339,9 @@ const callToolWithReconnect = async (serverInfo, toolParams, options, maxRetries
                 try {
                     const rawConfig = await getServerDao().findById(serverInfo.name);
                     if (!rawConfig) {
-                        throw new Error(`Server configuration not found for: ${serverInfo.name}`);
+                        throw new Error(`Server configuration not found for: ${serverInfo.name}`, {
+                            cause: error,
+                        });
                     }
                     // Match initial connection expansion before URL validation and transport creation.
                     const server = replaceEnvVars(rawConfig);
@@ -2762,9 +2828,14 @@ export const toggleServerStatus = async (name, enabled) => {
     }
 };
 const getMcpAppsRouteContext = async (sessionId, group) => {
-    if (!sessionId ||
-        isSmartRoutingGroup(group) ||
-        !hasMcpAppsCapability(servers[sessionId]?.getClientCapabilities())) {
+    // Stateless (2026-07-28) requests have no session; capabilities arrive per request.
+    const requestContext = RequestContextService.getInstance().getRequestContext();
+    const clientCapabilities = requestContext?.stateless
+        ? requestContext.clientCapabilities
+        : sessionId
+            ? servers[sessionId]?.getClientCapabilities()
+            : undefined;
+    if (isSmartRoutingGroup(group) || !hasMcpAppsCapability(clientCapabilities)) {
         return { enabled: false };
     }
     const { filteredServerInfos } = await getFilteredServerInfosForGroup(group);
@@ -3043,12 +3114,19 @@ const handleCallToolRequestImpl = async (request, extra) => {
         extra?.username ||
         (requestContextService.getKeyKindContext() === 'system' ? 'system' : undefined) ||
         undefined;
-    let appsRouteContext = { enabled: false };
+    let appsRouteContext;
     const keyId = bearerKeyContext.keyId || extra?.keyId || undefined;
     const keyName = bearerKeyContext.keyName || extra?.keyName || undefined;
     const sourceIp = requestContextService.getRequestContext()?.remoteAddress || undefined;
     let hostedReservation = null;
     let releaseOnDemandToolCall;
+    let clientStateLease;
+    const getToolStateId = (info, legacyId) => {
+        if (!requestContextService.getRequestContext()?.stateless)
+            return legacyId;
+        clientStateLease ?? (clientStateLease = acquireClientState(info));
+        return clientStateLease.id;
+    };
     const reserveHostedIfNeeded = async (serverName, toolName) => {
         const hostedAuth = requestContextService.getHostedAuthContext();
         assertHostedToolAllowed(hostedAuth, serverName, toolName);
@@ -3172,11 +3250,14 @@ const handleCallToolRequestImpl = async (request, extra) => {
                         }
                     }
                 }
-                if (targetServerInfo.config?.openapi?.cookieSession && !cookieSessionId) {
+                const stateId = targetServerInfo.config?.openapi?.cookieSession
+                    ? getToolStateId(targetServerInfo, cookieSessionId)
+                    : cookieSessionId;
+                if (targetServerInfo.config?.openapi?.cookieSession && !stateId) {
                     throw new Error(`OpenAPI server '${targetServerInfo.name}' requires cookie-session state and is not yet available on stateless MCP requests`);
                 }
                 await reserveHostedIfNeeded(targetServerInfo.name, cleanToolName);
-                const result = await openApiClient.callTool(cleanToolName, finalArgs, passthroughHeaders, false, cookieSessionId);
+                const result = await openApiClient.callTool(cleanToolName, finalArgs, passthroughHeaders, false, stateId);
                 await settleHostedIfNeeded({
                     success: true,
                     requestContent: finalArgs,
@@ -3221,11 +3302,16 @@ const handleCallToolRequestImpl = async (request, extra) => {
             let isolatedCtx;
             if (targetServerInfo.config?.perSessionClient &&
                 !hasCredentialTemplate(targetServerInfo.config)) {
-                if (!sessionId) {
+                const stateId = getToolStateId(targetServerInfo, sessionId);
+                if (!stateId) {
                     throw new Error(`Server '${targetServerInfo.name}' requires per-session client isolation and is not yet available on stateless MCP requests`);
                 }
-                const isolated = await getOrCreateIsolatedClient(sessionId, targetServerInfo);
-                isolatedCtx = { sessionId, client: isolated.client, transport: isolated.transport };
+                const isolated = await getOrCreateIsolatedClient(stateId, targetServerInfo);
+                isolatedCtx = {
+                    sessionId: stateId,
+                    client: isolated.client,
+                    transport: isolated.transport,
+                };
             }
             else if (!targetServerInfo.client) {
                 throw new Error(`Client not found for server: ${targetServerInfo.name}`);
@@ -3343,11 +3429,14 @@ const handleCallToolRequestImpl = async (request, extra) => {
                 }
             }
             const finalArgs = request.params.arguments || {};
-            if (serverInfo.config?.openapi?.cookieSession && !cookieSessionId) {
+            const stateId = serverInfo.config?.openapi?.cookieSession
+                ? getToolStateId(serverInfo, cookieSessionId)
+                : cookieSessionId;
+            if (serverInfo.config?.openapi?.cookieSession && !stateId) {
                 throw new Error(`OpenAPI server '${serverInfo.name}' requires cookie-session state and is not yet available on stateless MCP requests`);
             }
             await reserveHostedIfNeeded(serverInfo.name, cleanToolName);
-            const result = await openApiClient.callTool(cleanToolName, finalArgs, passthroughHeaders, false, cookieSessionId);
+            const result = await openApiClient.callTool(cleanToolName, finalArgs, passthroughHeaders, false, stateId);
             await settleHostedIfNeeded({
                 success: true,
                 requestContent: finalArgs,
@@ -3391,11 +3480,12 @@ const handleCallToolRequestImpl = async (request, extra) => {
         // For servers with perSessionClient: true, use a per-session dedicated client
         let isolatedCtx;
         if (serverInfo.config?.perSessionClient && !hasCredentialTemplate(serverInfo.config)) {
-            if (!sessionId) {
+            const stateId = getToolStateId(serverInfo, sessionId);
+            if (!stateId) {
                 throw new Error(`Server '${serverInfo.name}' requires per-session client isolation and is not yet available on stateless MCP requests`);
             }
-            const isolated = await getOrCreateIsolatedClient(sessionId, serverInfo);
-            isolatedCtx = { sessionId, client: isolated.client, transport: isolated.transport };
+            const isolated = await getOrCreateIsolatedClient(stateId, serverInfo);
+            isolatedCtx = { sessionId: stateId, client: isolated.client, transport: isolated.transport };
         }
         else if (!serverInfo.client) {
             throw new Error(`Client not found for server: ${serverInfo.name}`);
@@ -3487,6 +3577,7 @@ const handleCallToolRequestImpl = async (request, extra) => {
         };
     }
     finally {
+        clientStateLease?.release();
         releaseOnDemandToolCall?.();
     }
 };