@thalovant/mcp-server 0.1.17 → 0.1.19

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.1.19
+
+- Require Node SDK 0.3.5 or newer so runtime tools receive secure MQTT URL enforcement and bounded MQTT setup and HTTP failure cleanup.
+- Keep package, registry, and container source metadata on version 0.1.19. Runtime tool names, inputs, and identity serialization remain compatible.
+
+## 0.1.18
+
+- Serialize runtime tool calls sharing a hub client identity so concurrent calls cannot replace each other's Noise sessions or HTTP message queues. Different identities remain independent.
+- Use Node SDK 0.3.4 or newer for authenticated HiveMind v3 Noise across WSS, HTTPS and MQTT. HTTPS retains replica affinity and uses binary encrypted polling; MQTT reauthenticates when reconnecting.
+- Derive the advertised MCP server version from the package manifest so stdio, Streamable HTTP, npm, OCI and registry metadata agree. Add transport smoke assertions for version consistency.
+
 ## Unreleased
 
 ### Fixed

package/README.md

@@ -393,6 +393,26 @@ With the flag unset, a call with any `sourceType` other than `catalog` fails bef
 
 Set `THALOVANT_MCP_READONLY=1` to register only tools annotated `readOnlyHint: true`. Write and destructive tools are then never registered and never appear in `tools/list`, so an operator can run an observe-only agent without hand-writing a denylist. Like the other registration-time gates it is read when a server instance is created; `thalovant_config_status` reports the state as `readOnly`.
 
+## HiveMind Runtime Compatibility
+
+Runtime calls sharing the same hub client identity run sequentially within one
+MCP process. Use a distinct client identity for each independently running MCP
+server so the hub can keep their sessions separate.
+
+Version 0.1.19 uses `@thalovant/sdk` 0.3.5 or newer. This release enforces
+secure effective MQTT URLs and carries a single connection deadline through
+MQTT setup and HTTP failure cleanup. Runtime tools support
+HiveMind v3 Noise over WSS, HTTPS and MQTT over TLS. `thalovant_healthcheck`
+reports readiness only after authentication; a reachable hub or broker alone
+does not establish a runtime session.
+
+Keep the SDK configuration directory persistent and private between server
+restarts (`~/.config/thalovant`, or the configured XDG/Windows equivalent). It
+contains the client Noise key and trusted server pins. An authentication
+failure preserves those pins; replacing a server key requires an explicit,
+verified trust change. HTTPS identities must advertise the hub's HTTPS plugin,
+and MQTT requires the identity's broker credentials and topic prefix.
+
 ## Development
 
 ```bash

package/dist/index.js

@@ -7,7 +7,7 @@ import { DEFAULT_CONTROL_API_URL, ThalovantClient, ThalovantControlPlane, Thalov
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import { createServer as createHttpServer } from "node:http";
-import { realpathSync } from "node:fs";
+import { readFileSync, realpathSync } from "node:fs";
 import { appendFile, readFile, writeFile } from "node:fs/promises";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { homedir } from "node:os";
@@ -15,7 +15,7 @@ import { mkdir } from "node:fs/promises";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { createRemoteJWKSet, jwtVerify } from "jose";
 import { z } from "zod";
-const VERSION = "0.1.10";
+const VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
 const DEFAULT_TIMEOUT_MS = 30_000;
 const MAX_TIMEOUT_MS = 300_000;
 const MAX_LIMIT = 100;
@@ -651,6 +651,38 @@ async function createRuntimeClient(options) {
         protocol,
     });
 }
+// The hub HTTP/MQTT queues and Noise sessions are keyed by client identity.
+// A second tool call must finish after the first closes that identity's session.
+const runtimeLeases = new Map();
+/**
+ * Hold an identity lease through both the tool action and client cleanup.
+ * This keeps HTTP/MQTT admissions from replacing another call's Noise session;
+ * a failed action still closes its client before the next lease starts.
+ */
+async function withRuntimeClient(options, run) {
+    const client = await createRuntimeClient(options);
+    const key = createHash("sha256").update(JSON.stringify([
+        client.identity.endpointBase(), client.identity.accessKey,
+    ])).digest("hex");
+    const previous = runtimeLeases.get(key) ?? Promise.resolve();
+    let release;
+    const current = new Promise(resolve => { release = resolve; });
+    runtimeLeases.set(key, current);
+    await previous;
+    try {
+        return await run(client);
+    }
+    finally {
+        try {
+            await client.close();
+        }
+        finally {
+            release();
+            if (runtimeLeases.get(key) === current)
+                runtimeLeases.delete(key);
+        }
+    }
+}
 function summarizeReply(reply) {
     const displayItems = reply.displayItems({ maxTextChars: 1_000 });
     return {
@@ -1249,8 +1281,7 @@ export function createServer() {
             openWorldHint: false,
         },
     }, async (args) => {
-        const client = await createRuntimeClient(args);
-        try {
+        return withRuntimeClient(args, async (client) => {
             const identity = client.identity;
             return jsonContent({
                 identity: redactSecrets(identity.asObject(false)),
@@ -1259,10 +1290,7 @@ export function createServer() {
                 supportsRequestedProtocol: identity.supportsProtocol(args.protocol),
                 health: client.healthcheck(),
             });
-        }
-        finally {
-            await client.close();
-        }
+        });
     });
     registerThalovantTool(server, "thalovant_healthcheck", {
         title: "Runtime Healthcheck",
@@ -1276,14 +1304,10 @@ export function createServer() {
             openWorldHint: true,
         },
     }, async ({ timeoutMs, ...runtime }) => {
-        const client = await createRuntimeClient(runtime);
-        try {
+        return withRuntimeClient(runtime, async (client) => {
             await client.connect(clampTimeout(timeoutMs));
             return jsonContent(redactSecrets(client.healthcheck()));
-        }
-        finally {
-            await client.close();
-        }
+        });
     });
     registerThalovantTool(server, "thalovant_ask", {
         title: "Ask Hub",
@@ -1306,8 +1330,7 @@ export function createServer() {
             openWorldHint: true,
         },
     }, async ({ text, timeoutMs, lang, sessionId, requestId, context, replySettleMs, emptyReplyWaitMs, ...runtime }) => {
-        const client = await createRuntimeClient(runtime);
-        try {
+        return withRuntimeClient(runtime, async (client) => {
             const builtContext = context ? buildClientContext({}, context) : undefined;
             const reply = await client.ask(text, {
                 timeoutMs: clampTimeout(timeoutMs),
@@ -1319,10 +1342,7 @@ export function createServer() {
                 emptyReplyWaitMs,
             });
             return jsonContent(redactSecrets(summarizeReply(reply)));
-        }
-        finally {
-            await client.close();
-        }
+        });
     });
     registerThalovantTool(server, "thalovant_send_action", {
         title: "Send Action",
@@ -1343,8 +1363,7 @@ export function createServer() {
             openWorldHint: true,
         },
     }, async ({ payload, title, lang, sessionId, requestId, context, ...runtime }) => {
-        const client = await createRuntimeClient(runtime);
-        try {
+        return withRuntimeClient(runtime, async (client) => {
             await client.sendAction(payload, {
                 title,
                 lang,
@@ -1353,10 +1372,7 @@ export function createServer() {
                 context: context ? buildClientContext({}, context) : undefined,
             });
             return textContent("Action sent.");
-        }
-        finally {
-            await client.close();
-        }
+        });
     });
     registerThalovantTool(server, "thalovant_send_code", {
         title: "Send Code",
@@ -1378,8 +1394,7 @@ export function createServer() {
             openWorldHint: true,
         },
     }, async ({ value, kind, label, lang, sessionId, requestId, context, ...runtime }) => {
-        const client = await createRuntimeClient(runtime);
-        try {
+        return withRuntimeClient(runtime, async (client) => {
             await client.sendCode(value, {
                 kind,
                 label,
@@ -1389,10 +1404,7 @@ export function createServer() {
                 context: context ? buildClientContext({}, context) : undefined,
             });
             return textContent("Code sent.");
-        }
-        finally {
-            await client.close();
-        }
+        });
     });
     registerThalovantTool(server, "thalovant_emit_event", {
         title: "Emit Event",
@@ -1410,14 +1422,10 @@ export function createServer() {
             openWorldHint: true,
         },
     }, async ({ eventType, data, context, ...runtime }) => {
-        const client = await createRuntimeClient(runtime);
-        try {
+        return withRuntimeClient(runtime, async (client) => {
             await client.emit(eventType, data, context ? buildClientContext({}, context) : undefined);
             return textContent("Event emitted.");
-        }
-        finally {
-            await client.close();
-        }
+        });
     });
     registerThalovantTool(server, "thalovant_wait_for_event", {
         title: "Wait For Event",
@@ -1435,8 +1443,7 @@ export function createServer() {
             openWorldHint: true,
         },
     }, async ({ eventName, timeoutMs, sessionId, requestId, context, ...runtime }) => {
-        const client = await createRuntimeClient(runtime);
-        try {
+        return withRuntimeClient(runtime, async (client) => {
             const event = await client.waitForEvent(eventName, {
                 timeoutMs: clampTimeout(timeoutMs),
                 sessionId,
@@ -1444,10 +1451,7 @@ export function createServer() {
                 context: context ? buildClientContext({}, context) : undefined,
             });
             return jsonContent(redactSecrets(event.asObject()));
-        }
-        finally {
-            await client.close();
-        }
+        });
     });
     registerThalovantTool(server, "thalovant_get_analytics_overview", {
         title: "Analytics Overview",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thalovant/mcp-server",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "description": "Stdio and Streamable HTTP MCP server for Thalovant control-plane and hub runtime APIs.",
   "license": "MIT",
   "type": "module",
@@ -64,7 +64,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "@thalovant/sdk": "^0.3.3",
+    "@thalovant/sdk": "^0.3.5",
     "jose": "^6.2.8",
     "zod": "^3.25.76"
   },

package/server.json

@@ -7,19 +7,19 @@
     "url": "https://github.com/thalovant/thalovant-mcp",
     "source": "github"
   },
-  "version": "0.1.17",
+  "version": "0.1.19",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@thalovant/mcp-server",
-      "version": "0.1.17",
+      "version": "0.1.19",
       "transport": {
         "type": "stdio"
       }
     },
     {
       "registryType": "oci",
-      "identifier": "ghcr.io/thalovant/thalovant-mcp:0.1.17",
+      "identifier": "ghcr.io/thalovant/thalovant-mcp:0.1.19",
       "transport": {
         "type": "streamable-http",
         "url": "http://127.0.0.1:3000/mcp"