@thalovant/mcp-server 0.1.19 → 0.1.21

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.1.21
+
+- Propagate MCP request cancellation through runtime identity acquisition and SDK connection, Ask, Query and event waits in stdio and Streamable HTTP mode. Require Node SDK 0.3.12 for Query cancellation and explicit HTTP admission cleanup failures, including contradictory disconnect acknowledgments.
+- Skip cancelled queued calls without constructing a client or interrupting the active identity owner. Retain admitted work and actual cleanup after caller cancellation, including SDK operations without cancellation support; preserve failed-cleanup poisoning and never replay application writes.
+- Check cancellation during connection setup before action/code sends, raw event publication and inventory discovery. Tool schemas and the 41-tool default catalogue remain compatible.
+- Verify actual MCP cancellation against independent HTTPS Noise peers on both MCP transports, with late queued execution, pending physical write and healthy successor regressions. Add real remote-cleanup refusal cases that prove an identity with unconfirmed HTTP cleanup remains unavailable instead of admitting an overlapping client.
+
+## 0.1.20
+
+- Require HTTPS for credential-bearing API calls, preserving explicit loopback HTTP for local development. Reject API redirects through the SDK. Instantiate runtime clients only after acquiring their identity lease.
+- Bind server-managed Thalovant tokens and password login to their configured API origin. Reject cross-origin tool overrides before any outbound request, including credentials for remote principals; retain configured custom origins and anonymous public discovery.
+- Add `thalovant_query` for routed HiveMind queries, preserving query/request/session correlation and runtime identity cleanup; hide it in read-only mode. The default catalogue now contains 41 tools.
+- Add read-only `thalovant_intent_inventory` and `thalovant_get_operation` tools for runtime discovery and asynchronous provisioning status. Inventory preserves fallback knowledge and conservative answerability.
+- Require Node SDK 0.3.9 for aligned intent discovery, request correlation, whole-operation reply deadlines, fixed Ask settlement windows, cancellation and retained cleanup ownership, and credential-safe control-plane redirect handling.
+- Retain the runtime identity lease until actual cleanup, even after a caller close timeout; failed cleanup blocks later identity reuse with an explicit error. Bound queued lease acquisition to six seconds without releasing pending ownership or executing expired callers.
+- Upgrade the test runner to Vitest 4.1.11 to remove GHSA-82fw-gwwq-j7x9.
+- Test Node 20, 22 and 24; add per-principal/shared credential regressions and exercise the inventory tool over a real HTTPS Noise session.
+
 ## 0.1.19
 
 - Require Node SDK 0.3.5 or newer so runtime tools receive secure MQTT URL enforcement and bounded MQTT setup and HTTP failure cleanup.

package/README.md

@@ -93,6 +93,13 @@ npm start
 
 If neither a token nor email/password is configured, authenticated control-plane tools fail with a clear error naming the supported options.
 
+Configured API tokens and login credentials are bound to the origin of their
+configured `apiUrl` or `THALOVANT_API_URL` (default `https://api.thalovant.com`).
+A tool argument cannot redirect those credentials to another origin. Equivalent
+URL spellings and paths on the same origin are allowed; custom origins must be
+configured alongside their credentials. Anonymous public discovery may still
+select a custom API URL.
+
 ## Local Stdio
 
 The server speaks MCP over stdio and does not write logs to stdout.
@@ -305,8 +312,10 @@ Read-only:
 - `thalovant_get_public_hub`
 - `thalovant_list_hubs`
 - `thalovant_get_hub`
+- `thalovant_get_operation`
 - `thalovant_identity_status`
 - `thalovant_healthcheck`
+- `thalovant_intent_inventory`
 - `thalovant_wait_for_event`
 - `thalovant_get_analytics_overview`
 - `thalovant_list_memory_items`
@@ -327,6 +336,7 @@ Writes or hub events:
 
 - `thalovant_create_client_identity`
 - `thalovant_ask`
+- `thalovant_query`
 - `thalovant_send_action`
 - `thalovant_send_code`
 - `thalovant_emit_event`
@@ -355,6 +365,16 @@ Destructive, **not registered unless explicitly enabled** (see [Destructive Tool
 
 Tool outputs redact credential-shaped fields. `thalovant_create_client_identity` does not return secret identity material; pass `savePath` when you want the full identity written to a local file with mode `0600`. `savePath` is confined to the server's identity directory (`THALOVANT_MCP_IDENTITY_DIR`, default `<config-dir>/thalovant/identities`): pass a plain filename, since absolute paths outside that directory and `..` traversal are rejected, so a model cannot drop a credential file into a git working tree or synced folder. `thalovant_config_status` reports the active `identityDir`.
 
+`thalovant_intent_inventory` uses the runtime identity and accepts `languages`,
+`describe`, `fallback`, and a per-query/batch `timeoutMs`. It returns registered
+intents and examples, fallback skills, `fallbacks_known`, and `may_answer` by
+requested language. A missing or denied optional fallback-skill query remains
+unknown, rather than being reported as a known empty list. The optional probe
+adds at most 1500ms. A silent listing can use engine manifests; disable this with
+`fallback: false`. Both new tools are available in read-only mode and respect
+per-principal policy. `thalovant_get_operation` reads an operation ID returned by
+provisioning without replaying the write.
+
 ## Destructive Tools
 
 `thalovant_delete_hub` and `thalovant_delete_runtime_group` are **disabled by default**. They are not merely blocked when called — they are never registered, so they do not appear in `tools/list` and a model cannot see or attempt them.
@@ -399,7 +419,7 @@ Runtime calls sharing the same hub client identity run sequentially within one
 MCP process. Use a distinct client identity for each independently running MCP
 server so the hub can keep their sessions separate.
 
-Version 0.1.19 uses `@thalovant/sdk` 0.3.5 or newer. This release enforces
+Version 0.1.21 uses `@thalovant/sdk` `^0.3.12` (0.3.12 through versions below 0.4.0). This release enforces
 secure effective MQTT URLs and carries a single connection deadline through
 MQTT setup and HTTP failure cleanup. Runtime tools support
 HiveMind v3 Noise over WSS, HTTPS and MQTT over TLS. `thalovant_healthcheck`
@@ -413,6 +433,37 @@ failure preserves those pins; replacing a server key requires an explicit,
 verified trust change. HTTPS identities must advertise the hub's HTTPS plugin,
 and MQTT requires the identity's broker credentials and topic prefix.
 
+Runtime tools retain their identity lease through actual cleanup. If the close
+caller times out, a later tool waits up to six seconds for that cleanup before opening a session.
+A queued tool that reaches this deadline fails without executing later or releasing
+the previous session's identity.
+An actual cleanup failure marks the identity unavailable to later calls instead
+of risking concurrent sessions. These leases are process-local; separate server
+processes or replicas need distinct runtime identities or external coordination.
+
+MCP request cancellation applies to queued runtime tools in both stdio and
+Streamable HTTP mode. A cancelled queued call never constructs a runtime client
+or executes later. Cancellation also reaches runtime connection setup, Ask,
+Query and event waits. Action/code sends, raw event publication and inventory
+queries check cancellation during connection setup, then retain ownership until
+the admitted SDK operation finishes. Cancelling the MCP request cannot undo an
+already admitted operation or its effects. The identity remains reserved through
+that work and actual cleanup; application requests are never automatically replayed.
+Control-plane tools do not gain runtime cancellation semantics in this release.
+
+For example, an MCP TypeScript client can cancel a runtime query after ten seconds,
+including time spent waiting for its identity lease:
+
+```typescript
+await mcpClient.callTool({
+  name: "thalovant_query",
+  arguments: { identityFile: "/secure/identity.json", text: "What is the weather?", timeoutMs: 30000 },
+}, undefined, { signal: AbortSignal.timeout(10000) });
+```
+
+Intent inventory retains its connection setup and per-query/batch budgets plus
+a separate optional fallback probe; it has no single inventory-wide deadline.
+
 ## Development
 
 ```bash
@@ -429,3 +480,16 @@ npm pack --dry-run
 ## License
 
 MIT. This is the right default for a public integration server: it is permissive, compatible with the MIT Thalovant Node SDK and MCP TypeScript SDK, and does not force downstream agent or enterprise users into a reciprocal licensing model.
+
+Credential-bearing control-plane calls require HTTPS. Explicit loopback HTTP
+(`localhost`, `127.0.0.1`, `[::1]`) remains supported for local development.
+API redirects are rejected so password-login bodies cannot be forwarded.
+Runtime clients are constructed only after acquiring their identity lease.
+
+`thalovant_query` sends a routed HiveMind query; the hub may cascade it according
+to its routing policy. It accepts `text`, `timeoutMs`, `lang`, `sessionId`,
+`requestId`, `queryId`, `context` and `replySettleMs`, plus the runtime identity
+options, and returns the same normalized reply shape as `thalovant_ask`. A query
+may trigger actions, so read-only mode hides it. Conversation workflows use
+`sessionId` with ask/query and the existing event-wait tool; MCP does not expose
+one tool for every SDK conversation or event-listener method.

package/SECURITY.md

@@ -20,3 +20,13 @@ Do not open public issues for vulnerabilities. Email security reports to `hello@
 - Keep `THALOVANT_ALLOW_SHARED_CREDENTIALS=false` for multi-user deployments.
 - Set exact `MCP_HTTP_ALLOWED_HOSTS` and `MCP_HTTP_ALLOWED_ORIGINS`.
 - Send audit logs to your log pipeline with `MCP_AUDIT_LOG=stderr` or `MCP_AUDIT_LOG_FILE`.
+
+
+Server-managed Thalovant tokens and password login are bound to their configured
+control-plane origin. Tool-provided `apiUrl` overrides with a different origin
+are rejected before any request is sent. Configure a custom API origin together
+with its credentials; per-principal credentials follow the same rule.
+
+Control-plane credentials require HTTPS, with an explicit loopback HTTP exception
+for local development (`localhost`, `127.0.0.1`, `[::1]`). API redirects are rejected,
+including redirects that would preserve password-login request bodies.

package/dist/index.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { throwIfRuntimeCancelled, withRuntimeLease } from "./runtime-lease.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
@@ -77,7 +78,7 @@ const controlPlaneSchema = {
         .string()
         .url()
         .optional()
-        .describe("Control-plane base URL. Defaults to https://api.thalovant.com."),
+        .describe("Control-plane base URL. Configured credentials may only be used on their configured origin; defaults to https://api.thalovant.com."),
 };
 const contextSchema = z
     .object({
@@ -519,7 +520,7 @@ function registerThalovantTool(server, name, config, handler) {
         const start = Date.now();
         try {
             await authorizeTool(name, principal);
-            const result = await requestContext.run({ toolName: name, principal }, () => handler(args, extra));
+            const result = await requestContext.run({ toolName: name, principal, signal: extra.signal }, () => handler(args, extra));
             await auditLog({
                 ts: new Date().toISOString(),
                 event: "mcp.tool",
@@ -567,20 +568,40 @@ function redactSecrets(value) {
     }
     return output;
 }
+/** Keep server-managed credentials on their configured control-plane origin. */
 async function createControlPlane(options) {
     const principal = currentPrincipal();
     const credential = await credentialForPrincipal(principal);
     const canUseShared = allowSharedThalovantCredentials(principal);
-    const apiUrl = options.apiUrl ?? credential?.control?.apiUrl ?? (canUseShared ? process.env.THALOVANT_API_URL : undefined) ?? DEFAULT_CONTROL_API_URL;
+    const configuredApiUrl = credential?.control?.apiUrl ?? (canUseShared ? process.env.THALOVANT_API_URL : undefined) ?? DEFAULT_CONTROL_API_URL;
+    const apiUrl = options.apiUrl ?? configuredApiUrl;
     const accessToken = credential?.control?.accessToken ??
         (canUseShared ? process.env.THALOVANT_API_TOKEN ?? process.env.THALOVANT_ACCESS_TOKEN : undefined);
+    const email = canUseShared ? process.env.THALOVANT_EMAIL : undefined;
+    const password = canUseShared ? process.env.THALOVANT_PASSWORD : undefined;
+    if (accessToken || (email && password)) {
+        let endpoint;
+        let configuredEndpoint;
+        try {
+            endpoint = new URL(apiUrl);
+            configuredEndpoint = new URL(configuredApiUrl);
+        }
+        catch {
+            throw new Error("The configured control-plane API URL is invalid.");
+        }
+        if (endpoint.origin !== configuredEndpoint.origin) {
+            throw new Error("apiUrl must use the configured Thalovant credential origin.");
+        }
+        const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(endpoint.hostname);
+        if (endpoint.protocol !== "https:" && !(endpoint.protocol === "http:" && loopback)) {
+            throw new Error("Credential-bearing control-plane requests require HTTPS (except explicit loopback HTTP).");
+        }
+    }
     const api = new ThalovantControlPlane(apiUrl, {
         accessToken,
         userAgent: `thalovant-mcp/${VERSION}`,
     });
     if (!accessToken && canUseShared) {
-        const email = process.env.THALOVANT_EMAIL;
-        const password = process.env.THALOVANT_PASSWORD;
         if (email && password) {
             await api.login(email, password, { scope: options.loginScope ?? process.env.THALOVANT_SCOPE });
         }
@@ -601,28 +622,26 @@ function controlPlaneAuthModeFromEnv() {
         return "email-password";
     return "none";
 }
-async function createRuntimeClient(options) {
-    const protocol = options.protocol ?? "wss";
+async function createRuntimeIdentity(options) {
     const principal = currentPrincipal();
     const credential = await credentialForPrincipal(principal);
     const runtimeCredential = credential?.runtime;
     const canUseShared = allowSharedThalovantCredentials(principal);
     const canUseToolPaths = canUseShared || parseBool(process.env.MCP_HTTP_ALLOW_CLIENT_CREDENTIAL_PATHS, false);
     if (runtimeCredential?.identity) {
-        return new ThalovantClient(new ThalovantIdentity(runtimeCredential.identity), { protocol });
+        return new ThalovantIdentity(runtimeCredential.identity);
     }
     if (runtimeCredential?.identityFile) {
-        return ThalovantClient.fromIdentityFile(runtimeCredential.identityFile, { protocol });
+        return ThalovantIdentity.fromFile(runtimeCredential.identityFile);
     }
     if (runtimeCredential?.configPath || runtimeCredential?.profile) {
-        return ThalovantClient.fromConfig({
+        return ThalovantIdentity.fromConfig({
             path: runtimeCredential.configPath,
             profile: runtimeCredential.profile,
-            protocol,
         });
     }
     if (runtimeCredential?.fromEnv && canUseShared) {
-        return ThalovantClient.fromEnv({ protocol });
+        return ThalovantIdentity.fromEnv();
     }
     if (isRemotePrincipal(principal) && !canUseShared && !canUseToolPaths) {
         throw new Error("No per-principal Thalovant runtime identity is configured for this authenticated MCP principal.");
@@ -631,57 +650,33 @@ async function createRuntimeClient(options) {
         throw new Error("Runtime identity path/config arguments are disabled for remote MCP principals.");
     }
     if (options.identityFile) {
-        return ThalovantClient.fromIdentityFile(options.identityFile, { protocol });
+        return ThalovantIdentity.fromFile(options.identityFile);
     }
     if (options.configPath || options.profile) {
-        return ThalovantClient.fromConfig({
+        return ThalovantIdentity.fromConfig({
             path: options.configPath,
             profile: options.profile ?? process.env.THALOVANT_PROFILE,
-            protocol,
         });
     }
     if (!canUseShared) {
         throw new Error("No per-principal Thalovant runtime identity is configured for this authenticated MCP principal.");
     }
     if (options.fromEnv || process.env.THALOVANT_ACCESS_KEY) {
-        return ThalovantClient.fromEnv({ protocol });
+        return ThalovantIdentity.fromEnv();
     }
-    return ThalovantClient.fromConfig({
+    return ThalovantIdentity.fromConfig({
         profile: process.env.THALOVANT_PROFILE,
-        protocol,
     });
 }
-// The hub HTTP/MQTT queues and Noise sessions are keyed by client identity.
-// A second tool call must finish after the first closes that identity's session.
-const runtimeLeases = new Map();
-/**
- * Hold an identity lease through both the tool action and client cleanup.
- * This keeps HTTP/MQTT admissions from replacing another call's Noise session;
- * a failed action still closes its client before the next lease starts.
- */
+/** Use one identity lease through the action and actual retained cleanup. */
 async function withRuntimeClient(options, run) {
-    const client = await createRuntimeClient(options);
+    const signal = requestContext.getStore()?.signal;
+    throwIfRuntimeCancelled(signal);
+    const identity = await createRuntimeIdentity(options);
     const key = createHash("sha256").update(JSON.stringify([
-        client.identity.endpointBase(), client.identity.accessKey,
+        identity.endpointBase(), identity.accessKey,
     ])).digest("hex");
-    const previous = runtimeLeases.get(key) ?? Promise.resolve();
-    let release;
-    const current = new Promise(resolve => { release = resolve; });
-    runtimeLeases.set(key, current);
-    await previous;
-    try {
-        return await run(client);
-    }
-    finally {
-        try {
-            await client.close();
-        }
-        finally {
-            release();
-            if (runtimeLeases.get(key) === current)
-                runtimeLeases.delete(key);
-        }
-    }
+    return withRuntimeLease(key, () => new ThalovantClient(identity, { protocol: options.protocol ?? "wss" }), client => run(client, signal), 6000, signal);
 }
 function summarizeReply(reply) {
     const displayItems = reply.displayItems({ maxTextChars: 1_000 });
@@ -1214,6 +1209,16 @@ export function createServer() {
         ensureAuthenticated(api);
         return jsonContent(redactSecrets(await api.getHub(hubId)));
     });
+    registerThalovantTool(server, "thalovant_get_operation", {
+        title: "Get Provisioning Operation",
+        description: "Read the status of an asynchronous control-plane operation returned by provisioning.",
+        inputSchema: { ...controlPlaneSchema, operationId: z.string().min(1).max(500) },
+        annotations: { readOnlyHint: true, openWorldHint: true },
+    }, async ({ operationId, ...auth }) => {
+        const api = await createControlPlane(auth);
+        ensureAuthenticated(api);
+        return jsonContent(redactSecrets(await api.getOperation(operationId)));
+    });
     registerThalovantTool(server, "thalovant_create_client_identity", {
         title: "Create Client Identity",
         description: "Create a Thalovant client identity for a hub. The identity is secret; output is redacted unless savePath is used.",
@@ -1304,11 +1309,31 @@ export function createServer() {
             openWorldHint: true,
         },
     }, async ({ timeoutMs, ...runtime }) => {
-        return withRuntimeClient(runtime, async (client) => {
-            await client.connect(clampTimeout(timeoutMs));
+        return withRuntimeClient(runtime, async (client, signal) => {
+            await client.connect(clampTimeout(timeoutMs), signal);
             return jsonContent(redactSecrets(client.healthcheck()));
         });
     });
+    registerThalovantTool(server, "thalovant_intent_inventory", {
+        title: "Runtime Intent Inventory",
+        description: "Discover a hub's registered intents, language examples and fallback skills using its runtime identity. Unknown fallback support remains distinct from a known empty list; answerability is a conservative hint.",
+        inputSchema: {
+            ...runtimeAuthSchema,
+            languages: z.array(z.string().trim().min(1).max(100)).min(1).max(20).default(["en-us"]),
+            describe: z.boolean().default(true),
+            fallback: z.boolean().default(true).describe("Try engine manifests if the intent listing is refused or unanswered."),
+            timeoutMs: z.number().int().min(1_000).max(MAX_TIMEOUT_MS).default(DEFAULT_TIMEOUT_MS).describe("Per-query/batch timeout; the optional fallback-skill probe is capped at 1500ms."),
+        },
+        annotations: { readOnlyHint: true, openWorldHint: true },
+    }, async ({ languages, describe, fallback, timeoutMs, ...runtime }) => withRuntimeClient(runtime, async (client, signal) => {
+        await client.connect(undefined, signal);
+        throwIfRuntimeCancelled(signal);
+        const inventory = await client.intents(languages, { describe, fallback, timeoutMs: clampTimeout(timeoutMs) });
+        return jsonContent(redactSecrets({
+            ...inventory.asObject(),
+            may_answer: Object.fromEntries(inventory.languages.map(lang => [lang, inventory.mayAnswer(lang)])),
+        }));
+    }));
     registerThalovantTool(server, "thalovant_ask", {
         title: "Ask Hub",
         description: "Send one text request to a Thalovant hub using a saved identity and return the normalized reply.",
@@ -1330,9 +1355,10 @@ export function createServer() {
             openWorldHint: true,
         },
     }, async ({ text, timeoutMs, lang, sessionId, requestId, context, replySettleMs, emptyReplyWaitMs, ...runtime }) => {
-        return withRuntimeClient(runtime, async (client) => {
+        return withRuntimeClient(runtime, async (client, signal) => {
             const builtContext = context ? buildClientContext({}, context) : undefined;
             const reply = await client.ask(text, {
+                signal,
                 timeoutMs: clampTimeout(timeoutMs),
                 lang,
                 sessionId,
@@ -1344,6 +1370,31 @@ export function createServer() {
             return jsonContent(redactSecrets(summarizeReply(reply)));
         });
     });
+    registerThalovantTool(server, "thalovant_query", {
+        title: "Query Hub",
+        description: "Send a routed HiveMind query using a saved identity and return the normalized reply. The hub may cascade the query according to its routing policy; a query can trigger actions.",
+        inputSchema: {
+            ...runtimeAuthSchema,
+            text: z.string().trim().min(1).max(20_000),
+            timeoutMs: z.number().int().min(1_000).max(MAX_TIMEOUT_MS).default(DEFAULT_TIMEOUT_MS),
+            lang: z.string().min(1).optional(),
+            sessionId: z.string().min(1).optional(),
+            requestId: z.string().min(1).optional(),
+            queryId: z.string().min(1).optional(),
+            context: contextSchema,
+            replySettleMs: z.number().int().min(0).max(10_000).optional(),
+        },
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+    }, async ({ text, timeoutMs, lang, sessionId, requestId, queryId, context, replySettleMs, ...runtime }) => {
+        return withRuntimeClient(runtime, async (client, signal) => {
+            const reply = await client.query(text, {
+                signal,
+                timeoutMs: clampTimeout(timeoutMs), lang, sessionId, requestId, queryId,
+                context: context ? buildClientContext({}, context) : undefined, replySettleMs,
+            });
+            return jsonContent(redactSecrets(summarizeReply(reply)));
+        });
+    });
     registerThalovantTool(server, "thalovant_send_action", {
         title: "Send Action",
         description: "Send a structured action payload to a Thalovant hub.",
@@ -1363,7 +1414,9 @@ export function createServer() {
             openWorldHint: true,
         },
     }, async ({ payload, title, lang, sessionId, requestId, context, ...runtime }) => {
-        return withRuntimeClient(runtime, async (client) => {
+        return withRuntimeClient(runtime, async (client, signal) => {
+            await client.connect(undefined, signal);
+            throwIfRuntimeCancelled(signal);
             await client.sendAction(payload, {
                 title,
                 lang,
@@ -1394,7 +1447,9 @@ export function createServer() {
             openWorldHint: true,
         },
     }, async ({ value, kind, label, lang, sessionId, requestId, context, ...runtime }) => {
-        return withRuntimeClient(runtime, async (client) => {
+        return withRuntimeClient(runtime, async (client, signal) => {
+            await client.connect(undefined, signal);
+            throwIfRuntimeCancelled(signal);
             await client.sendCode(value, {
                 kind,
                 label,
@@ -1422,7 +1477,9 @@ export function createServer() {
             openWorldHint: true,
         },
     }, async ({ eventType, data, context, ...runtime }) => {
-        return withRuntimeClient(runtime, async (client) => {
+        return withRuntimeClient(runtime, async (client, signal) => {
+            await client.connect(undefined, signal);
+            throwIfRuntimeCancelled(signal);
             await client.emit(eventType, data, context ? buildClientContext({}, context) : undefined);
             return textContent("Event emitted.");
         });
@@ -1443,8 +1500,9 @@ export function createServer() {
             openWorldHint: true,
         },
     }, async ({ eventName, timeoutMs, sessionId, requestId, context, ...runtime }) => {
-        return withRuntimeClient(runtime, async (client) => {
+        return withRuntimeClient(runtime, async (client, signal) => {
             const event = await client.waitForEvent(eventName, {
+                signal,
                 timeoutMs: clampTimeout(timeoutMs),
                 sessionId,
                 requestId,

package/dist/runtime-lease.d.ts

@@ -0,0 +1,9 @@
+/** Runtime identities admit one Noise session at a time across MCP tool calls. */
+interface RuntimeClosable {
+    close(): Promise<void>;
+    waitForClosed(): Promise<void>;
+}
+export declare function throwIfRuntimeCancelled(signal?: AbortSignal): void;
+/** Caller cancellation/deadlines never release an identity before owned work and cleanup settle. */
+export declare function withRuntimeLease<T, C extends RuntimeClosable>(key: string, createClient: () => C, run: (client: C) => Promise<T>, acquireTimeoutMs?: number, signal?: AbortSignal): Promise<T>;
+export {};

package/dist/runtime-lease.js

@@ -0,0 +1,97 @@
+const leases = new Map();
+function cancellationError() {
+    // MCP cancellation reasons are caller supplied and may contain credentials.
+    const error = new Error("Runtime tool request cancelled.");
+    error.name = "AbortError";
+    return error;
+}
+export function throwIfRuntimeCancelled(signal) {
+    if (signal?.aborted)
+        throw cancellationError();
+}
+/** Caller cancellation/deadlines never release an identity before owned work and cleanup settle. */
+export async function withRuntimeLease(key, createClient, run, acquireTimeoutMs = 6000, signal) {
+    throwIfRuntimeCancelled(signal);
+    if (!Number.isFinite(acquireTimeoutMs) || acquireTimeoutMs <= 0) {
+        throw new Error("Runtime identity acquisition deadline expired.");
+    }
+    const previous = leases.get(key) ?? Promise.resolve();
+    let release;
+    let fail;
+    const current = new Promise((resolve, reject) => { release = resolve; fail = reject; });
+    // Observe poisoned barriers even when no later caller arrives.
+    void current.catch(() => undefined);
+    leases.set(key, current);
+    const releaseIdentity = () => {
+        release();
+        if (leases.get(key) === current)
+            leases.delete(key);
+    };
+    const failIdentity = () => {
+        fail(new Error("Previous runtime session cleanup failed; this identity remains unavailable."));
+    };
+    let onAbort;
+    const cancelled = new Promise((_, reject) => {
+        onAbort = () => reject(cancellationError());
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+    // The signal may fire during a synchronous client factory or cleanup callback.
+    // Observe it even when execution fails before the final race is installed.
+    void cancelled.catch(() => undefined);
+    try {
+        let timer;
+        try {
+            await Promise.race([
+                previous, cancelled,
+                new Promise((_, reject) => {
+                    timer = setTimeout(() => reject(new Error("Runtime identity acquisition deadline expired; previous session cleanup is still pending.")), acquireTimeoutMs);
+                }),
+            ]);
+            throwIfRuntimeCancelled(signal);
+        }
+        catch (error) {
+            // An abandoned waiter never constructs a client or runs later. Its place
+            // in the chain remains occupied until the prior owner actually retires.
+            void previous.then(releaseIdentity, failIdentity);
+            throw error;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        let client;
+        try {
+            client = createClient();
+        }
+        catch (error) {
+            releaseIdentity();
+            throw error;
+        }
+        const owned = (async () => {
+            try {
+                throwIfRuntimeCancelled(signal);
+                return await run(client);
+            }
+            finally {
+                let closing;
+                try {
+                    closing = client.close();
+                    // Observe close independently if waitForClosed throws synchronously.
+                    void closing.catch(() => undefined);
+                    void client.waitForClosed().then(releaseIdentity, failIdentity);
+                }
+                catch (error) {
+                    failIdentity();
+                    throw error;
+                }
+                await closing;
+            }
+        })();
+        // SDK methods accepting a signal can retire promptly. Other admitted work
+        // must finish naturally before close begins; cancellation never replays it.
+        // The race observes both branches, including late work/cleanup rejections.
+        return await Promise.race([owned, cancelled]);
+    }
+    finally {
+        signal?.removeEventListener("abort", onAbort);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thalovant/mcp-server",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "description": "Stdio and Streamable HTTP MCP server for Thalovant control-plane and hub runtime APIs.",
   "license": "MIT",
   "type": "module",
@@ -64,7 +64,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "@thalovant/sdk": "^0.3.5",
+    "@thalovant/sdk": "^0.3.12",
     "jose": "^6.2.8",
     "zod": "^3.25.76"
   },
@@ -74,6 +74,6 @@
   "devDependencies": {
     "@types/node": "^22.18.12",
     "typescript": "^5.9.3",
-    "vitest": "^3.2.4"
+    "vitest": "^4.1.11"
   }
 }

package/server.json

@@ -7,19 +7,19 @@
     "url": "https://github.com/thalovant/thalovant-mcp",
     "source": "github"
   },
-  "version": "0.1.19",
+  "version": "0.1.21",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@thalovant/mcp-server",
-      "version": "0.1.19",
+      "version": "0.1.21",
       "transport": {
         "type": "stdio"
       }
     },
     {
       "registryType": "oci",
-      "identifier": "ghcr.io/thalovant/thalovant-mcp:0.1.19",
+      "identifier": "ghcr.io/thalovant/thalovant-mcp:0.1.21",
       "transport": {
         "type": "streamable-http",
         "url": "http://127.0.0.1:3000/mcp"