@thalovant/mcp-server 0.1.20 → 0.1.21

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.1.21
+
+- Propagate MCP request cancellation through runtime identity acquisition and SDK connection, Ask, Query and event waits in stdio and Streamable HTTP mode. Require Node SDK 0.3.12 for Query cancellation and explicit HTTP admission cleanup failures, including contradictory disconnect acknowledgments.
+- Skip cancelled queued calls without constructing a client or interrupting the active identity owner. Retain admitted work and actual cleanup after caller cancellation, including SDK operations without cancellation support; preserve failed-cleanup poisoning and never replay application writes.
+- Check cancellation during connection setup before action/code sends, raw event publication and inventory discovery. Tool schemas and the 41-tool default catalogue remain compatible.
+- Verify actual MCP cancellation against independent HTTPS Noise peers on both MCP transports, with late queued execution, pending physical write and healthy successor regressions. Add real remote-cleanup refusal cases that prove an identity with unconfirmed HTTP cleanup remains unavailable instead of admitting an overlapping client.
+
 ## 0.1.20
 
 - Require HTTPS for credential-bearing API calls, preserving explicit loopback HTTP for local development. Reject API redirects through the SDK. Instantiate runtime clients only after acquiring their identity lease.

package/README.md

@@ -419,7 +419,7 @@ Runtime calls sharing the same hub client identity run sequentially within one
 MCP process. Use a distinct client identity for each independently running MCP
 server so the hub can keep their sessions separate.
 
-Version 0.1.20 uses `@thalovant/sdk` `^0.3.9` (0.3.9 through versions below 0.4.0). This release enforces
+Version 0.1.21 uses `@thalovant/sdk` `^0.3.12` (0.3.12 through versions below 0.4.0). This release enforces
 secure effective MQTT URLs and carries a single connection deadline through
 MQTT setup and HTTP failure cleanup. Runtime tools support
 HiveMind v3 Noise over WSS, HTTPS and MQTT over TLS. `thalovant_healthcheck`
@@ -438,7 +438,31 @@ caller times out, a later tool waits up to six seconds for that cleanup before o
 A queued tool that reaches this deadline fails without executing later or releasing
 the previous session's identity.
 An actual cleanup failure marks the identity unavailable to later calls instead
-of risking concurrent sessions.
+of risking concurrent sessions. These leases are process-local; separate server
+processes or replicas need distinct runtime identities or external coordination.
+
+MCP request cancellation applies to queued runtime tools in both stdio and
+Streamable HTTP mode. A cancelled queued call never constructs a runtime client
+or executes later. Cancellation also reaches runtime connection setup, Ask,
+Query and event waits. Action/code sends, raw event publication and inventory
+queries check cancellation during connection setup, then retain ownership until
+the admitted SDK operation finishes. Cancelling the MCP request cannot undo an
+already admitted operation or its effects. The identity remains reserved through
+that work and actual cleanup; application requests are never automatically replayed.
+Control-plane tools do not gain runtime cancellation semantics in this release.
+
+For example, an MCP TypeScript client can cancel a runtime query after ten seconds,
+including time spent waiting for its identity lease:
+
+```typescript
+await mcpClient.callTool({
+  name: "thalovant_query",
+  arguments: { identityFile: "/secure/identity.json", text: "What is the weather?", timeoutMs: 30000 },
+}, undefined, { signal: AbortSignal.timeout(10000) });
+```
+
+Intent inventory retains its connection setup and per-query/batch budgets plus
+a separate optional fallback probe; it has no single inventory-wide deadline.
 
 ## Development
 

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { withRuntimeLease } from "./runtime-lease.js";
+import { throwIfRuntimeCancelled, withRuntimeLease } from "./runtime-lease.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
@@ -520,7 +520,7 @@ function registerThalovantTool(server, name, config, handler) {
         const start = Date.now();
         try {
             await authorizeTool(name, principal);
-            const result = await requestContext.run({ toolName: name, principal }, () => handler(args, extra));
+            const result = await requestContext.run({ toolName: name, principal, signal: extra.signal }, () => handler(args, extra));
             await auditLog({
                 ts: new Date().toISOString(),
                 event: "mcp.tool",
@@ -670,11 +670,13 @@ async function createRuntimeIdentity(options) {
 }
 /** Use one identity lease through the action and actual retained cleanup. */
 async function withRuntimeClient(options, run) {
+    const signal = requestContext.getStore()?.signal;
+    throwIfRuntimeCancelled(signal);
     const identity = await createRuntimeIdentity(options);
     const key = createHash("sha256").update(JSON.stringify([
         identity.endpointBase(), identity.accessKey,
     ])).digest("hex");
-    return withRuntimeLease(key, () => new ThalovantClient(identity, { protocol: options.protocol ?? "wss" }), run);
+    return withRuntimeLease(key, () => new ThalovantClient(identity, { protocol: options.protocol ?? "wss" }), client => run(client, signal), 6000, signal);
 }
 function summarizeReply(reply) {
     const displayItems = reply.displayItems({ maxTextChars: 1_000 });
@@ -1307,8 +1309,8 @@ export function createServer() {
             openWorldHint: true,
         },
     }, async ({ timeoutMs, ...runtime }) => {
-        return withRuntimeClient(runtime, async (client) => {
-            await client.connect(clampTimeout(timeoutMs));
+        return withRuntimeClient(runtime, async (client, signal) => {
+            await client.connect(clampTimeout(timeoutMs), signal);
             return jsonContent(redactSecrets(client.healthcheck()));
         });
     });
@@ -1323,7 +1325,9 @@ export function createServer() {
             timeoutMs: z.number().int().min(1_000).max(MAX_TIMEOUT_MS).default(DEFAULT_TIMEOUT_MS).describe("Per-query/batch timeout; the optional fallback-skill probe is capped at 1500ms."),
         },
         annotations: { readOnlyHint: true, openWorldHint: true },
-    }, async ({ languages, describe, fallback, timeoutMs, ...runtime }) => withRuntimeClient(runtime, async (client) => {
+    }, async ({ languages, describe, fallback, timeoutMs, ...runtime }) => withRuntimeClient(runtime, async (client, signal) => {
+        await client.connect(undefined, signal);
+        throwIfRuntimeCancelled(signal);
         const inventory = await client.intents(languages, { describe, fallback, timeoutMs: clampTimeout(timeoutMs) });
         return jsonContent(redactSecrets({
             ...inventory.asObject(),
@@ -1351,9 +1355,10 @@ export function createServer() {
             openWorldHint: true,
         },
     }, async ({ text, timeoutMs, lang, sessionId, requestId, context, replySettleMs, emptyReplyWaitMs, ...runtime }) => {
-        return withRuntimeClient(runtime, async (client) => {
+        return withRuntimeClient(runtime, async (client, signal) => {
             const builtContext = context ? buildClientContext({}, context) : undefined;
             const reply = await client.ask(text, {
+                signal,
                 timeoutMs: clampTimeout(timeoutMs),
                 lang,
                 sessionId,
@@ -1381,8 +1386,9 @@ export function createServer() {
         },
         annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
     }, async ({ text, timeoutMs, lang, sessionId, requestId, queryId, context, replySettleMs, ...runtime }) => {
-        return withRuntimeClient(runtime, async (client) => {
+        return withRuntimeClient(runtime, async (client, signal) => {
             const reply = await client.query(text, {
+                signal,
                 timeoutMs: clampTimeout(timeoutMs), lang, sessionId, requestId, queryId,
                 context: context ? buildClientContext({}, context) : undefined, replySettleMs,
             });
@@ -1408,7 +1414,9 @@ export function createServer() {
             openWorldHint: true,
         },
     }, async ({ payload, title, lang, sessionId, requestId, context, ...runtime }) => {
-        return withRuntimeClient(runtime, async (client) => {
+        return withRuntimeClient(runtime, async (client, signal) => {
+            await client.connect(undefined, signal);
+            throwIfRuntimeCancelled(signal);
             await client.sendAction(payload, {
                 title,
                 lang,
@@ -1439,7 +1447,9 @@ export function createServer() {
             openWorldHint: true,
         },
     }, async ({ value, kind, label, lang, sessionId, requestId, context, ...runtime }) => {
-        return withRuntimeClient(runtime, async (client) => {
+        return withRuntimeClient(runtime, async (client, signal) => {
+            await client.connect(undefined, signal);
+            throwIfRuntimeCancelled(signal);
             await client.sendCode(value, {
                 kind,
                 label,
@@ -1467,7 +1477,9 @@ export function createServer() {
             openWorldHint: true,
         },
     }, async ({ eventType, data, context, ...runtime }) => {
-        return withRuntimeClient(runtime, async (client) => {
+        return withRuntimeClient(runtime, async (client, signal) => {
+            await client.connect(undefined, signal);
+            throwIfRuntimeCancelled(signal);
             await client.emit(eventType, data, context ? buildClientContext({}, context) : undefined);
             return textContent("Event emitted.");
         });
@@ -1488,8 +1500,9 @@ export function createServer() {
             openWorldHint: true,
         },
     }, async ({ eventName, timeoutMs, sessionId, requestId, context, ...runtime }) => {
-        return withRuntimeClient(runtime, async (client) => {
+        return withRuntimeClient(runtime, async (client, signal) => {
             const event = await client.waitForEvent(eventName, {
+                signal,
                 timeoutMs: clampTimeout(timeoutMs),
                 sessionId,
                 requestId,

package/dist/runtime-lease.d.ts

@@ -3,6 +3,7 @@ interface RuntimeClosable {
     close(): Promise<void>;
     waitForClosed(): Promise<void>;
 }
-/** A caller timeout never releases an identity before actual cleanup settles. */
-export declare function withRuntimeLease<T, C extends RuntimeClosable>(key: string, createClient: () => C, run: (client: C) => Promise<T>, acquireTimeoutMs?: number): Promise<T>;
+export declare function throwIfRuntimeCancelled(signal?: AbortSignal): void;
+/** Caller cancellation/deadlines never release an identity before owned work and cleanup settle. */
+export declare function withRuntimeLease<T, C extends RuntimeClosable>(key: string, createClient: () => C, run: (client: C) => Promise<T>, acquireTimeoutMs?: number, signal?: AbortSignal): Promise<T>;
 export {};

package/dist/runtime-lease.js

@@ -1,6 +1,17 @@
 const leases = new Map();
-/** A caller timeout never releases an identity before actual cleanup settles. */
-export async function withRuntimeLease(key, createClient, run, acquireTimeoutMs = 6000) {
+function cancellationError() {
+    // MCP cancellation reasons are caller supplied and may contain credentials.
+    const error = new Error("Runtime tool request cancelled.");
+    error.name = "AbortError";
+    return error;
+}
+export function throwIfRuntimeCancelled(signal) {
+    if (signal?.aborted)
+        throw cancellationError();
+}
+/** Caller cancellation/deadlines never release an identity before owned work and cleanup settle. */
+export async function withRuntimeLease(key, createClient, run, acquireTimeoutMs = 6000, signal) {
+    throwIfRuntimeCancelled(signal);
     if (!Number.isFinite(acquireTimeoutMs) || acquireTimeoutMs <= 0) {
         throw new Error("Runtime identity acquisition deadline expired.");
     }
@@ -8,8 +19,7 @@ export async function withRuntimeLease(key, createClient, run, acquireTimeoutMs
     let release;
     let fail;
     const current = new Promise((resolve, reject) => { release = resolve; fail = reject; });
-    // A failed cleanup poisons this identity's barrier. Observe it even when no
-    // later caller arrives; later tools fail instead of replacing that session.
+    // Observe poisoned barriers even when no later caller arrives.
     void current.catch(() => undefined);
     leases.set(key, current);
     const releaseIdentity = () => {
@@ -20,45 +30,68 @@ export async function withRuntimeLease(key, createClient, run, acquireTimeoutMs
     const failIdentity = () => {
         fail(new Error("Previous runtime session cleanup failed; this identity remains unavailable."));
     };
-    let timer;
-    try {
-        await Promise.race([
-            previous,
-            new Promise((_, reject) => {
-                timer = setTimeout(() => reject(new Error("Runtime identity acquisition deadline expired; previous session cleanup is still pending.")), acquireTimeoutMs);
-            }),
-        ]);
-    }
-    catch (error) {
-        // An expired waiter never runs or closes its unused client. Its place in
-        // the chain remains occupied until the prior owner actually retires.
-        void previous.then(releaseIdentity, failIdentity);
-        throw error;
-    }
-    finally {
-        clearTimeout(timer);
-    }
-    let client;
-    try {
-        client = createClient();
-    }
-    catch (error) {
-        releaseIdentity();
-        throw error;
-    }
+    let onAbort;
+    const cancelled = new Promise((_, reject) => {
+        onAbort = () => reject(cancellationError());
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+    // The signal may fire during a synchronous client factory or cleanup callback.
+    // Observe it even when execution fails before the final race is installed.
+    void cancelled.catch(() => undefined);
     try {
-        return await run(client);
-    }
-    finally {
-        let closing;
+        let timer;
+        try {
+            await Promise.race([
+                previous, cancelled,
+                new Promise((_, reject) => {
+                    timer = setTimeout(() => reject(new Error("Runtime identity acquisition deadline expired; previous session cleanup is still pending.")), acquireTimeoutMs);
+                }),
+            ]);
+            throwIfRuntimeCancelled(signal);
+        }
+        catch (error) {
+            // An abandoned waiter never constructs a client or runs later. Its place
+            // in the chain remains occupied until the prior owner actually retires.
+            void previous.then(releaseIdentity, failIdentity);
+            throw error;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        let client;
         try {
-            closing = client.close();
+            client = createClient();
         }
         catch (error) {
-            failIdentity();
+            releaseIdentity();
             throw error;
         }
-        void client.waitForClosed().then(releaseIdentity, failIdentity);
-        await closing;
+        const owned = (async () => {
+            try {
+                throwIfRuntimeCancelled(signal);
+                return await run(client);
+            }
+            finally {
+                let closing;
+                try {
+                    closing = client.close();
+                    // Observe close independently if waitForClosed throws synchronously.
+                    void closing.catch(() => undefined);
+                    void client.waitForClosed().then(releaseIdentity, failIdentity);
+                }
+                catch (error) {
+                    failIdentity();
+                    throw error;
+                }
+                await closing;
+            }
+        })();
+        // SDK methods accepting a signal can retire promptly. Other admitted work
+        // must finish naturally before close begins; cancellation never replays it.
+        // The race observes both branches, including late work/cleanup rejections.
+        return await Promise.race([owned, cancelled]);
+    }
+    finally {
+        signal?.removeEventListener("abort", onAbort);
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thalovant/mcp-server",
-  "version": "0.1.20",
+  "version": "0.1.21",
   "description": "Stdio and Streamable HTTP MCP server for Thalovant control-plane and hub runtime APIs.",
   "license": "MIT",
   "type": "module",
@@ -64,7 +64,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "@thalovant/sdk": "^0.3.9",
+    "@thalovant/sdk": "^0.3.12",
     "jose": "^6.2.8",
     "zod": "^3.25.76"
   },

package/server.json

@@ -7,19 +7,19 @@
     "url": "https://github.com/thalovant/thalovant-mcp",
     "source": "github"
   },
-  "version": "0.1.20",
+  "version": "0.1.21",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@thalovant/mcp-server",
-      "version": "0.1.20",
+      "version": "0.1.21",
       "transport": {
         "type": "stdio"
       }
     },
     {
       "registryType": "oci",
-      "identifier": "ghcr.io/thalovant/thalovant-mcp:0.1.20",
+      "identifier": "ghcr.io/thalovant/thalovant-mcp:0.1.21",
       "transport": {
         "type": "streamable-http",
         "url": "http://127.0.0.1:3000/mcp"