@thalovant/mcp-server 0.1.20 → 0.1.22

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.1.22
+
+- Require Node SDK 0.3.14 for fail-closed persistent Noise trust, complete filesystem state transactions across Node processes, active reply-ID guards, and intent-description timeouts that only recover when usable definitions were received. Preserve process-local runtime identity leases and require distinct identities across independently running MCP processes.
+- Correct global-deny precedence, process restart guidance, and historical unmatched-intent/redaction release notes.
+- Validate successful provisioning results and protected identity-file creation, including nonempty credentials, matching persisted values, redacted output and private permissions. Share the fake control-plane server and handle malformed test requests safely.
+- Require Node 22.22.2 or newer within the 22.x line for the pinned npm 12 publisher.
+
+## 0.1.21
+
+- Propagate MCP request cancellation through runtime identity acquisition and SDK connection, Ask, Query and event waits in stdio and Streamable HTTP mode. Require Node SDK 0.3.12 for Query cancellation and explicit HTTP admission cleanup failures, including contradictory disconnect acknowledgments.
+- Skip cancelled queued calls without constructing a client or interrupting the active identity owner. Retain admitted work and actual cleanup after caller cancellation, including SDK operations without cancellation support; preserve failed-cleanup poisoning and never replay application writes.
+- Check cancellation during connection setup before action/code sends, raw event publication and inventory discovery. Tool schemas and the 41-tool default catalogue remain compatible.
+- Verify actual MCP cancellation against independent HTTPS Noise peers on both MCP transports, with late queued execution, pending physical write and healthy successor regressions. Add real remote-cleanup refusal cases that prove an identity with unconfirmed HTTP cleanup remains unavailable instead of admitting an overlapping client.
+
 ## 0.1.20
 
 - Require HTTPS for credential-bearing API calls, preserving explicit loopback HTTP for local development. Reject API redirects through the SDK. Instantiate runtime clients only after acquiring their identity lease.
@@ -22,15 +36,13 @@
 - Use Node SDK 0.3.4 or newer for authenticated HiveMind v3 Noise across WSS, HTTPS and MQTT. HTTPS retains replica affinity and uses binary encrypted polling; MQTT reauthenticates when reconnecting.
 - Derive the advertised MCP server version from the package manifest so stdio, Streamable HTTP, npm, OCI and registry metadata agree. Add transport smoke assertions for version consistency.
 
-## Unreleased
+## Historical updates before 0.1.18
 
 ### Fixed
 
 - The server talks to HiveMind 5.x hubs. `@thalovant/sdk` 0.3.x speaks the protocol v3 Noise transport (the published 0.1.16 bundled 0.2.37 and could not connect to a 5.x hub at all); 0.3.3 additionally derives the v3 pre-shared key with WebAssembly argon2id and caches the derived key (only the key, never a password fingerprint) beside the client identity, so a reconnect skips the ~3 s derivation. Bumped the dependency floor to `^0.3.3` and refreshed the lockfile so the npm package and OCI image both ship it (thalovant-mcp#50).
 - `thalovant_ask` picks up the reply-correlation fixes from `@thalovant/sdk` 0.2.37: a hub-rewritten session id no longer rejects replies, and replies are correlated by request id rather than the session id a hub replaces. Bumped the dependency floor to `^0.2.37` and refreshed the lockfile so the npm package and OCI image both ship them.
-- The `thalovant_ask` tool surfaces an unrecovered intent miss promptly instead of waiting out the full timeout, and still lets a fallback reply win, via `@thalovant/sdk` 0.2.35's soft-failure ask path (thalovant-python-sdk#22). Bumped the dependency floor to `^0.2.35` and refreshed the lockfile.
-- The `thalovant_ask` tool recognises `ovos.intent.unmatched` on the bus ask path. `@thalovant/sdk` 0.2.33 fixed only the query path; the bus path (which `ask()` uses) registered handlers per event name and dropped the current OVOS intent-miss name. Bumped the dependency floor to `@thalovant/sdk ^0.2.34` and refreshed the lockfile so the npm package and OCI image ship it (thalovant-python-sdk#22).
-- The `thalovant_ask` tool now fails fast when an utterance matches no intent. It depends on `@thalovant/sdk`, whose ask loop previously only recognised the legacy `complete_intent_failure` event and missed the current OVOS `ovos.intent.unmatched` name, so an unmatched utterance waited out the full timeout. Bumped the dependency floor to `@thalovant/sdk ^0.2.33` (which carries the fix) and refreshed the lockfile, so the published npm package and OCI image both ship it (thalovant-python-sdk#22).
+- Earlier unmatched-intent fixes progressed from query-path recognition in `@thalovant/sdk` 0.2.33 to bus-path event collection in 0.2.34, then recoverable soft-miss settlement in 0.2.35. The earlier event-only changes did not by themselves finish a silent bus Ask promptly. Later releases above supersede these dependency floors and preserve fallback replies within the documented fixed wait.
 
 ### Security
 
@@ -38,7 +50,7 @@
 - `thalovant_create_client_identity` now confines the optional `savePath` to a configurable identity directory (`THALOVANT_MCP_IDENTITY_DIR`, default `<config-dir>/thalovant/identities`). Absolute paths outside the directory and `..` traversal are rejected, and the destination is validated before the identity is created in the control plane, so a model can no longer drop a `0600` credential file into a git working tree or synced folder. `thalovant_config_status` reports `identityDir`.
 - `thalovant_healthcheck` output is now passed through `redactSecrets`, matching every other tool output.
 - `thalovant_get_analytics_overview` no longer advertises the `admin` and (admin-only) `ownerId` arguments to the model, so it no longer teaches an admin mode that only ever 403s for non-admin callers; only the plain overview call remains. Injected `admin`/`ownerId` values are stripped and never reach the control plane.
-- Extended output redaction to additional secret-ish keys: `device_code`, `user_code`, `psk`, `cert`, and `jwt`.
+- Extended output redaction to additional secret-ish keys: `device_code`, `deviceCode`, `user_code`, `userCode`, `authToken`, `authorization`, `bearer`, `psk`, `cert`, and `jwt`.
 - Added an opt-in read-only mode (`THALOVANT_MCP_READONLY`): only tools annotated `readOnlyHint: true` are registered, so an observe-only agent needs no hand-written denylist. `thalovant_config_status` reports `readOnly`.
 
 ## 0.1.10

package/README.md

@@ -385,17 +385,17 @@ A long-lived control-plane token combined with an always-available delete tool i
 export THALOVANT_ENABLE_DESTRUCTIVE_TOOLS="true"
 ```
 
-Accepted true values are `1`, `true`, `yes`, and `on`; anything else, including unset, leaves the tools off. The flag is read when a server instance is created, so restart the server (or, in Streamable HTTP mode, start a new session) after changing it. `thalovant_config_status` reports the current state as `destructiveToolsEnabled` and lists the tools the flag controls.
+Accepted true values are `1`, `true`, `yes`, and `on`; anything else, including unset, leaves the tools off. The flag is read when a server instance is created. Restart the server process with the updated environment after changing it. `thalovant_config_status` reports the current state as `destructiveToolsEnabled` and lists the tools the flag controls.
 
 This is a separate mechanism from the existing tool policy, deliberately. `MCP_TOOL_ALLOWLIST` / `MCP_TOOL_DENYLIST` and the per-principal `allowedTools` / `deniedTools` are call-time filters where an empty allowlist means "allow everything"; they cannot express a tool that is off until an operator turns it on, and they cannot hide a tool from `tools/list`. Once `THALOVANT_ENABLE_DESTRUCTIVE_TOOLS` is set the delete tools are ordinary tools again and remain subject to that policy, so the two layers compose:
 
 ```bash
-# Enable deletes server-wide, but deny them to everyone except trusted principals.
+# Register delete tools, then deny their use by every principal.
 export THALOVANT_ENABLE_DESTRUCTIVE_TOOLS="true"
 export MCP_TOOL_DENYLIST="thalovant_delete_hub,thalovant_delete_runtime_group"
 ```
 
-with the trusted principal's credential file granting them back via `allowedTools`.
+The global deny applies to every principal and cannot be overridden by a principal's `allowedTools`. To restrict only selected principals, leave these tools out of the global denylist and use those principals' `deniedTools` instead.
 
 Deleting a hub still requires a current etag (`412` otherwise), and deleting a runtime group fails with `409` while it is the workspace default or still has hubs attached.
 
@@ -419,7 +419,7 @@ Runtime calls sharing the same hub client identity run sequentially within one
 MCP process. Use a distinct client identity for each independently running MCP
 server so the hub can keep their sessions separate.
 
-Version 0.1.20 uses `@thalovant/sdk` `^0.3.9` (0.3.9 through versions below 0.4.0). This release enforces
+Version 0.1.22 uses `@thalovant/sdk` `^0.3.14` (0.3.14 through versions below 0.4.0). This release enforces
 secure effective MQTT URLs and carries a single connection deadline through
 MQTT setup and HTTP failure cleanup. Runtime tools support
 HiveMind v3 Noise over WSS, HTTPS and MQTT over TLS. `thalovant_healthcheck`
@@ -438,7 +438,31 @@ caller times out, a later tool waits up to six seconds for that cleanup before o
 A queued tool that reaches this deadline fails without executing later or releasing
 the previous session's identity.
 An actual cleanup failure marks the identity unavailable to later calls instead
-of risking concurrent sessions.
+of risking concurrent sessions. These leases are process-local; separate server
+processes or replicas need distinct runtime identities or external coordination.
+
+MCP request cancellation applies to queued runtime tools in both stdio and
+Streamable HTTP mode. A cancelled queued call never constructs a runtime client
+or executes later. Cancellation also reaches runtime connection setup, Ask,
+Query and event waits. Action/code sends, raw event publication and inventory
+queries check cancellation during connection setup, then retain ownership until
+the admitted SDK operation finishes. Cancelling the MCP request cannot undo an
+already admitted operation or its effects. The identity remains reserved through
+that work and actual cleanup; application requests are never automatically replayed.
+Control-plane tools do not gain runtime cancellation semantics in this release.
+
+For example, an MCP TypeScript client can cancel a runtime query after ten seconds,
+including time spent waiting for its identity lease:
+
+```typescript
+await mcpClient.callTool({
+  name: "thalovant_query",
+  arguments: { identityFile: "/secure/identity.json", text: "What is the weather?", timeoutMs: 30000 },
+}, undefined, { signal: AbortSignal.timeout(10000) });
+```
+
+Intent inventory retains its connection setup and per-query/batch budgets plus
+a separate optional fallback probe; it has no single inventory-wide deadline.
 
 ## Development
 

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { withRuntimeLease } from "./runtime-lease.js";
+import { throwIfRuntimeCancelled, withRuntimeLease } from "./runtime-lease.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
@@ -520,7 +520,7 @@ function registerThalovantTool(server, name, config, handler) {
         const start = Date.now();
         try {
             await authorizeTool(name, principal);
-            const result = await requestContext.run({ toolName: name, principal }, () => handler(args, extra));
+            const result = await requestContext.run({ toolName: name, principal, signal: extra.signal }, () => handler(args, extra));
             await auditLog({
                 ts: new Date().toISOString(),
                 event: "mcp.tool",
@@ -670,11 +670,13 @@ async function createRuntimeIdentity(options) {
 }
 /** Use one identity lease through the action and actual retained cleanup. */
 async function withRuntimeClient(options, run) {
+    const signal = requestContext.getStore()?.signal;
+    throwIfRuntimeCancelled(signal);
     const identity = await createRuntimeIdentity(options);
     const key = createHash("sha256").update(JSON.stringify([
         identity.endpointBase(), identity.accessKey,
     ])).digest("hex");
-    return withRuntimeLease(key, () => new ThalovantClient(identity, { protocol: options.protocol ?? "wss" }), run);
+    return withRuntimeLease(key, () => new ThalovantClient(identity, { protocol: options.protocol ?? "wss" }), client => run(client, signal), 6000, signal);
 }
 function summarizeReply(reply) {
     const displayItems = reply.displayItems({ maxTextChars: 1_000 });
@@ -1307,8 +1309,8 @@ export function createServer() {
             openWorldHint: true,
         },
     }, async ({ timeoutMs, ...runtime }) => {
-        return withRuntimeClient(runtime, async (client) => {
-            await client.connect(clampTimeout(timeoutMs));
+        return withRuntimeClient(runtime, async (client, signal) => {
+            await client.connect(clampTimeout(timeoutMs), signal);
             return jsonContent(redactSecrets(client.healthcheck()));
         });
     });
@@ -1323,7 +1325,9 @@ export function createServer() {
             timeoutMs: z.number().int().min(1_000).max(MAX_TIMEOUT_MS).default(DEFAULT_TIMEOUT_MS).describe("Per-query/batch timeout; the optional fallback-skill probe is capped at 1500ms."),
         },
         annotations: { readOnlyHint: true, openWorldHint: true },
-    }, async ({ languages, describe, fallback, timeoutMs, ...runtime }) => withRuntimeClient(runtime, async (client) => {
+    }, async ({ languages, describe, fallback, timeoutMs, ...runtime }) => withRuntimeClient(runtime, async (client, signal) => {
+        await client.connect(undefined, signal);
+        throwIfRuntimeCancelled(signal);
         const inventory = await client.intents(languages, { describe, fallback, timeoutMs: clampTimeout(timeoutMs) });
         return jsonContent(redactSecrets({
             ...inventory.asObject(),
@@ -1351,9 +1355,10 @@ export function createServer() {
             openWorldHint: true,
         },
     }, async ({ text, timeoutMs, lang, sessionId, requestId, context, replySettleMs, emptyReplyWaitMs, ...runtime }) => {
-        return withRuntimeClient(runtime, async (client) => {
+        return withRuntimeClient(runtime, async (client, signal) => {
             const builtContext = context ? buildClientContext({}, context) : undefined;
             const reply = await client.ask(text, {
+                signal,
                 timeoutMs: clampTimeout(timeoutMs),
                 lang,
                 sessionId,
@@ -1381,8 +1386,9 @@ export function createServer() {
         },
         annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
     }, async ({ text, timeoutMs, lang, sessionId, requestId, queryId, context, replySettleMs, ...runtime }) => {
-        return withRuntimeClient(runtime, async (client) => {
+        return withRuntimeClient(runtime, async (client, signal) => {
             const reply = await client.query(text, {
+                signal,
                 timeoutMs: clampTimeout(timeoutMs), lang, sessionId, requestId, queryId,
                 context: context ? buildClientContext({}, context) : undefined, replySettleMs,
             });
@@ -1408,7 +1414,9 @@ export function createServer() {
             openWorldHint: true,
         },
     }, async ({ payload, title, lang, sessionId, requestId, context, ...runtime }) => {
-        return withRuntimeClient(runtime, async (client) => {
+        return withRuntimeClient(runtime, async (client, signal) => {
+            await client.connect(undefined, signal);
+            throwIfRuntimeCancelled(signal);
             await client.sendAction(payload, {
                 title,
                 lang,
@@ -1439,7 +1447,9 @@ export function createServer() {
             openWorldHint: true,
         },
     }, async ({ value, kind, label, lang, sessionId, requestId, context, ...runtime }) => {
-        return withRuntimeClient(runtime, async (client) => {
+        return withRuntimeClient(runtime, async (client, signal) => {
+            await client.connect(undefined, signal);
+            throwIfRuntimeCancelled(signal);
             await client.sendCode(value, {
                 kind,
                 label,
@@ -1467,7 +1477,9 @@ export function createServer() {
             openWorldHint: true,
         },
     }, async ({ eventType, data, context, ...runtime }) => {
-        return withRuntimeClient(runtime, async (client) => {
+        return withRuntimeClient(runtime, async (client, signal) => {
+            await client.connect(undefined, signal);
+            throwIfRuntimeCancelled(signal);
             await client.emit(eventType, data, context ? buildClientContext({}, context) : undefined);
             return textContent("Event emitted.");
         });
@@ -1488,8 +1500,9 @@ export function createServer() {
             openWorldHint: true,
         },
     }, async ({ eventName, timeoutMs, sessionId, requestId, context, ...runtime }) => {
-        return withRuntimeClient(runtime, async (client) => {
+        return withRuntimeClient(runtime, async (client, signal) => {
             const event = await client.waitForEvent(eventName, {
+                signal,
                 timeoutMs: clampTimeout(timeoutMs),
                 sessionId,
                 requestId,

package/dist/runtime-lease.d.ts

@@ -3,6 +3,7 @@ interface RuntimeClosable {
     close(): Promise<void>;
     waitForClosed(): Promise<void>;
 }
-/** A caller timeout never releases an identity before actual cleanup settles. */
-export declare function withRuntimeLease<T, C extends RuntimeClosable>(key: string, createClient: () => C, run: (client: C) => Promise<T>, acquireTimeoutMs?: number): Promise<T>;
+export declare function throwIfRuntimeCancelled(signal?: AbortSignal): void;
+/** Caller cancellation/deadlines never release an identity before owned work and cleanup settle. */
+export declare function withRuntimeLease<T, C extends RuntimeClosable>(key: string, createClient: () => C, run: (client: C) => Promise<T>, acquireTimeoutMs?: number, signal?: AbortSignal): Promise<T>;
 export {};

package/dist/runtime-lease.js

@@ -1,6 +1,17 @@
 const leases = new Map();
-/** A caller timeout never releases an identity before actual cleanup settles. */
-export async function withRuntimeLease(key, createClient, run, acquireTimeoutMs = 6000) {
+function cancellationError() {
+    // MCP cancellation reasons are caller supplied and may contain credentials.
+    const error = new Error("Runtime tool request cancelled.");
+    error.name = "AbortError";
+    return error;
+}
+export function throwIfRuntimeCancelled(signal) {
+    if (signal?.aborted)
+        throw cancellationError();
+}
+/** Caller cancellation/deadlines never release an identity before owned work and cleanup settle. */
+export async function withRuntimeLease(key, createClient, run, acquireTimeoutMs = 6000, signal) {
+    throwIfRuntimeCancelled(signal);
     if (!Number.isFinite(acquireTimeoutMs) || acquireTimeoutMs <= 0) {
         throw new Error("Runtime identity acquisition deadline expired.");
     }
@@ -8,8 +19,7 @@ export async function withRuntimeLease(key, createClient, run, acquireTimeoutMs
     let release;
     let fail;
     const current = new Promise((resolve, reject) => { release = resolve; fail = reject; });
-    // A failed cleanup poisons this identity's barrier. Observe it even when no
-    // later caller arrives; later tools fail instead of replacing that session.
+    // Observe poisoned barriers even when no later caller arrives.
     void current.catch(() => undefined);
     leases.set(key, current);
     const releaseIdentity = () => {
@@ -20,45 +30,68 @@ export async function withRuntimeLease(key, createClient, run, acquireTimeoutMs
     const failIdentity = () => {
         fail(new Error("Previous runtime session cleanup failed; this identity remains unavailable."));
     };
-    let timer;
-    try {
-        await Promise.race([
-            previous,
-            new Promise((_, reject) => {
-                timer = setTimeout(() => reject(new Error("Runtime identity acquisition deadline expired; previous session cleanup is still pending.")), acquireTimeoutMs);
-            }),
-        ]);
-    }
-    catch (error) {
-        // An expired waiter never runs or closes its unused client. Its place in
-        // the chain remains occupied until the prior owner actually retires.
-        void previous.then(releaseIdentity, failIdentity);
-        throw error;
-    }
-    finally {
-        clearTimeout(timer);
-    }
-    let client;
-    try {
-        client = createClient();
-    }
-    catch (error) {
-        releaseIdentity();
-        throw error;
-    }
+    let onAbort;
+    const cancelled = new Promise((_, reject) => {
+        onAbort = () => reject(cancellationError());
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+    // The signal may fire during a synchronous client factory or cleanup callback.
+    // Observe it even when execution fails before the final race is installed.
+    void cancelled.catch(() => undefined);
     try {
-        return await run(client);
-    }
-    finally {
-        let closing;
+        let timer;
+        try {
+            await Promise.race([
+                previous, cancelled,
+                new Promise((_, reject) => {
+                    timer = setTimeout(() => reject(new Error("Runtime identity acquisition deadline expired; previous session cleanup is still pending.")), acquireTimeoutMs);
+                }),
+            ]);
+            throwIfRuntimeCancelled(signal);
+        }
+        catch (error) {
+            // An abandoned waiter never constructs a client or runs later. Its place
+            // in the chain remains occupied until the prior owner actually retires.
+            void previous.then(releaseIdentity, failIdentity);
+            throw error;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        let client;
         try {
-            closing = client.close();
+            client = createClient();
         }
         catch (error) {
-            failIdentity();
+            releaseIdentity();
             throw error;
         }
-        void client.waitForClosed().then(releaseIdentity, failIdentity);
-        await closing;
+        const owned = (async () => {
+            try {
+                throwIfRuntimeCancelled(signal);
+                return await run(client);
+            }
+            finally {
+                let closing;
+                try {
+                    closing = client.close();
+                    // Observe close independently if waitForClosed throws synchronously.
+                    void closing.catch(() => undefined);
+                    void client.waitForClosed().then(releaseIdentity, failIdentity);
+                }
+                catch (error) {
+                    failIdentity();
+                    throw error;
+                }
+                await closing;
+            }
+        })();
+        // SDK methods accepting a signal can retire promptly. Other admitted work
+        // must finish naturally before close begins; cancellation never replays it.
+        // The race observes both branches, including late work/cleanup rejections.
+        return await Promise.race([owned, cancelled]);
+    }
+    finally {
+        signal?.removeEventListener("abort", onAbort);
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thalovant/mcp-server",
-  "version": "0.1.20",
+  "version": "0.1.22",
   "description": "Stdio and Streamable HTTP MCP server for Thalovant control-plane and hub runtime APIs.",
   "license": "MIT",
   "type": "module",
@@ -64,7 +64,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "@thalovant/sdk": "^0.3.9",
+    "@thalovant/sdk": "^0.3.14",
     "jose": "^6.2.8",
     "zod": "^3.25.76"
   },

package/server.json

@@ -7,19 +7,19 @@
     "url": "https://github.com/thalovant/thalovant-mcp",
     "source": "github"
   },
-  "version": "0.1.20",
+  "version": "0.1.22",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@thalovant/mcp-server",
-      "version": "0.1.20",
+      "version": "0.1.22",
       "transport": {
         "type": "stdio"
       }
     },
     {
       "registryType": "oci",
-      "identifier": "ghcr.io/thalovant/thalovant-mcp:0.1.20",
+      "identifier": "ghcr.io/thalovant/thalovant-mcp:0.1.22",
       "transport": {
         "type": "streamable-http",
         "url": "http://127.0.0.1:3000/mcp"