@wrongstack/mcp 0.282.0 → 0.282.2

package/dist/index.d.ts

@@ -12,6 +12,14 @@ interface MCPClientOptions {
     headers?: Record<string, string> | undefined;
     startupTimeoutMs?: number | undefined;
     requestTimeoutMs?: number | undefined;
+    /**
+     * Allowlist of env var names to forward from the parent process (process.env)
+     * to the child. Values are resolved at spawn time and merged into `env`
+     * via the `extra` path of `buildChildEnv` (unfiltered). This is how built-in
+     * MCP server presets (GitHub, Slack, Brave Search, …) get their API tokens
+     * without storing them in config.json or being scrubbed by the secret filter.
+     */
+    passthroughEnv?: string[] | undefined;
 }
 type ConnectionState = 'idle' | 'connecting' | 'connected' | 'disconnected' | 'reconnecting' | 'failed'
 /** Lazy server: registered from a cached manifest, process not spawned. */
@@ -291,6 +299,8 @@ interface McpServerInput {
     permission?: Permission | undefined;
     /** Lazy connect — spawn the process only on first tool call (see config). */
     lazy?: boolean | undefined;
+    /** Env var names to forward from parent process at spawn time. */
+    passthroughEnv?: string[] | undefined;
 }
 /** Projected view of one server, merging disk config with live registry state. */
 interface McpServerInfo {

package/dist/index.js

@@ -624,30 +624,38 @@ var SSETransport = class extends BaseHTTPTransport {
       signal: timeoutSignal.signal
     };
     this.applyTlsAgent(fetchOpts);
-    const res = await fetch(this.url, fetchOpts);
-    if (!res.ok) {
-      throw new ToolError({
-        message: `HTTP ${res.status}: ${res.statusText}`,
-        code: "TOOL_EXECUTION_FAILED",
-        toolName: method,
-        context: { transport: "sse", url: this.url, status: res.status, statusText: res.statusText }
-      });
-    }
-    let data;
     try {
-      data = await res.json();
-    } catch (err) {
-      throw new ToolError({
-        message: `Invalid JSON-RPC response: ${err instanceof Error ? err.message : "parse failed"}`,
-        code: "TOOL_EXECUTION_FAILED",
-        toolName: method,
-        context: { transport: "sse", url: this.url, phase: "parse-json" },
-        cause: err
-      });
+      const res = await fetch(this.url, fetchOpts);
+      if (!res.ok) {
+        throw new ToolError({
+          message: `HTTP ${res.status}: ${res.statusText}`,
+          code: "TOOL_EXECUTION_FAILED",
+          toolName: method,
+          context: {
+            transport: "sse",
+            url: this.url,
+            status: res.status,
+            statusText: res.statusText
+          }
+        });
+      }
+      let data;
+      try {
+        data = await res.json();
+      } catch (err) {
+        throw new ToolError({
+          message: `Invalid JSON-RPC response: ${err instanceof Error ? err.message : "parse failed"}`,
+          code: "TOOL_EXECUTION_FAILED",
+          toolName: method,
+          context: { transport: "sse", url: this.url, phase: "parse-json" },
+          cause: err
+        });
+      }
+      const result = assertMatchingJsonRpcResult(data, id, method);
+      return { jsonrpc: "2.0", id, result: result.result, error: result.error };
+    } finally {
+      timeoutSignal.dispose();
     }
-    const result = assertMatchingJsonRpcResult(data, id, method);
-    timeoutSignal.dispose();
-    return { jsonrpc: "2.0", id, result: result.result, error: result.error };
   }
   async close() {
     if (this.state === "disconnected") return;
@@ -916,9 +924,18 @@ var MCPClient = class {
       throw new Error('MCP stdio transport requires "command"');
     }
     this.rxBuffer = "";
+    const extraEnv = { ...this.opts.env };
+    if (this.opts.passthroughEnv) {
+      for (const name of this.opts.passthroughEnv) {
+        const val = process.env[name];
+        if (val !== void 0) {
+          extraEnv[name] = val;
+        }
+      }
+    }
     const isWin = process.platform === "win32";
     const rawArgs = this.opts.args ?? [];
-    const spawnEnv = buildChildEnv({ extra: this.opts.env });
+    const spawnEnv = buildChildEnv({ extra: extraEnv });
     const stdio = ["pipe", "pipe", "pipe"];
     const child = isWin ? spawn([this.opts.command, ...rawArgs].map(quoteWindowsArg).join(" "), {
       env: spawnEnv,
@@ -944,8 +961,9 @@ var MCPClient = class {
         }
       }
     });
-    child.on("error", () => {
+    child.on("error", (err) => {
       this.state = "failed";
+      this.failPending(`MCP "${this.opts.name}" child error: ${toErrorMessage(err)}`);
     });
     const initialize = await this.request(
       "initialize",
@@ -1145,8 +1163,16 @@ var MCPClient = class {
         },
         timer
       });
+      const stdin = this.child?.stdin;
+      if (!stdin || stdin.destroyed) {
+        const pending = this.pending.get(id);
+        this.pending.delete(id);
+        if (pending) clearTimeout(pending.timer);
+        reject(new Error(`MCP "${this.opts.name}" request "${method}": stdin not writable`));
+        return;
+      }
       try {
-        this.child?.stdin?.write(JSON.stringify(req) + "\n");
+        stdin.write(JSON.stringify(req) + "\n");
       } catch (err) {
         const pending = this.pending.get(id);
         this.pending.delete(id);
@@ -1181,7 +1207,14 @@ var MCPClient = class {
         if (this._drainPending) {
           this._lastNotifySkipped = true;
           console.warn(
-            `[MCP] notify("${method}") skipped: stdin buffer backpressure (already waiting for drain)`
+            JSON.stringify({
+              level: "warn",
+              event: "mcp.notify_skipped_backpressure",
+              server: this.opts.name,
+              method,
+              message: "stdin buffer backpressure (already waiting for drain)",
+              timestamp: (/* @__PURE__ */ new Date()).toISOString()
+            })
           );
           return;
         }
@@ -1813,7 +1846,8 @@ var MCPRegistry = class _MCPRegistry {
           url: slot.cfg.url,
           headers: slot.cfg.headers,
           startupTimeoutMs: slot.cfg.startupTimeoutMs,
-          requestTimeoutMs: slot.cfg.requestTimeoutMs
+          requestTimeoutMs: slot.cfg.requestTimeoutMs,
+          passthroughEnv: slot.cfg.passthroughEnv
         });
         if (slot.cfg.transport === "stdio") {
           client.addExitListener(this.onChildExit);
@@ -1897,9 +1931,14 @@ async function readConfig(path2) {
 }
 async function writeConfig(path2, cfg) {
   const raw = JSON.stringify(cfg, null, 2);
-  const tmp = `${path2}.tmp`;
+  const tmp = `${path2}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
   await fs.writeFile(tmp, raw, "utf8");
-  await fs.rename(tmp, path2);
+  try {
+    await fs.rename(tmp, path2);
+  } catch (err) {
+    await fs.rm(tmp, { force: true }).catch(() => void 0);
+    throw err;
+  }
 }
 function isMcpServerRecord(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
@@ -1943,6 +1982,8 @@ function buildConfig(input, base) {
   if (enabled !== void 0) cfg.enabled = enabled;
   const lazy = input.lazy ?? base?.lazy;
   if (lazy !== void 0) cfg.lazy = lazy;
+  const passthroughEnv = input.passthroughEnv ?? base?.passthroughEnv;
+  if (passthroughEnv !== void 0) cfg.passthroughEnv = passthroughEnv;
   return cfg;
 }
 function projectServer(name, cfg, registry) {