@wrongstack/mcp 0.293.0 → 0.295.1

package/dist/index.js

@@ -47,7 +47,7 @@ function parseMcpBearerChallenge(header, resource) {
   if (!header) return challenge;
   const bearer = /(?:^|,)\s*Bearer(?:\s+|$)/i.exec(header);
   if (!bearer) return challenge;
-  const parameters = header.slice((bearer.index ?? 0) + bearer[0].length);
+  const parameters = header.slice(bearer.index + bearer[0].length);
   const resourceMetadata = challengeParameter(parameters, "resource_metadata");
   if (resourceMetadata) {
     const metadataUrl = validateMetadataUrl(resourceMetadata);
@@ -395,7 +395,7 @@ async function requestPinnedJson(rawUrl, options) {
     };
     const requestFn = url.protocol === "https:" ? https.request : http.request;
     const request3 = requestFn(requestOptions, (response) => {
-      const status = response.statusCode ?? 0;
+      const status = response.statusCode;
       if (status === 404 || status === 410) {
         response.resume();
         finish(void 0, void 0);
@@ -739,8 +739,7 @@ function boundedServerName(value) {
 
 // src/client.ts
 import { spawn } from "node:child_process";
-import { buildChildEnv } from "@wrongstack/core";
-import { toErrorMessage } from "@wrongstack/core/utils";
+import { buildChildEnv, toErrorMessage } from "@wrongstack/core/utils";
 
 // src/constants.ts
 var MCP_CONSTANTS = Object.freeze({
@@ -997,13 +996,15 @@ function normalizeMCPTools(value) {
     if (typeof t.name !== "string" || t.name.trim().length === 0) continue;
     const inputSchema = t.inputSchema && typeof t.inputSchema === "object" && !Array.isArray(t.inputSchema) ? t.inputSchema : { type: "object", properties: {} };
     if (!t.inputSchema || typeof t.inputSchema !== "object" || Array.isArray(t.inputSchema)) {
-      console.warn(JSON.stringify({
-        level: "warn",
-        event: "mcp.tool_schema_invalid",
-        tool: t.name,
-        message: "no/invalid inputSchema \u2014 defaulting to empty object",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      }));
+      console.warn(
+        JSON.stringify({
+          level: "warn",
+          event: "mcp.tool_schema_invalid",
+          tool: t.name,
+          message: "no/invalid inputSchema \u2014 defaulting to empty object",
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        })
+      );
     }
     tools.push({
       name: t.name,
@@ -1014,96 +1015,8 @@ function normalizeMCPTools(value) {
   return tools;
 }
 
-// src/transport-jsonrpc.ts
-import { ToolError } from "@wrongstack/core";
-function isJsonRpcResult(v) {
-  if (typeof v !== "object" || v === null) return false;
-  const r = v;
-  if (r["jsonrpc"] !== "2.0" || typeof r["id"] !== "number") return false;
-  if (Object.hasOwn(r, "method")) return false;
-  const hasResult = Object.hasOwn(r, "result");
-  const hasError = Object.hasOwn(r, "error");
-  if (hasResult === hasError) return false;
-  if (hasError) {
-    const error = r["error"];
-    return typeof error === "object" && error !== null && typeof error["code"] === "number" && typeof error["message"] === "string";
-  }
-  return true;
-}
-function isJsonRpcMethodEnvelope(v) {
-  if (typeof v !== "object" || v === null) return false;
-  const envelope = v;
-  if (envelope["jsonrpc"] !== "2.0" || typeof envelope["method"] !== "string") return false;
-  const id = envelope["id"];
-  return id === void 0 || typeof id === "number" || typeof id === "string";
-}
-function extractJsonRpcEnvelopes(text) {
-  const out = [];
-  let dataBuf = [];
-  const flush = () => {
-    if (dataBuf.length === 0) return;
-    const joined = dataBuf.join("\n").trim();
-    dataBuf = [];
-    if (!joined) return;
-    try {
-      const parsed = JSON.parse(joined);
-      if (isJsonRpcResult(parsed) || isJsonRpcMethodEnvelope(parsed)) out.push(parsed);
-    } catch {
-    }
-  };
-  for (const raw of text.split("\n")) {
-    const line = raw.replace(/\r$/, "");
-    if (line === "") {
-      flush();
-      continue;
-    }
-    if (line.startsWith(":")) continue;
-    if (line.startsWith("data:")) {
-      let v = line.slice(5);
-      if (v.startsWith(" ")) v = v.slice(1);
-      dataBuf.push(v);
-      continue;
-    }
-    if (line.startsWith("event:") || line.startsWith("id:") || line.startsWith("retry:")) {
-      continue;
-    }
-    const trimmed = line.trim();
-    if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
-      try {
-        const parsed = JSON.parse(trimmed);
-        if (isJsonRpcResult(parsed) || isJsonRpcMethodEnvelope(parsed)) out.push(parsed);
-      } catch {
-      }
-    }
-  }
-  flush();
-  return out;
-}
-function extractJsonRpcResults(text) {
-  return extractJsonRpcEnvelopes(text).filter(isJsonRpcResult);
-}
-function assertMatchingJsonRpcResult(data, expectedId, method) {
-  if (!isJsonRpcResult(data)) {
-    throw new ToolError({
-      message: "Invalid JSON-RPC response: not a JSON-RPC 2.0 envelope",
-      code: "TOOL_EXECUTION_FAILED",
-      toolName: "mcp_transport_jsonrpc",
-      context: { method, expectedId, reason: "not-jsonrpc-envelope" }
-    });
-  }
-  if (data.id !== expectedId) {
-    throw new ToolError({
-      message: `Invalid JSON-RPC response: id mismatch for ${method} (expected ${expectedId}, got ${data.id})`,
-      code: "TOOL_EXECUTION_FAILED",
-      toolName: "mcp_transport_jsonrpc",
-      context: { method, expectedId, actualId: data.id, reason: "id-mismatch" }
-    });
-  }
-  return data;
-}
-
 // src/sse-reader.ts
-import { ToolError as ToolError2 } from "@wrongstack/core";
+import { ToolError } from "@wrongstack/core/types";
 var SSE_READER_MAX_BUFFER = 256 * 1024;
 var SSE_READER_MAX_DATA_LINES = 1024;
 var SSEReader = class {
@@ -1119,7 +1032,7 @@ var SSEReader = class {
   }
   feed(chunk) {
     if (chunk.length > SSE_READER_MAX_BUFFER) {
-      throw new ToolError2({
+      throw new ToolError({
         message: `SSE: chunk size ${chunk.length} exceeds max buffer ${SSE_READER_MAX_BUFFER} \u2014 refusing to accumulate`,
         code: "TOOL_EXECUTION_FAILED",
         toolName: "mcp_transport_sse_reader",
@@ -1128,7 +1041,7 @@ var SSEReader = class {
     }
     this.buffer += chunk;
     if (this.buffer.length > SSE_READER_MAX_BUFFER) {
-      throw new ToolError2({
+      throw new ToolError({
         message: `SSE: pending line exceeds ${SSE_READER_MAX_BUFFER} bytes \u2014 upstream is not framing events`,
         code: "TOOL_EXECUTION_FAILED",
         toolName: "mcp_transport_sse_reader",
@@ -1139,13 +1052,16 @@ var SSEReader = class {
         }
       });
     }
-    let idx = this.buffer.indexOf("\n");
+    let start = 0;
+    let idx = this.buffer.indexOf("\n", start);
     while (idx !== -1) {
-      const line = this.buffer.slice(0, idx).replace(/\r$/, "");
-      this.buffer = this.buffer.slice(idx + 1);
-      idx = this.buffer.indexOf("\n");
-      this.processLine(line);
+      let end = idx;
+      if (end > start && this.buffer.charCodeAt(end - 1) === 13) end--;
+      this.processLine(this.buffer.slice(start, end));
+      start = idx + 1;
+      idx = this.buffer.indexOf("\n", start);
     }
+    if (start > 0) this.buffer = this.buffer.slice(start);
   }
   processLine(line) {
     if (line === "") {
@@ -1160,7 +1076,7 @@ var SSEReader = class {
     if (field === "event") {
     } else if (field === "data") {
       if (this.dataLines.length >= SSE_READER_MAX_DATA_LINES) {
-        throw new ToolError2({
+        throw new ToolError({
           message: `SSE: exceeded ${SSE_READER_MAX_DATA_LINES} data lines per event \u2014 upstream is not sending blank-line delimiters`,
           code: "TOOL_EXECUTION_FAILED",
           toolName: "mcp_transport_sse_reader",
@@ -1204,11 +1120,11 @@ var SSEReader = class {
 
 // src/transport-base.ts
 import * as https2 from "node:https";
-import { ConfigError as ConfigError2 } from "@wrongstack/core";
+import { ConfigError as ConfigError2 } from "@wrongstack/core/types";
 
 // src/transport-security.ts
 import * as net2 from "node:net";
-import { ConfigError } from "@wrongstack/core";
+import { ConfigError } from "@wrongstack/core/types";
 function isTlsUnsafeAllowed() {
   return process.env["WRONGSTACK_UNSAFE_MCP_TLS"] === "1";
 }
@@ -1450,9 +1366,133 @@ var BaseHTTPTransport = class {
   }
 };
 
+// src/transport-jsonrpc.ts
+import { ToolError as ToolError2 } from "@wrongstack/core/types";
+function isJsonRpcResult(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const r = v;
+  if (r["jsonrpc"] !== "2.0" || typeof r["id"] !== "number") return false;
+  if (Object.hasOwn(r, "method")) return false;
+  const hasResult = Object.hasOwn(r, "result");
+  const hasError = Object.hasOwn(r, "error");
+  if (hasResult === hasError) return false;
+  if (hasError) {
+    const error = r["error"];
+    return typeof error === "object" && error !== null && typeof error["code"] === "number" && typeof error["message"] === "string";
+  }
+  return true;
+}
+function isJsonRpcMethodEnvelope(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const envelope = v;
+  if (envelope["jsonrpc"] !== "2.0" || typeof envelope["method"] !== "string") return false;
+  const id = envelope["id"];
+  return id === void 0 || typeof id === "number" || typeof id === "string";
+}
+function extractJsonRpcEnvelopes(text) {
+  const out = [];
+  let dataBuf = [];
+  const flush = () => {
+    if (dataBuf.length === 0) return;
+    const joined = dataBuf.join("\n").trim();
+    dataBuf = [];
+    if (!joined) return;
+    try {
+      const parsed = JSON.parse(joined);
+      if (isJsonRpcResult(parsed) || isJsonRpcMethodEnvelope(parsed)) out.push(parsed);
+    } catch {
+    }
+  };
+  for (const raw of text.split("\n")) {
+    const line = raw.replace(/\r$/, "");
+    if (line === "") {
+      flush();
+      continue;
+    }
+    if (line.startsWith(":")) continue;
+    if (line.startsWith("data:")) {
+      let v = line.slice(5);
+      if (v.startsWith(" ")) v = v.slice(1);
+      dataBuf.push(v);
+      continue;
+    }
+    if (line.startsWith("event:") || line.startsWith("id:") || line.startsWith("retry:")) {
+      continue;
+    }
+    const trimmed = line.trim();
+    if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+      try {
+        const parsed = JSON.parse(trimmed);
+        if (isJsonRpcResult(parsed) || isJsonRpcMethodEnvelope(parsed)) out.push(parsed);
+      } catch {
+      }
+    }
+  }
+  flush();
+  return out;
+}
+function extractJsonRpcResults(text) {
+  return extractJsonRpcEnvelopes(text).filter(isJsonRpcResult);
+}
+function assertMatchingJsonRpcResult(data, expectedId, method) {
+  if (!isJsonRpcResult(data)) {
+    throw new ToolError2({
+      message: "Invalid JSON-RPC response: not a JSON-RPC 2.0 envelope",
+      code: "TOOL_EXECUTION_FAILED",
+      toolName: "mcp_transport_jsonrpc",
+      context: { method, expectedId, reason: "not-jsonrpc-envelope" }
+    });
+  }
+  if (data.id !== expectedId) {
+    throw new ToolError2({
+      message: `Invalid JSON-RPC response: id mismatch for ${method} (expected ${expectedId}, got ${data.id})`,
+      code: "TOOL_EXECUTION_FAILED",
+      toolName: "mcp_transport_jsonrpc",
+      context: { method, expectedId, actualId: data.id, reason: "id-mismatch" }
+    });
+  }
+  return data;
+}
+
 // src/transport-sse.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { ToolError as ToolError3 } from "@wrongstack/core";
+import { ToolError as ToolError4 } from "@wrongstack/core/types";
+
+// src/read-body.ts
+import { ToolError as ToolError3 } from "@wrongstack/core/types";
+var MAX_MCP_HTTP_BODY_BYTES = 16 * 1024 * 1024;
+async function readBodyCapped(res, maxBytes = MAX_MCP_HTTP_BODY_BYTES) {
+  const body = res.body;
+  if (!body || typeof body.getReader !== "function") {
+    return await res.text();
+  }
+  const reader = body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (!value) continue;
+      total += value.byteLength;
+      if (total > maxBytes) {
+        await reader.cancel().catch(() => void 0);
+        throw new ToolError3({
+          message: `MCP response body exceeded ${maxBytes} bytes \u2014 refusing to buffer`,
+          code: "TOOL_EXECUTION_FAILED",
+          toolName: "mcp_transport",
+          context: { maxBytes, received: total }
+        });
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock?.();
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+// src/transport-sse.ts
 var SSETransport = class extends BaseHTTPTransport {
   _nextId = 1;
   readerDone = false;
@@ -1499,7 +1539,7 @@ var SSETransport = class extends BaseHTTPTransport {
       this.applyTlsAgent(fetchOpts);
       const response = await this.fetchWithAuthorization(sseUrl, fetchOpts, signal);
       if (!response.ok) {
-        throw new ToolError3({
+        throw new ToolError4({
           message: `SSE connect HTTP ${response.status}: ${response.statusText}`,
           code: "TOOL_EXECUTION_FAILED",
           toolName: "mcp_transport_sse_connect",
@@ -1507,7 +1547,7 @@ var SSETransport = class extends BaseHTTPTransport {
         });
       }
       if (!response.body) {
-        throw new ToolError3({
+        throw new ToolError4({
           message: "SSE response has no body",
           code: "TOOL_EXECUTION_FAILED",
           toolName: "mcp_transport_sse_connect",
@@ -1540,7 +1580,7 @@ var SSETransport = class extends BaseHTTPTransport {
         clientInfo: MCP_CONSTANTS.CLIENT_INFO
       });
       if (initRes.error) {
-        throw new ToolError3({
+        throw new ToolError4({
           message: `initialize failed: ${initRes.error.message}`,
           code: "TOOL_EXECUTION_FAILED",
           toolName: "mcp_transport_initialize",
@@ -1615,7 +1655,7 @@ var SSETransport = class extends BaseHTTPTransport {
         const body2 = await res.text();
         const cap = MCP_CONSTANTS.REQUEST_LOG_CAP;
         const snippet = body2.length > cap ? `${body2.slice(0, cap)}\u2026 [${body2.length} bytes total]` : body2;
-        throw new ToolError3({
+        throw new ToolError4({
           message: `HTTP ${res.status}: ${snippet}`,
           code: "TOOL_EXECUTION_FAILED",
           toolName: method,
@@ -1624,9 +1664,9 @@ var SSETransport = class extends BaseHTTPTransport {
       }
       let data;
       try {
-        data = await res.json();
+        data = JSON.parse(await readBodyCapped(res));
       } catch (err) {
-        throw new ToolError3({
+        throw new ToolError4({
           message: `Invalid JSON-RPC response: ${err instanceof Error ? err.message : "parse failed"}`,
           code: "TOOL_EXECUTION_FAILED",
           toolName: method,
@@ -1651,7 +1691,7 @@ var SSETransport = class extends BaseHTTPTransport {
   }
   async callTool(name, input, opts) {
     if (this.state !== "connected") {
-      throw new ToolError3({
+      throw new ToolError4({
         message: `SSE transport not connected (state=${this.state})`,
         code: "TOOL_EXECUTION_FAILED",
         toolName: name,
@@ -1688,7 +1728,7 @@ var SSETransport = class extends BaseHTTPTransport {
     try {
       const res = await this.fetchWithAuthorization(this.url, fetchOpts, timeoutSignal.signal);
       if (!res.ok) {
-        throw new ToolError3({
+        throw new ToolError4({
           message: `HTTP ${res.status}: ${res.statusText}`,
           code: "TOOL_EXECUTION_FAILED",
           toolName: method,
@@ -1702,9 +1742,9 @@ var SSETransport = class extends BaseHTTPTransport {
       }
       let data;
       try {
-        data = await res.json();
+        data = JSON.parse(await readBodyCapped(res));
       } catch (err) {
-        throw new ToolError3({
+        throw new ToolError4({
           message: `Invalid JSON-RPC response: ${err instanceof Error ? err.message : "parse failed"}`,
           code: "TOOL_EXECUTION_FAILED",
           toolName: method,
@@ -1764,7 +1804,7 @@ var StreamableHTTPTransport = class extends BaseHTTPTransport {
       }
     }
     const responses = envelopes.filter(isJsonRpcResult);
-    return responses.find((envelope) => envelope.id === requestId) ?? responses.find((envelope) => envelope.id !== void 0) ?? responses[0];
+    return responses.find((envelope) => envelope.id === requestId) ?? responses[0];
   }
   handleNotification(method) {
     if (method === "notifications/resources/list_changed") {
@@ -1883,9 +1923,9 @@ var StreamableHTTPTransport = class extends BaseHTTPTransport {
       }
       if (method.startsWith("notifications/")) {
         await res.text().catch(() => void 0);
-        return { jsonrpc: "2.0" };
+        return { jsonrpc: "2.0", id };
       }
-      const match = this.consumeResponseText(await res.text(), id);
+      const match = this.consumeResponseText(await readBodyCapped(res), id);
       if (match) {
         return assertMatchingJsonRpcResult(match, id, method);
       }
@@ -1932,7 +1972,7 @@ var StreamableHTTPTransport = class extends BaseHTTPTransport {
         await res.text().catch(() => void 0);
         return { jsonrpc: "2.0", id };
       }
-      const parsed = this.consumeResponseText(await res.text(), id);
+      const parsed = this.consumeResponseText(await readBodyCapped(res), id);
       if (parsed) {
         return {
           jsonrpc: "2.0",
@@ -1979,17 +2019,32 @@ var StreamableHTTPTransport = class extends BaseHTTPTransport {
 };
 
 // src/client.ts
-function isJsonRpcResponse(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const response = value;
-  if (response["jsonrpc"] !== "2.0" || typeof response["id"] !== "number") return false;
-  if (Object.hasOwn(response, "method")) return false;
-  const hasResult = Object.hasOwn(response, "result");
-  const hasError = Object.hasOwn(response, "error");
-  if (hasResult === hasError) return false;
-  if (!hasError) return true;
-  const error = response["error"];
-  return typeof error === "object" && error !== null && typeof error["code"] === "number" && typeof error["message"] === "string";
+function forceKillTree(child) {
+  if (child.pid === void 0) {
+    try {
+      child.kill("SIGKILL");
+    } catch {
+    }
+    return;
+  }
+  if (process.platform === "win32") {
+    const killer = spawn("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
+      stdio: "ignore",
+      windowsHide: true
+    });
+    killer.once("error", () => {
+      try {
+        child.kill("SIGKILL");
+      } catch {
+      }
+    });
+    killer.unref();
+    return;
+  }
+  try {
+    child.kill("SIGKILL");
+  } catch {
+  }
 }
 var MCPClient = class _MCPClient {
   constructor(opts) {
@@ -2383,10 +2438,7 @@ var MCPClient = class _MCPClient {
         new Promise((resolve) => setTimeout(() => resolve("timeout"), GRACEFUL_MS))
       ]);
       if (gracefulRace === "timeout") {
-        try {
-          child.kill("SIGKILL");
-        } catch {
-        }
+        forceKillTree(child);
         await Promise.race([
           exitPromise,
           new Promise((resolve) => setTimeout(resolve, FORCE_TIMEOUT_MS))
@@ -2615,11 +2667,12 @@ var MCPClient = class _MCPClient {
       }
       return;
     }
-    if (!isJsonRpcResponse(msg)) return;
-    if (this.pending.has(msg.id)) {
-      const entry = this.pending.get(msg.id);
-      this.pending.delete(msg.id);
-      entry?.resolve(msg);
+    if (!isJsonRpcResult(msg)) return;
+    const response = msg;
+    if (this.pending.has(response.id)) {
+      const entry = this.pending.get(response.id);
+      this.pending.delete(response.id);
+      entry?.resolve(response);
     }
   }
   handleServerRequest(request3) {
@@ -2853,7 +2906,7 @@ async function writeConfig(path2, cfg) {
   try {
     await fs.rename(tmp, path2);
   } catch (err) {
-    await fs.rm(tmp, { force: true }).catch(() => void 0);
+    await fs.rm(tmp, { force: true });
     throw err;
   }
 }
@@ -2917,6 +2970,8 @@ function projectServer(name, cfg, registry) {
   if (cfg.description !== void 0) info.description = cfg.description;
   if (cfg.url !== void 0) info.url = cfg.url;
   if (cfg.command !== void 0) info.command = cfg.command;
+  if (cfg.args !== void 0) info.args = cfg.args;
+  if (cfg.env !== void 0) info.env = cfg.env;
   if (cfg.lazy !== void 0) info.lazy = cfg.lazy;
   return info;
 }
@@ -3091,7 +3146,7 @@ function forgetRegistryState(registry, name) {
 }
 
 // src/manifest-cache.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash2, randomBytes as randomBytes4 } from "node:crypto";
 import * as fs2 from "node:fs/promises";
 import * as path from "node:path";
 function manifestConfigHash(cfg) {
@@ -3139,9 +3194,14 @@ async function writeCapabilityManifest(cacheDir, name, configHash, manifest) {
     const file = manifestFile(cacheDir, name);
     await fs2.mkdir(path.dirname(file), { recursive: true });
     const body = { version: 2, configHash, ...manifest };
-    const tmp = `${file}.tmp`;
-    await fs2.writeFile(tmp, JSON.stringify(body, null, 2), "utf8");
-    await fs2.rename(tmp, file);
+    const tmp = `${file}.${process.pid}.${randomBytes4(6).toString("hex")}.tmp`;
+    try {
+      await fs2.writeFile(tmp, JSON.stringify(body, null, 2), "utf8");
+      await fs2.rename(tmp, file);
+    } catch (err) {
+      await fs2.rm(tmp, { force: true });
+      throw err;
+    }
   } catch {
   }
 }
@@ -3202,7 +3262,10 @@ function evaluateHealthThresholds(operations, thresholds) {
   if (!thresholds) return [];
   const checks = [];
   if (thresholds.connectionLatencyP95Ms !== void 0 && operations.connectionSamples.length > 0) {
-    const value = percentile([...operations.connectionSamples].sort((a, b) => a - b), 0.95);
+    const value = percentile(
+      [...operations.connectionSamples].sort((a, b) => a - b),
+      0.95
+    );
     checks.push({
       name: "connection-latency-p95",
       passed: value <= thresholds.connectionLatencyP95Ms,
@@ -3211,7 +3274,10 @@ function evaluateHealthThresholds(operations, thresholds) {
     });
   }
   if (thresholds.discoveryLatencyP95Ms !== void 0 && operations.discoverySamples.length > 0) {
-    const value = percentile([...operations.discoverySamples].sort((a, b) => a - b), 0.95);
+    const value = percentile(
+      [...operations.discoverySamples].sort((a, b) => a - b),
+      0.95
+    );
     checks.push({
       name: "discovery-latency-p95",
       passed: value <= thresholds.discoveryLatencyP95Ms,
@@ -3220,7 +3286,10 @@ function evaluateHealthThresholds(operations, thresholds) {
     });
   }
   if (thresholds.callLatencyP95Ms !== void 0 && operations.callSamples.length > 0) {
-    const value = percentile([...operations.callSamples].sort((a, b) => a - b), 0.95);
+    const value = percentile(
+      [...operations.callSamples].sort((a, b) => a - b),
+      0.95
+    );
     checks.push({
       name: "call-latency-p95",
       passed: value <= thresholds.callLatencyP95Ms,
@@ -3268,10 +3337,10 @@ function percentile(sorted, ratio) {
 }
 
 // src/registry.ts
-import { expectDefined } from "@wrongstack/core";
+import { expectDefined } from "@wrongstack/core/utils";
 
 // src/wrap-tool.ts
-import { ToolCapabilities } from "@wrongstack/core";
+import { ToolCapabilities } from "@wrongstack/core/security";
 var MUTATING_RE = /create|update|delete|write|send|set|put|post|patch|remove|rename|move/i;
 function isMutatingTool(mcpTool) {
   if (MUTATING_RE.test(mcpTool.name)) return true;
@@ -3456,11 +3525,7 @@ var MCPRegistry = class _MCPRegistry {
    * cache yet, do a one-time cold discovery connect to learn + cache the tools.
    */
   async startLazy(slot) {
-    const cacheDir = this.cacheDir;
-    if (!cacheDir) {
-      await this.attemptConnect(slot);
-      return;
-    }
+    const cacheDir = expectDefined(this.cacheDir);
     const hash = manifestConfigHash(slot.cfg);
     const cached = await readCapabilityManifest(cacheDir, slot.cfg.name, hash);
     if (cached) {
@@ -4298,8 +4363,7 @@ function catalogSnapshot(slot) {
 
 // src/server.ts
 import { createServer } from "node:http";
-import { expectDefined as expectDefined2 } from "@wrongstack/core";
-import { toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils";
+import { expectDefined as expectDefined2, toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils";
 var PARSE_ERROR = -32700;
 var INVALID_REQUEST = -32600;
 var METHOD_NOT_FOUND = -32601;
@@ -4624,8 +4688,7 @@ function serveHttp(server, opts = {}) {
     httpServer.once("error", reject);
     httpServer.listen(port, host, () => {
       httpServer.removeListener("error", reject);
-      const addr = httpServer.address();
-      const boundPort = typeof addr === "object" && addr ? addr.port : port;
+      const boundPort = httpServer.address().port;
       const displayHost = host === "::1" ? "[::1]" : host;
       resolve({
         port: boundPort,
@@ -4657,18 +4720,14 @@ async function handleHttpRequest(server, req, res, token, log) {
     }
   }
   let body = "";
-  let tooLarge = false;
   req.on("data", (chunk) => {
-    if (tooLarge) return;
     body += chunk.toString("utf8");
     if (body.length > HTTP_BODY_CAP) {
-      tooLarge = true;
       send(413, JSON.stringify({ error: "payload too large" }));
       req.destroy();
     }
   });
   req.on("end", () => {
-    if (tooLarge) return;
     void server.handleMessage(body).then((out) => {
       if (out === null) return send(202, "");
       return send(200, out);