@wrongstack/mcp 0.295.0 → 0.295.1

package/dist/client.d.ts

@@ -1,3 +1,4 @@
+import { type ChildProcess } from 'node:child_process';
 import type { MCPAuthorizationProvider } from './authorization.js';
 import { type MCPGetPromptResult, type MCPListPromptsResult, type MCPListResourcesResult, type MCPListResourceTemplatesResult, type MCPReadResourceResult, type MCPServerMetadata } from './protocol.js';
 export type Transport = 'stdio' | 'sse' | 'streamable-http';
@@ -58,6 +59,14 @@ type ExitListener = (name: string, code: number | null, signal: string | null) =
  */
 type ToolsChangedListener = (name: string, tools: MCPTool[]) => void;
 export type MCPListChangedListener = (name: string) => void;
+/**
+ * Force-kill a child and its descendants. On Windows a stdio server is launched
+ * through a `.cmd` shim with `shell: true`, so `child` is the `cmd.exe` wrapper
+ * and the real server (npx→node / uvx) is its grandchild — `child.kill('SIGKILL')`
+ * signals only the wrapper and orphans the server, which then accumulates across
+ * every close / restart / idle-sleep. `taskkill /T /F` tears down the whole tree.
+ */
+export declare function forceKillTree(child: ChildProcess): void;
 /**
  * Lightweight MCP client supporting three transport types:
  * - stdio: spawns a child process and communicates over pipes

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAEnE,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,8BAA8B,EACnC,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EAOvB,MAAM,eAAe,CAAC;AAIvB,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,KAAK,GAAG,iBAAiB,CAAC;AAE5D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC7C,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,kEAAkE;IAClE,qBAAqB,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAC7D;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CACvC;AAED,MAAM,MAAM,eAAe,GACvB,MAAM,GACN,YAAY,GACZ,WAAW,GACX,cAAc,GACd,cAAc,GACd,QAAQ;AACV,2EAA2E;GACzE,SAAS,CAAC;AAEd,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CAClC;AAED,MAAM,WAAW,cAAe,SAAQ,iBAAiB;IACvD,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AASD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC7B,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAC;CAC/F;AA6BD,KAAK,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;AACvF;;;;GAIG;AACH,KAAK,oBAAoB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;AACrE,MAAM,MAAM,sBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAE5D;;;;;GAKG;AACH,qBAAa,SAAS;aA2CQ,IAAI,EAAE,gBAAgB;IA1ClD;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAoB;IAE/D,OAAO,CAAC,KAAK,CAA2B;IACxC,OAAO,CAAC,KAAK,CAAC,CAA2B;IACzC,OAAO,CAAC,MAAM,CAAK;IACnB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAGpB;IACJ,OAAO,CAAC,QAAQ,CAAM;IACtB,OAAO,CAAC,MAAM,CAAiB;IAC/B,2FAA2F;IAC3F,OAAO,CAAC,eAAe,CAAC,CAAgC;IACxD,qGAAqG;IACrG,OAAO,CAAC,WAAW,CAAC,CAAwB;IAC5C,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,kBAAkB,CAAS;IAEnC,OAAO,CAAC,YAAY,CAAC,CAA2B;IAChD,OAAO,CAAC,aAAa,CAAC,CAAsC;IAC5D,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2B;IACzD,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAmC;IACzE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAqC;IAC/E,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAqC;IAC7E,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAyB;IAE7D,YAA4B,IAAI,EAAE,gBAAgB,EAAI;IAEtD,QAAQ,IAAI,eAAe,CAE1B;IAED,iBAAiB,IAAI,iBAAiB,GAAG,SAAS,CAQjD;IAED,SAAS,IAAI,OAAO,EAAE,CAMrB;IAED,6EAA6E;IAC7E,gBAAgB,IAAI,OAAO,CAE1B;IAED;;;OAGG;IACH,eAAe,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,CAE5C;IAED,kBAAkB,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,CAE/C;IAED;;;OAGG;IACH,qBAAqB,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAEhD;IAED,wBAAwB,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAEnD;IAEK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAc7B;YAEa,YAAY;YAgIZ,UAAU;YAgEV,qBAAqB;IA6D7B,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,EACd,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;KAAE,GAC1C,OAAO,CAAC,cAAc,CAAC,CAuBzB;IAEK,aAAa,CAAC,IAAI,GAAE,cAAmB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAS9E;IAEK,qBAAqB,CAAC,IAAI,GAAE,cAAmB,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAS9F;IAEK,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAS5F;IAEK,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAUhF;IAEK,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAUlF;IAEK,WAAW,CAAC,IAAI,GAAE,cAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAG1E;IAEK,SAAS,CACb,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACzC,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAgB7B;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAsD3B;IAED,OAAO,CAAC,OAAO;YA0FD,iBAAiB;IA4B/B,OAAO,CAAC,4BAA4B;IAWpC;;;;OAIG;IACH,OAAO,CAAC,WAAW;YAcL,MAAM;IAsDpB,OAAO,CAAC,MAAM;IAwBd,OAAO,CAAC,MAAM;IAgDd,OAAO,CAAC,mBAAmB;IAmB3B;;;;;OAKG;YACW,sBAAsB;IAoBpC,uBAAuB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAE5D;IAED,0BAA0B,CAAC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAE/D;IAED,2BAA2B,CAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI,CAElE;IAED,8BAA8B,CAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI,CAErE;IAED,yBAAyB,CAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI,CAEhE;IAED,4BAA4B,CAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI,CAEnE;IAED,OAAO,CAAC,qBAAqB;CAW9B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGnD"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAS,MAAM,oBAAoB,CAAC;AAE9D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAEnE,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,8BAA8B,EACnC,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EAOvB,MAAM,eAAe,CAAC;AAKvB,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,KAAK,GAAG,iBAAiB,CAAC;AAE5D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC7C,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,kEAAkE;IAClE,qBAAqB,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAC7D;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CACvC;AAED,MAAM,MAAM,eAAe,GACvB,MAAM,GACN,YAAY,GACZ,WAAW,GACX,cAAc,GACd,cAAc,GACd,QAAQ;AACV,2EAA2E;GACzE,SAAS,CAAC;AAEd,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CAClC;AAED,MAAM,WAAW,cAAe,SAAQ,iBAAiB;IACvD,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AASD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC7B,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAC;CAC/F;AASD,KAAK,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;AACvF;;;;GAIG;AACH,KAAK,oBAAoB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;AACrE,MAAM,MAAM,sBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAE5D;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CA6BvD;AAED;;;;;GAKG;AACH,qBAAa,SAAS;aA2CQ,IAAI,EAAE,gBAAgB;IA1ClD;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAoB;IAE/D,OAAO,CAAC,KAAK,CAA2B;IACxC,OAAO,CAAC,KAAK,CAAC,CAA2B;IACzC,OAAO,CAAC,MAAM,CAAK;IACnB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAGpB;IACJ,OAAO,CAAC,QAAQ,CAAM;IACtB,OAAO,CAAC,MAAM,CAAiB;IAC/B,2FAA2F;IAC3F,OAAO,CAAC,eAAe,CAAC,CAAgC;IACxD,qGAAqG;IACrG,OAAO,CAAC,WAAW,CAAC,CAAwB;IAC5C,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,kBAAkB,CAAS;IAEnC,OAAO,CAAC,YAAY,CAAC,CAA2B;IAChD,OAAO,CAAC,aAAa,CAAC,CAAsC;IAC5D,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2B;IACzD,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAmC;IACzE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAqC;IAC/E,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAqC;IAC7E,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAyB;IAE7D,YAA4B,IAAI,EAAE,gBAAgB,EAAI;IAEtD,QAAQ,IAAI,eAAe,CAE1B;IAED,iBAAiB,IAAI,iBAAiB,GAAG,SAAS,CAQjD;IAED,SAAS,IAAI,OAAO,EAAE,CAMrB;IAED,6EAA6E;IAC7E,gBAAgB,IAAI,OAAO,CAE1B;IAED;;;OAGG;IACH,eAAe,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,CAE5C;IAED,kBAAkB,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,CAE/C;IAED;;;OAGG;IACH,qBAAqB,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAEhD;IAED,wBAAwB,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAEnD;IAEK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAc7B;YAEa,YAAY;YAgIZ,UAAU;YAgEV,qBAAqB;IA6D7B,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,EACd,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;KAAE,GAC1C,OAAO,CAAC,cAAc,CAAC,CAuBzB;IAEK,aAAa,CAAC,IAAI,GAAE,cAAmB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAS9E;IAEK,qBAAqB,CAAC,IAAI,GAAE,cAAmB,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAS9F;IAEK,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAS5F;IAEK,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAUhF;IAEK,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAUlF;IAEK,WAAW,CAAC,IAAI,GAAE,cAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAG1E;IAEK,SAAS,CACb,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACzC,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAgB7B;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAkD3B;IAED,OAAO,CAAC,OAAO;YA0FD,iBAAiB;IA4B/B,OAAO,CAAC,4BAA4B;IAWpC;;;;OAIG;IACH,OAAO,CAAC,WAAW;YAcL,MAAM;IAsDpB,OAAO,CAAC,MAAM;IAwBd,OAAO,CAAC,MAAM;IAiDd,OAAO,CAAC,mBAAmB;IAmB3B;;;;;OAKG;YACW,sBAAsB;IAoBpC,uBAAuB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAE5D;IAED,0BAA0B,CAAC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAE/D;IAED,2BAA2B,CAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI,CAElE;IAED,8BAA8B,CAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI,CAErE;IAED,yBAAyB,CAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI,CAEhE;IAED,4BAA4B,CAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI,CAEnE;IAED,OAAO,CAAC,qBAAqB;CAW9B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGnD"}

package/dist/index.js

@@ -47,7 +47,7 @@ function parseMcpBearerChallenge(header, resource) {
   if (!header) return challenge;
   const bearer = /(?:^|,)\s*Bearer(?:\s+|$)/i.exec(header);
   if (!bearer) return challenge;
-  const parameters = header.slice((bearer.index ?? 0) + bearer[0].length);
+  const parameters = header.slice(bearer.index + bearer[0].length);
   const resourceMetadata = challengeParameter(parameters, "resource_metadata");
   if (resourceMetadata) {
     const metadataUrl = validateMetadataUrl(resourceMetadata);
@@ -395,7 +395,7 @@ async function requestPinnedJson(rawUrl, options) {
     };
     const requestFn = url.protocol === "https:" ? https.request : http.request;
     const request3 = requestFn(requestOptions, (response) => {
-      const status = response.statusCode ?? 0;
+      const status = response.statusCode;
       if (status === 404 || status === 410) {
         response.resume();
         finish(void 0, void 0);
@@ -739,8 +739,7 @@ function boundedServerName(value) {
 
 // src/client.ts
 import { spawn } from "node:child_process";
-import { buildChildEnv } from "@wrongstack/core/utils";
-import { toErrorMessage } from "@wrongstack/core/utils";
+import { buildChildEnv, toErrorMessage } from "@wrongstack/core/utils";
 
 // src/constants.ts
 var MCP_CONSTANTS = Object.freeze({
@@ -997,13 +996,15 @@ function normalizeMCPTools(value) {
     if (typeof t.name !== "string" || t.name.trim().length === 0) continue;
     const inputSchema = t.inputSchema && typeof t.inputSchema === "object" && !Array.isArray(t.inputSchema) ? t.inputSchema : { type: "object", properties: {} };
     if (!t.inputSchema || typeof t.inputSchema !== "object" || Array.isArray(t.inputSchema)) {
-      console.warn(JSON.stringify({
-        level: "warn",
-        event: "mcp.tool_schema_invalid",
-        tool: t.name,
-        message: "no/invalid inputSchema \u2014 defaulting to empty object",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      }));
+      console.warn(
+        JSON.stringify({
+          level: "warn",
+          event: "mcp.tool_schema_invalid",
+          tool: t.name,
+          message: "no/invalid inputSchema \u2014 defaulting to empty object",
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        })
+      );
     }
     tools.push({
       name: t.name,
@@ -1014,96 +1015,8 @@ function normalizeMCPTools(value) {
   return tools;
 }
 
-// src/transport-jsonrpc.ts
-import { ToolError } from "@wrongstack/core/types";
-function isJsonRpcResult(v) {
-  if (typeof v !== "object" || v === null) return false;
-  const r = v;
-  if (r["jsonrpc"] !== "2.0" || typeof r["id"] !== "number") return false;
-  if (Object.hasOwn(r, "method")) return false;
-  const hasResult = Object.hasOwn(r, "result");
-  const hasError = Object.hasOwn(r, "error");
-  if (hasResult === hasError) return false;
-  if (hasError) {
-    const error = r["error"];
-    return typeof error === "object" && error !== null && typeof error["code"] === "number" && typeof error["message"] === "string";
-  }
-  return true;
-}
-function isJsonRpcMethodEnvelope(v) {
-  if (typeof v !== "object" || v === null) return false;
-  const envelope = v;
-  if (envelope["jsonrpc"] !== "2.0" || typeof envelope["method"] !== "string") return false;
-  const id = envelope["id"];
-  return id === void 0 || typeof id === "number" || typeof id === "string";
-}
-function extractJsonRpcEnvelopes(text) {
-  const out = [];
-  let dataBuf = [];
-  const flush = () => {
-    if (dataBuf.length === 0) return;
-    const joined = dataBuf.join("\n").trim();
-    dataBuf = [];
-    if (!joined) return;
-    try {
-      const parsed = JSON.parse(joined);
-      if (isJsonRpcResult(parsed) || isJsonRpcMethodEnvelope(parsed)) out.push(parsed);
-    } catch {
-    }
-  };
-  for (const raw of text.split("\n")) {
-    const line = raw.replace(/\r$/, "");
-    if (line === "") {
-      flush();
-      continue;
-    }
-    if (line.startsWith(":")) continue;
-    if (line.startsWith("data:")) {
-      let v = line.slice(5);
-      if (v.startsWith(" ")) v = v.slice(1);
-      dataBuf.push(v);
-      continue;
-    }
-    if (line.startsWith("event:") || line.startsWith("id:") || line.startsWith("retry:")) {
-      continue;
-    }
-    const trimmed = line.trim();
-    if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
-      try {
-        const parsed = JSON.parse(trimmed);
-        if (isJsonRpcResult(parsed) || isJsonRpcMethodEnvelope(parsed)) out.push(parsed);
-      } catch {
-      }
-    }
-  }
-  flush();
-  return out;
-}
-function extractJsonRpcResults(text) {
-  return extractJsonRpcEnvelopes(text).filter(isJsonRpcResult);
-}
-function assertMatchingJsonRpcResult(data, expectedId, method) {
-  if (!isJsonRpcResult(data)) {
-    throw new ToolError({
-      message: "Invalid JSON-RPC response: not a JSON-RPC 2.0 envelope",
-      code: "TOOL_EXECUTION_FAILED",
-      toolName: "mcp_transport_jsonrpc",
-      context: { method, expectedId, reason: "not-jsonrpc-envelope" }
-    });
-  }
-  if (data.id !== expectedId) {
-    throw new ToolError({
-      message: `Invalid JSON-RPC response: id mismatch for ${method} (expected ${expectedId}, got ${data.id})`,
-      code: "TOOL_EXECUTION_FAILED",
-      toolName: "mcp_transport_jsonrpc",
-      context: { method, expectedId, actualId: data.id, reason: "id-mismatch" }
-    });
-  }
-  return data;
-}
-
 // src/sse-reader.ts
-import { ToolError as ToolError2 } from "@wrongstack/core/types";
+import { ToolError } from "@wrongstack/core/types";
 var SSE_READER_MAX_BUFFER = 256 * 1024;
 var SSE_READER_MAX_DATA_LINES = 1024;
 var SSEReader = class {
@@ -1119,7 +1032,7 @@ var SSEReader = class {
   }
   feed(chunk) {
     if (chunk.length > SSE_READER_MAX_BUFFER) {
-      throw new ToolError2({
+      throw new ToolError({
         message: `SSE: chunk size ${chunk.length} exceeds max buffer ${SSE_READER_MAX_BUFFER} \u2014 refusing to accumulate`,
         code: "TOOL_EXECUTION_FAILED",
         toolName: "mcp_transport_sse_reader",
@@ -1128,7 +1041,7 @@ var SSEReader = class {
     }
     this.buffer += chunk;
     if (this.buffer.length > SSE_READER_MAX_BUFFER) {
-      throw new ToolError2({
+      throw new ToolError({
         message: `SSE: pending line exceeds ${SSE_READER_MAX_BUFFER} bytes \u2014 upstream is not framing events`,
         code: "TOOL_EXECUTION_FAILED",
         toolName: "mcp_transport_sse_reader",
@@ -1163,7 +1076,7 @@ var SSEReader = class {
     if (field === "event") {
     } else if (field === "data") {
       if (this.dataLines.length >= SSE_READER_MAX_DATA_LINES) {
-        throw new ToolError2({
+        throw new ToolError({
           message: `SSE: exceeded ${SSE_READER_MAX_DATA_LINES} data lines per event \u2014 upstream is not sending blank-line delimiters`,
           code: "TOOL_EXECUTION_FAILED",
           toolName: "mcp_transport_sse_reader",
@@ -1453,9 +1366,133 @@ var BaseHTTPTransport = class {
   }
 };
 
+// src/transport-jsonrpc.ts
+import { ToolError as ToolError2 } from "@wrongstack/core/types";
+function isJsonRpcResult(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const r = v;
+  if (r["jsonrpc"] !== "2.0" || typeof r["id"] !== "number") return false;
+  if (Object.hasOwn(r, "method")) return false;
+  const hasResult = Object.hasOwn(r, "result");
+  const hasError = Object.hasOwn(r, "error");
+  if (hasResult === hasError) return false;
+  if (hasError) {
+    const error = r["error"];
+    return typeof error === "object" && error !== null && typeof error["code"] === "number" && typeof error["message"] === "string";
+  }
+  return true;
+}
+function isJsonRpcMethodEnvelope(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const envelope = v;
+  if (envelope["jsonrpc"] !== "2.0" || typeof envelope["method"] !== "string") return false;
+  const id = envelope["id"];
+  return id === void 0 || typeof id === "number" || typeof id === "string";
+}
+function extractJsonRpcEnvelopes(text) {
+  const out = [];
+  let dataBuf = [];
+  const flush = () => {
+    if (dataBuf.length === 0) return;
+    const joined = dataBuf.join("\n").trim();
+    dataBuf = [];
+    if (!joined) return;
+    try {
+      const parsed = JSON.parse(joined);
+      if (isJsonRpcResult(parsed) || isJsonRpcMethodEnvelope(parsed)) out.push(parsed);
+    } catch {
+    }
+  };
+  for (const raw of text.split("\n")) {
+    const line = raw.replace(/\r$/, "");
+    if (line === "") {
+      flush();
+      continue;
+    }
+    if (line.startsWith(":")) continue;
+    if (line.startsWith("data:")) {
+      let v = line.slice(5);
+      if (v.startsWith(" ")) v = v.slice(1);
+      dataBuf.push(v);
+      continue;
+    }
+    if (line.startsWith("event:") || line.startsWith("id:") || line.startsWith("retry:")) {
+      continue;
+    }
+    const trimmed = line.trim();
+    if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+      try {
+        const parsed = JSON.parse(trimmed);
+        if (isJsonRpcResult(parsed) || isJsonRpcMethodEnvelope(parsed)) out.push(parsed);
+      } catch {
+      }
+    }
+  }
+  flush();
+  return out;
+}
+function extractJsonRpcResults(text) {
+  return extractJsonRpcEnvelopes(text).filter(isJsonRpcResult);
+}
+function assertMatchingJsonRpcResult(data, expectedId, method) {
+  if (!isJsonRpcResult(data)) {
+    throw new ToolError2({
+      message: "Invalid JSON-RPC response: not a JSON-RPC 2.0 envelope",
+      code: "TOOL_EXECUTION_FAILED",
+      toolName: "mcp_transport_jsonrpc",
+      context: { method, expectedId, reason: "not-jsonrpc-envelope" }
+    });
+  }
+  if (data.id !== expectedId) {
+    throw new ToolError2({
+      message: `Invalid JSON-RPC response: id mismatch for ${method} (expected ${expectedId}, got ${data.id})`,
+      code: "TOOL_EXECUTION_FAILED",
+      toolName: "mcp_transport_jsonrpc",
+      context: { method, expectedId, actualId: data.id, reason: "id-mismatch" }
+    });
+  }
+  return data;
+}
+
 // src/transport-sse.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
+import { ToolError as ToolError4 } from "@wrongstack/core/types";
+
+// src/read-body.ts
 import { ToolError as ToolError3 } from "@wrongstack/core/types";
+var MAX_MCP_HTTP_BODY_BYTES = 16 * 1024 * 1024;
+async function readBodyCapped(res, maxBytes = MAX_MCP_HTTP_BODY_BYTES) {
+  const body = res.body;
+  if (!body || typeof body.getReader !== "function") {
+    return await res.text();
+  }
+  const reader = body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (!value) continue;
+      total += value.byteLength;
+      if (total > maxBytes) {
+        await reader.cancel().catch(() => void 0);
+        throw new ToolError3({
+          message: `MCP response body exceeded ${maxBytes} bytes \u2014 refusing to buffer`,
+          code: "TOOL_EXECUTION_FAILED",
+          toolName: "mcp_transport",
+          context: { maxBytes, received: total }
+        });
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock?.();
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+// src/transport-sse.ts
 var SSETransport = class extends BaseHTTPTransport {
   _nextId = 1;
   readerDone = false;
@@ -1502,7 +1539,7 @@ var SSETransport = class extends BaseHTTPTransport {
       this.applyTlsAgent(fetchOpts);
       const response = await this.fetchWithAuthorization(sseUrl, fetchOpts, signal);
       if (!response.ok) {
-        throw new ToolError3({
+        throw new ToolError4({
           message: `SSE connect HTTP ${response.status}: ${response.statusText}`,
           code: "TOOL_EXECUTION_FAILED",
           toolName: "mcp_transport_sse_connect",
@@ -1510,7 +1547,7 @@ var SSETransport = class extends BaseHTTPTransport {
         });
       }
       if (!response.body) {
-        throw new ToolError3({
+        throw new ToolError4({
           message: "SSE response has no body",
           code: "TOOL_EXECUTION_FAILED",
           toolName: "mcp_transport_sse_connect",
@@ -1543,7 +1580,7 @@ var SSETransport = class extends BaseHTTPTransport {
         clientInfo: MCP_CONSTANTS.CLIENT_INFO
       });
       if (initRes.error) {
-        throw new ToolError3({
+        throw new ToolError4({
           message: `initialize failed: ${initRes.error.message}`,
           code: "TOOL_EXECUTION_FAILED",
           toolName: "mcp_transport_initialize",
@@ -1618,7 +1655,7 @@ var SSETransport = class extends BaseHTTPTransport {
         const body2 = await res.text();
         const cap = MCP_CONSTANTS.REQUEST_LOG_CAP;
         const snippet = body2.length > cap ? `${body2.slice(0, cap)}\u2026 [${body2.length} bytes total]` : body2;
-        throw new ToolError3({
+        throw new ToolError4({
           message: `HTTP ${res.status}: ${snippet}`,
           code: "TOOL_EXECUTION_FAILED",
           toolName: method,
@@ -1627,9 +1664,9 @@ var SSETransport = class extends BaseHTTPTransport {
       }
       let data;
       try {
-        data = await res.json();
+        data = JSON.parse(await readBodyCapped(res));
       } catch (err) {
-        throw new ToolError3({
+        throw new ToolError4({
           message: `Invalid JSON-RPC response: ${err instanceof Error ? err.message : "parse failed"}`,
           code: "TOOL_EXECUTION_FAILED",
           toolName: method,
@@ -1654,7 +1691,7 @@ var SSETransport = class extends BaseHTTPTransport {
   }
   async callTool(name, input, opts) {
     if (this.state !== "connected") {
-      throw new ToolError3({
+      throw new ToolError4({
         message: `SSE transport not connected (state=${this.state})`,
         code: "TOOL_EXECUTION_FAILED",
         toolName: name,
@@ -1691,7 +1728,7 @@ var SSETransport = class extends BaseHTTPTransport {
     try {
       const res = await this.fetchWithAuthorization(this.url, fetchOpts, timeoutSignal.signal);
       if (!res.ok) {
-        throw new ToolError3({
+        throw new ToolError4({
           message: `HTTP ${res.status}: ${res.statusText}`,
           code: "TOOL_EXECUTION_FAILED",
           toolName: method,
@@ -1705,9 +1742,9 @@ var SSETransport = class extends BaseHTTPTransport {
       }
       let data;
       try {
-        data = await res.json();
+        data = JSON.parse(await readBodyCapped(res));
       } catch (err) {
-        throw new ToolError3({
+        throw new ToolError4({
           message: `Invalid JSON-RPC response: ${err instanceof Error ? err.message : "parse failed"}`,
           code: "TOOL_EXECUTION_FAILED",
           toolName: method,
@@ -1767,7 +1804,7 @@ var StreamableHTTPTransport = class extends BaseHTTPTransport {
       }
     }
     const responses = envelopes.filter(isJsonRpcResult);
-    return responses.find((envelope) => envelope.id === requestId) ?? responses.find((envelope) => envelope.id !== void 0) ?? responses[0];
+    return responses.find((envelope) => envelope.id === requestId) ?? responses[0];
   }
   handleNotification(method) {
     if (method === "notifications/resources/list_changed") {
@@ -1886,9 +1923,9 @@ var StreamableHTTPTransport = class extends BaseHTTPTransport {
       }
       if (method.startsWith("notifications/")) {
         await res.text().catch(() => void 0);
-        return { jsonrpc: "2.0" };
+        return { jsonrpc: "2.0", id };
       }
-      const match = this.consumeResponseText(await res.text(), id);
+      const match = this.consumeResponseText(await readBodyCapped(res), id);
       if (match) {
         return assertMatchingJsonRpcResult(match, id, method);
       }
@@ -1935,7 +1972,7 @@ var StreamableHTTPTransport = class extends BaseHTTPTransport {
         await res.text().catch(() => void 0);
         return { jsonrpc: "2.0", id };
       }
-      const parsed = this.consumeResponseText(await res.text(), id);
+      const parsed = this.consumeResponseText(await readBodyCapped(res), id);
       if (parsed) {
         return {
           jsonrpc: "2.0",
@@ -1982,17 +2019,32 @@ var StreamableHTTPTransport = class extends BaseHTTPTransport {
 };
 
 // src/client.ts
-function isJsonRpcResponse(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const response = value;
-  if (response["jsonrpc"] !== "2.0" || typeof response["id"] !== "number") return false;
-  if (Object.hasOwn(response, "method")) return false;
-  const hasResult = Object.hasOwn(response, "result");
-  const hasError = Object.hasOwn(response, "error");
-  if (hasResult === hasError) return false;
-  if (!hasError) return true;
-  const error = response["error"];
-  return typeof error === "object" && error !== null && typeof error["code"] === "number" && typeof error["message"] === "string";
+function forceKillTree(child) {
+  if (child.pid === void 0) {
+    try {
+      child.kill("SIGKILL");
+    } catch {
+    }
+    return;
+  }
+  if (process.platform === "win32") {
+    const killer = spawn("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
+      stdio: "ignore",
+      windowsHide: true
+    });
+    killer.once("error", () => {
+      try {
+        child.kill("SIGKILL");
+      } catch {
+      }
+    });
+    killer.unref();
+    return;
+  }
+  try {
+    child.kill("SIGKILL");
+  } catch {
+  }
 }
 var MCPClient = class _MCPClient {
   constructor(opts) {
@@ -2386,10 +2438,7 @@ var MCPClient = class _MCPClient {
         new Promise((resolve) => setTimeout(() => resolve("timeout"), GRACEFUL_MS))
       ]);
       if (gracefulRace === "timeout") {
-        try {
-          child.kill("SIGKILL");
-        } catch {
-        }
+        forceKillTree(child);
         await Promise.race([
           exitPromise,
           new Promise((resolve) => setTimeout(resolve, FORCE_TIMEOUT_MS))
@@ -2618,11 +2667,12 @@ var MCPClient = class _MCPClient {
       }
       return;
     }
-    if (!isJsonRpcResponse(msg)) return;
-    if (this.pending.has(msg.id)) {
-      const entry = this.pending.get(msg.id);
-      this.pending.delete(msg.id);
-      entry?.resolve(msg);
+    if (!isJsonRpcResult(msg)) return;
+    const response = msg;
+    if (this.pending.has(response.id)) {
+      const entry = this.pending.get(response.id);
+      this.pending.delete(response.id);
+      entry?.resolve(response);
     }
   }
   handleServerRequest(request3) {
@@ -2856,7 +2906,7 @@ async function writeConfig(path2, cfg) {
   try {
     await fs.rename(tmp, path2);
   } catch (err) {
-    await fs.rm(tmp, { force: true }).catch(() => void 0);
+    await fs.rm(tmp, { force: true });
     throw err;
   }
 }
@@ -3096,7 +3146,7 @@ function forgetRegistryState(registry, name) {
 }
 
 // src/manifest-cache.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash2, randomBytes as randomBytes4 } from "node:crypto";
 import * as fs2 from "node:fs/promises";
 import * as path from "node:path";
 function manifestConfigHash(cfg) {
@@ -3144,9 +3194,14 @@ async function writeCapabilityManifest(cacheDir, name, configHash, manifest) {
     const file = manifestFile(cacheDir, name);
     await fs2.mkdir(path.dirname(file), { recursive: true });
     const body = { version: 2, configHash, ...manifest };
-    const tmp = `${file}.tmp`;
-    await fs2.writeFile(tmp, JSON.stringify(body, null, 2), "utf8");
-    await fs2.rename(tmp, file);
+    const tmp = `${file}.${process.pid}.${randomBytes4(6).toString("hex")}.tmp`;
+    try {
+      await fs2.writeFile(tmp, JSON.stringify(body, null, 2), "utf8");
+      await fs2.rename(tmp, file);
+    } catch (err) {
+      await fs2.rm(tmp, { force: true });
+      throw err;
+    }
   } catch {
   }
 }
@@ -3207,7 +3262,10 @@ function evaluateHealthThresholds(operations, thresholds) {
   if (!thresholds) return [];
   const checks = [];
   if (thresholds.connectionLatencyP95Ms !== void 0 && operations.connectionSamples.length > 0) {
-    const value = percentile([...operations.connectionSamples].sort((a, b) => a - b), 0.95);
+    const value = percentile(
+      [...operations.connectionSamples].sort((a, b) => a - b),
+      0.95
+    );
     checks.push({
       name: "connection-latency-p95",
       passed: value <= thresholds.connectionLatencyP95Ms,
@@ -3216,7 +3274,10 @@ function evaluateHealthThresholds(operations, thresholds) {
     });
   }
   if (thresholds.discoveryLatencyP95Ms !== void 0 && operations.discoverySamples.length > 0) {
-    const value = percentile([...operations.discoverySamples].sort((a, b) => a - b), 0.95);
+    const value = percentile(
+      [...operations.discoverySamples].sort((a, b) => a - b),
+      0.95
+    );
     checks.push({
       name: "discovery-latency-p95",
       passed: value <= thresholds.discoveryLatencyP95Ms,
@@ -3225,7 +3286,10 @@ function evaluateHealthThresholds(operations, thresholds) {
     });
   }
   if (thresholds.callLatencyP95Ms !== void 0 && operations.callSamples.length > 0) {
-    const value = percentile([...operations.callSamples].sort((a, b) => a - b), 0.95);
+    const value = percentile(
+      [...operations.callSamples].sort((a, b) => a - b),
+      0.95
+    );
     checks.push({
       name: "call-latency-p95",
       passed: value <= thresholds.callLatencyP95Ms,
@@ -3461,11 +3525,7 @@ var MCPRegistry = class _MCPRegistry {
    * cache yet, do a one-time cold discovery connect to learn + cache the tools.
    */
   async startLazy(slot) {
-    const cacheDir = this.cacheDir;
-    if (!cacheDir) {
-      await this.attemptConnect(slot);
-      return;
-    }
+    const cacheDir = expectDefined(this.cacheDir);
     const hash = manifestConfigHash(slot.cfg);
     const cached = await readCapabilityManifest(cacheDir, slot.cfg.name, hash);
     if (cached) {
@@ -4303,8 +4363,7 @@ function catalogSnapshot(slot) {
 
 // src/server.ts
 import { createServer } from "node:http";
-import { expectDefined as expectDefined2 } from "@wrongstack/core/utils";
-import { toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils";
+import { expectDefined as expectDefined2, toErrorMessage as toErrorMessage2 } from "@wrongstack/core/utils";
 var PARSE_ERROR = -32700;
 var INVALID_REQUEST = -32600;
 var METHOD_NOT_FOUND = -32601;
@@ -4629,8 +4688,7 @@ function serveHttp(server, opts = {}) {
     httpServer.once("error", reject);
     httpServer.listen(port, host, () => {
       httpServer.removeListener("error", reject);
-      const addr = httpServer.address();
-      const boundPort = typeof addr === "object" && addr ? addr.port : port;
+      const boundPort = httpServer.address().port;
       const displayHost = host === "::1" ? "[::1]" : host;
       resolve({
         port: boundPort,
@@ -4662,18 +4720,14 @@ async function handleHttpRequest(server, req, res, token, log) {
     }
   }
   let body = "";
-  let tooLarge = false;
   req.on("data", (chunk) => {
-    if (tooLarge) return;
     body += chunk.toString("utf8");
     if (body.length > HTTP_BODY_CAP) {
-      tooLarge = true;
       send(413, JSON.stringify({ error: "payload too large" }));
       req.destroy();
     }
   });
   req.on("end", () => {
-    if (tooLarge) return;
     void server.handleMessage(body).then((out) => {
       if (out === null) return send(202, "");
       return send(200, out);