@wrongstack/mcp 1.0.35 → 1.0.37

package/dist/client-http-connection.d.ts

@@ -10,6 +10,7 @@ export interface ClientHttpConnectionHost {
     disconnectListeners: Set<() => void>;
     _tools: MCPTool[];
     _toolsCache: MCPTool[] | undefined;
+    readonly toolCatalogVersion: number;
     toolsChangedListeners: Set<ToolsChangedListener>;
     emitCapabilityChanged: (capability: 'resources' | 'prompts') => void;
     emitResourceUpdated: (uri: string) => void;

package/dist/client-stdio-request.d.ts

@@ -3,6 +3,8 @@ import type { JsonRpcResponse } from './contracts.js';
 /**
  * The effective per-request timeout: an explicit positive `timeoutMs` wins,
  * then the client's configured `requestTimeoutMs`, then the package default.
+ * Capped at the largest timer delay: Node turns a longer one into 1 ms, which
+ * timed out every request to a server configured to "never" time out.
  */
 export declare function resolveRequestTimeoutMs(configuredMs: number | undefined, timeoutMs: number | undefined): number;
 /**

package/dist/client.d.ts

@@ -2,7 +2,7 @@ import { StringDecoder } from 'node:string_decoder';
 import type { ExitListener, JsonRpcServerRequest, MCPClientOptions, MCPListChangedListener, MCPLogMessageListener, MCPPageOptions, MCPProgressListener, MCPRequestOptions, MCPResourceUpdatedListener, ToolsChangedListener } from './client-types.js';
 import type { ConnectionState, JsonRpcResponse, MCPTool, ToolCallResult } from './contracts.js';
 import { ServerRequestResponder, type UrlElicitation } from './elicitation.js';
-import type { MCPGetPromptResult, MCPListPromptsResult, MCPListResourcesResult, MCPListResourceTemplatesResult, MCPReadResourceResult, MCPServerMetadata } from './protocol.js';
+import { type MCPCompletionReference, type MCPCompletionResult, type MCPGetPromptResult, type MCPListPromptsResult, type MCPListResourcesResult, type MCPListResourceTemplatesResult, type MCPReadResourceResult, type MCPServerMetadata } from './protocol.js';
 export { forceKillTree } from './client-process.js';
 export { quoteWindowsArg } from './client-protocol-helpers.js';
 export type { ConnectionState, JsonRpcResponse, MCPTool, ToolCallResult };
@@ -109,6 +109,21 @@ export declare class MCPClient {
     unsubscribeResource(uri: string, opts?: MCPRequestOptions): Promise<void>;
     listPrompts(opts?: MCPPageOptions): Promise<MCPListPromptsResult>;
     getPrompt(name: string, args?: Record<string, string> | undefined, opts?: MCPRequestOptions): Promise<MCPGetPromptResult>;
+    /**
+     * Liveness check (MCP `ping`): the server MUST answer promptly with an
+     * empty result. Works on every transport — a cheap connection health probe
+     * before a long call, and the natural reconnect-readiness check.
+     */
+    ping(opts?: MCPRequestOptions): Promise<void>;
+    /**
+     * Argument autocompletion (MCP `completion/complete`, 2024-11-05). The
+     * server must advertise the `completions` capability; an unsupported
+     * server answers with a JSON-RPC error, which surfaces here as a throw.
+     */
+    complete(ref: MCPCompletionReference, argument: {
+        name: string;
+        value: string;
+    }, opts?: MCPRequestOptions): Promise<MCPCompletionResult>;
     close(): Promise<void>;
     private closeInner;
     /**

package/dist/index.d.ts

@@ -12,7 +12,7 @@ export { elicitViaUserInput } from './elicitation-form.js';
 export { addMcp, disableMcp, discoverMcp, enableMcp, listMcp, MCP_ENV_MASK, type McpManageDeps, type McpOpResult, type McpServerInfo, type McpServerInput, removeMcp, restartMcp, updateMcp, } from './manage.js';
 export { type MCPCapabilityManifest, manifestConfigHash, readCapabilityManifest, readManifest, writeCapabilityManifest, writeManifest, } from './manifest-cache.js';
 export { MCP_OPERATION_LIMITS, type MCPFailureKind, type MCPHealthState, type MCPLatencySummary, type MCPOperationEvent, type MCPOperationKind, type MCPServerOperationalHealth, } from './operations.js';
-export { type MCPGetPromptResult, type MCPImplementationInfo, type MCPListPromptsResult, type MCPListResourcesResult, type MCPListResourceTemplatesResult, type MCPPrompt, type MCPPromptArgument, type MCPPromptMessage, type MCPReadResourceResult, type MCPResource, type MCPResourceContents, type MCPResourceTemplate, type MCPServerCapabilities, type MCPServerMetadata, parseGetPromptResult, parseListPromptsResult, parseListResourcesResult, parseListResourceTemplatesResult, parseReadResourceResult, parseServerMetadata, } from './protocol.js';
+export { type MCPCompletionReference, type MCPCompletionResult, type MCPGetPromptResult, type MCPImplementationInfo, type MCPListPromptsResult, type MCPListResourcesResult, type MCPListResourceTemplatesResult, type MCPPrompt, type MCPPromptArgument, type MCPPromptMessage, type MCPReadResourceResult, type MCPResource, type MCPResourceContents, type MCPResourceTemplate, type MCPServerCapabilities, type MCPServerMetadata, parseCompletionResult, parseGetPromptResult, parseListPromptsResult, parseListResourcesResult, parseListResourceTemplatesResult, parseReadResourceResult, parseServerMetadata, } from './protocol.js';
 export { MCPRegistry, type MCPRegistryCatalog, type MCPRegistryOptions } from './registry.js';
 export { MCPServer, type MCPServerCallResult, type MCPServerLogger, type MCPServerOptions, type MCPServerPrompt, type MCPServerResource, type MCPServerTool, type MCPServerToolHost, type ServeHttpHandle, type ServeHttpOptions, type ServeStdioHandle, type ServeStdioOptions, serveHttp, serveStdio, toContentBlocks, } from './server.js';
 export { createVaultBackedMcpAuthorizationProviderFactory, type MCPAuthorizationStateEvent, MCPRefreshingAuthorizationProvider, type MCPRefreshingAuthorizationProviderOptions, type MCPStoredAuthorization, type MCPVaultProviderFactoryOptions, MCPVaultTokenStore, } from './token-store.js';

package/dist/index.js

@@ -1443,6 +1443,24 @@ function logMessageNotification(params) {
     data: input["data"] === void 0 ? void 0 : serializedNotificationData(input["data"])
   };
 }
+function parseCompletionResult(value) {
+  const envelope = record2(value, "completion/complete result");
+  const completion = record2(envelope["completion"], "completion/complete result.completion");
+  const rawValues = completion["values"];
+  if (!Array.isArray(rawValues)) {
+    throw new Error("Malformed MCP completion/complete result: expected values array");
+  }
+  const values = rawValues.map((entry, index) => {
+    if (typeof entry !== "string") {
+      throw new Error(`Malformed MCP completion/complete result.values[${index}]: expected string`);
+    }
+    return entry;
+  });
+  const rawTotal = completion["total"];
+  const total = typeof rawTotal === "number" && Number.isInteger(rawTotal) && rawTotal >= 0 ? rawTotal : void 0;
+  const hasMore = typeof completion["hasMore"] === "boolean" ? completion["hasMore"] : void 0;
+  return { completion: { values, total, hasMore } };
+}
 
 // src/client-capabilities.ts
 var MCPCapabilityClient = class {
@@ -1710,7 +1728,7 @@ var MCPServer = class {
     }
     const validId = msg?.id === void 0 || msg.id === null || typeof msg.id === "string" || typeof msg.id === "number";
     if (typeof msg !== "object" || msg === null || msg.jsonrpc !== "2.0" || typeof msg.method !== "string" || !validId) {
-      const id = msg && typeof msg === "object" ? msg.id ?? null : null;
+      const id = validId && msg && typeof msg === "object" ? msg.id ?? null : null;
       return this.encodeError(id ?? null, INVALID_REQUEST, "Invalid Request");
     }
     const isNotification = msg.id === void 0 || msg.id === null;
@@ -2166,10 +2184,11 @@ function checkValue(field, raw) {
   switch (field.kind) {
     case "string": {
       if (typeof raw !== "string") return { ok: false, error: `${name} must be text` };
-      if (field.minLength !== void 0 && raw.length < field.minLength) {
+      const length = [...raw].length;
+      if (field.minLength !== void 0 && length < field.minLength) {
         return { ok: false, error: `${name} needs at least ${field.minLength} characters` };
       }
-      if (field.maxLength !== void 0 && raw.length > field.maxLength) {
+      if (field.maxLength !== void 0 && length > field.maxLength) {
         return { ok: false, error: `${name} allows at most ${field.maxLength} characters` };
       }
       return { ok: true, value: raw };
@@ -2398,6 +2417,10 @@ async function listAllTools(requestPage) {
       break;
     }
     const result = response.result;
+    if (!Array.isArray(result?.tools)) {
+      if (page === 0) return null;
+      break;
+    }
     tools.push(...normalizeMCPTools(result?.tools));
     const next = result?.nextCursor;
     if (typeof next !== "string" || next.length === 0) break;
@@ -2538,6 +2561,7 @@ async function refreshToolsOnListChanged(self) {
     self._toolsCache = tools;
     self.toolCatalogRevision++;
     for (const listener of self.toolsChangedListeners) {
+      if (version !== self.toolCatalogVersion) break;
       try {
         listener(self.opts.name, [...tools]);
       } catch {
@@ -2590,6 +2614,9 @@ function buildClientHttpConnectionHost(self) {
       self._toolsCache = value;
     },
     toolsChangedListeners: self.toolsChangedListeners,
+    get toolCatalogVersion() {
+      return self.toolCatalogVersion;
+    },
     emitCapabilityChanged: (...args) => emitCapabilityChanged(self, ...args),
     emitResourceUpdated: (uri) => emitResourceUpdated(self, uri),
     emitProgress: (progress) => emitProgress(self, progress),
@@ -2714,11 +2741,59 @@ function buildClientStdioProtocolHost(self) {
 }
 
 // src/sse-reader.ts
+import { ToolError as ToolError2 } from "@wrongstack/core/types";
+
+// src/read-body.ts
 import { ToolError } from "@wrongstack/core/types";
-var SSE_READER_MAX_BUFFER = 256 * 1024;
+var MAX_MCP_HTTP_BODY_BYTES = 16 * 1024 * 1024;
+async function readBodyCapped(res, maxBytes = MAX_MCP_HTTP_BODY_BYTES) {
+  const safeCap = typeof maxBytes === "number" && Number.isFinite(maxBytes) && maxBytes >= 0 ? maxBytes : MAX_MCP_HTTP_BODY_BYTES;
+  const body = res.body;
+  if (!body || typeof body.getReader !== "function") {
+    const text = await res.text();
+    const received = Buffer.byteLength(text, "utf8");
+    if (received > safeCap) {
+      throw new ToolError({
+        message: `MCP response body exceeded ${safeCap} bytes \u2014 refusing to buffer`,
+        code: "TOOL_EXECUTION_FAILED",
+        toolName: "mcp_transport",
+        context: { maxBytes: safeCap, received }
+      });
+    }
+    return text;
+  }
+  const reader = body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (!value) continue;
+      total += value.byteLength;
+      if (total > safeCap) {
+        await reader.cancel().catch(() => void 0);
+        throw new ToolError({
+          message: `MCP response body exceeded ${safeCap} bytes \u2014 refusing to buffer`,
+          code: "TOOL_EXECUTION_FAILED",
+          toolName: "mcp_transport",
+          context: { maxBytes: safeCap, received: total }
+        });
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock?.();
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+// src/sse-reader.ts
+var SSE_READER_MAX_BUFFER = MAX_MCP_HTTP_BODY_BYTES;
 var SSE_READER_MAX_DATA_LINES = 1024;
 var SSEReader = class {
-  buffer = "";
+  pending = [];
+  pendingLength = 0;
   skipLeadingLF = false;
   dataLines = [];
   dataLength = 0;
@@ -2745,47 +2820,58 @@ var SSEReader = class {
     };
   }
   feed(chunk) {
-    const carried = this.buffer.length;
+    const carried = this.pendingLength;
     if (this.skipLeadingLF && chunk.length > 0) {
       this.skipLeadingLF = false;
       if (chunk.startsWith("\n")) chunk = chunk.slice(1);
     }
-    this.buffer += chunk;
     let start2 = 0;
-    for (let idx = 0; idx < this.buffer.length; idx++) {
-      const code = this.buffer.charCodeAt(idx);
+    for (let idx = 0; idx < chunk.length; idx++) {
+      const code = chunk.charCodeAt(idx);
       if (code !== 10 && code !== 13) continue;
-      this.processLine(this.buffer.slice(start2, idx));
+      const head = chunk.slice(start2, idx);
+      if (this.pending.length > 0) {
+        this.pending.push(head);
+        const line = this.pending.join("");
+        this.pending = [];
+        this.pendingLength = 0;
+        this.processLine(line);
+      } else {
+        this.processLine(head);
+      }
       if (code === 13) {
-        if (this.buffer.charCodeAt(idx + 1) === 10) idx++;
-        else if (idx + 1 === this.buffer.length) this.skipLeadingLF = true;
+        if (chunk.charCodeAt(idx + 1) === 10) idx++;
+        else if (idx + 1 === chunk.length) this.skipLeadingLF = true;
       }
       start2 = idx + 1;
     }
-    if (start2 > 0) this.buffer = this.buffer.slice(start2);
-    if (this.buffer.length <= SSE_READER_MAX_BUFFER) return;
-    if (start2 >= carried) {
-      throw new ToolError({
+    if (start2 < chunk.length) {
+      this.pending.push(start2 > 0 ? chunk.slice(start2) : chunk);
+      this.pendingLength += chunk.length - start2;
+    }
+    if (this.pendingLength <= SSE_READER_MAX_BUFFER) return;
+    if (start2 > 0 || carried === 0) {
+      throw new ToolError2({
         message: `SSE: chunk size ${chunk.length} exceeds max buffer ${SSE_READER_MAX_BUFFER} \u2014 refusing to accumulate`,
         code: "TOOL_EXECUTION_FAILED",
         toolName: "mcp_transport_sse_reader",
         context: { phase: "feed", chunkLength: chunk.length, maxBuffer: SSE_READER_MAX_BUFFER }
       });
     }
-    throw new ToolError({
+    throw new ToolError2({
       message: `SSE: pending line exceeds ${SSE_READER_MAX_BUFFER} bytes \u2014 upstream is not framing events`,
       code: "TOOL_EXECUTION_FAILED",
       toolName: "mcp_transport_sse_reader",
       context: {
         phase: "feed",
-        bufferLength: this.buffer.length,
+        bufferLength: this.pendingLength,
         maxBuffer: SSE_READER_MAX_BUFFER
       }
     });
   }
   processLine(line) {
     if (line.length > SSE_READER_MAX_BUFFER) {
-      throw new ToolError({
+      throw new ToolError2({
         message: `SSE: completed line exceeds ${SSE_READER_MAX_BUFFER} characters`,
         code: "TOOL_EXECUTION_FAILED",
         toolName: "mcp_transport_sse_reader"
@@ -2805,14 +2891,14 @@ var SSEReader = class {
     } else if (field === "data") {
       const nextLength = this.dataLength + value.length + (this.dataLines.length > 0 ? 1 : 0);
       if (nextLength > SSE_READER_MAX_BUFFER) {
-        throw new ToolError({
+        throw new ToolError2({
           message: `SSE: event data exceeds ${SSE_READER_MAX_BUFFER} characters`,
           code: "TOOL_EXECUTION_FAILED",
           toolName: "mcp_transport_sse_reader"
         });
       }
       if (this.dataLines.length >= SSE_READER_MAX_DATA_LINES) {
-        throw new ToolError({
+        throw new ToolError2({
           message: `SSE: exceeded ${SSE_READER_MAX_DATA_LINES} data lines per event \u2014 upstream is not sending blank-line delimiters`,
           code: "TOOL_EXECUTION_FAILED",
           toolName: "mcp_transport_sse_reader",
@@ -2838,7 +2924,10 @@ var SSEReader = class {
     this.dataLines = [];
     if (!data) return;
     if (eventName === "endpoint") {
-      for (const cb of this.endpointListeners) {
+      const listeners = this.endpointListeners;
+      for (const cb of [...listeners]) {
+        if (listeners !== this.endpointListeners) break;
+        if (!listeners.includes(cb)) continue;
         try {
           cb(data);
         } catch {
@@ -2853,7 +2942,10 @@ var SSEReader = class {
     }
   }
   dispatch(msg) {
-    for (const cb of this.listeners) {
+    const listeners = this.listeners;
+    for (const cb of [...listeners]) {
+      if (listeners !== this.listeners) break;
+      if (!listeners.includes(cb)) continue;
       try {
         cb(msg);
       } catch {
@@ -2861,7 +2953,8 @@ var SSEReader = class {
     }
   }
   reset() {
-    this.buffer = "";
+    this.pending = [];
+    this.pendingLength = 0;
     this.skipLeadingLF = false;
     this.dataLines = [];
     this.eventName = "";
@@ -2875,51 +2968,6 @@ var SSEReader = class {
 import * as https2 from "node:https";
 import { ConfigError as ConfigError2 } from "@wrongstack/core/types";
 
-// src/read-body.ts
-import { ToolError as ToolError2 } from "@wrongstack/core/types";
-var MAX_MCP_HTTP_BODY_BYTES = 16 * 1024 * 1024;
-async function readBodyCapped(res, maxBytes = MAX_MCP_HTTP_BODY_BYTES) {
-  const safeCap = typeof maxBytes === "number" && Number.isFinite(maxBytes) && maxBytes >= 0 ? maxBytes : MAX_MCP_HTTP_BODY_BYTES;
-  const body = res.body;
-  if (!body || typeof body.getReader !== "function") {
-    const text = await res.text();
-    const received = Buffer.byteLength(text, "utf8");
-    if (received > safeCap) {
-      throw new ToolError2({
-        message: `MCP response body exceeded ${safeCap} bytes \u2014 refusing to buffer`,
-        code: "TOOL_EXECUTION_FAILED",
-        toolName: "mcp_transport",
-        context: { maxBytes: safeCap, received }
-      });
-    }
-    return text;
-  }
-  const reader = body.getReader();
-  const chunks = [];
-  let total = 0;
-  try {
-    for (; ; ) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      if (!value) continue;
-      total += value.byteLength;
-      if (total > safeCap) {
-        await reader.cancel().catch(() => void 0);
-        throw new ToolError2({
-          message: `MCP response body exceeded ${safeCap} bytes \u2014 refusing to buffer`,
-          code: "TOOL_EXECUTION_FAILED",
-          toolName: "mcp_transport",
-          context: { maxBytes: safeCap, received: total }
-        });
-      }
-      chunks.push(value);
-    }
-  } finally {
-    reader.releaseLock?.();
-  }
-  return Buffer.concat(chunks).toString("utf8");
-}
-
 // src/transport-security.ts
 import * as dns2 from "node:dns/promises";
 import * as net2 from "node:net";
@@ -3083,7 +3131,7 @@ var undiciModule;
 var undiciLoad;
 async function ensureUndici() {
   if (undiciModule) return undiciModule;
-  undiciLoad ??= import("undici");
+  undiciLoad ??= import("undici/index.js");
   undiciModule = await undiciLoad;
   return undiciModule;
 }
@@ -3175,8 +3223,8 @@ var BaseHTTPTransport = class {
     this.headers = { ...opts.headers };
     this.authorizationProvider = opts.authorizationProvider;
     this.authorizationResource = canonicalMcpResource(opts.url);
-    this.timeout = typeof opts.startupTimeoutMs === "number" && Number.isFinite(opts.startupTimeoutMs) && opts.startupTimeoutMs > 0 ? opts.startupTimeoutMs : 1e4;
-    this.requestTimeout = typeof opts.requestTimeoutMs === "number" && Number.isFinite(opts.requestTimeoutMs) && opts.requestTimeoutMs > 0 ? opts.requestTimeoutMs : MCP_CONSTANTS.REQUEST_TIMEOUT_MS;
+    this.timeout = typeof opts.startupTimeoutMs === "number" && Number.isFinite(opts.startupTimeoutMs) && opts.startupTimeoutMs > 0 ? Math.min(opts.startupTimeoutMs, 2147483647) : 1e4;
+    this.requestTimeout = typeof opts.requestTimeoutMs === "number" && Number.isFinite(opts.requestTimeoutMs) && opts.requestTimeoutMs > 0 ? Math.min(opts.requestTimeoutMs, 2147483647) : MCP_CONSTANTS.REQUEST_TIMEOUT_MS;
     if (opts.tls) {
       if (opts.tls.rejectUnauthorized === false) {
         const where = urlOriginForLog(this.url);
@@ -3480,6 +3528,14 @@ function isJsonRpcMethodEnvelope(v) {
 }
 function extractJsonRpcEnvelopes(text) {
   const out = [];
+  const whole = text.trim();
+  if (whole.startsWith("{") && /[\r\n]/.test(whole)) {
+    try {
+      const parsed = JSON.parse(whole);
+      if (isJsonRpcResult(parsed) || isJsonRpcMethodEnvelope(parsed)) return [parsed];
+    } catch {
+    }
+  }
   let dataBuf = [];
   const flush = () => {
     if (dataBuf.length === 0) return;
@@ -3579,6 +3635,7 @@ var SSETransport = class extends BaseHTTPTransport {
       this.tools.splice(0, this.tools.length, ...tools);
       this.toolCatalogRevision++;
       for (const cb of this.toolsChangedListeners) {
+        if (version !== this.toolCatalogVersion) break;
         try {
           cb([...this.tools]);
         } catch {
@@ -4091,6 +4148,7 @@ var StreamableHTTPTransport = class _StreamableHTTPTransport extends BaseHTTPTra
       this.tools.splice(0, this.tools.length, ...tools);
       this.toolCatalogRevision++;
       for (const listener of this.toolsChangedListeners) {
+        if (version !== this.toolCatalogVersion) break;
         try {
           listener([...tools]);
         } catch {
@@ -4365,9 +4423,11 @@ async function connectSSE(host) {
     }
   });
   host.sseTransport.onToolsChanged((tools) => {
+    const version = host.toolCatalogVersion;
     host._tools = tools;
     host._toolsCache = tools;
     for (const cb of host.toolsChangedListeners) {
+      if (version !== host.toolCatalogVersion) break;
       try {
         cb(host.opts.name, tools);
       } catch {
@@ -4420,9 +4480,11 @@ async function connectStreamableHTTP(host) {
     }
   });
   host.httpTransport.onToolsChanged((tools) => {
+    const version = host.toolCatalogVersion;
     host._tools = tools;
     host._toolsCache = tools;
     for (const cb of host.toolsChangedListeners) {
+      if (version !== host.toolCatalogVersion) break;
       try {
         cb(host.opts.name, tools);
       } catch {
@@ -4533,7 +4595,7 @@ async function connectStdio(host) {
       capabilities: host.serverRequests.capabilities(),
       clientInfo: MCP_CONSTANTS.CLIENT_INFO
     },
-    typeof host.opts.startupTimeoutMs === "number" && Number.isFinite(host.opts.startupTimeoutMs) && host.opts.startupTimeoutMs > 0 ? host.opts.startupTimeoutMs : 1e4
+    typeof host.opts.startupTimeoutMs === "number" && Number.isFinite(host.opts.startupTimeoutMs) && host.opts.startupTimeoutMs > 0 ? Math.min(host.opts.startupTimeoutMs, 2147483647) : 1e4
   );
   if (initialize.error) {
     host.state = "failed";
@@ -4588,6 +4650,7 @@ async function notifyStdio(host, method, params) {
         const timeout = setTimeout(() => {
           stdin.removeListener?.("drain", onDrain);
           stdin.removeListener?.("error", onError);
+          stdin.removeListener?.("close", onClose);
           host._drainPending = false;
           reject(new Error(`MCP notify("${method}") drain timeout`));
         }, 500);
@@ -4595,6 +4658,7 @@ async function notifyStdio(host, method, params) {
           clearTimeout(timeout);
           stdin.removeListener?.("drain", onDrain);
           stdin.removeListener?.("error", onError);
+          stdin.removeListener?.("close", onClose);
           host._drainPending = false;
           resolve();
         };
@@ -4602,11 +4666,14 @@ async function notifyStdio(host, method, params) {
           clearTimeout(timeout);
           stdin.removeListener?.("drain", onDrain);
           stdin.removeListener?.("error", onError);
+          stdin.removeListener?.("close", onClose);
           host._drainPending = false;
           reject(err);
         };
+        const onClose = () => onError(new Error(`MCP notify("${method}") stdin closed`));
         stdin.once?.("drain", onDrain);
         stdin.once?.("error", onError);
+        stdin.once?.("close", onClose);
       });
     }
   } catch (err) {
@@ -4700,7 +4767,10 @@ function receiveStdioLine(host, line) {
 // src/client-stdio-request.ts
 function resolveRequestTimeoutMs(configuredMs, timeoutMs) {
   const defaultTimeoutMs = typeof configuredMs === "number" && Number.isFinite(configuredMs) && configuredMs > 0 ? configuredMs : MCP_CONSTANTS.REQUEST_TIMEOUT_MS;
-  return typeof timeoutMs === "number" && Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : defaultTimeoutMs;
+  return Math.min(
+    typeof timeoutMs === "number" && Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : defaultTimeoutMs,
+    2147483647
+  );
 }
 function sendStdioRequest(self, method, params, effectiveTimeoutMs, opts) {
   const signal = opts?.signal;
@@ -4994,6 +5064,31 @@ var MCPClient = class {
   async getPrompt(name, args, opts = {}) {
     return this.capabilityClient.getPrompt(name, args, opts);
   }
+  /**
+   * Liveness check (MCP `ping`): the server MUST answer promptly with an
+   * empty result. Works on every transport — a cheap connection health probe
+   * before a long call, and the natural reconnect-readiness check.
+   */
+  async ping(opts = {}) {
+    const res = await this.request("ping", {}, void 0, opts);
+    if (res.error) {
+      throw new Error(`MCP ping failed: ${res.error.message}`);
+    }
+    parseEmptyResult(res.result);
+  }
+  /**
+   * Argument autocompletion (MCP `completion/complete`, 2024-11-05). The
+   * server must advertise the `completions` capability; an unsupported
+   * server answers with a JSON-RPC error, which surfaces here as a throw.
+   */
+  async complete(ref, argument, opts = {}) {
+    validateProtocolString(argument.name, "completion argument name");
+    const res = await this.request("completion/complete", { ref, argument }, void 0, opts);
+    if (res.error) {
+      throw new Error(`MCP completion/complete failed: ${res.error.message}`);
+    }
+    return parseCompletionResult(res.result);
+  }
   async close() {
     if (this.closePromise) return this.closePromise;
     this.closePromise = this.closeInner().finally(() => {
@@ -5154,6 +5249,7 @@ function prepareResourceInsertion(serverName, requestedUri, result, policy = {})
     throw new Error("MCP resource insertion exceeds the limit of 64 content blocks");
   }
   let byteSize = 0;
+  enforceSize(byteSize, policy);
   for (const content of result.contents) {
     validateUri(content.uri, policy);
     if (content.text !== void 0) byteSize += utf8Bytes(content.text);
@@ -5497,7 +5593,7 @@ async function readConfig(path2) {
   }
   let parsed;
   try {
-    parsed = JSON.parse(raw);
+    parsed = JSON.parse(raw.replace(/^\uFEFF/, ""));
   } catch {
     throw new Error(
       `Profile config "${path2}" is not valid JSON \u2014 fix or remove it before changing MCP servers`
@@ -5841,6 +5937,7 @@ function manifestConfigHash(cfg) {
     env: sortedEntries(cfg.env),
     headers: sortedEntries(cfg.headers),
     bearerTokenEnv: cfg.bearerTokenEnv ?? null,
+    ...cfg.bearerTokenEnv ? { bearerToken: process.env[cfg.bearerTokenEnv.trim()] ?? null } : {},
     passthroughEnv: passthroughEntries(cfg.passthroughEnv)
   });
   return createHash2("sha256").update(basis).digest("hex").slice(0, 16);
@@ -6254,7 +6351,7 @@ function describeSlotTools(slot) {
     // Behaviour hints the SERVER claimed (already sanitized to the five
     // known keys by normalizeMCPTools). Surfaced for the operator only:
     // nothing in the permission path reads this field.
-    ...tool.annotations ? { annotations: tool.annotations } : {}
+    ...tool.annotations ? { annotations: structuredClone(tool.annotations) } : {}
   }));
 }
 function listServers(servers) {
@@ -6558,7 +6655,11 @@ function applySlotTools(ctx, slot, tools, client) {
           if (at >= 0) slot.activeCallers?.splice(at, 1);
           slot.operations.inFlightCalls = Math.max(0, slot.operations.inFlightCalls - 1);
           slot.lastUsed = Date.now();
-          pushBounded(slot.operations.callSamples, durationMs, MCP_OPERATION_LIMITS.LATENCY_SAMPLES);
+          pushBounded(
+            slot.operations.callSamples,
+            durationMs,
+            MCP_OPERATION_LIMITS.LATENCY_SAMPLES
+          );
           if (ok) {
             ctx.recordSuccess(slot);
             ctx.recordOperation(slot, "call", "ok", void 0, durationMs, false);
@@ -7289,8 +7390,11 @@ function detachCatalogListeners(self, client) {
 function handleChildExit(self, name, code) {
   const slot = self.servers.get(name);
   if (slot?.state !== "connected") return;
+  const generation = slot.startupGeneration;
+  const isCurrent = () => self.servers.get(name) === slot && slot.startupGeneration === generation;
   if (slot.lazy) {
     self.recordFailure(slot, "transport", "process-exit-lazy");
+    if (!isCurrent()) return;
     markLazySlotDormant(slot, self.events, `exit:${code ?? "unknown"}`, {
       onChildExit: self.onChildExit,
       onToolsChanged: self.onToolsChanged,
@@ -7301,14 +7405,18 @@ function handleChildExit(self, name, code) {
   resetDisconnectedSlotTools(slot, self.toolRegistry);
   slot.state = "disconnected";
   self.recordFailure(slot, "transport", "process-exit");
+  if (!isCurrent()) return;
   self.events.emit("mcp.server.disconnected", { name, reason: `exit:${code ?? "unknown"}` });
-  self.scheduleReconnect(slot);
+  if (isCurrent()) self.scheduleReconnect(slot);
 }
 function handleTransportDisconnect(self, name) {
   const slot = self.servers.get(name);
   if (slot?.state !== "connected") return;
+  const generation = slot.startupGeneration;
+  const isCurrent = () => self.servers.get(name) === slot && slot.startupGeneration === generation;
   if (slot.lazy) {
     self.recordFailure(slot, "transport", "http-disconnect-lazy");
+    if (!isCurrent()) return;
     markLazySlotDormant(slot, self.events, "http-disconnect", {
       onChildExit: self.onChildExit,
       onToolsChanged: self.onToolsChanged,
@@ -7319,8 +7427,9 @@ function handleTransportDisconnect(self, name) {
   resetDisconnectedSlotTools(slot, self.toolRegistry);
   slot.state = "disconnected";
   self.recordFailure(slot, "transport", "http-disconnect");
+  if (!isCurrent()) return;
   self.events.emit("mcp.server.disconnected", { name, reason: "http-disconnect" });
-  self.scheduleReconnect(slot);
+  if (isCurrent()) self.scheduleReconnect(slot);
 }
 var MAX_RECONNECT_CYCLES = MCP_CONSTANTS.RECONNECT.MAX_CYCLES;
 var BASE_RECONNECT_DELAY_MS = MCP_CONSTANTS.RECONNECT.BASE_DELAY_MS;
@@ -7793,6 +7902,8 @@ function serveStdio(server, opts = {}) {
     if (closed) return;
     closed = true;
     stdin.off("data", onData);
+    stdin.off("end", onEnd);
+    stdin.off("close", onEnd);
     if (!bufferTooLarge && buffer.trim()) {
       const line = buffer.trim();
       buffer = "";
@@ -8162,6 +8273,7 @@ var MCPRefreshingAuthorizationProvider = class {
       }
       throw err;
     }
+    if (!tokenSet.scopes?.length) tokenSet = { ...tokenSet, scopes: state.tokenSet.scopes };
     const next = normalizeStoredAuthorization({
       ...state,
       tokenSet,
@@ -8327,6 +8439,7 @@ export {
   mcpEnvPlaceholders,
   negotiateProtocolVersion,
   parseAuthorizationServerMetadata,
+  parseCompletionResult,
   parseGetPromptResult,
   parseListPromptsResult,
   parseListResourceTemplatesResult,

package/dist/protocol.d.ts

@@ -139,4 +139,28 @@ export declare function progressNotification(params: unknown): MCPProgressNotifi
  * notification has no reply.
  */
 export declare function logMessageNotification(params: unknown): MCPLogMessageNotification | undefined;
+/** Reference identifying what to autocomplete (MCP `Reference`). */
+export type MCPCompletionReference = {
+    type: 'ref/prompt';
+    name: string;
+} | {
+    type: 'ref/resource';
+    uri: string;
+};
+export interface MCPCompletionResult {
+    completion: {
+        /** Suggested completions, most relevant first. May be empty. */
+        values: string[];
+        /** Total completions the server knows about, when it reports it. */
+        total?: number | undefined;
+        /** True when more completions exist beyond `values`. */
+        hasMore?: boolean | undefined;
+    };
+}
+/**
+ * Parse a `completion/complete` result (2024-11-05 completions utility).
+ * `values` is required (may be empty); `total`/`hasMore` are validated only
+ * when present, so a malformed optional cannot masquerade as valid pagination.
+ */
+export declare function parseCompletionResult(value: unknown): MCPCompletionResult;
 //# sourceMappingURL=protocol.d.ts.map

package/dist/sse-reader.d.ts

@@ -1,5 +1,6 @@
 export declare class SSEReader {
-    private buffer;
+    private pending;
+    private pendingLength;
     private skipLeadingLF;
     private dataLines;
     private dataLength;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/mcp",
-  "version": "1.0.35",
+  "version": "1.0.37",
   "license": "MIT",
   "description": "WrongStack Model Context Protocol client and registry: stdio, SSE, and streamable HTTP transports.",
   "repository": {
@@ -25,8 +25,14 @@
     "dist",
     "!dist/**/*.map"
   ],
+  "scripts": {
+    "build": "bun ../../scripts/build-package.mjs",
+    "typecheck": "bun ../../scripts/bun-typecheck.mjs --noEmit -p tsconfig.test.json",
+    "test": "bun --bun run vitest run",
+    "clean": "bun -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\""
+  },
   "dependencies": {
-    "@wrongstack/core": "1.0.35",
+    "@wrongstack/core": "1.0.37",
     "undici": "^8.10.2"
   },
   "devDependencies": {
@@ -37,11 +43,5 @@
   },
   "publishConfig": {
     "access": "public"
-  },
-  "scripts": {
-    "build": "node ../../scripts/build-package.mjs",
-    "typecheck": "tsc --noEmit -p tsconfig.test.json",
-    "test": "vitest run",
-    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\""
   }
-}
+}

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 ECOSTACK TECHNOLOGY OÜ
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.