@yawlabs/lemonsqueezy-mcp 0.13.0 → 0.13.1

package/CHANGELOG.md

@@ -1,7 +1,19 @@
 # Changelog
 
-## [Unreleased]
-
+## [Unreleased]
+
+### Changed
+- **The minimum oam version is now actually enforced.** `oamVersion()` and `atLeast()` were defined but never called, so `OAM_MIN` was dead code and any oam on the box was spawned regardless of version — including the pre-0.9.0 releases the floor exists to exclude, where `child_process.execFile` ran its arguments through a shell, `exec` accepted `timeout` and ignored it, and `stdio: 'inherit'` behaved as `'pipe'`. This launcher shells out on its main paths, so those were reachable bugs. An oam below the floor is now refused under `LEMONSQUEEZY_MCP_RUNTIME=oam` and bypassed for Node under `auto`, in both cases saying which version it found.
+
+### Fixed
+- **The launcher no longer dies with a raw stack trace when `spawn` fails.** Node throws synchronously rather than emitting `error` for some unexecutable targets — notably a `.cmd`/`.bat` on Windows — and the `error` listener is registered *after* the `spawn` call, so it could never observe that throw. Both failure modes now route through one handler.
+- **Windows `PATH` discovery accepts `oam.exe` only**, instead of walking every `PATHEXT` entry and returning an `oam.cmd` Node cannot execute. A skipped shim is still **named** in the diagnostic, so an npm-style install no longer reports as "no oam binary was found".
+- **A failing in-process fallback no longer escapes as an unhandled rejection.** `void runInProcess()` discarded the promise, replacing the launcher's own diagnostic with a raw stack trace.
+- **Diagnostics that precede `process.exit` are written synchronously.** stderr is async for TTYs and pipes on Windows, so the exit could truncate them. They route through one helper that also handles short writes and macOS `EAGAIN` on a non-blocking piped stderr.
+- Removed a literal backspace byte (`U+0008`) from the runtime-discovery comment, which made git treat the file as binary so its diff could not be reviewed.
+- **Windows: the launcher no longer hard-kills the server on the first Ctrl-C.** There are no POSIX signals on Windows — `child.kill(sig)` ignores the name and calls `TerminateProcess`, an immediate hard kill (verified: a child with a `SIGTERM` handler never runs it and dies with `code=null`). The launcher forwarded anyway, on the stated assumption that this was a "no-op on Windows", so it aborted the graceful shutdown the console's own Ctrl-C had just started and skipped the server's `process.on("exit")` cleanup. The console already delivers the event to the whole process group, so on Windows the launcher now forwards nothing.
+- **A wedged server no longer leaves the launcher hanging.** Forwarding was gated on `child.killed`, which records only that `kill()` was *called* — never that the child is gone — so every signal after the first was swallowed and there was no escape hatch. Escalation is now armed by a timer on the first signal: one press is enough, and a child still alive after a 2s grace window is killed. Using a timer rather than counting signals also stops the ordinary supervisor sequence (`SIGINT` then `SIGTERM` milliseconds apart) from being misread as impatience.
+
 ## [0.12.0] — 2026-08-07
 
 ### Added

package/bin/lemonsqueezy-mcp.mjs

@@ -22,37 +22,37 @@
  * For an MCP host config, point straight at oam and skip this file:
  *   { "command": "oam", "args": ["run", "<abs>/dist/index.js"] }
  *
- * THE `--permission` SANDBOX (oam 0.9.0+, opt-in)
- * `LEMONSQUEEZY_MCP_SANDBOX=1` runs the server under oam's permission model:
- * network limited to api.lemonsqueezy.com, filesystem denied outright.
- *
- * LEMONSQUEEZY_SINK_URL is operator-configured, so its host is parsed out and
- * added to the grant when set rather than assumed. Child-process stays denied
- * UNLESS LEMONSQUEEZY_API_KEY_COMMAND is configured -- that feature shells out
- * to fetch the key, so the grant is tied to the feature instead of handed over
- * unconditionally.
- *
- * Opt-in, not default, because a wrong grant does not fail loudly. oam denies a
- * non-granted environment variable by making it ABSENT from process.env rather
- * than throwing, so an under-granted LEMONSQUEEZY_API_KEY reads as
- * "unauthenticated" rather than "denied". The env list is derived from what the
- * shipped bundle actually reads -- keep it in step with the bundle.
- *
- * MINIMUM OAM VERSION
- * 0.9.0. Below it `child_process.execFile` ran its arguments through a SHELL,
- * `exec` accepted `timeout` and ignored it, `spawnSync` truncated at
- * `maxBuffer` while reporting success, and `stdio: 'inherit'`/`'ignore'` both
- * behaved as `'pipe'`. This server shells out only when
- * LEMONSQUEEZY_API_KEY_COMMAND is configured, so the execFile bug was reachable
- * on exactly that path -- the command's arguments were re-split by a shell.
- * An older oam is not an error: the launcher falls back to Node and says so on
- * stderr. Pinning the floor here is what makes that fallback automatic.
- *
+ * THE `--permission` SANDBOX (oam 0.9.0+, opt-in)
+ * `LEMONSQUEEZY_MCP_SANDBOX=1` runs the server under oam's permission model:
+ * network limited to api.lemonsqueezy.com, filesystem denied outright.
+ *
+ * LEMONSQUEEZY_SINK_URL is operator-configured, so its host is parsed out and
+ * added to the grant when set rather than assumed. Child-process stays denied
+ * UNLESS LEMONSQUEEZY_API_KEY_COMMAND is configured -- that feature shells out
+ * to fetch the key, so the grant is tied to the feature instead of handed over
+ * unconditionally.
+ *
+ * Opt-in, not default, because a wrong grant does not fail loudly. oam denies a
+ * non-granted environment variable by making it ABSENT from process.env rather
+ * than throwing, so an under-granted LEMONSQUEEZY_API_KEY reads as
+ * "unauthenticated" rather than "denied". The env list is derived from what the
+ * shipped bundle actually reads -- keep it in step with the bundle.
+ *
+ * MINIMUM OAM VERSION
+ * 0.9.0. Below it `child_process.execFile` ran its arguments through a SHELL,
+ * `exec` accepted `timeout` and ignored it, `spawnSync` truncated at
+ * `maxBuffer` while reporting success, and `stdio: 'inherit'`/`'ignore'` both
+ * behaved as `'pipe'`. This server shells out only when
+ * LEMONSQUEEZY_API_KEY_COMMAND is configured, so the execFile bug was reachable
+ * on exactly that path -- the command's arguments were re-split by a shell.
+ * An older oam is not an error: the launcher falls back to Node and says so on
+ * stderr. Pinning the floor here is what makes that fallback automatic.
+ *
  * SELECTION
  *   LEMONSQUEEZY_MCP_RUNTIME=oam    require oam; fail loudly if it is missing
  *   LEMONSQUEEZY_MCP_RUNTIME=node   never use oam
  *   LEMONSQUEEZY_MCP_RUNTIME=auto   prefer oam, silently fall back (default)
- *   LEMONSQUEEZY_MCP_SANDBOX=1      run oam under --permission (oam 0.9.0+)
+ *   LEMONSQUEEZY_MCP_SANDBOX=1      run oam under --permission (oam 0.9.0+)
  *   OAM_BIN=/path/to/oam     explicit binary, checked before any discovery
  */
 
@@ -60,9 +60,9 @@ import { execFileSync, spawn } from "node:child_process";
 import { existsSync } from "node:fs";
 import { constants, homedir } from "node:os";
 import { delimiter, join } from "node:path";
-import { fileURLToPath } from "node:url";
-
-/** Oldest oam whose `child_process` matches Node. See MINIMUM OAM VERSION above. */
+import { fileURLToPath } from "node:url";
+
+/** Oldest oam whose `child_process` matches Node. See MINIMUM OAM VERSION above. */
 const OAM_MIN = [0, 9, 0];
 
 // Two forms, deliberately. `import()` on Windows REJECTS a bare `C:\...` path
@@ -88,7 +88,7 @@ function findOam() {
   //    point deliberately at a dev build.
   //
   //    Both forms are checked on Windows: the installer defaults to
-  //    %LOCALAPPDATA%oamin there, but oam's docs name ~/.oam/bin first and
+  //    %LOCALAPPDATA%\oam\bin there, but oam's docs name ~/.oam/bin first and
   //    OAM_INSTALL_DIR can pick either, so checking one silently misses a real
   //    install.
   const installed = [join(homedir(), ".oam", "bin", exe)];
@@ -101,82 +101,127 @@ function findOam() {
 
   // 3. PATH, resolved manually rather than by spawning `which`/`where`, which
   //    would cost a subprocess on every launch just to decide whether to spawn.
-  const pathExt = isWin ? (process.env.PATHEXT ?? ".EXE").split(";").filter(Boolean) : [""];
+  // Windows: `.exe` ONLY -- deliberately narrower than PATHEXT. Node refuses to
+  // run a .cmd/.bat through execFile/spawn without `shell: true` (EINVAL, and
+  // for spawn it throws SYNCHRONOUSLY rather than emitting 'error'), so walking
+  // the full PATHEXT list would hand back a path this launcher cannot execute.
+  // Discovery has to agree with execution. A skipped shim is still reported --
+  // see findOamShim.
   for (const dir of (process.env.PATH ?? "").split(delimiter)) {
     if (!dir) continue;
-    for (const ext of isWin ? pathExt : [""]) {
-      const candidate = join(dir, isWin ? `oam${ext.toLowerCase()}` : "oam");
-      if (existsSync(candidate)) return candidate;
+    const candidate = join(dir, exe);
+    if (existsSync(candidate)) return candidate;
+  }
+
+  return null;
+}
+
+/**
+ * `oam --version` -> [major, minor, patch], or null when it cannot be read.
+ * A pre-release suffix (0.9.0-rc.1) truncates to its base version.
+ */
+function oamVersion(cmd) {
+  try {
+    const out = execFileSync(cmd, ["--version"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+    });
+    const m = /(\d+)\.(\d+)\.(\d+)/.exec(out);
+    return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
+  } catch {
+    // Not executable, wrong arch, or deleted since the stat. Caller degrades.
+    return null;
+  }
+}
+
+/** True when `v` is at least `min`, comparing major/minor/patch in order. */
+function atLeast(v, min) {
+  if (!v) return false;
+  for (let i = 0; i < min.length; i++) {
+    if (v[i] > min[i]) return true;
+    if (v[i] < min[i]) return false;
+  }
+  return true;
+}
+
+/**
+ * The `--permission` grant list, or [] when the sandbox is not requested.
+ *
+ * These are oam's PROCESS-level flags: they belong before the `run` subcommand,
+ * not after it. `oam run --permission file.js` is rejected outright, which is a
+ * good failure but only because it is loud -- ordering here is load-bearing.
+ *
+ * Net grants prefix-match `host` for fetch and `host:port` for sockets.
+ * A denied environment variable is ABSENT from process.env rather than throwing,
+ * so the env list below is derived from what the bundle actually reads; trimming
+ * it produces silent misbehaviour, not a clear denial.
+ */
+function sandboxFlags() {
+  if (process.env.LEMONSQUEEZY_MCP_SANDBOX !== "1") return [];
+
+  const hosts = ["api.lemonsqueezy.com"];
+  // LEMONSQUEEZY_SINK_URL is operator-configured, so its host has to be learned, not assumed.
+  if (process.env.LEMONSQUEEZY_SINK_URL) {
+    try {
+      const { hostname } = new URL(process.env.LEMONSQUEEZY_SINK_URL);
+      if (hostname && !hosts.includes(hostname)) hosts.push(hostname);
+    } catch {
+      // Malformed URL: the feature is already broken on its own terms; adding
+      // nothing here keeps the grant honest rather than guessing a host.
     }
   }
+  const netFlag = `--allow-net=${hosts.join(",")}`;
 
+  const env = ["LEMONSQUEEZY_ALLOWED_STORE_IDS","LEMONSQUEEZY_API_KEY","LEMONSQUEEZY_API_KEY_COMMAND","LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT","LEMONSQUEEZY_DISABLE_CLASSES","LEMONSQUEEZY_LOG","LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS","LEMONSQUEEZY_RATE_LIMIT_PER_CLASS","LEMONSQUEEZY_SINK_ADMIN_TOKEN","LEMONSQUEEZY_SINK_URL","PATH"];
+
+  const flags = ["--permission", netFlag, `--allow-env=${env.join(",")}`];
+  // Tied to the feature that needs it, not granted unconditionally.
+  if (process.env.LEMONSQUEEZY_API_KEY_COMMAND) flags.push("--allow-child-process");
+  return flags;
+}
+
+/**
+ * Write a diagnostic to stderr synchronously, so a following process.exit
+ * cannot truncate it.
+ *
+ * Not a bare writeSync: that call can short-write (it returns a byte count) and
+ * on macOS it can throw EAGAIN, because Node makes a piped stderr non-blocking
+ * there rather than blocking the write. Loop over the remaining bytes, and if
+ * stderr turns out to be unusable give up quietly -- failing to print a
+ * diagnostic is not worth crashing a stdio server over.
+ */
+async function errSync(message) {
+  const { writeSync } = await import("node:fs");
+  const buf = Buffer.from(message);
+  let off = 0;
+  for (let attempts = 0; off < buf.length && attempts < 1000; attempts++) {
+    try {
+      off += writeSync(2, buf, off, buf.length - off);
+    } catch (err) {
+      if (err?.code !== "EAGAIN") return;
+      // Pipe is full and the reader has not drained yet -- retry.
+    }
+  }
+}
+
+/**
+ * An oam-named .cmd/.bat on PATH: a real install in a shape this launcher
+ * cannot spawn. Reported rather than ignored, because "no oam binary was found"
+ * reads as "install oam" -- the one thing that will not help. Windows only;
+ * there is no such shim concept on POSIX.
+ */
+function findOamShim() {
+  if (!isWin) return null;
+  for (const dir of (process.env.PATH ?? "").split(delimiter)) {
+    if (!dir) continue;
+    for (const ext of [".cmd", ".bat"]) {
+      const candidate = join(dir, `oam${ext}`);
+      if (existsSync(candidate)) return candidate;
+    }
+  }
   return null;
 }
 
-/**
- * `oam --version` -> [major, minor, patch], or null when it cannot be read.
- * A pre-release suffix (0.9.0-rc.1) truncates to its base version.
- */
-function oamVersion(cmd) {
-  try {
-    const out = execFileSync(cmd, ["--version"], {
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"],
-    });
-    const m = /(\d+)\.(\d+)\.(\d+)/.exec(out);
-    return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
-  } catch {
-    // Not executable, wrong arch, or deleted since the stat. Caller degrades.
-    return null;
-  }
-}
-
-/** True when `v` is at least `min`, comparing major/minor/patch in order. */
-function atLeast(v, min) {
-  if (!v) return false;
-  for (let i = 0; i < min.length; i++) {
-    if (v[i] > min[i]) return true;
-    if (v[i] < min[i]) return false;
-  }
-  return true;
-}
-
-/**
- * The `--permission` grant list, or [] when the sandbox is not requested.
- *
- * These are oam's PROCESS-level flags: they belong before the `run` subcommand,
- * not after it. `oam run --permission file.js` is rejected outright, which is a
- * good failure but only because it is loud -- ordering here is load-bearing.
- *
- * Net grants prefix-match `host` for fetch and `host:port` for sockets.
- * A denied environment variable is ABSENT from process.env rather than throwing,
- * so the env list below is derived from what the bundle actually reads; trimming
- * it produces silent misbehaviour, not a clear denial.
- */
-function sandboxFlags() {
-  if (process.env.LEMONSQUEEZY_MCP_SANDBOX !== "1") return [];
-
-  const hosts = ["api.lemonsqueezy.com"];
-  // LEMONSQUEEZY_SINK_URL is operator-configured, so its host has to be learned, not assumed.
-  if (process.env.LEMONSQUEEZY_SINK_URL) {
-    try {
-      const { hostname } = new URL(process.env.LEMONSQUEEZY_SINK_URL);
-      if (hostname && !hosts.includes(hostname)) hosts.push(hostname);
-    } catch {
-      // Malformed URL: the feature is already broken on its own terms; adding
-      // nothing here keeps the grant honest rather than guessing a host.
-    }
-  }
-  const netFlag = `--allow-net=${hosts.join(",")}`;
-
-  const env = ["LEMONSQUEEZY_ALLOWED_STORE_IDS","LEMONSQUEEZY_API_KEY","LEMONSQUEEZY_API_KEY_COMMAND","LEMONSQUEEZY_DESTRUCTIVE_RATE_LIMIT","LEMONSQUEEZY_DISABLE_CLASSES","LEMONSQUEEZY_LOG","LEMONSQUEEZY_MAX_REFUND_AMOUNT_CENTS","LEMONSQUEEZY_RATE_LIMIT_PER_CLASS","LEMONSQUEEZY_SINK_ADMIN_TOKEN","LEMONSQUEEZY_SINK_URL","PATH"];
-
-  const flags = ["--permission", netFlag, `--allow-env=${env.join(",")}`];
-  // Tied to the feature that needs it, not granted unconditionally.
-  if (process.env.LEMONSQUEEZY_API_KEY_COMMAND) flags.push("--allow-child-process");
-  return flags;
-}
-
 /** Run the server in THIS process. The zero-overhead fallback. */
 async function runInProcess() {
   // A server may gate its bootstrap on being the process ENTRY POINT --
@@ -199,8 +244,25 @@ if (mode === "node") {
   await runInProcess();
 } else {
   const oam = findOam();
+  // Read the version ONCE, and only when discovery found something: the gate
+  // below has to tell "too old" apart from "could not be read at all", and
+  // re-probing inside the branch would cost a second subprocess.
+  //
+  // This is the first subprocess the launcher runs -- discovery itself is
+  // stat-only. Paid on every launch that finds an oam, including the ones
+  // that go on to fall back to Node.
+  const found = oam ? oamVersion(oam) : null;
 
   if (!oam) {
+    // An oam-named .cmd/.bat on PATH is a real install in a shape this
+    // launcher cannot spawn. Naming it turns "no oam binary was found" --
+    // which reads as "install oam", the one thing that will not help --
+    // into something the user can act on.
+    const oamShim = findOamShim();
+    const shimNote = oamShim
+      ? `Found ${oamShim}, but Node cannot execute a .cmd/.bat directly.\n` +
+        "Install the native oam binary, or point OAM_BIN at one.\n"
+      : "";
     if (mode === "oam") {
       // Explicitly demanded, so this is a real misconfiguration. writeSync
       // because stderr is async for TTYs/pipes on Windows and process.exit
@@ -208,56 +270,153 @@ if (mode === "node") {
       const { writeSync } = await import("node:fs");
       writeSync(
         2,
-        "lemonsqueezy-mcp: LEMONSQUEEZY_MCP_RUNTIME=oam but no oam binary was found.\n" +
+        "lemonsqueezy-mcp: LEMONSQUEEZY_MCP_RUNTIME=oam but no runnable oam binary was found.\n" + shimNote +
           "Install from https://oamjs.org, set OAM_BIN=/path/to/oam, or use LEMONSQUEEZY_MCP_RUNTIME=node.\n",
       );
       process.exit(1);
     }
+    // auto: falling back is correct, but silence is how someone never learns
+    // their oam install is a shape this launcher skips.
+    if (oamShim) await errSync(`lemonsqueezy-mcp: ${shimNote}Using Node instead.\n`);
+    await runInProcess();
+  } else if (!atLeast(found, OAM_MIN)) {
+    const min = OAM_MIN.join(".");
+    // Two different causes reach this branch and they need different
+    // remedies. `found === null` is NOT "old": oamVersion returns null when
+    // the binary could not be run at all (not executable, wrong arch, a
+    // .cmd/.bat Node refuses, deleted between the stat and the probe) or
+    // when its --version output did not parse. Telling that user to
+    // `oam self-update` sends them after the one cause it definitely is not.
+    const detail = found
+      ? `${oam} is oam ${found.join(".")}, older than ${min}`
+      : `${oam} could not be run, or did not report a version this launcher understands`;
+    const remedy = found
+      ? "Run `oam self-update`, or use LEMONSQUEEZY_MCP_RUNTIME=node.\n"
+      : "Check that it is an executable oam binary for this platform, or use LEMONSQUEEZY_MCP_RUNTIME=node.\n";
+    if (mode === "oam") {
+      await errSync(`lemonsqueezy-mcp: LEMONSQUEEZY_MCP_RUNTIME=oam but ${detail}.\n${remedy}`);
+      process.exit(1);
+    }
+    // auto: neither cause is worth failing over -- prefer Node. Say so,
+    // because a silent downgrade is how someone keeps running an oam they
+    // meant to update, or never learns their oam is unexecutable.
+    await errSync(`lemonsqueezy-mcp: ${detail}; using Node instead.\n`);
     await runInProcess();
   } else {
     // `--` separates oam's own flags from the script's argv, so `lemonsqueezy-mcp
     // --version` and any host-supplied flags survive the hop unchanged.
-    const child = spawn(oam, [...sandboxFlags(), "run", SERVER_ENTRY, "--", ...process.argv.slice(2)], {
-      // inherit keeps the SAME fds, so MCP's newline-delimited JSON framing on
-      // stdin/stdout is untouched and the host's stdin-close still reaches the
-      // server's shutdown path.
-      stdio: "inherit",
-      env: process.env,
-      windowsHide: true,
-    });
-
-    // If oam cannot be executed at all (deleted between the stat and the spawn,
-    // wrong arch, permission), fall back rather than failing the whole server.
-    // `spawned` prevents falling back AFTER the child started, which would
-    // double-start the server on the same stdio.
-    let spawned = false;
-    child.on("spawn", () => {
-      spawned = true;
-    });
-    child.on("error", (err) => {
-      if (spawned) return;
+    // Every "oam could not be executed" outcome lands here: the synchronous
+    // throw from spawn() and the async 'error' event mean the same thing and
+    // must degrade the same way, so the handling lives in one place.
+    // errSync rather than process.stderr.write because stderr is async for
+    // TTYs and pipes on Windows and the process.exit below truncates pending
+    // writes.
+    const launchFailed = async (err) => {
       if (mode === "oam") {
-        process.stderr.write(`lemonsqueezy-mcp: failed to launch oam (${err.message})\n`);
+        await errSync(`lemonsqueezy-mcp: failed to launch oam (${err?.message ?? err})\n`);
         process.exit(1);
       }
-      void runInProcess();
-    });
+      await runInProcess();
+    };
 
-    // Forward termination so the server's own shutdown path runs in the child
-    // rather than the child being orphaned. No-op on Windows, harmless to add.
-    for (const sig of ["SIGINT", "SIGTERM"]) {
-      process.on(sig, () => {
-        if (!child.killed) child.kill(sig);
+    // ONE reporter shared by both launchFailed call sites, so the sync-throw
+    // path and the 'error'-event path cannot drift apart. Either can reject:
+    // runInProcess() is a bare import() that rejects when dist/index.js is
+    // missing, and at ESM top level an unhandled rejection is an uncaught
+    // exception -- the exact failure this handling exists to prevent.
+    const fallbackFailed = (e) => {
+      process.stderr.write(`lemonsqueezy-mcp: fallback to Node failed (${e?.message ?? e})\n`);
+      process.exitCode = 1;
+    };
+
+    let child = null;
+    try {
+      child = spawn(oam, [...sandboxFlags(), "run", SERVER_ENTRY, "--", ...process.argv.slice(2)], {
+        // inherit keeps the SAME fds, so MCP's newline-delimited JSON framing on
+        // stdin/stdout is untouched and the host's stdin-close still reaches the
+        // server's shutdown path.
+        stdio: "inherit",
+        env: process.env,
+        windowsHide: true,
       });
+    } catch (err) {
+      // spawn() THROWS for some failures instead of emitting 'error', and the
+      // 'error' listener is registered AFTER this call, so it can never observe
+      // one -- an uncaught throw here kills the launcher with a raw stack trace
+      // instead of falling back to Node.
+      await launchFailed(err).catch(fallbackFailed);
     }
 
-    child.on("exit", (code, signal) => {
-      // Mirror the child's fate: a signal death becomes 128+n so callers see a
-      // conventional shell exit status rather than a bare 0.
-      if (signal) {
-        process.exit(128 + (constants.signals[signal] ?? 15));
+    if (child) {
+
+      // If oam cannot be executed at all (deleted between the stat and the spawn,
+      // wrong arch, permission), fall back rather than failing the whole server.
+      // `spawned` prevents falling back AFTER the child started, which would
+      // double-start the server on the same stdio.
+      let spawned = false;
+      child.on("spawn", () => {
+        spawned = true;
+      });
+      child.on("error", (err) => {
+        if (spawned) return;
+        // Handle the rejection instead of discarding it: a failing in-process
+        // fallback would otherwise escape as an unhandled rejection, replacing
+        // this launcher's diagnostic with a raw stack trace.
+        launchFailed(err).catch(fallbackFailed);
+      });
+
+      // Forward termination so the server's own shutdown path runs in the child
+      // rather than the child being orphaned.
+      //
+      // Registering ANY handler for these suppresses Node's default
+      // terminate-on-signal, so the parent's exit has to be arranged explicitly.
+      // `child.killed` only records that kill() was CALLED, never that the child
+      // is gone, so gating on it swallows every signal after the first and wedges
+      // the launcher with no escape hatch.
+      //
+      // Escalation is driven by a TIMER, not by counting signals. Counting is
+      // ambiguous: a supervisor routinely sends SIGINT then SIGTERM milliseconds
+      // apart, and a terminal Ctrl-C reaches the whole process group, so reading
+      // "a second signal" as impatience hard-kills a child that is already
+      // shutting down cleanly. A timer makes the count irrelevant -- ONE press is
+      // enough, and a wedged child dies on schedule. setTimeout is monotonic, so
+      // a wall-clock step cannot mis-gate the window either.
+      //
+      // POSIX vs Windows, and why we do NOT forward on Windows.
+      // On POSIX child.kill(sig) delivers a real, catchable signal, so forwarding
+      // is what lets the child run its shutdown. On Windows there are no POSIX
+      // signals: child.kill IGNORES the name and calls TerminateProcess -- an
+      // immediate hard kill (verified: a child with a SIGTERM handler never runs
+      // it and dies with code=null, signal=SIGTERM). Forwarding there ABORTS the
+      // graceful shutdown the console's own Ctrl-C just started, skipping the
+      // child's process.on("exit") cleanup. The console has already notified the
+      // child, so on Windows the timer below is the only kill we issue.
+      const ESCALATE_AFTER_MS = 2000;
+      let escalation = null;
+      for (const sig of ["SIGINT", "SIGTERM"]) {
+        process.on(sig, () => {
+          // No try/catch: kill() on an already-exited child returns false, it does
+          // not throw. It throws only for a signal the platform does not know,
+          // which SIGINT/SIGTERM/SIGKILL never are.
+          if (!isWin) child.kill(sig);
+          if (escalation) return; // already counting down; further signals are noise
+          escalation = setTimeout(() => {
+            // Still here after its grace window. Stop waiting on it.
+            child.kill("SIGKILL");
+            process.exit(128 + (constants.signals[sig] ?? 15));
+          }, ESCALATE_AFTER_MS);
+        });
       }
-      process.exit(code ?? 0);
-    });
+
+      child.on("exit", (code, signal) => {
+        if (escalation) clearTimeout(escalation);
+        // Mirror the child's fate: a signal death becomes 128+n so callers see a
+        // conventional shell exit status rather than a bare 0.
+        if (signal) {
+          process.exit(128 + (constants.signals[signal] ?? 15));
+        }
+        process.exit(code ?? 0);
+      });
+    }
   }
 }

package/dist/index.js

@@ -23793,7 +23793,7 @@ function readAuditLogResource(uri) {
 }
 
 // src/index.ts
-var version2 = true ? "0.13.0" : createRequire(import.meta.url)("../package.json").version;
+var version2 = true ? "0.13.1" : createRequire(import.meta.url)("../package.json").version;
 var subcommand = process.argv[2];
 if (subcommand === "version" || subcommand === "--version") {
   console.log(version2);

package/package.json

@@ -1,61 +1,61 @@
-{
-  "name": "@yawlabs/lemonsqueezy-mcp",
-  "version": "0.13.0",
-  "mcpName": "io.github.YawLabs/lemonsqueezy-mcp",
-  "description": "LemonSqueezy MCP server for managing your store from AI assistants",
-  "license": "MIT",
-  "author": "YawLabs <contact@yaw.sh>",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/YawLabs/lemonsqueezy-mcp.git"
-  },
-  "keywords": [
-    "lemonsqueezy",
-    "lemon-squeezy",
-    "mcp",
-    "model-context-protocol",
-    "ai",
-    "payments",
-    "subscriptions",
-    "licensing"
-  ],
-  "type": "module",
-  "main": "dist/index.js",
-  "bin": {
-    "lemonsqueezy-mcp": "bin/lemonsqueezy-mcp.mjs"
-  },
-  "files": [
-    "bin/lemonsqueezy-mcp.mjs",
-    "dist/index.js",
-    "CHANGELOG.md"
-  ],
-  "scripts": {
-    "build": "tsc && node build.mjs",
-    "dev": "tsc --watch",
-    "start": "node dist/index.js",
-    "test": "npm run build && node --test \"dist/**/*.test.js\"",
-    "test:integration": "npm run build && node --test dist/integration/*.test.js",
-    "lint": "biome check src/",
-    "lint:fix": "biome check --write src/",
-    "check:oam": "oam check",
-    "build:binary:oam": "node scripts/build-binary.mjs --oam",
-    "gen:containerfile": "node scripts/sync-containerfile.mjs",
-    "check:containerfile": "node scripts/sync-containerfile.mjs --check",
-    "prepublishOnly": "npm run build"
-  },
-  "overrides": {
-    "hono": "^4.12.14"
-  },
-  "devDependencies": {
-    "@biomejs/biome": "^2.4.12",
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "@types/node": "^26.1.1",
-    "esbuild": "^0.28.1",
-    "postject": "^1.0.0-alpha.6",
-    "typescript": "^7.0.2",
-    "zod": "^4.3.6"
-  },
-  "engines": {
-    "node": ">=22"
-  }
-}
+{
+  "name": "@yawlabs/lemonsqueezy-mcp",
+  "version": "0.13.1",
+  "mcpName": "io.github.YawLabs/lemonsqueezy-mcp",
+  "description": "LemonSqueezy MCP server for managing your store from AI assistants",
+  "license": "MIT",
+  "author": "YawLabs <contact@yaw.sh>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/YawLabs/lemonsqueezy-mcp.git"
+  },
+  "keywords": [
+    "lemonsqueezy",
+    "lemon-squeezy",
+    "mcp",
+    "model-context-protocol",
+    "ai",
+    "payments",
+    "subscriptions",
+    "licensing"
+  ],
+  "type": "module",
+  "main": "dist/index.js",
+  "bin": {
+    "lemonsqueezy-mcp": "bin/lemonsqueezy-mcp.mjs"
+  },
+  "files": [
+    "bin/lemonsqueezy-mcp.mjs",
+    "dist/index.js",
+    "CHANGELOG.md"
+  ],
+  "scripts": {
+    "build": "tsc && node build.mjs",
+    "dev": "tsc --watch",
+    "start": "node dist/index.js",
+    "test": "npm run build && node --test-timeout=300000 --test \"dist/**/*.test.js\"",
+    "test:integration": "npm run build && node --test-timeout=300000 --test dist/integration/*.test.js",
+    "lint": "biome check src/",
+    "lint:fix": "biome check --write src/",
+    "check:oam": "oam check",
+    "build:binary:oam": "node scripts/build-binary.mjs --oam",
+    "gen:containerfile": "node scripts/sync-containerfile.mjs",
+    "check:containerfile": "node scripts/sync-containerfile.mjs --check",
+    "prepublishOnly": "npm run build"
+  },
+  "overrides": {
+    "hono": "^4.12.14"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^2.4.12",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@types/node": "^26.1.1",
+    "esbuild": "^0.28.1",
+    "postject": "^1.0.0-alpha.6",
+    "typescript": "^7.0.2",
+    "zod": "^4.3.6"
+  },
+  "engines": {
+    "node": ">=22"
+  }
+}