actual-mcp-server 0.22.17 → 0.22.18

package/README.md

@@ -835,7 +835,7 @@ The software is provided **as-is**, without warranty of any kind. The author acc
 
 ---
 
-**Version:** 0.22.17 | **Tool Count:** 83 (verified LibreChat-compatible)
+**Version:** 0.22.18 | **Tool Count:** 83 (verified LibreChat-compatible)
 
 ## Sponsor
 

package/dist/src/actualConnection.js

@@ -165,6 +165,10 @@ export async function shutdownActualForSession(sessionId) {
         logger.error(`Error shutting down Actual for session ${sessionId}:`, err);
     }
 }
+function poolSummary() {
+    const { sessions: _sessions, ...summary } = connectionPool.getStats();
+    return summary;
+}
 export function getConnectionState() {
     // When using connection pooling, consider server initialized if pool is ready
     // (even with 0 active connections, pool being initialized means server is ready to accept sessions)
@@ -173,7 +177,9 @@ export function getConnectionState() {
     return {
         initialized: effectivelyInitialized,
         initializationError,
-        connectionPool: useConnectionPool ? connectionPool.getStats() : null,
+        // Aggregate figures only. This feeds the unauthenticated /health route, so the
+        // per-session list (full session ids) is left out on purpose.
+        connectionPool: useConnectionPool ? poolSummary() : null,
         idleTimeoutMinutes: useConnectionPool ? connectionPool.getIdleTimeoutMinutes() : null,
     };
 }

package/dist/src/lib/session-owners.js

@@ -0,0 +1,41 @@
+/**
+ * Which principal created each MCP session.
+ *
+ * An MCP session id is bearer material for the Streamable HTTP transport, so a
+ * session must only be usable, listable and closable by the principal that
+ * created it. The principal is the one `resolvePrincipal` in httpServer.ts
+ * derives from the verified request (the OIDC subject, `static-bearer`, or
+ * undefined when auth is disabled), never a client-supplied value.
+ *
+ * This lives beside the transport table rather than on the connection-pool
+ * entry on purpose: a pool entry is dropped and recreated during the life of
+ * one MCP session (a budget switch onto another server, a transient upstream
+ * error), and an owner stored there would vanish with it. The transport's
+ * lifetime IS the session's lifetime, so httpServer records the owner when it
+ * registers the transport and forgets it when the pool evicts the session.
+ *
+ * Lives in src/lib/ so the session tools can import it without importing the
+ * HTTP server.
+ */
+const owners = new Map();
+export function recordSessionOwner(sessionId, principal) {
+    owners.set(sessionId, principal);
+}
+export function forgetSessionOwner(sessionId) {
+    owners.delete(sessionId);
+}
+/**
+ * True when `principal` may use `sessionId`.
+ *
+ * A session with no recorded owner is treated as owned by "no principal"
+ * (undefined). In auth-disabled and stdio modes every caller is that same
+ * undefined principal, so nothing changes there; under OIDC or a static bearer
+ * every caller has a principal, so an unrecorded session matches nobody.
+ */
+export function sessionOwnerMatches(sessionId, principal) {
+    return owners.get(sessionId) === principal;
+}
+/** Keep only the sessions `principal` owns. */
+export function filterOwnedSessions(sessions, principal) {
+    return sessions.filter((s) => sessionOwnerMatches(s.sessionId, principal));
+}

package/dist/src/server/httpServer.js

@@ -28,6 +28,7 @@ import * as fs from 'node:fs';
 // Re-exported here for backward compatibility with any callers that imported
 // `requestContext` from this module.
 import { requestContext } from '../lib/requestContext.js';
+import { recordSessionOwner, forgetSessionOwner, sessionOwnerMatches } from '../lib/session-owners.js';
 import { buildToolListEntries } from '../lib/tool-list-entry.js';
 // #438 / #452: the init-failure classifier now lives in src/lib/init-failure.ts so BOTH
 // transports can reach it (stdio could not, which was the whole of #452). Re-exported here
@@ -288,6 +289,7 @@ advertisedUrl) {
         }
         transports.delete(sessionId);
         sessionInitPromises.delete(sessionId);
+        forgetSessionOwner(sessionId);
         logger.info(`[SESSION] Transport torn down for evicted session: ${sessionId}`);
     });
     // Authentication middleware
@@ -488,6 +490,9 @@ advertisedUrl) {
                 // onsessioninitialized catch block below: we deliberately do NOT re-log here
                 // to avoid duplicate noise and any risk of leaking credentials.
                 initPromise.catch(() => { });
+                // The session belongs to the principal that initialized it. Resolved here,
+                // from this request, so the owner can never come from a later request.
+                const sessionOwner = resolvePrincipal(req);
                 const transport = new StreamableHTTPServerTransport({
                     sessionIdGenerator: () => randomUUID(),
                     enableJsonResponse: true,
@@ -501,6 +506,7 @@ advertisedUrl) {
                             // Only register the transport if the pool connection succeeded.
                             // The pool stamped lastActivity when it created the entry, so it
                             // is already the source of truth for this session's idle clock.
+                            recordSessionOwner(sid, sessionOwner);
                             transports.set(sid, transport);
                             logger.info(`[SESSION] Actual connection initialized for session: ${sid}`);
                             resolveInit?.();
@@ -642,6 +648,31 @@ advertisedUrl) {
                     return;
                 }
             }
+            // A session is usable only by the principal that created it. Another
+            // principal gets exactly the "Session not found" answer an unknown id gets,
+            // so the response does not confirm that the id exists. That includes the
+            // tools/list discovery fallback above: answering it with a 404 here while
+            // an unknown id gets the tool list would itself confirm the id is live.
+            if (!sessionOwnerMatches(sessionId, resolvePrincipal(req))) {
+                logger.warn(`[SESSION] Refused a request for session ${sessionId} from a principal that does not own it (method: ${method})`);
+                if (method === 'tools/list') {
+                    res.json({
+                        jsonrpc: '2.0',
+                        id: payload?.id ?? null,
+                        result: { tools: buildToolListEntries(toolsList, resolveToolMeta) },
+                    });
+                    return;
+                }
+                res.status(404).json({
+                    jsonrpc: '2.0',
+                    id: payload?.id ?? null,
+                    error: {
+                        code: -32001,
+                        message: 'Session not found. Please re-initialize by calling initialize without mcp-session-id header.'
+                    },
+                });
+                return;
+            }
             // Refresh the pool's idle clock for this session (single source of truth, #167).
             connectionPool.touch(sessionId);
             // Run in AsyncLocalStorage context so tools and the adapter can access
@@ -700,6 +731,14 @@ advertisedUrl) {
             res.status(400).json({ jsonrpc: '2.0', error: { code: -32000, message: 'No session id' }, id: null });
             return;
         }
+        // Same ownership rule as the POST route, checked before the idle clock is
+        // touched so another principal cannot keep a session alive either. A refusal
+        // reads like an unknown session.
+        if (transports.has(sessionId) && !sessionOwnerMatches(sessionId, resolvePrincipal(req))) {
+            logger.warn(`[SESSION] Refused a GET for session ${sessionId} from a principal that does not own it`);
+            res.status(400).json({ jsonrpc: '2.0', error: { code: -32000, message: 'Transport not ready' }, id: null });
+            return;
+        }
         connectionPool.touch(sessionId); // Refresh the pool's idle clock (#167)
         const transport = transports.get(sessionId);
         if (!transport) {
@@ -760,6 +799,9 @@ advertisedUrl) {
     });
     app.get('/mcp-info', (_req, res) => { res.json(mcpInfo()); });
     app.get('/mcp-info/http', (_req, res) => { res.json(mcpInfo()); });
+    // /health is unauthenticated, so it reports counts only. Session ids are bearer
+    // material for the transport and must never appear here; getConnectionState
+    // returns the pool's aggregate figures without the per-session list.
     app.get('/health', (_req, res) => {
         const state = getConnectionState();
         const poolStats = state.connectionPool || null;

package/dist/src/tools/session_close.js

@@ -2,16 +2,25 @@ import { z } from 'zod';
 import { connectionPool } from '../lib/ActualConnectionPool.js';
 import { shutdownActualForSession } from '../actualConnection.js';
 import { clearSessionBudgetState } from '../lib/actual-adapter.js';
+import { requestContext } from '../lib/requestContext.js';
+import { filterOwnedSessions } from '../lib/session-owners.js';
 const InputSchema = z.object({
-    sessionId: z.string().optional().describe('Session ID to close (partial match). If not provided, closes the oldest idle session.'),
+    sessionId: z.string().optional().describe('Session ID to close (partial match among your own sessions). If not provided, closes your oldest idle session.'),
 });
 const tool = {
     name: 'actual_session_close',
-    description: 'Close an idle MCP session to free up connection slots. Useful when you get "Max concurrent sessions reached" errors. Only closes sessions other than the current one.',
+    description: 'Close one of your idle MCP sessions to free up connection slots. Useful when you get "Max concurrent sessions reached" errors. Only closes sessions you opened, other than the current one.',
     inputSchema: InputSchema,
     call: async (args, _meta) => {
         const input = InputSchema.parse(args || {});
         const stats = connectionPool.getStats();
+        // Get the current session and principal from the request context: the
+        // session to protect from closing itself, and the owner to scope by.
+        const context = requestContext.getStore();
+        const currentSessionId = context?.sessionId;
+        // Only the caller's own sessions are candidates, and only their ids appear in
+        // any reply. Partial matching stays, because it runs over this list alone.
+        const ownSessions = filterOwnedSessions(stats.sessions, context?.principal);
         if (stats.totalSessions === 0) {
             return {
                 success: false,
@@ -20,20 +29,16 @@ const tool = {
                 maxConcurrent: stats.maxConcurrent,
             };
         }
-        // Get current session ID from request context to prevent closing own session
-        const { requestContext } = await import('../server/httpServer.js');
-        const context = requestContext.getStore();
-        const currentSessionId = context?.sessionId;
         // Find session to close
         let targetSessionId = null;
         if (input.sessionId) {
             // Find session by partial match
-            const matchingSessions = stats.sessions.filter(s => s.sessionId.toLowerCase().includes(input.sessionId.toLowerCase()));
+            const matchingSessions = ownSessions.filter(s => s.sessionId.toLowerCase().includes(input.sessionId.toLowerCase()));
             if (matchingSessions.length === 0) {
                 return {
                     success: false,
                     message: `No session found matching "${input.sessionId}"`,
-                    availableSessions: stats.sessions.map(s => s.sessionId),
+                    availableSessions: ownSessions.map(s => s.sessionId),
                 };
             }
             if (matchingSessions.length > 1) {
@@ -47,7 +52,7 @@ const tool = {
         }
         else {
             // Close the oldest idle session (not current session)
-            const sortedSessions = [...stats.sessions]
+            const sortedSessions = [...ownSessions]
                 .filter(s => !currentSessionId || !s.sessionId.includes(currentSessionId))
                 .sort((a, b) => b.idleMinutes - a.idleMinutes);
             if (sortedSessions.length === 0) {
@@ -76,7 +81,7 @@ const tool = {
                 return {
                     success: false,
                     message: `Session ${targetSessionId} not found in connection pool`,
-                    availableSessions: stats.sessions.map(s => s.sessionId),
+                    availableSessions: ownSessions.map(s => s.sessionId),
                 };
             }
             await shutdownActualForSession(targetSessionId);

package/dist/src/tools/session_list.js

@@ -1,18 +1,23 @@
 import { z } from 'zod';
 import { connectionPool } from '../lib/ActualConnectionPool.js';
+import { requestContext } from '../lib/requestContext.js';
+import { filterOwnedSessions } from '../lib/session-owners.js';
 const InputSchema = z.object({});
 const tool = {
     name: 'actual_session_list',
-    description: 'List all active MCP sessions with their activity status. Useful for diagnosing connection issues or seeing which sessions can be closed.',
+    description: 'List your active MCP sessions with their activity status. Useful for diagnosing connection issues or seeing which sessions can be closed. The pool totals cover every session; the list shows only sessions you opened.',
     inputSchema: InputSchema,
     call: async (_args) => {
         const stats = connectionPool.getStats();
+        // Session ids are bearer material: list only the caller's own sessions. The
+        // totals stay pool-wide because they explain a "max concurrent sessions" refusal.
+        const own = filterOwnedSessions(stats.sessions, requestContext.getStore()?.principal);
         return {
             totalSessions: stats.totalSessions,
             activeSessions: stats.activeSessions,
             maxConcurrent: stats.maxConcurrent,
             availableSlots: stats.maxConcurrent - stats.activeSessions,
-            sessions: stats.sessions.map(s => ({
+            sessions: own.map(s => ({
                 sessionId: s.sessionId,
                 lastActivity: s.lastActivity,
                 idleMinutes: s.idleMinutes,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "actual-mcp-server",
   "displayName": "Actual MCP Server",
-  "version": "0.22.17",
+  "version": "0.22.18",
   "engines": {
     "node": ">=22.0.0",
     "npm": ">=10.0.0"
@@ -30,7 +30,7 @@
     "verify-tools": "npm run build && node scripts/verify-tools.js",
     "check:coverage": "node scripts/list-actual-api-methods.mjs",
     "direct-sync": "node scripts/direct-sync/bank-sync-direct.mjs",
-    "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/transactions_aggregate.test.js && node tests/unit/account_flow_summary.test.js && node tests/unit/recurring_expenses_summary.test.js && node tests/unit/generated_tools.smoke.test.js &&node tests/unit/schema_validation.test.js && node tests/unit/schema_json_openai_compat.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/e2e_spec_collection.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/new_tool_completeness.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/workflow_release_guards.test.js && node tests/unit/report_train_failure.test.js && node tests/unit/unit_chain_membership.test.js && node tests/unit/api_surface_drift.test.js && node tests/unit/write_effect_audit_staleness.test.js && node tests/unit/write_effect_audit_membership.test.js && node tests/unit/tool_annotations.test.js && node tests/unit/tool_id_schema_drift.test.js && node tests/unit/filter_id_resolution.test.js && node tests/unit/filter_id_tool_wiring.test.js && node tests/unit/api_coverage_baseline.test.js && node tests/unit/train_preflight.test.js && node tests/unit/verify_published_artifacts.test.js && node tests/unit/report_train_stale.test.js && node tests/unit/stdio_framing_check.test.js && node tests/unit/server_info.test.js && node tests/unit/transfers_create.test.js && node tests/unit/bot_target_branch.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/adapter_set_budget_batch.test.js && node tests/unit/budget_updates_batch.test.js && node tests/unit/rules_create.test.js && node tests/unit/adapter_rule_reference_guard.test.js && node tests/unit/rules_create_batch.test.js && node tests/unit/budgets_hold_for_next_month.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/httpServer_init_failure_report.test.js && node tests/unit/stdio_init_failure_report.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/accounts_delete.test.js && node tests/unit/update_tools_not_found.test.js && node tests/unit/accounts_close.test.js && node tests/unit/accounts_reopen.test.js && node tests/unit/payees_delete.test.js && node tests/unit/payees_merge.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/oidc_resource_identifier.test.js && node tests/unit/httpServer_oidc_resource_metadata.test.js && node tests/unit/oidc_error_cause.test.js && node tests/unit/httpServer_oidc_error_body.test.js && node tests/unit/oidc_token_source.test.js && node tests/unit/config_oidc_assertion_refines.test.js && node tests/unit/httpServer_oidc_assertion_mode.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpServer_batch_cap.test.js && node tests/unit/dotenv_stdout_quiet.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/adapter_drain_listing_cache.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_selection_precondition.test.js && node tests/unit/budget_load_abandonment.test.js && node tests/unit/budget_loader_postcondition.test.js && node tests/unit/budget_loader_import_allowlist.test.js && node tests/unit/budget_import_tracking.test.js && node tests/unit/pool_shutdown_under_lock.test.js && node tests/unit/api_lock_affinity.test.js && node tests/unit/commit_message_closing_keyword.test.js && node tests/unit/write_queue_stranding.test.js && node tests/unit/write_queue_stranded_bound.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/transactions_update_splits.test.js && node tests/unit/transactions_update_split_convert.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/transactions_update_batch.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/stdio_budget_switch.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js && node tests/unit/adapter_op_timeout.test.js && node tests/unit/adapter_write_queue_wakeup.test.js && node tests/unit/ci_workflow_guards.test.js && node tests/unit/node_version_guard.test.js && node tests/unit/node_version_drift.test.js && node tests/unit/playwright_version_drift.test.js && node tests/unit/observability_smoke.test.js && node tests/unit/residue_pattern.test.js && node tests/unit/dual_transport_gate.test.js && node tests/unit/manual_assertions_use_helper.test.js && node tests/unit/server_version_guard.test.js && node tests/unit/server_version_probe_outside_op_timeout.test.js && node tests/unit/payee_rules_reference_filter.test.js && node tests/unit/oidc_metadata_discovery.test.js && node tests/unit/httpServer_oauth_metadata_route.test.js && node tests/unit/httpServer_mcp_info_route.test.js && node tests/unit/residue_sweep_balance_account.test.js && node tests/unit/tool_factory.test.js && node tests/unit/budget_registry_parse.test.js && node tests/unit/preferences_get.test.js && node tests/unit/budgets_export.test.js && node tests/unit/budgets_import.test.js && node tests/unit/budgets_import_syncid.test.js && node tests/unit/budget_acl_dynamic.test.js && node tests/unit/budget_acl_identity_map.test.js && node tests/unit/budget_acl_userinfo.test.js && node tests/unit/acl_e2e_fixture_contract.test.js && node tests/unit/budget_acl_middleware.test.js && node tests/unit/rules_stage.test.js && node tests/unit/oidc_scope_list.test.js && node tests/unit/get_context.test.js && node tests/unit/contributor_docs.test.js && node tests/unit/toolsets.test.js && node tests/unit/toolsets_entrypoint.test.js && node tests/unit/tools_list_size_budget.test.js && node tests/unit/rules_update_schedules_schema.test.js",
+    "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/transactions_aggregate.test.js && node tests/unit/account_flow_summary.test.js && node tests/unit/recurring_expenses_summary.test.js && node tests/unit/generated_tools.smoke.test.js &&node tests/unit/schema_validation.test.js && node tests/unit/schema_json_openai_compat.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/e2e_spec_collection.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/new_tool_completeness.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/workflow_release_guards.test.js && node tests/unit/report_train_failure.test.js && node tests/unit/unit_chain_membership.test.js && node tests/unit/api_surface_drift.test.js && node tests/unit/write_effect_audit_staleness.test.js && node tests/unit/write_effect_audit_membership.test.js && node tests/unit/tool_annotations.test.js && node tests/unit/tool_id_schema_drift.test.js && node tests/unit/filter_id_resolution.test.js && node tests/unit/filter_id_tool_wiring.test.js && node tests/unit/api_coverage_baseline.test.js && node tests/unit/train_preflight.test.js && node tests/unit/verify_published_artifacts.test.js && node tests/unit/report_train_stale.test.js && node tests/unit/stdio_framing_check.test.js && node tests/unit/server_info.test.js && node tests/unit/transfers_create.test.js && node tests/unit/bot_target_branch.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/adapter_set_budget_batch.test.js && node tests/unit/budget_updates_batch.test.js && node tests/unit/rules_create.test.js && node tests/unit/adapter_rule_reference_guard.test.js && node tests/unit/rules_create_batch.test.js && node tests/unit/budgets_hold_for_next_month.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/httpServer_init_failure_report.test.js && node tests/unit/stdio_init_failure_report.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/accounts_delete.test.js && node tests/unit/update_tools_not_found.test.js && node tests/unit/accounts_close.test.js && node tests/unit/accounts_reopen.test.js && node tests/unit/payees_delete.test.js && node tests/unit/payees_merge.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/session_ownership.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/oidc_resource_identifier.test.js && node tests/unit/httpServer_oidc_resource_metadata.test.js && node tests/unit/oidc_error_cause.test.js && node tests/unit/httpServer_oidc_error_body.test.js && node tests/unit/oidc_token_source.test.js && node tests/unit/config_oidc_assertion_refines.test.js && node tests/unit/httpServer_oidc_assertion_mode.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpServer_batch_cap.test.js && node tests/unit/dotenv_stdout_quiet.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/adapter_drain_listing_cache.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_selection_precondition.test.js && node tests/unit/budget_load_abandonment.test.js && node tests/unit/budget_loader_postcondition.test.js && node tests/unit/budget_loader_import_allowlist.test.js && node tests/unit/budget_import_tracking.test.js && node tests/unit/pool_shutdown_under_lock.test.js && node tests/unit/api_lock_affinity.test.js && node tests/unit/commit_message_closing_keyword.test.js && node tests/unit/write_queue_stranding.test.js && node tests/unit/write_queue_stranded_bound.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/transactions_update_splits.test.js && node tests/unit/transactions_update_split_convert.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/transactions_update_batch.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/stdio_budget_switch.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js && node tests/unit/adapter_op_timeout.test.js && node tests/unit/adapter_write_queue_wakeup.test.js && node tests/unit/ci_workflow_guards.test.js && node tests/unit/node_version_guard.test.js && node tests/unit/node_version_drift.test.js && node tests/unit/playwright_version_drift.test.js && node tests/unit/observability_smoke.test.js && node tests/unit/residue_pattern.test.js && node tests/unit/dual_transport_gate.test.js && node tests/unit/manual_assertions_use_helper.test.js && node tests/unit/server_version_guard.test.js && node tests/unit/server_version_probe_outside_op_timeout.test.js && node tests/unit/payee_rules_reference_filter.test.js && node tests/unit/oidc_metadata_discovery.test.js && node tests/unit/httpServer_oauth_metadata_route.test.js && node tests/unit/httpServer_mcp_info_route.test.js && node tests/unit/residue_sweep_balance_account.test.js && node tests/unit/tool_factory.test.js && node tests/unit/budget_registry_parse.test.js && node tests/unit/preferences_get.test.js && node tests/unit/budgets_export.test.js && node tests/unit/budgets_import.test.js && node tests/unit/budgets_import_syncid.test.js && node tests/unit/budget_acl_dynamic.test.js && node tests/unit/budget_acl_identity_map.test.js && node tests/unit/budget_acl_userinfo.test.js && node tests/unit/acl_e2e_fixture_contract.test.js && node tests/unit/budget_acl_middleware.test.js && node tests/unit/rules_stage.test.js && node tests/unit/oidc_scope_list.test.js && node tests/unit/get_context.test.js && node tests/unit/contributor_docs.test.js && node tests/unit/toolsets.test.js && node tests/unit/toolsets_entrypoint.test.js && node tests/unit/tools_list_size_budget.test.js && node tests/unit/rules_update_schedules_schema.test.js",
     "test:adapter": "npm run build && node dist/src/tests_adapter_runner.js",
     "test:e2e": "npx playwright test",
     "test:e2e:docker": "./tests/e2e/run-docker-e2e.sh",