actual-mcp-server 0.26.0 → 0.27.0

package/README.md

@@ -169,4 +169,4 @@ MIT, see [LICENSE](LICENSE). Built on [Actual Budget](https://actualbudget.org/)
 
 ---
 
-**Version:** 0.26.0 | **Tool Count:** 85 (verified LibreChat-compatible)
+**Version:** 0.27.0 | **Tool Count:** 85 (verified LibreChat-compatible)

package/dist/src/actualToolsManager.js

@@ -195,6 +195,10 @@ class ActualToolsManager {
         const { toolsets, tools, readOnly } = this.requirePolicy().settings;
         return { toolsets: [...toolsets], tools: [...tools], readOnly };
     }
+    /** How many tools exist, published or not, for the sys_startup record (#623). */
+    getRegisteredToolCount() {
+        return this.tools.size;
+    }
     getToolNames() {
         return Array.from(this.tools.keys());
     }

package/dist/src/config.js

@@ -89,6 +89,10 @@ export const configSchema = z.object({
     // password is set (e.g. an isolated Docker network where the hop is trusted).
     // Off by default so a plaintext upstream + encryption password is refused.
     ALLOW_INSECURE_UPSTREAM: z.string().optional().transform(val => val === 'true'),
+    // #620: upstream @actual-app/api logs at its own info/debug level (sync chatter, and on every
+    // import or bank sync a dump of each reconciled transaction) unless init is told otherwise.
+    // Off by default; `=== 'true'` fails safe, since turning it on is what carries the risk.
+    ACTUAL_API_VERBOSE: z.string().optional().transform(val => val === 'true'),
     MCP_BRIDGE_DATA_DIR: z.string().default('./actual-data'),
     // #332: where actual_budgets_export writes budget zips. A budget export is
     // megabytes of binary, so the tool returns a PATH plus metadata rather than

package/dist/src/index.js

@@ -5,12 +5,16 @@
 // guard cannot live in bin/ alone. It is a side-effect import: the module's top-level
 // `enforceNodeVersion()` fires here, exactly once.
 import './lib/node-version-guard.js';
+// #622: MUST be the second import. Registers the unhandledRejection and uncaughtException
+// handlers before any other module evaluates. They write gated records only (no reason,
+// message or stack) and get the logger later through attachProcessLogger below.
+import { attachProcessLogger } from './lib/processHandlersInstall.js';
 import { getMcpServerVersion } from './lib/mcp-version.js';
 import path from 'node:path';
 import { z } from 'zod';
-import { isKnownBenignRejection } from './lib/rejection-allowlist.js';
 import { buildServerInstructions } from './lib/serverInstructions.js';
 import { format } from 'node:util';
+import { writeSync } from 'node:fs';
 /*
  * #277 / #541: this module's version comes from `getMcpServerVersion()` (src/lib/mcp-version.ts),
  * which `--version`, `--help`, the startup banner, the MCP initialize `serverInfo.version` and
@@ -22,54 +26,6 @@ import { format } from 'node:util';
  * ignored `VERSION`, so a Docker image built as `X-dev-abc` printed plain `X` from
  * `--version` while clients saw `X-dev-abc`. One reader means one string.
  */
-// Add global error handlers
-process.on('unhandledRejection', (reason, promise) => {
-    console.error('=== UNHANDLED REJECTION ===');
-    console.error('Promise:', promise);
-    console.error('Reason:', reason);
-    if (reason instanceof Error) {
-        console.error('Stack:', reason.stack);
-    }
-    console.error('===========================');
-    // #275 backstop. The guard above catches both entry points, but a consumer that
-    // imports this package as a library reaches neither. Import attributes are the one
-    // construct here that fails on an under-floor Node, and it fails asynchronously,
-    // so name the real cause rather than letting the reader chase a packaging bug.
-    if (reason?.code === 'ERR_IMPORT_ASSERTION_TYPE_MISSING') {
-        console.error(`⚠️  This almost certainly means Node ${process.version} is too old.`);
-        console.error('⚠️  actual-mcp-server requires the Node version in package.json "engines".');
-        console.error('⚠️  Import attributes (`with { type: "json" }`) need Node 22 or newer.');
-    }
-    if (isKnownBenignRejection(reason)) {
-        console.error('⚠️  Known Actual API domain error escaped to unhandledRejection:');
-        console.error('⚠️  ' + String(reason));
-        console.error('⚠️  Server will continue running. The caller received an error response.');
-        return;
-    }
-    process.exit(1);
-});
-process.on('uncaughtException', (error) => {
-    const errMsg = String(error?.message || error);
-    const errType = error?.type;
-    // Bank sync errors from GoCardless/SimpleFIN can surface as uncaughtException
-    // from within the @actual-app/api SDK when the provider API returns an error
-    // asynchronously (e.g. RATE_LIMIT_EXCEEDED from GoCardless/Nordigen).
-    // These are non-fatal — the server should survive and continue serving requests.
-    if (errType === 'BankSyncError' ||
-        errMsg.includes('BankSyncError') ||
-        errMsg.includes('NORDIGEN_ERROR') ||
-        errMsg.includes('RATE_LIMIT_EXCEEDED') ||
-        errMsg.includes('Rate limit exceeded') ||
-        errMsg.includes('Failed syncing account') ||
-        errMsg.includes('GoCardless') ||
-        errMsg.includes('SimpleFIN')) {
-        console.error('⚠️  [BANK SYNC] Non-fatal bank sync error surfaced as uncaughtException (server continues):');
-        console.error('⚠️  ' + errMsg);
-        return;
-    }
-    console.error('Uncaught Exception:', error);
-    process.exit(1);
-});
 // Minimal early help handling before any side-effectful modules (prevents dotenv from running on --help)
 const argsEarly = process.argv.slice(2);
 // Set MCP_STDIO_MODE before the async IIFE so it is in place when src/logger.ts is first
@@ -200,6 +156,9 @@ Docs & source: https://github.com/agigante80/actual-mcp-server`);
         import('./actualToolsManager.js'),
     ]);
     const logger = loggerModule.default;
+    // #622: the process handlers log survivable events through the logger from here on.
+    const { createModuleLogger } = await import('./lib/loggerFactory.js');
+    attachProcessLogger(createModuleLogger('PROCESS'));
     const { getLocalIp } = utilsModule;
     const actualToolsManager = actualToolsManagerModule.default;
     // #541: the build-time VERSION, or the root package version plus a dev suffix on a
@@ -213,7 +172,7 @@ Docs & source: https://github.com/agigante80/actual-mcp-server`);
     const useStdio = args.includes('--stdio');
     const useTestActualConnection = args.includes('--test-actual-connection');
     const useTestMcpClient = args.includes('--test-mcp-client');
-    const SERVER_DESCRIPTION = 'Bridge MCP server exposing Actual finance API to LibreChat.';
+    const SERVER_DESCRIPTION = 'Actual Budget over the Model Context Protocol';
     async function main() {
         // Mutual exclusion — stdio and http are incompatible transports
         if (useHttp && useStdio) {
@@ -300,6 +259,8 @@ Docs & source: https://github.com/agigante80/actual-mcp-server`);
         // the configured posture is safe. On a non-loopback bind with no auth and no
         // explicit opt-out this refuses startup (exit 1) rather than silently serving
         // financial data open on the LAN. stdio mode never reaches this check.
+        // #623: kept for the sys_startup record; 'n/a' on stdio, which has no posture.
+        let posture = 'n/a';
         if (useHttp || useTestMcpClient) {
             const oidcEnabled = process.env.AUTH_PROVIDER === 'oidc';
             const decision = enforceHttpAuthPosture({
@@ -317,6 +278,7 @@ Docs & source: https://github.com/agigante80/actual-mcp-server`);
             // if process.exit were ever non-terminal, so we never bind on a refuse.
             if (decision === 'refuse')
                 return;
+            posture = decision;
         }
         // If requested, run the MCP client-side tests now that all variables are ready
         if (useTestMcpClient) {
@@ -354,29 +316,65 @@ Docs & source: https://github.com/agigante80/actual-mcp-server`);
                 process.exit(1);
             }
         }
-        // Startup banner — skip in stdio mode (stdout writes corrupt JSON-RPC framing)
-        if (!useStdio) {
-            logger.info('---------');
-            logger.info('🟡 MCP SERVER INFO');
-            logger.info(`• Server Description:   ${SERVER_DESCRIPTION}`);
-            logger.info(`• OAuth Required:       false`);
-            logger.info(`• Capabilities:         ${Object.keys(capabilities).join(', ')}`);
-            logger.info(`• Tools:                ${implementedTools.join(', ') || 'none'}`);
-            logger.info(`• Server Instructions:  ${serverInstructionsText}`);
-            logger.info(`• MCP endpoint (advertised): ${advertisedUrl}`);
-            logger.info('---------');
-        }
+        // #623: the one structured startup record, logged only once the transport is really up
+        // (never on a posture refusal, a port clash or --test-mcp-client). It replaces the old
+        // banner, which printed every tool name and the instructions text. Failure isolated: a
+        // throw here logs one warn line with the error name and never stops a started server.
+        const emitStartupRecord = async (transport) => {
+            try {
+                const [{ buildStartupRecord }, { resolveLogConfig }, { default: config }, { connectionPool }, { getBudgetRegistrySummary }, { existsSync }] = await Promise.all([
+                    import('./lib/startupRecord.js'),
+                    import('./logger.js'),
+                    import('./config.js'),
+                    import('./lib/ActualConnectionPool.js'),
+                    import('./lib/actual-adapter.js'),
+                    import('node:fs'),
+                ]);
+                const policy = actualToolsManager.getToolPolicy();
+                const record = buildStartupRecord({
+                    env: process.env,
+                    logConfig: resolveLogConfig(process.env),
+                    budgets: getBudgetRegistrySummary(),
+                    tools: {
+                        published: actualToolsManager.getPublishedToolNames().length,
+                        registered: actualToolsManager.getRegisteredToolCount(),
+                        policy: { toolsets: policy.toolsets, readOnly: policy.readOnly },
+                    },
+                    posture,
+                    actualApiVerbose: config.ACTUAL_API_VERBOSE,
+                    // From the pool, not config: an empty config value parses to NaN (#623 gate).
+                    limits: {
+                        opTimeoutMs: config.ACTUAL_OP_TIMEOUT_MS,
+                        maxSessions: connectionPool.getStats().maxConcurrent,
+                        idleTimeoutMs: connectionPool.getIdleTimeoutMinutes() * 60000,
+                    },
+                    runtime: {
+                        container: existsSync('/.dockerenv') || !!process.env.container,
+                        timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
+                        utcOffsetMinutes: -new Date().getTimezoneOffset(),
+                    },
+                    transport,
+                });
+                logger.info('sys_startup', record);
+            }
+            catch (err) {
+                logger.warn('sys_startup record failed', { error: err instanceof Error ? err.name : 'unknown' });
+            }
+        };
         if (useHttp) {
-            logger.info('Mode: HTTP');
+            // The listen callback is synchronous; the record is fire-and-forget from there.
             await startHttpServer(mcp, PORT, HTTP_PATH, capabilities, implementedTools, SERVER_DESCRIPTION, serverInstructionsText, toolSchemas, version, 
             // bind host (ensure server accepts connections on that interface)
             bindHost, 
             // advertised URL shown to clients
-            advertisedUrl);
+            advertisedUrl, (listener) => {
+                void emitStartupRecord({ kind: 'http', bindHost, path: HTTP_PATH, advertisedUrl, listener });
+            });
         }
         else if (useStdio) {
             logger.debug('Mode: stdio');
             await startStdioServer(mcp, capabilities, implementedTools, SERVER_DESCRIPTION, serverInstructionsText, toolSchemas, version);
+            await emitStartupRecord({ kind: 'stdio' });
         }
         else {
             logger.error('❌ Please specify a transport mode: --http or --stdio');
@@ -390,4 +388,12 @@ Docs & source: https://github.com/agigante80/actual-mcp-server`);
         logger.error(`Failed to start Actual MCP bridge: ${err?.message || String(err)}`);
         process.exit(1);
     });
-})();
+})().catch((err) => {
+    // #622: the prelude above (dotenv, the dynamic imports, the logger) runs before main(), so
+    // its failures never reach main().catch. Without this catch they escape as an
+    // unhandledRejection, whose gated record drops the message: a missing package or a broken
+    // build would name no module. Same residual as main().catch: startup text only. The logger
+    // may not exist yet, so this writes synchronously to stderr, never stdout.
+    writeSync(2, `Failed to start Actual MCP bridge: ${err?.message || String(err)}\n`);
+    process.exit(1);
+});

package/dist/src/lib/actual-adapter.js

@@ -19,7 +19,7 @@ import { findMatchingRule } from './rule-matching.js';
 import logger from '../logger.js';
 import { checkServerVersionOnce } from './server-version-guard.js';
 import config from '../config.js';
-import { parseBudgetRegistry } from './budget-registry.js';
+import { formatBudgetRegistrySummary, logSafeOrigin, parseBudgetRegistry, summarizeBudgetRegistry } from './budget-registry.js';
 import { getPreferredBudgetSyncId, setPreferredBudgetSyncId, pickAllowedPreferredBudget } from './budget-preference-store.js';
 import { requestContext } from './requestContext.js';
 import { connectionPool } from './ActualConnectionPool.js';
@@ -38,8 +38,12 @@ const budgetRegistry = parseBudgetRegistry(process.env, {
     encryptionPassword: config.ACTUAL_BUDGET_PASSWORD,
 });
 setLoginsSpanServers(new Set([...budgetRegistry.values()].map((b) => JSON.stringify([b.serverUrl, b.password || '']))).size > 1);
-logger.info(`[ADAPTER] Budget registry: ${budgetRegistry.size} budget(s) — ` +
-    [...budgetRegistry.values()].map(b => `"${b.name}" (${b.serverUrl})`).join(', '));
+// #621: counts and schemes only; budget names and server hosts stay out of the startup log.
+logger.info(`[ADAPTER] ${formatBudgetRegistrySummary(budgetRegistry)}`);
+/** #623: the registry's counts and schemes for the startup record. Reads config only, never Actual. */
+export function getBudgetRegistrySummary() {
+    return summarizeBudgetRegistry(budgetRegistry);
+}
 /**
  * Per-session active budget. Map from sessionId to lowercased budget key
  * (matches the keys in budgetRegistry).
@@ -276,7 +280,7 @@ function loginOf(budget) {
 async function loadBudgetOnItsServer(budget) {
     const login = loginOf(budget);
     if (!isApiLoggedInTo(login)) {
-        logger.info(`[ADAPTER] logging the api in to ${budget.serverUrl} before loading "${budget.name}"`);
+        logger.info(`[ADAPTER] logging the api in to ${logSafeOrigin(budget.serverUrl)} before loading "${budget.name}"`);
         await withAuthRetry(() => initApiLoggedIn(config.MCP_BRIDGE_DATA_DIR, login, 'init'));
     }
     await loadBudgetTracked(budget.syncId, budget.encryptionPassword);
@@ -828,7 +832,7 @@ async function initActualApiForOperation() {
     try {
         const budget = getActiveBudgetConfig();
         const DATA_DIR = config.MCP_BRIDGE_DATA_DIR;
-        logger.debug(`[ADAPTER] Initializing Actual API for operation (budget: "${budget.name}", server: ${budget.serverUrl})`);
+        logger.debug(`[ADAPTER] Initializing Actual API for operation (budget: "${budget.name}", server: ${logSafeOrigin(budget.serverUrl)})`);
         // Wrap api.init in auth-rate-limit retry so a transient too-many-requests
         // doesn't surface to the caller (and doesn't trigger #132's crash path).
         // Bound EACH init attempt with the op timeout (#270), inside withAuthRetry:
@@ -4078,6 +4082,9 @@ export async function switchBudget(name) {
     };
     if (!found)
         throw notFound();
+    // #628: tool results show the server origin only, never a userinfo credential, path or query.
+    // `found` keeps the raw URL, which the login below still needs.
+    const shownServerUrl = logSafeOrigin(found.serverUrl);
     // ACL enforcement: the target budget must be in this session's allowedBudgets.
     // OIDC mode: explicit ACL required. #572: any mode whose request carries a
     // restricting list (MCP_STATIC_TOKENS) is checked against it too; with no list
@@ -4129,7 +4136,7 @@ export async function switchBudget(name) {
         setSessionBudget(sessionId, key);
         setPreferredBudgetSyncId(store?.principal, found.syncId); // #189: persist at commit
         logger.info(`[ADAPTER] switchBudget no-op for session ${sessionId}: already on "${found.name}" (${found.syncId})`);
-        return { name: found.name, syncId: found.syncId, serverUrl: found.serverUrl };
+        return { name: found.name, syncId: found.syncId, serverUrl: shownServerUrl };
     }
     if (sameAuth) {
         // Same server + creds, different syncId. Reload budget file in place.
@@ -4150,8 +4157,8 @@ export async function switchBudget(name) {
         connectionPool.updateLoadedSyncId(sessionId, found.syncId);
         setSessionBudget(sessionId, key);
         setPreferredBudgetSyncId(store?.principal, found.syncId); // #189: persist at commit
-        logger.info(`[ADAPTER] Active budget switched for session ${sessionId} to: "${found.name}" (${found.syncId}) on ${found.serverUrl}`);
-        return { name: found.name, syncId: found.syncId, serverUrl: found.serverUrl };
+        logger.info(`[ADAPTER] Active budget switched for session ${sessionId} to: "${found.name}" (${found.syncId}) on ${logSafeOrigin(found.serverUrl)}`);
+        return { name: found.name, syncId: found.syncId, serverUrl: shownServerUrl };
     }
     // #581: hold this session's slot across the window between releasing the old entry and
     // creating the new one, so a concurrent initialize cannot take it and leave this session over
@@ -4220,8 +4227,8 @@ export async function switchBudget(name) {
         if (holdsSlot)
             connectionPool.releaseReservation(sessionId);
     }
-    logger.info(`[ADAPTER] Active budget switched for session ${sessionId} to: "${found.name}" (${found.syncId}) on ${found.serverUrl}`);
-    return { name: found.name, syncId: found.syncId, serverUrl: found.serverUrl };
+    logger.info(`[ADAPTER] Active budget switched for session ${sessionId} to: "${found.name}" (${found.syncId}) on ${logSafeOrigin(found.serverUrl)}`);
+    return { name: found.name, syncId: found.syncId, serverUrl: shownServerUrl };
 }
 /**
  * Clear the per-session budget state for a session, so the map does not
@@ -4242,7 +4249,8 @@ export function getBudgetRegistry() {
     return [...budgetRegistry.values()].filter(b => !allowed || allowed.includes(b.syncId)).map(b => ({
         name: b.name,
         syncId: b.syncId,
-        serverUrl: b.serverUrl,
+        // #628: origin only; the registry entry itself keeps the raw URL for the login.
+        serverUrl: logSafeOrigin(b.serverUrl),
         hasEncryption: !!b.encryptionPassword,
     }));
 }

package/dist/src/lib/apiLogin.js

@@ -1,4 +1,5 @@
 import api from '@actual-app/api';
+import config from '../config.js';
 import { withOpTimeout } from './opTimeout.js';
 import { setApiLogin, setLoadedBudgetSyncId, registerBudgetLoad, loginsSpanServers } from './apiState.js';
 import { createModuleLogger } from './loggerFactory.js';
@@ -38,6 +39,10 @@ let upstreamLib = null;
  *     entries are still valid.
  *  3. log in, then record the login.
  *
+ * Every init passes `verbose` explicitly (#620): upstream only sets its process-global verbose
+ * mode when the key is present, and its default is on, which writes reconciled transactions into
+ * our log through `wireConsoleAndDebug`.
+ *
  * Bounded by the op timeout (#270). Callers that retry on the auth rate limit wrap this whole
  * call in `withAuthRetry`, so each attempt is bounded on its own.
  *
@@ -72,6 +77,7 @@ export async function initApiLoggedIn(dataDir, login, label) {
         dataDir,
         serverURL: login.serverUrl,
         password: login.password,
+        verbose: config.ACTUAL_API_VERBOSE,
     });
     const lib = await withOpTimeout(() => loggingIn, label);
     if (lib && typeof lib.send === 'function')
@@ -109,7 +115,7 @@ async function initOverFetchedLogin(dataDir, login, label) {
         }
     }
     // `password: ''` is upstream's no-credential init (it signs in only on a truthy password).
-    const pointing = api.init({ dataDir, serverURL: login.serverUrl, password: '' });
+    const pointing = api.init({ dataDir, serverURL: login.serverUrl, password: '', verbose: config.ACTUAL_API_VERBOSE });
     registerBudgetLoad(pointing);
     const lib = await withOpTimeout(() => pointing, label);
     if (!lib || typeof lib.send !== 'function')

package/dist/src/lib/authPosture.js

@@ -218,3 +218,20 @@ export function enforceHttpAuthPosture(input, log = logger, exit = process.exit)
     }
     return decision;
 }
+/**
+ * One word naming the HTTP auth mode for the startup banner (#626). Precedence
+ * mirrors the listen callback's posture lines in httpServer.ts: OIDC, then the
+ * static token map, then the single shared bearer token, then none. With both
+ * token variables set this reports `static`, as the ticket specifies; the
+ * listen callback still names the extra unrestricted token, and #623 replaces
+ * the banner. Never prints an issuer, token or principal.
+ */
+export function describeAuthMode(input) {
+    if (input.oidcEnabled)
+        return 'oidc';
+    if (input.hasStaticTokens)
+        return 'static';
+    if (input.hasSseAuthorization)
+        return 'bearer';
+    return 'none';
+}

package/dist/src/lib/budget-registry.js

@@ -25,6 +25,49 @@
  * The AI uses `actual_budgets_list_available` to see all configured budgets,
  * then `actual_budgets_switch` with the budget name to switch between them.
  */
+/**
+ * #621: a server URL as it may appear in a log line: scheme, host and port only. URL userinfo
+ * (a reverse-proxy credential), path and query are dropped. Never throws; an unparseable URL
+ * or one with a `null` origin (a non-special scheme such as a schemeless `user:pass@host`
+ * typo) becomes `<invalid url>`. Display text only, for log lines and tool results (#628):
+ * its output is never used to connect, and the login itself must keep the full URL.
+ */
+export function logSafeOrigin(url) {
+    try {
+        const origin = new URL(url).origin;
+        return origin === 'null' ? '<invalid url>' : origin;
+    }
+    catch {
+        return '<invalid url>';
+    }
+}
+/**
+ * #621 / #623: counts and schemes only, from PARSED URLs, so no budget name, host or credential
+ * can leave through it. Servers are counted by the same [serverUrl, password] key
+ * setLoginsSpanServers uses, so the two can never disagree. Never throws.
+ */
+export function summarizeBudgetRegistry(registry) {
+    const budgets = [...registry.values()];
+    const distinctServers = new Set(budgets.map((b) => JSON.stringify([b.serverUrl, b.password || '']))).size;
+    const schemes = new Set();
+    for (const b of budgets) {
+        let scheme;
+        try {
+            const protocol = new URL(b.serverUrl).protocol;
+            scheme = protocol === 'http:' ? 'http' : protocol === 'https:' ? 'https' : 'other';
+        }
+        catch {
+            scheme = 'invalid';
+        }
+        schemes.add(scheme);
+    }
+    return { count: budgets.length, distinctServers, schemes: [...schemes].sort() };
+}
+/** #621: the startup registry line, built from summarizeBudgetRegistry. Never throws. */
+export function formatBudgetRegistrySummary(registry) {
+    const { count, distinctServers, schemes } = summarizeBudgetRegistry(registry);
+    return `Budget registry: ${count} budget(s) across ${distinctServers} server(s) (${schemes.join(', ')})`;
+}
 /**
  * Parse the budget registry from environment variables.
  * Always includes the default budget from the provided defaults (ACTUAL_* vars).
@@ -62,7 +105,7 @@ export function parseBudgetRegistry(env, defaults) {
         // Mirror the default-budget check (#161): never send an E2E encryption
         // password over an http:// upstream unless ALLOW_INSECURE_UPSTREAM is set.
         if (encryptionPassword && env.ALLOW_INSECURE_UPSTREAM !== 'true' && /^http:\/\//i.test(serverUrl)) {
-            console.error(`[CONFIG] BUDGET_${i}_ENCRYPTION_PASSWORD is set but the upstream URL is http:// (${serverUrl}). ` +
+            console.error(`[CONFIG] BUDGET_${i}_ENCRYPTION_PASSWORD is set but the upstream URL is http:// (${logSafeOrigin(serverUrl)}). ` +
                 `Refusing to send the encryption password over plaintext (#161). ` +
                 `Use https:// or set ALLOW_INSECURE_UPSTREAM=true to override.`);
             process.exit(1);

package/dist/src/lib/mcp-version.js

@@ -3,6 +3,12 @@ import { existsSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { findRootPackageJson } from './node-version-guard.js';
+/**
+ * #624: the MCP initialize `serverInfo.name` on both transports. It equals the package.json
+ * name (tests/unit/server_identity.test.js pins that), so a client shows the server under the
+ * name it was installed as, never a description sentence.
+ */
+export const SERVER_NAME = 'actual-mcp-server';
 /**
  * #541: the single source of this server's own version, shared by the MCP initialize
  * `serverInfo.version` (src/index.ts) and the `actual_server_info` tool.

package/dist/src/lib/processHandlers.js

@@ -0,0 +1,183 @@
+/**
+ * #622: the process-level unhandledRejection and uncaughtException handlers, as a pure
+ * factory so unit tests can drive them without exiting. src/lib/processHandlersInstall.ts
+ * registers them on `process`.
+ *
+ * Records are built from gated fields only (logging convention v1, agreed with
+ * actual-sync): `{ type, code?, httpStatus?, category, safeMessage }`. The reason itself,
+ * its message, its stack and any upstream `.type` never reach a record or winston, because
+ * a rejection reason can carry a request object with an Authorization header, and upstream
+ * text can quote account or payee names (#559).
+ *
+ * INVARIANT: imports only node: builtins, ./errors.js and ./rejection-allowlist.js, never
+ * logger.ts or loggerFactory.ts. This module loads before MCP_STDIO_MODE is set, and the
+ * logger reads that variable when winston is built.
+ */
+import { errorLogFields } from './errors.js';
+import { isKnownBenignRejection } from './rejection-allowlist.js';
+/** Fixed sentence per category, used when the throw site set no log-safe text. */
+const SAFE_MESSAGES = {
+    not_found: 'A requested item was not found.',
+    validation: 'A request was rejected as invalid.',
+    auth: 'An upstream request was not authorized.',
+    timeout: 'An operation timed out.',
+    conflict: 'An operation conflicted with existing state.',
+    rate_limited: 'An upstream service rate limited the request.',
+    upstream_unavailable: 'An upstream service was unavailable.',
+    cancelled: 'An operation was cancelled.',
+    internal: 'An internal error occurred.',
+};
+const UNAVAILABLE_CODES = new Set(['ECONNREFUSED', 'ECONNRESET', 'ENOTFOUND', 'EAI_AGAIN', 'EPIPE']);
+/** Closed mapping, first match wins. Never reads message text. */
+export function categorizeError({ errorClass, refusalKind, code, httpStatus: s }) {
+    if (refusalKind === 'not-found')
+        return 'not_found';
+    if (refusalKind === 'out-of-range')
+        return 'validation';
+    if (s === 401 || s === 403)
+        return 'auth';
+    if (s === 404)
+        return 'not_found';
+    if (s === 408 || s === 504 || code === 'ETIMEDOUT')
+        return 'timeout';
+    if (s === 409)
+        return 'conflict';
+    if (s === 429)
+        return 'rate_limited';
+    if (s === 400 || s === 422)
+        return 'validation';
+    if ((s !== undefined && s >= 500 && s <= 599) || (code !== undefined && UNAVAILABLE_CODES.has(code))) {
+        return 'upstream_unavailable';
+    }
+    // The Node AbortError class (its ABORT_ERR code fails the E-shape gate). A fetch abort is a
+    // DOMException and falls to internal by design: this keys on the class, never on `name`.
+    if (errorClass === 'AbortError')
+        return 'cancelled';
+    return 'internal';
+}
+function isHttpStatus(v) {
+    return typeof v === 'number' && Number.isInteger(v) && v >= 100 && v <= 599;
+}
+function readHttpStatus(reason) {
+    if (typeof reason !== 'object' || reason === null)
+        return undefined;
+    const r = reason;
+    if (isHttpStatus(r.status))
+        return r.status;
+    if (isHttpStatus(r.statusCode))
+        return r.statusCode;
+    const response = r.response;
+    if (typeof response === 'object' && response !== null && isHttpStatus(response.status))
+        return response.status;
+    return undefined;
+}
+/**
+ * The gated error object of a record. `type` is the prototype class name, never the
+ * reason's own `.type` property (that can carry CR/LF from upstream). Can throw when the
+ * reason has a hostile getter; the handlers catch that and write the fixed fallback.
+ */
+export function errorRecordFields(reason) {
+    const { errorClass, refusalKind, code, logMessage } = errorLogFields(reason);
+    const httpStatus = readHttpStatus(reason);
+    const category = categorizeError({ errorClass, refusalKind, code, httpStatus });
+    const record = { type: errorClass, category, safeMessage: logMessage ?? SAFE_MESSAGES[category] };
+    if (code !== undefined)
+        record.code = code;
+    if (httpStatus !== undefined)
+        record.httpStatus = httpStatus;
+    return record;
+}
+const NODE_FLOOR_HINT = [
+    `This almost certainly means Node ${process.version} is too old.`,
+    'actual-mcp-server requires the Node version in package.json "engines".',
+    'Import attributes (`with { type: "json" }`) need Node 22 or newer.',
+];
+/**
+ * Upstream raises bank sync failures as plain Errors with no code, so message text is the
+ * only signal. This is a documented exception to the no-text-matching rule: the text only
+ * decides survive versus exit, and is never logged.
+ */
+function isBankSyncError(error) {
+    const errMsg = String(error?.message || error);
+    const errType = error?.type;
+    return (errType === 'BankSyncError' ||
+        errMsg.includes('BankSyncError') ||
+        errMsg.includes('NORDIGEN_ERROR') ||
+        errMsg.includes('RATE_LIMIT_EXCEEDED') ||
+        errMsg.includes('Rate limit exceeded') ||
+        errMsg.includes('Failed syncing account') ||
+        errMsg.includes('GoCardless') ||
+        errMsg.includes('SimpleFIN'));
+}
+export function createProcessHandlers(deps) {
+    const { exit, writeSync, getLogger } = deps;
+    // Fatal: the one synchronous record, then exit 1 even when the write fails. Never also
+    // through winston, which under stdio already writes to stderr (one record per event).
+    function crash(source, error) {
+        try {
+            writeSync(2, JSON.stringify({ level: 'error', event: 'sys_crash', source, error }) + '\n');
+        }
+        catch {
+            // stderr is a full or closed pipe: nothing more can be written.
+        }
+        finally {
+            exit(1);
+        }
+    }
+    function fallback(source) {
+        crash(source, { type: 'unknown', category: 'internal', safeMessage: SAFE_MESSAGES.internal });
+    }
+    function survive(source, event, message, error) {
+        const logger = getLogger();
+        if (logger) {
+            logger.warn(message, { event, source, error });
+        }
+        else {
+            writeSync(2, JSON.stringify({ level: 'warn', event, source, error }) + '\n');
+        }
+    }
+    function writeNodeFloorHint(error) {
+        if (error.code !== 'ERR_IMPORT_ASSERTION_TYPE_MISSING')
+            return;
+        for (const line of NODE_FLOOR_HINT)
+            writeSync(2, line + '\n');
+    }
+    function onUnhandledRejection(reason) {
+        try {
+            const error = errorRecordFields(reason);
+            // #275 backstop: a library consumer reaches neither entry point's guard, and import
+            // attributes fail asynchronously on an under-floor Node, so name the real cause.
+            writeNodeFloorHint(error);
+            if (isKnownBenignRejection(reason)) {
+                survive('unhandledRejection', 'process.rejection_benign', 'Process-level rejection survived', error);
+                return;
+            }
+            crash('unhandledRejection', error);
+        }
+        catch {
+            fallback('unhandledRejection');
+        }
+    }
+    function onUncaughtException(reason) {
+        try {
+            const error = errorRecordFields(reason);
+            writeNodeFloorHint(error);
+            // GoCardless and SimpleFIN failures can surface here from inside @actual-app/api when
+            // the provider answers asynchronously (RATE_LIMIT_EXCEEDED, for example). Non-fatal.
+            if (isBankSyncError(reason)) {
+                if (error.category === 'internal') {
+                    error.category = 'upstream_unavailable';
+                    if (error.safeMessage === SAFE_MESSAGES.internal)
+                        error.safeMessage = SAFE_MESSAGES.upstream_unavailable;
+                }
+                survive('uncaughtException', 'bank_sync.exception_benign', 'Bank sync error survived', error);
+                return;
+            }
+            crash('uncaughtException', error);
+        }
+        catch {
+            fallback('uncaughtException');
+        }
+    }
+    return { onUnhandledRejection, onUncaughtException };
+}

package/dist/src/lib/processHandlersInstall.js

@@ -0,0 +1,25 @@
+/**
+ * #622: side-effect module that registers the process-level handlers. src/index.ts imports
+ * it SECOND, right after ./node-version-guard.js (#275), so the handlers are armed before
+ * any other module evaluates. The logger arrives later through attachProcessLogger, once
+ * src/index.ts has set MCP_STDIO_MODE and loaded src/logger.ts; until then the handlers
+ * write one fixed JSON line to stderr.
+ *
+ * INVARIANT: no import of logger.ts or loggerFactory.ts (see processHandlers.ts).
+ */
+import { writeSync } from 'node:fs';
+import { createProcessHandlers } from './processHandlers.js';
+let attached;
+/** Route the survivable records through the logger from now on. */
+export function attachProcessLogger(logger) {
+    attached = logger;
+}
+const handlers = createProcessHandlers({
+    exit: (code) => process.exit(code),
+    writeSync: (fd, text) => {
+        writeSync(fd, text);
+    },
+    getLogger: () => attached,
+});
+process.on('unhandledRejection', handlers.onUnhandledRejection);
+process.on('uncaughtException', handlers.onUncaughtException);

package/dist/src/lib/rejection-allowlist.js

@@ -7,9 +7,10 @@
  *
  * INVARIANT: this module MUST remain side-effect-free.
  *
- * src/index.ts registers the process.on('unhandledRejection', ...) handler
- * AFTER importing this module (ESM static imports are evaluated before the
- * top-level body runs). Any side effect introduced here, e.g. importing a
+ * src/lib/processHandlersInstall.ts (the second import of src/index.ts, #622)
+ * registers the process.on('unhandledRejection', ...) handler AFTER importing
+ * this module through processHandlers.ts (ESM static imports are evaluated
+ * before the top-level body runs). Any side effect introduced here, e.g. importing a
  * logger that performs winston/file-handle init, importing dotenv, or any
  * code that runs at module load, opens a window during ESM evaluation in
  * which an unhandled rejection bypasses this allow-list and crashes the

package/dist/src/lib/startupRecord.js

@@ -0,0 +1,141 @@
+// #623: the one structured startup record, `sys_startup`, logged at info on both transports
+// after the server has really started. Built by a pure allowlist function: every input is
+// injected, so it reads no env, no config and no Actual, and a field that is not listed in
+// STARTUP_RECORD_KEYS cannot appear. It imports neither src/index.ts, src/server/* nor the tool
+// registry (src/tools/server_info.ts imports this file, so importing the registry would cycle).
+import { INSTALLED_API_VERSION, resolveInstalledVersion } from './installed-api-version.js';
+import { getMcpServerVersion } from './mcp-version.js';
+import { describeAuthMode, isLoopbackHost } from './authPosture.js';
+import { logSafeOrigin } from './budget-registry.js';
+import { parseStaticTokensConfig, staticTokensConfigured } from '../auth/static-tokens.js';
+/** Resolved once at module load: the walk does blocking file reads. The SDK exports no root
+ *  path, so the resolvable subpath is passed explicitly (#445). */
+const MCP_SDK_RESOLVED = resolveInstalledVersion('@modelcontextprotocol/sdk', '@modelcontextprotocol/sdk/server/index.js');
+/** Every key the record may hold, by group. `event` is the one top-level scalar. */
+export const STARTUP_RECORD_KEYS = {
+    event: [],
+    versions: ['server', 'node', 'actualApi', 'mcpSdk'],
+    runtime: ['platform', 'arch', 'container', 'nodeEnv', 'timezone', 'utcOffsetMinutes'],
+    logging: ['level', 'format', 'fileSink'],
+    privacy: ['actualApiVerbose'],
+    paths: ['logDirCustom', 'dataDirCustom'],
+    transport: ['kind', 'bindScope', 'port', 'path', 'scheme', 'advertisedOrigin'],
+    auth: ['mode', 'posture', 'sharedBearerAccepted', 'issuerOrigin', 'staticPrincipals'],
+    tools: ['total', 'registered', 'readOnly', 'toolsets'],
+    budgets: ['count', 'distinctServers', 'schemes'],
+    limits: ['opTimeoutMs', 'maxSessions', 'idleTimeoutMs', 'keepAliveMs'],
+};
+/** Keys present only on the HTTP transport, as `group.key`. */
+export const STARTUP_RECORD_HTTP_ONLY_KEYS = [
+    'transport.bindScope', 'transport.port', 'transport.path', 'transport.scheme',
+    'transport.advertisedOrigin', 'limits.keepAliveMs',
+];
+/** Keys present only under AUTH_PROVIDER=oidc, as `group.key`. */
+export const STARTUP_RECORD_OIDC_ONLY_KEYS = ['auth.issuerOrigin'];
+/** Shared with actual_server_info, so the tool and the record can never report different
+ *  resolved versions or tool counts. */
+export function collectVersionAndToolFacts(counts) {
+    return {
+        versions: {
+            server: getMcpServerVersion(),
+            node: process.version,
+            actualApi: INSTALLED_API_VERSION,
+            mcpSdk: MCP_SDK_RESOLVED,
+        },
+        tools: {
+            total: counts.published,
+            registered: counts.registered,
+            readOnly: counts.policy.readOnly,
+            toolsets: [...counts.policy.toolsets],
+        },
+    };
+}
+function bindScopeOf(host) {
+    if (isLoopbackHost(host))
+        return 'loopback';
+    if (!host || host === '0.0.0.0' || host === '::')
+        return 'all-interfaces';
+    return 'specific';
+}
+/** A count of the configured static principals. config.ts already refused a malformed value at
+ *  startup, so a throw here only means "not countable": 0, never a crash. */
+function countStaticPrincipals(raw) {
+    try {
+        return Object.keys(parseStaticTokensConfig(raw)).length;
+    }
+    catch {
+        return 0;
+    }
+}
+/**
+ * Build the `sys_startup` metadata. Origins go through logSafeOrigin (never throws, drops
+ * userinfo, path and query); budget facts arrive as counts; no hostname, bind address, path,
+ * budget or principal name, tool name or instructions text is ever read into it.
+ */
+export function buildStartupRecord(inputs) {
+    const { env, transport } = inputs;
+    const oidcEnabled = env.AUTH_PROVIDER === 'oidc';
+    const facts = collectVersionAndToolFacts(inputs.tools);
+    const http = transport.kind === 'http' ? transport : undefined;
+    return {
+        event: 'sys_startup',
+        versions: facts.versions,
+        runtime: {
+            platform: process.platform,
+            arch: process.arch,
+            container: inputs.runtime.container,
+            nodeEnv: env.NODE_ENV ?? null,
+            timezone: inputs.runtime.timezone,
+            utcOffsetMinutes: inputs.runtime.utcOffsetMinutes,
+        },
+        logging: {
+            level: inputs.logConfig.level,
+            format: inputs.logConfig.useJson ? 'json' : 'pretty',
+            // The same rule as STORE_LOGS in src/logger.ts.
+            fileSink: env.MCP_BRIDGE_STORE_LOGS === 'true',
+        },
+        privacy: {
+            actualApiVerbose: inputs.actualApiVerbose,
+        },
+        paths: {
+            logDirCustom: !!env.MCP_BRIDGE_LOG_DIR,
+            dataDirCustom: !!env.MCP_BRIDGE_DATA_DIR,
+        },
+        transport: http
+            ? {
+                kind: 'http',
+                bindScope: bindScopeOf(http.bindHost),
+                port: http.listener.port,
+                path: http.path,
+                scheme: http.listener.scheme,
+                advertisedOrigin: logSafeOrigin(http.advertisedUrl),
+            }
+            : { kind: 'stdio' },
+        auth: {
+            // #626: the same blank-means-off rules as the posture check. MCP_SSE_AUTHORIZATION stays
+            // untrimmed: a whitespace-only value is still a live credential there.
+            mode: describeAuthMode({
+                oidcEnabled: env.AUTH_PROVIDER === 'oidc',
+                hasStaticTokens: staticTokensConfigured(env.MCP_STATIC_TOKENS),
+                hasSseAuthorization: !!env.MCP_SSE_AUTHORIZATION,
+            }),
+            posture: inputs.posture,
+            // Under OIDC the bearer entries are never built (httpServer.ts), so the token is not accepted.
+            sharedBearerAccepted: !oidcEnabled && !!env.MCP_SSE_AUTHORIZATION,
+            ...(oidcEnabled ? { issuerOrigin: logSafeOrigin(env.OIDC_ISSUER ?? '') } : {}),
+            staticPrincipals: oidcEnabled ? 0 : countStaticPrincipals(env.MCP_STATIC_TOKENS),
+        },
+        tools: facts.tools,
+        budgets: {
+            count: inputs.budgets.count,
+            distinctServers: inputs.budgets.distinctServers,
+            schemes: [...inputs.budgets.schemes],
+        },
+        limits: {
+            opTimeoutMs: inputs.limits.opTimeoutMs,
+            maxSessions: inputs.limits.maxSessions,
+            idleTimeoutMs: inputs.limits.idleTimeoutMs,
+            ...(http ? { keepAliveMs: http.listener.keepAliveMs } : {}),
+        },
+    };
+}

package/dist/src/server/httpServer.js

@@ -5,6 +5,8 @@ import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/
 import { ListToolsRequestSchema, CallToolRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
 import logger, { resolveRequestId } from '../logger.js';
 import { attachTransportErrorLogger } from '../lib/transportErrorLogger.js';
+import { SERVER_NAME } from '../lib/mcp-version.js';
+import { createModuleLogger } from '../lib/loggerFactory.js';
 import { getLocalIp } from '../utils.js';
 import actualToolsManager from '../actualToolsManager.js';
 import { getConnectionState, connectToActualForSession, shutdownActualForSession, shutdownActual, admitSession, releaseAdmission, isConnectionPoolEnabled } from '../actualConnection.js';
@@ -27,6 +29,7 @@ import { resolveStaticTokens, matchBearerToken, LEGACY_STATIC_PRINCIPAL } from '
 import { runAclPreflight } from '../auth/budget-acl-dynamic.js';
 import { hostHeaderValidation } from '@modelcontextprotocol/sdk/server/middleware/hostHeaderValidation.js';
 import { resolveAllowedHosts } from '../lib/authPosture.js';
+import { logSafeOrigin } from '../lib/budget-registry.js';
 import * as https from 'node:https';
 import { finished } from 'node:stream';
 import * as fs from 'node:fs';
@@ -43,6 +46,7 @@ import { buildToolListEntries } from '../lib/tool-list-entry.js';
 import { classifyInitFailure } from '../lib/init-failure.js';
 import { createHttpErrorHandler } from './httpErrorHandler.js';
 export { classifyInitFailure };
+const httpLog = createModuleLogger('HTTP');
 export { requestContext };
 // Resolve the authenticated principal for the per-principal budget preference
 // (#189). OIDC: the verified JWT subject. A MCP_STATIC_TOKENS token (#572): its
@@ -71,6 +75,8 @@ function capPrincipal(req) {
     }
     return req.staticPrincipal;
 }
+/** Idle keep-alive for the HTTP listener, in milliseconds. */
+export const HTTP_KEEP_ALIVE_TIMEOUT_MS = 65000;
 export async function startHttpServer(mcp, port, httpPath, capabilities, // was passed by index.ts
 implementedTools, // was passed by index.ts
 serverDescription, // was passed by index.ts
@@ -78,7 +84,7 @@ instructions, // was passed by index.ts (#560: built once there)
 toolSchemas, // was passed by index.ts
 version, // server version from package.json
 bindHost = 'localhost', // #239: interface to bind; forwarded to listen()
-advertisedUrl) {
+advertisedUrl, onListening) {
     // #572: resolve MCP_STATIC_TOKENS (token variables, budget names) before anything
     // binds, so a bad entry refuses startup like an unreadable TLS key. The registry is
     // read outside any request context, so it is the full, unfiltered list. config.ts
@@ -319,7 +325,7 @@ advertisedUrl) {
                 requiredScopes,
                 showErrorDetails: process.env.NODE_ENV !== 'production',
             }), budgetAclMiddleware);
-            logger.info(`[OIDC] JWT authentication enabled. Issuer: ${config.OIDC_ISSUER}`);
+            logger.info(`[OIDC] JWT authentication enabled. Issuer: ${logSafeOrigin(config.OIDC_ISSUER ?? '')}`);
             // #462 audit line: which header carries the JWT and where the keys come from.
             logger.info('[OIDC] token source and JWKS mode', {
                 tokenSource: config.OIDC_TOKEN_SOURCE,
@@ -486,7 +492,7 @@ advertisedUrl) {
             capabilities: capabilitiesObj,
         };
         const server = new Server({
-            name: serverDescription || "actual-mcp-server",
+            name: SERVER_NAME,
             version: version || "0.1.0",
         }, serverOptions);
         attachTransportErrorLogger(server, 'http');
@@ -1119,16 +1125,23 @@ advertisedUrl) {
                 `MCP_HTTPS_CERT=${config.MCP_HTTPS_CERT}, MCP_HTTPS_KEY=${config.MCP_HTTPS_KEY}. Cause: ${cause}`);
         }
     }
-    const listener = (tlsOptions ? https.createServer(tlsOptions, app) : app).listen(port, bindHost, () => {
+    const listener = (tlsOptions ? https.createServer(tlsOptions, app) : app).listen(port, bindHost, (err) => {
+        // #623: Express 5's app.listen also registers this callback as the server's 'error'
+        // handler, so a taken port (EADDRINUSE) lands HERE with the error. Without this rethrow it
+        // logged "listening", emitted sys_startup, and the process drained out with exit 0. The
+        // rethrow reaches the uncaughtException handler (sys_crash, exit 1), the same path the
+        // https.createServer branch takes, which has no error listener at all.
+        if (err)
+            throw err;
         const advertised = advertisedUrl || `${scheme}://${serverIp}:${port}${httpPath}`;
         // #239: when bound to a specific (non all-interfaces) host the server is NOT on
         // loopback, so point the health hint at the actual bind host instead of localhost.
         const healthHost = (!bindHost || bindHost === '0.0.0.0' || bindHost === '::') ? 'localhost' : bindHost;
-        console.info(`MCP Streamable HTTP Server listening on ${port}`);
-        console.info(`📨 MCP endpoint: ${advertised}`);
-        console.info(`❤️ Health check: ${scheme}://${healthHost}:${port}/health`);
+        const health = `${scheme}://${healthHost}:${port}/health`;
+        // #625: one structured record through the module logger instead of three console.info lines.
+        httpLog.info(`MCP Streamable HTTP Server listening on ${port}; MCP endpoint: ${advertised} (health: ${health})`, { port, endpoint: advertised, health });
         if (config.AUTH_PROVIDER === 'oidc') {
-            logger.info(`🔒 OIDC authentication enabled (JWT Bearer token required; issuer: ${config.OIDC_ISSUER})`);
+            logger.info(`🔒 OIDC authentication enabled (JWT Bearer token required; issuer: ${logSafeOrigin(config.OIDC_ISSUER ?? '')})`);
             // #345: name the userNames the ACL can match, once, at boot. Deliberately
             // fire-and-forget INSIDE the listen callback: the server is already
             // accepting connections, so a slow or unreachable Actual delays nothing,
@@ -1147,11 +1160,22 @@ advertisedUrl) {
         else {
             logger.warn(`⚠️  HTTP authentication disabled (no MCP_SSE_AUTHORIZATION, MCP_STATIC_TOKENS or OIDC configured)`);
         }
+        // #623: keepAliveTimeout is assigned below, synchronously after listen() returns, so it is
+        // already set when this callback fires. A throw from the record must never take down a
+        // server that is already accepting connections.
+        if (onListening) {
+            try {
+                onListening({ port, scheme, keepAliveMs: listener.keepAliveTimeout });
+            }
+            catch (err) {
+                logger.warn('sys_startup record failed', { error: err instanceof Error ? err.name : 'unknown' });
+            }
+        }
     });
     // Configure keep-alive to maintain persistent connections
-    listener.keepAliveTimeout = 65000; // 65 seconds (slightly higher than typical client timeout)
-    listener.headersTimeout = 66000; // 66 seconds (must be higher than keepAliveTimeout)
-    logger.info(`⏱️  HTTP keep-alive enabled (timeout: ${listener.keepAliveTimeout}ms)`);
+    // #623: the value is reported in the sys_startup record (limits.keepAliveMs), not its own line.
+    listener.keepAliveTimeout = HTTP_KEEP_ALIVE_TIMEOUT_MS; // slightly higher than typical client timeout
+    listener.headersTimeout = HTTP_KEEP_ALIVE_TIMEOUT_MS + 1000; // must be higher than keepAliveTimeout
     // Cleanup on server shutdown
     const cleanup = async () => {
         logger.info('[SERVER] Shutting down, cleaning up sessions...');

package/dist/src/server/stdioServer.js

@@ -5,6 +5,7 @@ import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprot
 import { randomUUID } from 'node:crypto';
 import logger from '../logger.js';
 import { attachTransportErrorLogger } from '../lib/transportErrorLogger.js';
+import { SERVER_NAME } from '../lib/mcp-version.js';
 import actualToolsManager from '../actualToolsManager.js';
 import { requestContext } from '../lib/requestContext.js';
 import { buildToolListEntries } from '../lib/tool-list-entry.js';
@@ -85,7 +86,9 @@ export function createStdioCallToolHandler(mcp, stdioSessionId) {
         }
     };
 }
-export async function startStdioServer(mcp, capabilities, implementedTools, serverDescription, instructions, toolSchemas, version) {
+export async function startStdioServer(mcp, capabilities, implementedTools, 
+// #624: no longer the serverInfo name; kept so the positional signature matches HTTP.
+_serverDescription, instructions, toolSchemas, version) {
     const toolsList = Array.isArray(implementedTools) ? implementedTools : [];
     // #348: a synthetic session identity for this stdio process.
     //
@@ -108,7 +111,7 @@ export async function startStdioServer(mcp, capabilities, implementedTools, serv
     // restarts and can never collide with an HTTP session id.
     const stdioSessionId = `stdio-${randomUUID()}`;
     logger.debug(`[STDIO] session id ${stdioSessionId}`);
-    const server = new Server({ name: serverDescription || 'actual-mcp-server', version: version || '0.1.0' }, { capabilities, instructions });
+    const server = new Server({ name: SERVER_NAME, version: version || '0.1.0' }, { capabilities, instructions });
     attachTransportErrorLogger(server, 'stdio');
     // List tools handler — mirrors createServerInstance() in httpServer.ts
     server.setRequestHandler(ListToolsRequestSchema, async () => {

package/dist/src/tools/budgets_list_available.js

@@ -4,7 +4,7 @@ const InputSchema = z.object({});
 const tool = {
     name: 'actual_budgets_list_available',
     description: 'List the pre-configured budgets this session may switch to (a session limited to some budgets sees only those). ' +
-        'Each entry shows the budget name, sync ID, server URL, and whether it uses E2E encryption. ' +
+        'Each entry shows the budget name, sync ID, server origin, and whether it uses E2E encryption. ' +
         'Budgets are configured via BUDGET_n_NAME / BUDGET_n_SYNC_ID / BUDGET_n_SERVER_URL env vars. ' +
         'Pass the budget name to actual_budgets_switch to change the active budget.',
     inputSchema: InputSchema,

package/dist/src/tools/schedules_update.js

@@ -3,7 +3,7 @@ import adapter from '../lib/actual-adapter.js';
 import { CommonSchemas } from '../lib/schemas/common.js';
 import { RecurConfigSchema } from '../lib/schemas/recur.js';
 import { ScheduleAmountSchema, amountOpMismatch } from '../lib/schemas/schedule-amount.js';
-const InputSchema = z.object({
+const InputSchema = z.strictObject({
     id: CommonSchemas.scheduleId.describe('Schedule UUID'),
     name: z.string().optional()
         .describe('New display name'),
@@ -24,10 +24,12 @@ const InputSchema = z.object({
         .describe('New YYYY-MM-DD date or RecurConfig object'),
     posts_transaction: z.boolean().optional()
         .describe('Auto-post a transaction on each occurrence'),
-    completed: z.boolean().optional()
-        .describe('true marks it completed, false reactivates it'),
     resetNextDate: z.boolean().optional().default(false)
         .describe('Recalculate next_date'),
+    // #627: strict, because upstream updateSchedule refuses `completed` and `next_date` as
+    // system-managed. A stripped key would return success while changing nothing; an advertised
+    // one failed upstream after the write queue. Either is refused here, before any write, as
+    // "unexpected field(s): completed" (formatZodError sanitises the key); the description says why.
 }).superRefine((input, ctx) => {
     // #527: with both fields supplied the input alone decides. With only one, the answer
     // depends on the stored schedule, so adapter.updateSchedule checks it inside the write queue.
@@ -39,7 +41,7 @@ const InputSchema = z.object({
 });
 const tool = {
     name: 'actual_schedules_update',
-    description: `Update a schedule; supply only the fields to change. A new date replaces the stored recurrence, patterns included. Set resetNextDate: true when changing the date or recurrence.`,
+    description: `Update a schedule; supply only the fields to change. A new date replaces the stored recurrence, patterns included. Set resetNextDate: true when changing the date or recurrence. Completion and next_date are managed by Actual and cannot be set.`,
     inputSchema: InputSchema,
     call: async (args, _meta) => {
         const input = InputSchema.parse(args || {});

package/dist/src/tools/server_info.js

@@ -3,12 +3,7 @@ import { readFileSync } from 'fs';
 import { fileURLToPath } from 'url';
 import { dirname, join } from 'path';
 import actualToolsManager from '../actualToolsManager.js';
-import { INSTALLED_API_VERSION, resolveInstalledVersion } from '../lib/installed-api-version.js';
-import { getMcpServerVersion } from '../lib/mcp-version.js';
-/** Resolved once at module load, not per call: the walk does blocking file reads
- *  and this tool can be called in a loop. The SDK exports no root path, so the
- *  resolvable subpath is passed explicitly (#445). */
-const MCP_SDK_RESOLVED = resolveInstalledVersion('@modelcontextprotocol/sdk', '@modelcontextprotocol/sdk/server/index.js');
+import { collectVersionAndToolFacts } from '../lib/startupRecord.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 // Name, description and declared dependencies come from package.json. The version does
@@ -41,15 +36,22 @@ Use this to check server status, verify version compatibility, or debug issues.`
     call: async (_args, _meta) => {
         const uptime = process.uptime();
         const uptimeFormatted = `${Math.floor(uptime / 3600)}h ${Math.floor((uptime % 3600) / 60)}m ${Math.floor(uptime % 60)}s`;
+        const policy = actualToolsManager.getToolPolicy();
+        // #623: the same resolved versions and counts the sys_startup record logs.
+        const facts = collectVersionAndToolFacts({
+            published: actualToolsManager.getPublishedToolNames().length,
+            registered: actualToolsManager.getToolNames().length,
+            policy,
+        });
         return {
             server: {
                 name: packageInfo.name,
-                version: getMcpServerVersion(),
+                version: facts.versions.server,
                 description: packageInfo.description,
                 transport: process.env.MCP_STDIO_MODE === 'true' ? 'stdio' : 'http',
             },
             runtime: {
-                node: process.version,
+                node: facts.versions.node,
                 platform: process.platform,
                 arch: process.arch,
             },
@@ -66,8 +68,8 @@ Use this to check server status, verify version compatibility, or debug issues.`
             dependencies: {
                 mcpSdk: packageInfo.dependencies?.['@modelcontextprotocol/sdk'] ?? 'unknown',
                 actualApi: packageInfo.dependencies?.['@actual-app/api'] ?? 'unknown',
-                ...(MCP_SDK_RESOLVED ? { mcpSdkResolved: MCP_SDK_RESOLVED } : {}),
-                ...(INSTALLED_API_VERSION ? { actualApiResolved: INSTALLED_API_VERSION } : {}),
+                ...(facts.versions.mcpSdk ? { mcpSdkResolved: facts.versions.mcpSdk } : {}),
+                ...(facts.versions.actualApi ? { actualApiResolved: facts.versions.actualApi } : {}),
             },
             status: {
                 uptime: uptimeFormatted,
@@ -80,9 +82,9 @@ Use this to check server status, verify version compatibility, or debug issues.`
             tools: {
                 // total is what this process PUBLISHES; registered is what exists. They differ
                 // when MCP_TOOLSETS, MCP_TOOLS or MCP_READ_ONLY narrows the surface (#483).
-                total: actualToolsManager.getPublishedToolNames().length,
-                registered: actualToolsManager.getToolNames().length,
-                policy: actualToolsManager.getToolPolicy(),
+                total: facts.tools.total,
+                registered: facts.tools.registered,
+                policy,
             },
         };
     },

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "actual-mcp-server",
   "displayName": "Actual MCP Server",
-  "version": "0.26.0",
+  "version": "0.27.0",
   "mcpName": "io.github.agigante80/actual-mcp-server",
   "engines": {
     "node": ">=22.0.0",
@@ -31,7 +31,7 @@
     "verify-tools": "npm run build && node scripts/verify-tools.js",
     "check:coverage": "node scripts/list-actual-api-methods.mjs",
     "direct-sync": "node scripts/direct-sync/bank-sync-direct.mjs",
-    "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/transactions_aggregate.test.js && node tests/unit/account_flow_summary.test.js && node tests/unit/recurring_expenses_summary.test.js && node tests/unit/generated_tools.smoke.test.js &&node tests/unit/schema_validation.test.js && node tests/unit/schema_json_openai_compat.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/e2e_spec_collection.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/install_snippets.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/new_tool_completeness.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/workflow_release_guards.test.js && node tests/unit/report_train_failure.test.js && node tests/unit/unit_chain_membership.test.js && node tests/unit/api_surface_drift.test.js && node tests/unit/write_effect_audit_staleness.test.js && node tests/unit/write_effect_audit_membership.test.js && node tests/unit/tool_annotations.test.js && node tests/unit/tool_id_schema_drift.test.js && node tests/unit/filter_id_resolution.test.js && node tests/unit/filter_id_tool_wiring.test.js && node tests/unit/api_coverage_baseline.test.js && node tests/unit/train_preflight.test.js && node tests/unit/verify_published_artifacts.test.js && node tests/unit/report_train_stale.test.js && node tests/unit/stdio_framing_check.test.js && node tests/unit/server_info.test.js && node tests/unit/transfers_create.test.js && node tests/unit/bot_target_branch.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/adapter_set_budget_batch.test.js && node tests/unit/budget_updates_batch.test.js && node tests/unit/rules_create.test.js && node tests/unit/adapter_rule_reference_guard.test.js && node tests/unit/rules_create_batch.test.js && node tests/unit/budgets_hold_for_next_month.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/httpServer_init_failure_report.test.js && node tests/unit/stdio_init_failure_report.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/schedules_dates.test.js && node tests/unit/bank_sync.test.js && node tests/unit/accounts_delete.test.js && node tests/unit/update_tools_not_found.test.js && node tests/unit/accounts_close.test.js && node tests/unit/accounts_reopen.test.js && node tests/unit/payees_delete.test.js && node tests/unit/payees_merge.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/session_ownership.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/oidc_resource_identifier.test.js && node tests/unit/httpServer_oidc_resource_metadata.test.js && node tests/unit/oidc_error_cause.test.js && node tests/unit/httpServer_oidc_error_body.test.js && node tests/unit/oidc_token_source.test.js && node tests/unit/config_oidc_assertion_refines.test.js && node tests/unit/httpServer_oidc_assertion_mode.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpErrorHandler.test.js && node tests/unit/httpServer_error_handler_wiring.test.js && node tests/unit/httpServer_trust_proxy.test.js && node tests/unit/httpServer_batch_cap.test.js && node tests/unit/dotenv_stdout_quiet.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/adapter_drain_listing_cache.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_acl_listing.test.js && node tests/unit/budget_selection_precondition.test.js && node tests/unit/multi_server_budget_selection.test.js && node tests/unit/static_tokens.test.js && node tests/unit/httpServer_static_tokens.test.js && node tests/unit/httpServer_host_validation.test.js && node tests/unit/multi_server_budget_selection_stdio.test.js && node tests/unit/api_login_fetch.test.js && node tests/unit/multi_server_session_open_http.test.js && node tests/unit/budget_load_abandonment.test.js && node tests/unit/budget_loader_postcondition.test.js && node tests/unit/budget_loader_import_allowlist.test.js && node tests/unit/budget_import_tracking.test.js && node tests/unit/pool_shutdown_under_lock.test.js && node tests/unit/api_lock_affinity.test.js && node tests/unit/commit_message_closing_keyword.test.js && node tests/unit/write_queue_stranding.test.js && node tests/unit/write_queue_stranded_bound.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/transactions_update_splits.test.js && node tests/unit/transactions_update_split_convert.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/transactions_update_batch.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/stdio_budget_switch.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/tool_content_logging.test.js && node tests/unit/adapter_error_logging.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js && node tests/unit/adapter_op_timeout.test.js && node tests/unit/adapter_write_queue_wakeup.test.js && node tests/unit/ci_workflow_guards.test.js && node tests/unit/node_version_guard.test.js && node tests/unit/node_version_drift.test.js && node tests/unit/playwright_version_drift.test.js && node tests/unit/observability_smoke.test.js && node tests/unit/residue_pattern.test.js && node tests/unit/harness_cleanup.test.js && node tests/unit/harness_stdio_data_dir.test.js && node tests/unit/batch_uncategorized_cleanup.test.js && node tests/unit/rules_stage342_cleanup.test.js && node tests/unit/residue_unreadable.test.js && node tests/unit/dual_transport_gate.test.js && node tests/unit/manual_assertions_use_helper.test.js && node tests/unit/server_version_guard.test.js && node tests/unit/server_version_probe_outside_op_timeout.test.js && node tests/unit/payee_rules_reference_filter.test.js && node tests/unit/oidc_metadata_discovery.test.js && node tests/unit/httpServer_oauth_metadata_route.test.js && node tests/unit/httpServer_mcp_info_route.test.js && node tests/unit/residue_sweep_balance_account.test.js && node tests/unit/tool_factory.test.js && node tests/unit/budget_registry_parse.test.js && node tests/unit/preferences_get.test.js && node tests/unit/budgets_export.test.js && node tests/unit/budgets_import.test.js && node tests/unit/budgets_import_syncid.test.js && node tests/unit/budget_acl_dynamic.test.js && node tests/unit/budget_acl_identity_map.test.js && node tests/unit/budget_acl_userinfo.test.js && node tests/unit/acl_e2e_fixture_contract.test.js && node tests/unit/budget_acl_middleware.test.js && node tests/unit/rules_stage.test.js && node tests/unit/oidc_scope_list.test.js && node tests/unit/get_context.test.js && node tests/unit/contributor_docs.test.js && node tests/unit/toolsets.test.js && node tests/unit/toolsets_entrypoint.test.js && node tests/unit/tools_list_size_budget.test.js && node tests/unit/rules_update_schedules_schema.test.js && node tests/unit/schedules_update_amount_guard.test.js && node tests/unit/source_text_helper.test.js && node tests/unit/transport_onerror.test.js && node tests/unit/adapter_transaction_batch_abort.test.js && node tests/unit/transactions_merge_adapter.test.js && node tests/unit/schedules_dead_conditions.test.js && node tests/unit/session_ownership_express.test.js && node tests/unit/pool_orphan_sweep.test.js && node tests/unit/session_budget_state_cleanup.test.js && node tests/unit/http_session_delete.test.js && node tests/unit/budget_acl_parse.test.js && node tests/unit/server_instructions.test.js && node tests/unit/query_run_empty_hint.test.js && node tests/unit/session_admission_race.test.js && node tests/unit/pool_admission_reservation.test.js && node tests/unit/config_max_sessions_per_principal.test.js && node tests/unit/session_principal_cap.test.js && node tests/unit/schema_published_parity.test.js && node tests/unit/manual_borrowed_category.test.js && node tests/unit/manual_budget_no_borrowed_writes.test.js && node tests/unit/refresh_test_budget_snapshot.test.js && node tests/unit/docs_check.test.js && node tests/unit/docs_markers.test.js && node tests/unit/docs_links_fixture.test.js && node tests/unit/docs_index.test.js && node tests/unit/docs_tools.test.js && node tests/unit/docs_readme_size.test.js && node tests/unit/template_lockstep.test.js && node tests/unit/client_examples.test.js && node tests/unit/mcp_server_json.test.js",
+    "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/transactions_aggregate.test.js && node tests/unit/account_flow_summary.test.js && node tests/unit/recurring_expenses_summary.test.js && node tests/unit/generated_tools.smoke.test.js &&node tests/unit/schema_validation.test.js && node tests/unit/schema_json_openai_compat.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/e2e_spec_collection.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/install_snippets.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/new_tool_completeness.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/workflow_release_guards.test.js && node tests/unit/report_train_failure.test.js && node tests/unit/unit_chain_membership.test.js && node tests/unit/api_surface_drift.test.js && node tests/unit/write_effect_audit_staleness.test.js && node tests/unit/write_effect_audit_membership.test.js && node tests/unit/tool_annotations.test.js && node tests/unit/tool_id_schema_drift.test.js && node tests/unit/filter_id_resolution.test.js && node tests/unit/filter_id_tool_wiring.test.js && node tests/unit/api_coverage_baseline.test.js && node tests/unit/train_preflight.test.js && node tests/unit/verify_published_artifacts.test.js && node tests/unit/report_train_stale.test.js && node tests/unit/stdio_framing_check.test.js && node tests/unit/server_info.test.js && node tests/unit/transfers_create.test.js && node tests/unit/bot_target_branch.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/adapter_set_budget_batch.test.js && node tests/unit/budget_updates_batch.test.js && node tests/unit/rules_create.test.js && node tests/unit/adapter_rule_reference_guard.test.js && node tests/unit/rules_create_batch.test.js && node tests/unit/budgets_hold_for_next_month.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/httpServer_init_failure_report.test.js && node tests/unit/stdio_init_failure_report.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/schedules_dates.test.js && node tests/unit/bank_sync.test.js && node tests/unit/accounts_delete.test.js && node tests/unit/update_tools_not_found.test.js && node tests/unit/accounts_close.test.js && node tests/unit/accounts_reopen.test.js && node tests/unit/payees_delete.test.js && node tests/unit/payees_merge.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/session_ownership.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/oidc_resource_identifier.test.js && node tests/unit/httpServer_oidc_resource_metadata.test.js && node tests/unit/oidc_error_cause.test.js && node tests/unit/httpServer_oidc_error_body.test.js && node tests/unit/oidc_token_source.test.js && node tests/unit/config_oidc_assertion_refines.test.js && node tests/unit/httpServer_oidc_assertion_mode.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpErrorHandler.test.js && node tests/unit/httpServer_error_handler_wiring.test.js && node tests/unit/httpServer_trust_proxy.test.js && node tests/unit/httpServer_batch_cap.test.js && node tests/unit/dotenv_stdout_quiet.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/adapter_drain_listing_cache.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_acl_listing.test.js && node tests/unit/budget_selection_precondition.test.js && node tests/unit/multi_server_budget_selection.test.js && node tests/unit/static_tokens.test.js && node tests/unit/httpServer_static_tokens.test.js && node tests/unit/httpServer_host_validation.test.js && node tests/unit/multi_server_budget_selection_stdio.test.js && node tests/unit/api_login_fetch.test.js && node tests/unit/api_login_verbose_optin.test.js && node tests/unit/config_actual_api_verbose.test.js && node tests/unit/multi_server_session_open_http.test.js && node tests/unit/budget_load_abandonment.test.js && node tests/unit/budget_loader_postcondition.test.js && node tests/unit/budget_loader_import_allowlist.test.js && node tests/unit/budget_import_tracking.test.js && node tests/unit/pool_shutdown_under_lock.test.js && node tests/unit/api_lock_affinity.test.js && node tests/unit/commit_message_closing_keyword.test.js && node tests/unit/write_queue_stranding.test.js && node tests/unit/write_queue_stranded_bound.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/transactions_update_splits.test.js && node tests/unit/transactions_update_split_convert.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/transactions_update_batch.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/stdio_budget_switch.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/tool_content_logging.test.js && node tests/unit/adapter_error_logging.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js && node tests/unit/adapter_op_timeout.test.js && node tests/unit/adapter_write_queue_wakeup.test.js && node tests/unit/ci_workflow_guards.test.js && node tests/unit/node_version_guard.test.js && node tests/unit/node_version_drift.test.js && node tests/unit/playwright_version_drift.test.js && node tests/unit/observability_smoke.test.js && node tests/unit/residue_pattern.test.js && node tests/unit/harness_cleanup.test.js && node tests/unit/harness_stdio_data_dir.test.js && node tests/unit/batch_uncategorized_cleanup.test.js && node tests/unit/rules_stage342_cleanup.test.js && node tests/unit/residue_unreadable.test.js && node tests/unit/dual_transport_gate.test.js && node tests/unit/manual_assertions_use_helper.test.js && node tests/unit/server_version_guard.test.js && node tests/unit/server_version_probe_outside_op_timeout.test.js && node tests/unit/payee_rules_reference_filter.test.js && node tests/unit/oidc_metadata_discovery.test.js && node tests/unit/httpServer_oauth_metadata_route.test.js && node tests/unit/httpServer_mcp_info_route.test.js && node tests/unit/residue_sweep_balance_account.test.js && node tests/unit/tool_factory.test.js && node tests/unit/budget_registry_parse.test.js && node tests/unit/server_no_console.test.js && node tests/unit/auth_mode.test.js && node tests/unit/process_handlers.test.js && node tests/unit/process_handlers_child.test.js && node tests/unit/server_identity.test.js && node tests/unit/budgets_serverurl_redaction.test.js && node tests/unit/budgets_serverurl_redaction_default.test.js && node tests/unit/preferences_get.test.js && node tests/unit/budgets_export.test.js && node tests/unit/budgets_import.test.js && node tests/unit/budgets_import_syncid.test.js && node tests/unit/budget_acl_dynamic.test.js && node tests/unit/budget_acl_identity_map.test.js && node tests/unit/budget_acl_userinfo.test.js && node tests/unit/acl_e2e_fixture_contract.test.js && node tests/unit/budget_acl_middleware.test.js && node tests/unit/rules_stage.test.js && node tests/unit/oidc_scope_list.test.js && node tests/unit/get_context.test.js && node tests/unit/contributor_docs.test.js && node tests/unit/toolsets.test.js && node tests/unit/toolsets_entrypoint.test.js && node tests/unit/startup_record.test.js && node tests/unit/startup_record_child.test.js && node tests/unit/tools_list_size_budget.test.js && node tests/unit/rules_update_schedules_schema.test.js && node tests/unit/schedules_update_amount_guard.test.js && node tests/unit/source_text_helper.test.js && node tests/unit/transport_onerror.test.js && node tests/unit/adapter_transaction_batch_abort.test.js && node tests/unit/transactions_merge_adapter.test.js && node tests/unit/schedules_dead_conditions.test.js && node tests/unit/session_ownership_express.test.js && node tests/unit/pool_orphan_sweep.test.js && node tests/unit/session_budget_state_cleanup.test.js && node tests/unit/http_session_delete.test.js && node tests/unit/budget_acl_parse.test.js && node tests/unit/server_instructions.test.js && node tests/unit/query_run_empty_hint.test.js && node tests/unit/session_admission_race.test.js && node tests/unit/pool_admission_reservation.test.js && node tests/unit/config_max_sessions_per_principal.test.js && node tests/unit/session_principal_cap.test.js && node tests/unit/schema_published_parity.test.js && node tests/unit/manual_borrowed_category.test.js && node tests/unit/manual_budget_no_borrowed_writes.test.js && node tests/unit/refresh_test_budget_snapshot.test.js && node tests/unit/docs_check.test.js && node tests/unit/docs_markers.test.js && node tests/unit/docs_links_fixture.test.js && node tests/unit/docs_index.test.js && node tests/unit/docs_tools.test.js && node tests/unit/docs_readme_size.test.js && node tests/unit/template_lockstep.test.js && node tests/unit/client_examples.test.js && node tests/unit/mcp_server_json.test.js",
     "test:adapter": "npm run build && node dist/src/tests_adapter_runner.js",
     "test:e2e": "npx playwright test",
     "test:e2e:docker": "./tests/e2e/run-docker-e2e.sh",