hoi4-agent-tools 3.0.7 → 3.0.8

package/dist/hoi4_agent_tools/mcp/transports/http.js

@@ -5,6 +5,7 @@ import express, {} from 'express';
 import { hostHeaderValidation } from '@modelcontextprotocol/sdk/server/middleware/hostHeaderValidation.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import { isInitializeRequest, SUPPORTED_PROTOCOL_VERSIONS, } from '@modelcontextprotocol/sdk/types.js';
+import { HTTP_MAX_AGGREGATE_BODY_BYTES } from '../../core/configuration.js';
 import { canonicalJson } from '../../core/canonical.js';
 import { authenticate, bearerChallenge, HttpAuthError, protectedResourceMetadata, validateHttpDeployment, } from '../security/auth.js';
 import { BoundedEventStore, SharedEventStoreBudget } from './event-store.js';
@@ -346,18 +347,39 @@ export async function startHttpServer(engine, configuration, serverFactory) {
     const rates = new Map();
     let lastRatePruneMinute = -1;
     let concurrent = 0;
+    let reservedBodyBytes = 0;
     const admissionMiddleware = (request, response, next) => {
-        if (concurrent >= http.maxConcurrentRequests) {
+        // Reserve a few small envelopes for cancellation, roots replies, and discovery,
+        // even when all long request slots are occupied.
+        const declaredLength = request.headers['content-length'];
+        const bodyBytes = request.method === 'POST'
+            ? declaredLength === undefined
+                ? http.maxBodyBytes
+                : Number(declaredLength)
+            : 0;
+        if (!Number.isSafeInteger(bodyBytes) || bodyBytes < 0 || bodyBytes > http.maxBodyBytes) {
+            jsonRpcError(response, 413, 'Payload too large');
+            return;
+        }
+        const overflow = concurrent >= http.maxConcurrentRequests;
+        if (overflow && (concurrent >= http.maxConcurrentRequests + 16 || bodyBytes > 65_536)) {
             response.status(429).setHeader('Retry-After', '1').json({ error: 'concurrency_limit' });
             return;
         }
+        if (bodyBytes > HTTP_MAX_AGGREGATE_BODY_BYTES - reservedBodyBytes) {
+            response.status(429).setHeader('Retry-After', '1').json({ error: 'body_capacity_limit' });
+            return;
+        }
         concurrent += 1;
+        reservedBodyBytes += bodyBytes;
+        response.locals.admissionOverflow = overflow;
         let released = false;
         const release = () => {
             if (released)
                 return;
             released = true;
             concurrent = Math.max(0, concurrent - 1);
+            reservedBodyBytes -= bodyBytes;
         };
         response.once('finish', release);
         response.once('close', release);
@@ -387,6 +409,8 @@ export async function startHttpServer(engine, configuration, serverFactory) {
         }
         next();
     };
+    app.post('/mcp', requireMcpJsonContentType);
+    app.post('/mcp', requireIdentityContentEncoding);
     app.use(admissionMiddleware);
     const authenticateMiddleware = async (request, response, next) => {
         try {
@@ -427,8 +451,6 @@ export async function startHttpServer(engine, configuration, serverFactory) {
     // Supplying a defined parsed body to handleRequest prevents the SDK from falling back to
     // an unbounded Request.json() parse for alternate media types or empty established-session
     // requests. GET and DELETE deliberately remain bodyless.
-    app.post('/mcp', requireMcpJsonContentType);
-    app.post('/mcp', requireIdentityContentEncoding);
     app.post('/mcp', express.json({
         limit: http.maxBodyBytes,
         strict: true,
@@ -437,6 +459,24 @@ export async function startHttpServer(engine, configuration, serverFactory) {
         verify: verifyMcpUtf8,
     }));
     app.post('/mcp', requireParsedMcpJsonBody);
+    app.post('/mcp', (request, response, next) => {
+        const method = isRecord(request.body) ? request.body.method : undefined;
+        const control = method === undefined ||
+            (typeof method === 'string' &&
+                (method.startsWith('notifications/') ||
+                    [
+                        'ping',
+                        'tools/list',
+                        'resources/list',
+                        'resources/templates/list',
+                        'prompts/list',
+                    ].includes(method)));
+        if (response.locals.admissionOverflow === true && !control) {
+            response.status(429).setHeader('Retry-After', '1').json({ error: 'concurrency_limit' });
+            return;
+        }
+        next();
+    });
     if (http.oauth !== undefined && http.publicUrl !== undefined) {
         const metadata = protectedResourceMetadata(configuration);
         app.get('/.well-known/oauth-protected-resource', (_request, response) => response.json(metadata));
@@ -449,6 +489,8 @@ export async function startHttpServer(engine, configuration, serverFactory) {
     let eventStreams = 0;
     const eventStreamsByPrincipal = new Map();
     const sessionTtlMs = http.sessionTtlSeconds * 1000;
+    const sessionExpired = (session) => session.credentialExpiresAt <= Date.now() ||
+        (session.activeRequests === 0 && session.expiresAt <= Date.now());
     const removeSession = async (sessionId) => {
         const session = sessions.get(sessionId);
         if (session === undefined)
@@ -463,13 +505,21 @@ export async function startHttpServer(engine, configuration, serverFactory) {
     const scheduleSessionExpiry = (sessionId, session) => {
         if (session.expiryTimer !== undefined)
             clearTimeout(session.expiryTimer);
-        session.expiryTimer = setTimeout(() => void removeSession(sessionId), Math.max(0, session.expiresAt - Date.now()));
+        session.expiryTimer = setTimeout(() => {
+            if (sessionExpired(session))
+                void removeSession(sessionId);
+            else {
+                session.expiresAt = Math.min(Date.now() + sessionTtlMs, session.credentialExpiresAt);
+                scheduleSessionExpiry(sessionId, session);
+            }
+        }, Math.max(0, session.expiresAt - Date.now()));
         session.expiryTimer.unref();
     };
     const pruneExpiredSessions = async () => {
         const now = Date.now();
         await Promise.all([...sessions]
-            .filter(([, session]) => session.expiresAt <= now)
+            .filter(([, session]) => session.credentialExpiresAt <= now ||
+            (session.activeRequests === 0 && session.expiresAt <= now))
             .map(([sessionId]) => removeSession(sessionId)));
     };
     const findSession = async (request, response) => {
@@ -479,7 +529,7 @@ export async function startHttpServer(engine, configuration, serverFactory) {
             return undefined;
         }
         const session = sessions.get(id);
-        if (session === undefined || session.expiresAt <= Date.now()) {
+        if (session === undefined || sessionExpired(session)) {
             if (session !== undefined)
                 await removeSession(id);
             jsonRpcError(response, 404, 'Unknown or expired MCP session');
@@ -504,6 +554,22 @@ export async function startHttpServer(engine, configuration, serverFactory) {
         session.scopes = expandedScopes;
         session.authorizationContext.scopes = expandedScopes;
         session.expiresAt = boundedSessionExpiration(principal, Date.now(), sessionTtlMs);
+        session.credentialExpiresAt =
+            principal.expiresAt === undefined ? Infinity : principal.expiresAt * 1000;
+        session.activeRequests += 1;
+        let requestFinished = false;
+        const finishRequest = () => {
+            if (requestFinished)
+                return;
+            requestFinished = true;
+            session.activeRequests -= 1;
+            if (sessions.get(id) !== session)
+                return;
+            session.expiresAt = Math.min(Date.now() + sessionTtlMs, session.credentialExpiresAt);
+            scheduleSessionExpiry(id, session);
+        };
+        response.once('finish', finishRequest);
+        response.once('close', finishRequest);
         scheduleSessionExpiry(id, session);
         return session;
     };
@@ -569,6 +635,8 @@ export async function startHttpServer(engine, configuration, serverFactory) {
                             credentialId: principal.credentialId,
                             scopes: [...principal.scopes],
                             authorizationContext,
+                            activeRequests: 0,
+                            credentialExpiresAt: principal.expiresAt === undefined ? Infinity : principal.expiresAt * 1000,
                             expiresAt: Math.min(initialExpiration, boundedSessionExpiration(principal, Date.now(), sessionTtlMs)),
                         };
                         sessions.set(newId, session);
@@ -718,7 +786,7 @@ export async function startHttpServer(engine, configuration, serverFactory) {
     process.stderr.write(`${canonicalJson({ level: 'info', event: 'http_listening', url })}\n`);
     const cleanup = setInterval(() => {
         for (const [sessionId, session] of sessions) {
-            if (session.expiresAt <= Date.now())
+            if (sessionExpired(session))
                 void removeSession(sessionId);
         }
     }, Math.min(60_000, sessionTtlMs));

package/dist/hoi4_agent_tools/version.js

@@ -1,6 +1,6 @@
 import { LATEST_PROTOCOL_VERSION } from '@modelcontextprotocol/sdk/types.js';
 export const PACKAGE_NAME = 'hoi4-agent-tools';
-export const PACKAGE_VERSION = '3.0.7';
+export const PACKAGE_VERSION = '3.0.8';
 export const MCP_PROTOCOL_VERSION = LATEST_PROTOCOL_VERSION;
 export const CONFIG_VERSION = 1;
 export const TRANSACTION_VERSION = 1;

package/docs/development.md

@@ -23,6 +23,8 @@ The event-chain acceptance fixture contains more than 300 project-owned event de
 
 The technology acceptance fixture contains 1,040 project-owned technologies across 13 folders and exercises classic and current doctrines, prerequisites, exclusive branches, multiple placements, unlocks, bonuses, grants, assets, unresolved references, rendering, and comparison.
 
+`npx vitest run tests/integration/mcp-concurrent-workloads.test.ts` tests simultaneous production calls across all six domains over six HTTP sessions and four independent stdio processes, including artifact retrieval and queued cancellation. Execution limits and connection behavior are described in [HTTP](http.md) and the [concurrency decision](https://github.com/klimPaskov/hoi4-agent-tools/blob/main/docs/adr/0026-concurrent-request-execution.md).
+
 The probability fixture contains more than 150 weighted blocks, 250 scenarios, and a declared stateful pool. Run `npm run benchmark` after analyzer changes. On the July 22, 2026 reference run, cold indexing took 28 ms, a cached block evaluation 29 ms, the 250-row matrix 85 ms, one million draws 9 ms, 3/12/25-candidate sequence cases 20/2,079/356 ms, and retrieval of a 1.84 MB result 3 ms. Review budgets are 250 ms, 150 ms, 750 ms, 100 ms, 200/10,000/3,000 ms, and 100 ms respectively; accuracy, method metadata, and omitted probability must not be weakened to meet them.
 
 Local opt-in tests can also read an installed game and an external mod without copying their sources:

package/docs/http.md

@@ -4,7 +4,11 @@ Local MCP clients should use the default stdio registration. Use `hoi4-agent-too
 
 The HTTP server exposes the MCP endpoint at `/mcp`.
 
-JSON request bodies default to and are capped at 64 MiB. This leaves transport-envelope headroom for the bounded 16 MiB GUI text package and a maximum canonical map mask while the two-request concurrency ceiling keeps aggregate body bytes at or below 128 MiB.
+The server accepts up to 128 simultaneous HTTP requests by default and queues expensive tool work automatically. Cancellation, discovery, and protocol replies retain separate admission headroom. Active requests keep their sessions alive; credential expiry still applies.
+
+JSON request bodies default to and are capped at 64 MiB, with a shared 128 MiB budget based on declared request sizes. Chunked bodies reserve their configured maximum. These byte reservations are independent of the number of accepted requests.
+
+`maxConcurrentTools` controls expensive operations per server engine (default 2), and `maxSharedTools` controls operations across local processes sharing the same `serverStateRoot` (default 4). Calls waiting for capacity remain cancellable and emit progress when requested. Increase execution capacity only when the host has enough memory for the corresponding scans and renders. HTTP admission, connection, session, and rate limits remain separately configurable.
 
 Resumable event history defaults to 2 MiB per session within the 16 MiB global store, enough to retain one framed 1 MiB artifact-resource chunk.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hoi4-agent-tools",
   "mcpName": "io.github.klimPaskov/hoi4-agent-tools",
-  "version": "3.0.7",
+  "version": "3.0.8",
   "description": "Analyze HOI4 events, tech trees, AI weights, and MTTH; build focus trees, GUIs, and maps.",
   "type": "module",
   "license": "Apache-2.0",
@@ -130,7 +130,8 @@
   "overrides": {
     "@hono/node-server": "2.1.0",
     "brace-expansion": "5.0.9",
-    "fast-uri": "3.1.5",
+    "fast-uri": "3.1.7",
+    "qs": "6.16.0",
     "hono": "4.13.1",
     "nanoid": "3.3.18",
     "ip-address": "10.4.0",