posterly-mcp-server 0.44.0 → 0.45.1

package/dist/tools/whoami.d.ts

@@ -1,8 +1,21 @@
 import { z } from 'zod';
 import type { PosterlyClient } from '../lib/api-client.js';
+import { type ToolContext } from '../lib/tool-runtime.js';
 export declare const whoamiTool: {
     name: string;
     description: string;
-    inputSchema: z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>;
-    execute(client: PosterlyClient): Promise<string>;
+    inputSchema: z.ZodObject<{
+        view: z.ZodOptional<z.ZodEnum<["identity", "status"]>>;
+    }, "strip", z.ZodTypeAny, {
+        view?: "status" | "identity" | undefined;
+    }, {
+        view?: "status" | "identity" | undefined;
+    }>;
+    /** The old tools' exact input schemas, for alias calls (see alias-transport.ts). */
+    legacySchemas: {
+        get_mcp_status: z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>;
+    };
+    execute(client: PosterlyClient, input: {
+        view?: "identity" | "status";
+    }, ctx: ToolContext): Promise<string>;
 };

package/dist/tools/whoami.js

@@ -1,31 +1,227 @@
 import { z } from 'zod';
+import { POSTERLY_MCP_VERSION } from '../lib/version.js';
+import { resolvePosterlyBaseUrl } from '../lib/api-client.js';
 import { code, mdKeyValue, mdTable, mdTitle } from '../lib/format.js';
+import { validateArgs } from '../lib/tool-runtime.js';
+const NPM_LATEST_URL = 'https://registry.npmjs.org/posterly-mcp-server/latest';
 export const whoamiTool = {
     name: 'whoami',
-    description: 'Return the authenticated user, API key scopes, workspaces, and onboarding next step. ALWAYS call this at the start of a session. If onboarding.completed is false, walk the remaining onboarding steps IN THIS conversation (about you, connect, brand voice, first post). Do not send the user to /onboarding-v2 or the dashboard composer wizard.',
-    inputSchema: z.object({}),
-    async execute(client) {
-        const info = await client.whoami();
-        return [
-            mdTitle('posterly identity'),
-            mdKeyValue([
-                ['User', info.user.email || code(info.user.id)],
-                ['API scopes', info.api_key.scopes.join(', ') || 'none'],
-                ['Default workspace', `${info.default_workspace.name} (${code(info.default_workspace.id)})`],
-                ['Default timezone', info.default_workspace.timezone || 'n/a'],
-                ['Onboarding', info.onboarding?.completed ? 'complete' : info.onboarding?.next_step_label || 'unknown'],
-            ]),
-            info.onboarding && !info.onboarding.completed
-                ? `**Onboarding next:** ${info.onboarding.next_step_label}. ${info.onboarding.instruction}`
-                : '',
-            mdTable(['Workspace', 'Workspace ID', 'Role', 'Timezone', 'Default'], info.workspaces.map((workspace) => [
-                `${workspace.name}${workspace.is_personal ? ' (personal)' : ''}`,
-                code(workspace.id),
-                workspace.role || 'member',
-                workspace.timezone || 'n/a',
-                workspace.id === info.default_workspace.id,
-            ])),
-            '**Tip:** Pass `workspace_id` to `create_post`, `list_posts`, `list_accounts`, and `find_available_slot` when you want the assistant to stay inside one workspace.',
-        ].filter(Boolean).join('\n\n');
+    description: 'Who you are and how posterly is connected. view=identity (default): the authenticated user, API key scopes, workspaces, and onboarding next step. ALWAYS call this at the start of a session; if onboarding.completed is false, walk the remaining onboarding steps IN THIS conversation (about you, connect, brand voice, first post) and do not send the user to /onboarding-v2 or the dashboard composer wizard. view=status: MCP server version, latest npm version, endpoint and API key health, and update guidance; works before POSTERLY_API_KEY is configured.',
+    inputSchema: z.object({
+        view: z
+            .enum(['identity', 'status'])
+            .optional()
+            .describe('identity (default): user, scopes, workspaces, onboarding. status: MCP server and connection health.'),
+    }),
+    /** The old tools' exact input schemas, for alias calls (see alias-transport.ts). */
+    legacySchemas: {
+        get_mcp_status: z.object({}),
+    },
+    async execute(client, input, ctx) {
+        const { mode } = validateArgs(ctx, 'whoami', input);
+        if (mode === 'status')
+            return mcpStatus(client);
+        return identity(client, ctx);
     },
 };
+async function identity(client, ctx) {
+    const info = await client.whoami();
+    const text = [
+        mdTitle('posterly identity'),
+        mdKeyValue([
+            ['User', info.user.email || code(info.user.id)],
+            ['API scopes', info.api_key.scopes.join(', ') || 'none'],
+            ['Default workspace', `${info.default_workspace.name} (${code(info.default_workspace.id)})`],
+            ['Default timezone', info.default_workspace.timezone || 'n/a'],
+            ['Onboarding', info.onboarding?.completed ? 'complete' : info.onboarding?.next_step_label || 'unknown'],
+        ]),
+        info.onboarding && !info.onboarding.completed
+            ? `**Onboarding next:** ${info.onboarding.next_step_label}. ${info.onboarding.instruction}`
+            : '',
+        mdTable(['Workspace', 'Workspace ID', 'Role', 'Timezone', 'Default'], info.workspaces.map((workspace) => [
+            `${workspace.name}${workspace.is_personal ? ' (personal)' : ''}`,
+            code(workspace.id),
+            workspace.role || 'member',
+            workspace.timezone || 'n/a',
+            workspace.id === info.default_workspace.id,
+        ])),
+        '**Tip:** Pass `workspace_id` to `create_post`, `list_posts`, `list_accounts`, and `find_available_slot` when you want the assistant to stay inside one workspace.',
+    ].filter(Boolean).join('\n\n');
+    // Only when tool sets are filtered, so the default answer is unchanged.
+    const toolsets = ctx.toolsets;
+    if (!toolsets || toolsets.all)
+        return text;
+    return `${text}\n\n**Tool sets:** ${toolsets.enabled.join(', ')} are listed in this connection. Every tool can still be called by name. To list every set, unset POSTERLY_TOOLSETS (or set it to all) and restart the MCP client.`;
+}
+async function mcpStatus(client) {
+    const apiOrigin = client.getBaseUrl();
+    const [latest, apiProbe, authProbe] = await Promise.all([
+        fetchLatestNpmVersion(),
+        probeHostedMcp(apiOrigin),
+        client.hasApiKey() ? client.probeWhoami() : Promise.resolve(null),
+    ]);
+    const updateStatus = describeUpdateStatus(POSTERLY_MCP_VERSION, latest.version, latest.error);
+    const versionMatch = apiProbe.version ? yesNo(apiProbe.version === POSTERLY_MCP_VERSION) : 'unknown';
+    const rows = [
+        ['Connection type', 'local app process (stdio)'],
+        ['Current server version', POSTERLY_MCP_VERSION],
+        ['Latest npm version', latest.version || 'unknown'],
+        ['Update status', updateStatus],
+        ['posterly API origin', code(apiOrigin)],
+        ['MCP endpoint health', formatApiProbe(apiProbe)],
+        ['Hosted MCP version', apiProbe.version || 'unknown'],
+        ['Version match', versionMatch],
+        ['API key configured', client.hasApiKey()],
+        ['API auth check', formatAuthProbe(authProbe)],
+    ];
+    if (authProbe?.ok && authProbe.whoami) {
+        rows.push(['User', authProbe.whoami.user.email || code(authProbe.whoami.user.id)], ['Default workspace', `${authProbe.whoami.default_workspace.name} (${code(authProbe.whoami.default_workspace.id)})`], ['API scopes', authProbe.whoami.api_key.scopes.join(', ') || 'none']);
+    }
+    return [
+        mdTitle('posterly MCP status'),
+        mdKeyValue(rows),
+        latest.error ? `**Latest check:** ${latest.error}` : '',
+        apiProbe.error ? `**MCP endpoint check:** ${apiProbe.error}` : '',
+        authProbe && !authProbe.ok ? `**API auth check:** ${authProbe.error || 'API key validation failed'}` : '',
+        nextStep({ hasApiKey: client.hasApiKey(), updateStatus, apiProbe, authProbe }),
+    ].filter(Boolean).join('\n\n');
+}
+async function probeHostedMcp(apiOrigin) {
+    const startedAt = Date.now();
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 2500);
+    try {
+        const res = await fetch(`${resolvePosterlyBaseUrl(apiOrigin)}/api/mcp`, {
+            headers: { Accept: 'application/json' },
+            signal: controller.signal,
+        });
+        const text = await res.text();
+        const data = parseJson(text);
+        if (!res.ok) {
+            return {
+                ok: false,
+                status: res.status,
+                error: formatError(data, text, res.statusText),
+                durationMs: Date.now() - startedAt,
+            };
+        }
+        const version = typeof data?.serverInfo?.version === 'string' ? data.serverInfo.version : undefined;
+        return {
+            ok: Boolean(version),
+            status: res.status,
+            version,
+            error: version ? undefined : 'Hosted MCP response did not include serverInfo.version',
+            durationMs: Date.now() - startedAt,
+        };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            error: err?.name === 'AbortError' ? 'timed out after 2500ms' : err?.message || String(err),
+            durationMs: Date.now() - startedAt,
+        };
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+async function fetchLatestNpmVersion() {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 2500);
+    try {
+        const res = await fetch(NPM_LATEST_URL, {
+            headers: { Accept: 'application/json' },
+            signal: controller.signal,
+        });
+        if (!res.ok) {
+            return { error: `npm registry returned HTTP ${res.status}` };
+        }
+        const data = await res.json();
+        return typeof data.version === 'string'
+            ? { version: data.version }
+            : { error: 'npm registry response did not include a version' };
+    }
+    catch (err) {
+        const reason = err?.name === 'AbortError' ? 'timed out' : err?.message || String(err);
+        return { error: `could not check npm latest: ${reason}` };
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+function describeUpdateStatus(current, latest, error) {
+    if (!latest)
+        return error ? 'unknown' : 'unknown';
+    const comparison = compareSemver(current, latest);
+    if (comparison < 0) {
+        return `update available: restart the MCP client or run ${code('npx -y posterly-mcp-server@latest')}`;
+    }
+    if (comparison > 0) {
+        return 'running newer than npm latest; npm may not have been published yet';
+    }
+    return 'current';
+}
+function formatApiProbe(probe) {
+    if (probe.ok)
+        return `ok (HTTP ${probe.status}, ${probe.durationMs}ms)`;
+    const status = probe.status ? `HTTP ${probe.status}` : 'network';
+    return `failed (${status}, ${probe.durationMs}ms)`;
+}
+function formatAuthProbe(probe) {
+    if (!probe)
+        return 'skipped (POSTERLY_API_KEY not configured)';
+    if (probe.ok)
+        return `valid (HTTP ${probe.status}, ${probe.durationMs}ms)`;
+    const status = probe.status ? `HTTP ${probe.status}` : 'network';
+    return `failed (${status}, ${probe.durationMs}ms)`;
+}
+function nextStep(input) {
+    const { hasApiKey, updateStatus, apiProbe, authProbe } = input;
+    if (updateStatus.startsWith('update available')) {
+        return '**Next step:** Restart your MCP client so it pulls `posterly-mcp-server@latest`, then call `whoami` with `view: "status"` again.';
+    }
+    if (!apiProbe.ok) {
+        return '**Next step:** Check `POSTERLY_URL` / `POSTERLY_API_BASE_URL`, DNS, and network access to the hosted MCP endpoint, then call `whoami` with `view: "status"` again.';
+    }
+    if (!hasApiKey) {
+        return '**Next step:** Add `POSTERLY_API_KEY` after activating API and MCP access, then call `whoami`.';
+    }
+    if (authProbe && !authProbe.ok) {
+        return '**Next step:** Create or reinstall a valid posterly API key, then restart the MCP client and call `whoami` with `view: "status"` again.';
+    }
+    return '**Next step:** Call `whoami` to confirm the user, workspace, and scopes before scheduling posts.';
+}
+function yesNo(value) {
+    return value ? 'yes' : 'no';
+}
+function parseJson(text) {
+    try {
+        return text ? JSON.parse(text) : {};
+    }
+    catch {
+        return null;
+    }
+}
+function formatError(data, fallback, statusText) {
+    if (data && typeof data === 'object') {
+        return data.error || data.message || data.code || statusText || 'API request failed';
+    }
+    return fallback || statusText || 'API request failed';
+}
+function compareSemver(a, b) {
+    const left = parts(a);
+    const right = parts(b);
+    for (let i = 0; i < 3; i += 1) {
+        if (left[i] !== right[i])
+            return left[i] > right[i] ? 1 : -1;
+    }
+    return 0;
+}
+function parts(value) {
+    const nums = value.split(/[.-]/).slice(0, 3).map((part) => Number.parseInt(part, 10));
+    return [
+        Number.isFinite(nums[0]) ? nums[0] : 0,
+        Number.isFinite(nums[1]) ? nums[1] : 0,
+        Number.isFinite(nums[2]) ? nums[2] : 0,
+    ];
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "posterly-mcp-server",
-  "version": "0.44.0",
+  "version": "0.45.1",
   "mcpName": "io.github.awpthorp/posterly",
   "description": "MCP server for posterly: schedule and publish social media posts across 18 platforms from any MCP client (Claude, ChatGPT, Cursor, Windsurf, Cline, and more)",
   "license": "MIT",
@@ -34,10 +34,12 @@
     "start": "node dist/index.js",
     "prepack": "npm run build && npm --prefix .. run --silent check:mcp-parity",
     "test:annotations": "npm run build && node scripts/test-tool-annotations.mjs",
-    "test:payloads": "npm run build && node scripts/test-payload-builders.mjs"
+    "test:payloads": "npm run build && node scripts/test-payload-builders.mjs",
+    "test:client-header": "npm run build && node scripts/test-client-header-sanitization.mjs",
+    "test:alias-transport": "npm run build && node scripts/test-alias-transport.mjs"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.12.1",
+    "@modelcontextprotocol/sdk": "1.27.1",
     "zod": "^3.24.0"
   },
   "devDependencies": {

package/scripts/test-alias-transport.mjs

@@ -0,0 +1,368 @@
+// Tests the stdio AliasTransport (src/lib/alias-transport.ts) over an
+// in-memory transport pair with a real McpServer and Client, using a small
+// fake registry that has aliases (the shipped registry has none yet):
+//   - aliases never appear in tools/list
+//   - an alias call is rewritten onto its target with translated args
+//     (rename + inject, inject wins) before the SDK validates it
+//   - handlers read the called name / legacyConfirm via extra.requestId
+//   - the response keeps content[0] untouched and gets exactly one appended
+//     rename note plus _meta["posterly/deprecation"]
+//   - canonical calls are untouched, including when run concurrently with an
+//     alias call (legacyConfirm never leaks across calls)
+//   - an alias call that fails per-mode validation returns a plain error
+//     (plus the note) without reaching the handler
+//   - per-request entries are cleaned up after the response, and after a
+//     notifications/cancelled (the SDK sends no response for those)
+//   - a visible set filters ONLY tools/list: hidden tools stay callable,
+//     including in the real built package with POSTERLY_TOOLSETS=core
+//   - an alias to a param-driven tool is pinned to the old tool's mode, and a
+//     legacy validator reproduces the old tool's exact schema error text
+// Run: npm run test:alias-transport (builds first)
+import assert from 'node:assert/strict';
+import { z } from 'zod';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js';
+import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { AliasTransport } from '../dist/lib/alias-transport.js';
+
+const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+
+const SUNSET = '2027-01-12';
+
+const registry = {
+  version: 1,
+  designRules: 'off',
+  budgets: { maxTotal: 70, maxCore: 30 },
+  sunset: SUNSET,
+  toolsets: { core: { label: 'Core', description: 'Core tools.' } },
+  tools: {
+    manage_thing: {
+      set: 'core',
+      label: 'Manage a thing',
+      selector: 'action',
+      actions: {
+        rename: {
+          label: 'Rename a thing',
+          destructive: false,
+          idempotent: true,
+          openWorld: false,
+          confirm: 'confirm',
+          params: {
+            thing_id: { type: 'string', required: true },
+            title: { type: 'string', required: true },
+          },
+        },
+        delete: { label: 'Delete a thing', destructive: true, idempotent: true, openWorld: false, confirm: 'preview' },
+      },
+    },
+    slow_thing: { set: 'core', label: 'Slow thing', readOnly: true, destructive: false, idempotent: true, openWorld: false, confirm: 'none' },
+    list_things: {
+      set: 'core',
+      label: 'Things',
+      selector: 'view',
+      defaultMode: 'all',
+      views: {
+        all: { label: 'All things' },
+        one: { label: 'One thing', params: { thing_id: { type: 'string', required: true }, limit: { type: 'integer', min: 1, max: 50, default: 10 } } },
+      },
+    },
+  },
+  aliases: {
+    old_slow: {
+      target: 'slow_thing',
+      added: '2026-10-01',
+      sunset: SUNSET,
+    },
+    delete_thing: {
+      target: 'manage_thing',
+      inject: { action: 'delete' },
+      rename: { id: 'thing_id' },
+      legacyConfirm: true,
+      added: '2026-10-01',
+      sunset: SUNSET,
+    },
+    rename_thing: {
+      target: 'manage_thing',
+      inject: { action: 'rename' },
+      added: '2026-10-01',
+      sunset: SUNSET,
+    },
+    get_thing: {
+      target: 'list_things',
+      inject: { view: 'one' },
+      added: '2026-10-01',
+      sunset: SUNSET,
+    },
+  },
+};
+
+const server = new McpServer({ name: 'alias-transport-test', version: '0.0.0' });
+const [clientSide, serverSide] = InMemoryTransport.createLinkedPair();
+const transport = new AliasTransport(serverSide, registry);
+
+const seen = [];
+server.tool(
+  'manage_thing',
+  'Rename or delete a thing.',
+  {
+    action: z.enum(['rename', 'delete']),
+    thing_id: z.string(),
+    title: z.string().optional(),
+    confirm: z.boolean().optional(),
+  },
+  async (input, extra) => {
+    const info = transport.getCallInfo(extra.requestId);
+    seen.push({ tool: 'manage_thing', input, calledName: info?.calledName ?? null, legacyConfirm: info?.legacyConfirm ?? false });
+    // Give a concurrent call the chance to interleave.
+    await new Promise((resolve) => setTimeout(resolve, 5));
+    return { content: [{ type: 'text', text: `did ${input.action} on ${input.thing_id}` }] };
+  },
+);
+server.tool(
+  'list_things',
+  'List things.',
+  { view: z.enum(['all', 'one']).optional(), thing_id: z.string().optional(), limit: z.number().optional() },
+  async (input, extra) => {
+    const info = transport.getCallInfo(extra.requestId);
+    seen.push({ tool: 'list_things', input, calledName: info?.calledName ?? null, legacyConfirm: info?.legacyConfirm ?? false });
+    return { content: [{ type: 'text', text: `view ${input.view} ${input.thing_id ?? ''} ${input.limit ?? ''}`.trim() }] };
+  },
+);
+
+let slowRequestId;
+server.tool('slow_thing', 'Takes a while.', {}, async (_input, extra) => {
+  slowRequestId = extra.requestId;
+  await new Promise((resolve) => {
+    const timer = setTimeout(resolve, 500);
+    extra.signal.addEventListener('abort', () => {
+      clearTimeout(timer);
+      resolve();
+    });
+  });
+  return { content: [{ type: 'text', text: 'slow done' }] };
+});
+
+const client = new Client({ name: 'alias-transport-test-client', version: '0.0.0' });
+await server.connect(transport);
+await client.connect(clientSide);
+
+try {
+  // 1. Aliases never appear in tools/list.
+  const { tools } = await client.listTools();
+  assert.deepEqual(tools.map((tool) => tool.name).sort(), ['list_things', 'manage_thing', 'slow_thing']);
+
+  // 2. Alias call: rename + inject (inject wins over a caller-supplied action).
+  seen.length = 0;
+  const aliased = await client.callTool({ name: 'delete_thing', arguments: { id: 't_1', action: 'rename', confirm: true } });
+  assert.equal(seen.length, 1);
+  assert.deepEqual(seen[0].input, { action: 'delete', thing_id: 't_1', confirm: true });
+  assert.equal(seen[0].calledName, 'delete_thing', 'handler reads the called (alias) name via extra.requestId');
+  assert.equal(seen[0].legacyConfirm, true);
+  assert.equal(aliased.content.length, 2, 'exactly one appended deprecation item');
+  assert.deepEqual(aliased.content[0], { type: 'text', text: 'did delete on t_1' }, 'content[0] is untouched');
+  assert.equal(
+    aliased.content[1].text,
+    `Renamed: delete_thing is now manage_thing with action=delete. The old name may stop working after ${SUNSET}.`,
+  );
+  assert.deepEqual(aliased._meta?.['posterly/deprecation'], {
+    old: 'delete_thing',
+    new: 'manage_thing',
+    action: 'delete',
+    sunset: SUNSET,
+  });
+
+  // 3. Canonical call: untouched, no note, no _meta, no alias info.
+  seen.length = 0;
+  const canonical = await client.callTool({ name: 'manage_thing', arguments: { action: 'rename', thing_id: 't_2', title: 'New' } });
+  assert.equal(canonical.content.length, 1);
+  assert.equal(canonical._meta, undefined);
+  assert.equal(seen[0].calledName, null);
+  assert.equal(seen[0].legacyConfirm, false);
+
+  // 4. Concurrent alias + canonical calls: legacyConfirm never leaks.
+  seen.length = 0;
+  const [a, b] = await Promise.all([
+    client.callTool({ name: 'delete_thing', arguments: { id: 't_3', confirm: true } }),
+    client.callTool({ name: 'manage_thing', arguments: { action: 'delete', thing_id: 't_4' } }),
+  ]);
+  const byThing = Object.fromEntries(seen.map((entry) => [entry.input.thing_id, entry]));
+  assert.equal(byThing.t_3.legacyConfirm, true);
+  assert.equal(byThing.t_3.calledName, 'delete_thing');
+  assert.equal(byThing.t_4.legacyConfirm, false);
+  assert.equal(byThing.t_4.calledName, null);
+  assert.equal(a.content.length, 2);
+  assert.equal(b.content.length, 1);
+
+  // 5. Per-mode validation (registry params) normalises before the SDK sees it:
+  //    the default limit is applied.
+  seen.length = 0;
+  const viewed = await client.callTool({ name: 'get_thing', arguments: { thing_id: 't_5' } });
+  assert.deepEqual(seen[0].input, { view: 'one', thing_id: 't_5', limit: 10 });
+  assert.equal(viewed.content[0].text, 'view one t_5 10');
+  assert.equal(viewed._meta?.['posterly/deprecation']?.action, 'one');
+
+  // 6. A validation failure is a plain error plus the note; the handler never runs.
+  seen.length = 0;
+  const invalid = await client.callTool({ name: 'rename_thing', arguments: { thing_id: 't_6' } });
+  assert.equal(seen.length, 0, 'handler must not run when validation fails');
+  assert.equal(invalid.isError, true);
+  assert.equal(invalid.content[0].text, 'title is required with action=rename.');
+  assert.equal(invalid.content.length, 2);
+  const extra = await client.callTool({ name: 'rename_thing', arguments: { thing_id: 't_6', title: 'x', bogus: 1 } });
+  assert.equal(extra.isError, true);
+  assert.equal(extra.content[0].text, 'bogus is not allowed with action=rename.');
+
+  // 7. Entries are cleaned up after each response.
+  for (let id = 0; id < 50; id += 1) {
+    assert.equal(transport.getCallInfo(id), undefined, `request ${id} still tracked after its response`);
+  }
+
+  // 8. A cancelled alias call (no response is ever sent) is still cleaned up.
+  const controller = new AbortController();
+  const pendingSlow = client.callTool({ name: 'old_slow', arguments: {} }, undefined, { signal: controller.signal });
+  await new Promise((resolve) => setTimeout(resolve, 30));
+  assert.notEqual(slowRequestId, undefined, 'slow handler started');
+  assert.equal(transport.getCallInfo(slowRequestId)?.calledName, 'old_slow', 'tracked while in flight');
+  controller.abort();
+  await assert.rejects(pendingSlow);
+  await new Promise((resolve) => setTimeout(resolve, 30));
+  assert.equal(transport.getCallInfo(slowRequestId), undefined, 'notifications/cancelled clears the entry');
+} finally {
+  await client.close();
+  await server.close();
+}
+
+// 9. A visible set filters tools/list only; hidden tools stay callable.
+{
+  const filteredServer = new McpServer({ name: 'alias-transport-filter-test', version: '0.0.0' });
+  const [filteredClientSide, filteredServerSide] = InMemoryTransport.createLinkedPair();
+  const filteredTransport = new AliasTransport(filteredServerSide, registry, new Set(['list_things']));
+  filteredServer.tool('list_things', 'List things.', {}, async () => ({ content: [{ type: 'text', text: 'listed' }] }));
+  filteredServer.tool('manage_thing', 'Manage a thing.', { action: z.string(), thing_id: z.string() }, async (input) => ({
+    content: [{ type: 'text', text: `managed ${input.thing_id}` }],
+  }));
+  const filteredClient = new Client({ name: 'alias-transport-filter-client', version: '0.0.0' });
+  await filteredServer.connect(filteredTransport);
+  await filteredClient.connect(filteredClientSide);
+  try {
+    const { tools: listed } = await filteredClient.listTools();
+    assert.deepEqual(listed.map((tool) => tool.name), ['list_things'], 'hidden tool is not listed');
+    const hiddenCall = await filteredClient.callTool({ name: 'manage_thing', arguments: { action: 'delete', thing_id: 't_9' } });
+    assert.equal(hiddenCall.isError, undefined);
+    assert.equal(hiddenCall.content[0].text, 'managed t_9', 'hidden tool is still callable');
+    const aliasToHidden = await filteredClient.callTool({ name: 'delete_thing', arguments: { id: 't_10' } });
+    assert.equal(aliasToHidden.content[0].text, 'managed t_10', 'an alias to a hidden tool still works');
+  } finally {
+    await filteredClient.close();
+    await filteredServer.close();
+  }
+}
+
+// 10. The real built package: POSTERLY_TOOLSETS=core hides get_subscription
+//     (billing) from tools/list, but calling it still reaches the tool. With
+//     no API key the tool answers its own "not installed" error before any
+//     network request, which proves it ran (an unregistered tool would give
+//     the SDK's "Tool get_subscription not found").
+{
+  const stdioClient = new Client({ name: 'alias-transport-toolsets-client', version: '0.0.0' });
+  const stdioTransport = new StdioClientTransport({
+    command: process.execPath,
+    args: [resolve(packageRoot, 'dist/index.js')],
+    env: { POSTERLY_TOOLSETS: 'core' },
+    stderr: 'ignore',
+  });
+  await stdioClient.connect(stdioTransport);
+  try {
+    const { tools: coreTools } = await stdioClient.listTools();
+    const names = coreTools.map((tool) => tool.name);
+    assert(!names.includes('get_subscription'), 'billing tool hidden from tools/list under core');
+    assert(names.includes('create_post'), 'core tool listed');
+    assert(names.includes('start_signup'), 'signup tools are always listed on stdio');
+    const hidden = await stdioClient.callTool({ name: 'get_subscription', arguments: {} });
+    assert.equal(hidden.isError, true);
+    assert.match(hidden.content[0].text, /posterly access is not installed yet/, 'the hidden tool itself answered');
+  } finally {
+    await stdioClient.close();
+  }
+}
+
+// 11. Param-driven targets and legacy schemas (mcp 0.45.0): an alias with
+//     `mode` is validated in the old tool's mode (a missing id is rejected,
+//     never silently widened into a list), and a legacy validator reproduces
+//     the old tool's exact error text before any translation.
+{
+  const modeRegistry = {
+    ...registry,
+    tools: {
+      list_notes: {
+        set: 'core',
+        label: 'Notes',
+        selector: 'params',
+        defaultMode: 'list',
+        views: {
+          list: { label: 'List notes', params: { limit: { type: 'integer', min: 1, max: 50 } } },
+          note: { label: 'One note', when: ['note_id'], params: { note_id: { type: 'string', required: true } } },
+        },
+      },
+    },
+    aliases: {
+      get_note: { target: 'list_notes', mode: 'note', added: '2026-10-01', sunset: SUNSET },
+    },
+  };
+  const legacyValidator = (aliasName, args) => {
+    if (aliasName !== 'get_note') return null;
+    if (!args || typeof args.note_id !== 'string') return { ok: false, message: 'MCP error -32602: old get_note schema error' };
+    return { ok: true, args: { note_id: args.note_id } };
+  };
+  const modeServer = new McpServer({ name: 'alias-transport-mode-test', version: '0.0.0' });
+  const [modeClientSide, modeServerSide] = InMemoryTransport.createLinkedPair();
+  const modeTransport = new AliasTransport(modeServerSide, modeRegistry, null, legacyValidator);
+  const noteCalls = [];
+  modeServer.tool('list_notes', 'Notes.', { note_id: z.string().optional(), limit: z.number().optional() }, async (input) => {
+    noteCalls.push(input);
+    return { content: [{ type: 'text', text: input.note_id ? `note ${input.note_id}` : 'all notes' }] };
+  });
+  const modeClient = new Client({ name: 'alias-transport-mode-client', version: '0.0.0' });
+  await modeServer.connect(modeTransport);
+  await modeClient.connect(modeClientSide);
+  try {
+    const legacyError = await modeClient.callTool({ name: 'get_note', arguments: {} });
+    assert.equal(legacyError.isError, true);
+    assert.equal(legacyError.content[0].text, 'MCP error -32602: old get_note schema error', 'the old schema error text is kept');
+    assert.equal(legacyError.content.length, 2, 'the rename note is still appended');
+    assert.equal(noteCalls.length, 0, 'the handler never ran');
+    const one = await modeClient.callTool({ name: 'get_note', arguments: { note_id: 'n_1', extra: 'dropped' } });
+    assert.equal(one.content[0].text, 'note n_1');
+    assert.deepEqual(noteCalls, [{ note_id: 'n_1' }], 'the legacy-parsed args (unknown keys dropped) reach the handler');
+  } finally {
+    await modeClient.close();
+    await modeServer.close();
+  }
+
+  // Without a legacy validator, the pinned mode still rejects a missing id.
+  const pinServer = new McpServer({ name: 'alias-transport-pin-test', version: '0.0.0' });
+  const [pinClientSide, pinServerSide] = InMemoryTransport.createLinkedPair();
+  const pinTransport = new AliasTransport(pinServerSide, modeRegistry);
+  let pinHandlerRan = false;
+  pinServer.tool('list_notes', 'Notes.', { note_id: z.string().optional() }, async () => {
+    pinHandlerRan = true;
+    return { content: [{ type: 'text', text: 'all notes' }] };
+  });
+  const pinClient = new Client({ name: 'alias-transport-pin-client', version: '0.0.0' });
+  await pinServer.connect(pinTransport);
+  await pinClient.connect(pinClientSide);
+  try {
+    const pinned = await pinClient.callTool({ name: 'get_note', arguments: {} });
+    assert.equal(pinned.isError, true);
+    assert.equal(pinned.content[0].text, 'note_id is required.');
+    assert.equal(pinHandlerRan, false, 'get_note without note_id never becomes a list call');
+  } finally {
+    await pinClient.close();
+    await pinServer.close();
+  }
+}
+
+console.log('OK  alias transport: hidden aliases, translated args, appended note, no leaks, tool sets filter tools/list only, pinned modes, legacy schemas.');