toolcraft 0.0.24 → 0.0.26

package/node_modules/auth-store/dist/encrypted-file-store.js

@@ -13,6 +13,7 @@ let temporaryFileSequence = 0;
 export class EncryptedFileStore {
     fs;
     filePath;
+    symbolicLinkCheckStartPath;
     salt;
     getMachineIdentity;
     getRandomBytes;
@@ -20,7 +21,16 @@ export class EncryptedFileStore {
     constructor(input) {
         this.fs = input.fs ?? fs;
         this.salt = input.salt;
-        this.filePath = input.filePath ?? path.join((input.getHomeDirectory ?? homedir)(), input.defaultDirectory ?? ".auth-store", input.defaultFileName ?? "credentials.enc");
+        if (input.filePath === undefined) {
+            const homeDirectory = (input.getHomeDirectory ?? homedir)();
+            const defaultDirectory = input.defaultDirectory ?? ".auth-store";
+            this.filePath = path.join(homeDirectory, defaultDirectory, input.defaultFileName ?? "credentials.enc");
+            this.symbolicLinkCheckStartPath = resolveDefaultDirectoryCheckStart(homeDirectory, defaultDirectory);
+        }
+        else {
+            this.filePath = input.filePath;
+            this.symbolicLinkCheckStartPath = null;
+        }
         this.getMachineIdentity = input.getMachineIdentity ?? defaultMachineIdentity;
         this.getRandomBytes = input.getRandomBytes ?? randomBytes;
     }
@@ -106,7 +116,7 @@ export class EncryptedFileStore {
     }
     async assertRegularCredentialPath() {
         const resolvedPath = path.resolve(this.filePath);
-        const protectedPaths = [path.dirname(resolvedPath), resolvedPath];
+        const protectedPaths = getProtectedCredentialPaths(resolvedPath, this.symbolicLinkCheckStartPath);
         for (const currentPath of protectedPaths) {
             try {
                 const stats = await this.fs.lstat(currentPath);
@@ -135,6 +145,30 @@ export class EncryptedFileStore {
         return this.keyPromise;
     }
 }
+function resolveDefaultDirectoryCheckStart(homeDirectory, defaultDirectory) {
+    const [firstSegment] = defaultDirectory.split(/[\\/]+/).filter(Boolean);
+    return path.resolve(homeDirectory, firstSegment ?? ".");
+}
+function getProtectedCredentialPaths(resolvedPath, symbolicLinkCheckStartPath) {
+    if (symbolicLinkCheckStartPath === null) {
+        return [path.dirname(resolvedPath), resolvedPath];
+    }
+    const resolvedStartPath = path.resolve(symbolicLinkCheckStartPath);
+    if (!isPathInsideOrEqual(resolvedPath, resolvedStartPath)) {
+        return [path.dirname(resolvedPath), resolvedPath];
+    }
+    const protectedPaths = [resolvedStartPath];
+    let currentPath = resolvedStartPath;
+    for (const segment of path.relative(resolvedStartPath, resolvedPath).split(path.sep).filter(Boolean)) {
+        currentPath = path.join(currentPath, segment);
+        protectedPaths.push(currentPath);
+    }
+    return protectedPaths;
+}
+function isPathInsideOrEqual(childPath, parentPath) {
+    const relativePath = path.relative(parentPath, childPath);
+    return relativePath === "" || (!relativePath.startsWith("..") && !path.isAbsolute(relativePath));
+}
 async function removeIfPresent(fileSystem, filePath) {
     try {
         await fileSystem.unlink(filePath);

package/node_modules/auth-store/dist/keychain-store.js

@@ -64,6 +64,19 @@ function runSecurityCommand(command, args, options) {
         });
         let stdout = "";
         let stderr = "";
+        let stdinErrorMessage;
+        const appendStderr = (message) => {
+            stderr = stderr.length === 0
+                ? message
+                : `${stderr}${stderr.endsWith("\n") ? "" : "\n"}${message}`;
+        };
+        const appendStdinError = () => {
+            if (stdinErrorMessage === undefined) {
+                return;
+            }
+            appendStderr(stdinErrorMessage);
+            stdinErrorMessage = undefined;
+        };
         child.stdout?.setEncoding("utf8");
         child.stdout?.on("data", (chunk) => {
             stdout += chunk.toString();
@@ -73,17 +86,23 @@ function runSecurityCommand(command, args, options) {
             stderr += chunk.toString();
         });
         if (options?.stdin !== undefined) {
+            child.stdin?.once("error", (error) => {
+                stdinErrorMessage = error instanceof Error ? error.message : String(error);
+            });
             child.stdin?.end(options.stdin);
         }
         child.on("error", (error) => {
             const message = error instanceof Error ? error.message : String(error ?? "Unknown error");
+            appendStdinError();
+            appendStderr(message);
             resolve({
                 stdout,
-                stderr: stderr ? `${stderr}${message}` : message,
+                stderr,
                 exitCode: 127
             });
         });
         child.on("close", (code) => {
+            appendStdinError();
             resolve({
                 stdout,
                 stderr,

package/node_modules/mcp-oauth/dist/client/auth-store-session-store.js

@@ -61,12 +61,15 @@ export function createAuthStoreClientStore(options) {
 }
 function createNamedSecretStore(key, options, defaults) {
     const hash = crypto.createHash("sha256").update(key).digest("hex");
-    const parsedFilePath = options.fileStore?.filePath === undefined ? null : path.parse(options.fileStore.filePath);
+    const configuredFilePath = options.fileStore?.filePath;
+    const parsedFilePath = configuredFilePath === undefined ? null : path.parse(configuredFilePath);
     const fileStore = {
         ...options.fileStore,
+        filePath: parsedFilePath === null
+            ? undefined
+            : path.join(parsedFilePath.dir, `${parsedFilePath.name}-${hash}${parsedFilePath.ext || ".enc"}`),
         salt: options.fileStore?.salt ?? defaults.salt,
-        defaultDirectory: parsedFilePath?.dir ||
-            options.fileStore?.defaultDirectory ||
+        defaultDirectory: options.fileStore?.defaultDirectory ||
             defaults.directory,
         defaultFileName: parsedFilePath === null
             ? `${hash}.enc`

package/node_modules/tiny-mcp-client/dist/internal.d.ts

@@ -400,6 +400,7 @@ export declare class StdioTransport implements McpTransport {
     private static readonly STDERR_MAX_LENGTH;
     constructor({ command, args, cwd, env, spawn: spawnProcess, }: StdioTransportOptions);
     getStderrOutput(): string;
+    private appendStderrOutput;
     dispose(reason?: Error): void;
 }
 export declare class HttpTransport implements McpTransport {
@@ -515,6 +516,7 @@ export declare class SseParser {
 export interface JsonRpcRequestOptions {
     timeoutMs?: number;
     onRequestId?: (requestId: RequestId) => void;
+    onTimeout?: (requestId: RequestId) => void;
 }
 interface JsonRpcRequestContext {
     id: RequestId;
@@ -541,6 +543,7 @@ export declare class JsonRpcMessageLayer {
     onRequest(method: string, handler: JsonRpcRequestHandler): void;
     onNotification(method: string, handler: JsonRpcNotificationHandler): void;
     sendRequest(method: string, params?: unknown, options?: JsonRpcRequestOptions): Promise<unknown>;
+    cancelRequest(requestId: RequestId, reason: unknown): boolean;
     dispose(reason?: Error): void;
     private consumeInput;
     private resolveInputStreamClosedReason;

package/node_modules/tiny-mcp-client/dist/internal.js

@@ -258,10 +258,19 @@ export class McpClient {
         }
         try {
             let requestId;
+            let cancellationSent = false;
+            const sendCancellationNotification = () => {
+                if (requestId === undefined || cancellationSent) {
+                    return;
+                }
+                cancellationSent = true;
+                messageLayer.sendNotification("notifications/cancelled", { requestId });
+            };
             const requestPromise = messageLayer.sendRequest("tools/call", requestParams, {
                 onRequestId: (nextRequestId) => {
                     requestId = nextRequestId;
                 },
+                onTimeout: sendCancellationNotification,
             }).then((result) => {
                 if (!isCallToolResult(result)) {
                     throw new McpError(ERROR_INVALID_REQUEST, "Invalid tool result");
@@ -275,8 +284,9 @@ export class McpClient {
             let abortListener;
             const abortPromise = new Promise((_, reject) => {
                 const rejectWithAbortReason = () => {
+                    sendCancellationNotification();
                     if (requestId !== undefined) {
-                        messageLayer.sendNotification("notifications/cancelled", { requestId });
+                        messageLayer.cancelRequest(requestId, signal.reason);
                     }
                     reject(signal.reason);
                 };
@@ -1504,11 +1514,15 @@ export class StdioTransport {
         const child = this.child;
         this.readable = child.stdout;
         this.writable = child.stdin;
+        const stderrDecoder = new TextDecoder();
         child.stderr.on("data", (chunk) => {
-            this.stderrOutput += chunkToString(chunk);
-            if (this.stderrOutput.length > StdioTransport.STDERR_MAX_LENGTH) {
-                this.stderrOutput = this.stderrOutput.slice(-StdioTransport.STDERR_MAX_LENGTH);
-            }
+            const decoded = chunk instanceof Uint8Array
+                ? stderrDecoder.decode(chunk, { stream: true })
+                : `${stderrDecoder.decode()}${String(chunk)}`;
+            this.appendStderrOutput(decoded);
+        });
+        child.stderr.once("end", () => {
+            this.appendStderrOutput(stderrDecoder.decode());
         });
         this.closed = new Promise((resolve) => {
             let settled = false;
@@ -1548,6 +1562,15 @@ export class StdioTransport {
     getStderrOutput() {
         return this.stderrOutput;
     }
+    appendStderrOutput(chunk) {
+        if (chunk.length === 0) {
+            return;
+        }
+        this.stderrOutput += chunk;
+        if (this.stderrOutput.length > StdioTransport.STDERR_MAX_LENGTH) {
+            this.stderrOutput = this.stderrOutput.slice(-StdioTransport.STDERR_MAX_LENGTH);
+        }
+    }
     dispose(reason = new Error("Stdio transport disposed")) {
         void reason;
         if (this.disposed) {
@@ -1959,15 +1982,6 @@ export class McpError extends Error {
 export function serializeJsonRpcMessage(message) {
     return `${JSON.stringify(message)}\n`;
 }
-function chunkToString(chunk) {
-    if (typeof chunk === "string") {
-        return chunk;
-    }
-    if (chunk instanceof Uint8Array) {
-        return Buffer.from(chunk).toString("utf8");
-    }
-    return String(chunk);
-}
 function normalizeLine(line) {
     return line.endsWith("\r") ? line.slice(0, -1) : line;
 }
@@ -2147,6 +2161,7 @@ export class JsonRpcMessageLayer {
         return new Promise((resolve, reject) => {
             const timeout = setTimeout(() => {
                 this.pendingRequests.delete(id);
+                options.onTimeout?.(id);
                 reject(new Error(`JSON-RPC request "${method}" timed out after ${timeoutMs}ms`));
             }, timeoutMs);
             this.pendingRequests.set(id, { resolve, reject, timeout });
@@ -2160,6 +2175,16 @@ export class JsonRpcMessageLayer {
             }
         });
     }
+    cancelRequest(requestId, reason) {
+        const pending = this.pendingRequests.get(requestId);
+        if (pending === undefined) {
+            return false;
+        }
+        this.pendingRequests.delete(requestId);
+        clearTimeout(pending.timeout);
+        pending.reject(reason);
+        return true;
+    }
     dispose(reason = new Error("JSON-RPC message layer disposed")) {
         if (this.disposedError !== undefined) {
             return;

package/node_modules/tiny-mcp-client/src/internal.ts

@@ -449,10 +449,19 @@ export class McpClient {
 
     try {
       let requestId: RequestId | undefined;
+      let cancellationSent = false;
+      const sendCancellationNotification = () => {
+        if (requestId === undefined || cancellationSent) {
+          return;
+        }
+        cancellationSent = true;
+        messageLayer.sendNotification("notifications/cancelled", { requestId });
+      };
       const requestPromise = messageLayer.sendRequest("tools/call", requestParams, {
         onRequestId: (nextRequestId) => {
           requestId = nextRequestId;
         },
+        onTimeout: sendCancellationNotification,
       }).then((result) => {
         if (!isCallToolResult(result)) {
           throw new McpError(ERROR_INVALID_REQUEST, "Invalid tool result");
@@ -468,8 +477,9 @@ export class McpClient {
       let abortListener: (() => void) | undefined;
       const abortPromise = new Promise<CallToolResult>((_, reject) => {
         const rejectWithAbortReason = () => {
+          sendCancellationNotification();
           if (requestId !== undefined) {
-            messageLayer.sendNotification("notifications/cancelled", { requestId });
+            messageLayer.cancelRequest(requestId, signal.reason);
           }
           reject(signal.reason);
         };
@@ -2343,11 +2353,16 @@ export class StdioTransport implements McpTransport {
 
     this.readable = child.stdout;
     this.writable = child.stdin;
+    const stderrDecoder = new TextDecoder();
     child.stderr.on("data", (chunk: unknown) => {
-      this.stderrOutput += chunkToString(chunk);
-      if (this.stderrOutput.length > StdioTransport.STDERR_MAX_LENGTH) {
-        this.stderrOutput = this.stderrOutput.slice(-StdioTransport.STDERR_MAX_LENGTH);
-      }
+      const decoded =
+        chunk instanceof Uint8Array
+          ? stderrDecoder.decode(chunk, { stream: true })
+          : `${stderrDecoder.decode()}${String(chunk)}`;
+      this.appendStderrOutput(decoded);
+    });
+    child.stderr.once("end", () => {
+      this.appendStderrOutput(stderrDecoder.decode());
     });
     this.closed = new Promise((resolve) => {
       let settled = false;
@@ -2398,6 +2413,17 @@ export class StdioTransport implements McpTransport {
     return this.stderrOutput;
   }
 
+  private appendStderrOutput(chunk: string): void {
+    if (chunk.length === 0) {
+      return;
+    }
+
+    this.stderrOutput += chunk;
+    if (this.stderrOutput.length > StdioTransport.STDERR_MAX_LENGTH) {
+      this.stderrOutput = this.stderrOutput.slice(-StdioTransport.STDERR_MAX_LENGTH);
+    }
+  }
+
   dispose(reason = new Error("Stdio transport disposed")): void {
     void reason;
 
@@ -2958,18 +2984,6 @@ export function serializeJsonRpcMessage(message: JsonRpcMessage): string {
   return `${JSON.stringify(message)}\n`;
 }
 
-function chunkToString(chunk: unknown): string {
-  if (typeof chunk === "string") {
-    return chunk;
-  }
-
-  if (chunk instanceof Uint8Array) {
-    return Buffer.from(chunk).toString("utf8");
-  }
-
-  return String(chunk);
-}
-
 function normalizeLine(line: string): string {
   return line.endsWith("\r") ? line.slice(0, -1) : line;
 }
@@ -3134,6 +3148,7 @@ interface ActiveIncomingRequest {
 export interface JsonRpcRequestOptions {
   timeoutMs?: number;
   onRequestId?: (requestId: RequestId) => void;
+  onTimeout?: (requestId: RequestId) => void;
 }
 
 interface JsonRpcRequestContext {
@@ -3242,6 +3257,7 @@ export class JsonRpcMessageLayer {
     return new Promise((resolve, reject) => {
       const timeout = setTimeout(() => {
         this.pendingRequests.delete(id);
+        options.onTimeout?.(id);
         reject(new Error(`JSON-RPC request "${method}" timed out after ${timeoutMs}ms`));
       }, timeoutMs);
 
@@ -3257,6 +3273,18 @@ export class JsonRpcMessageLayer {
     });
   }
 
+  cancelRequest(requestId: RequestId, reason: unknown): boolean {
+    const pending = this.pendingRequests.get(requestId);
+    if (pending === undefined) {
+      return false;
+    }
+
+    this.pendingRequests.delete(requestId);
+    clearTimeout(pending.timeout);
+    pending.reject(reason);
+    return true;
+  }
+
   dispose(reason = new Error("JSON-RPC message layer disposed")): void {
     if (this.disposedError !== undefined) {
       return;

package/node_modules/tiny-mcp-client/src/mcp-client-sdk.test.ts

@@ -293,6 +293,38 @@ describe("McpClient SDK integration callTool", () => {
     }
   });
 
+  it("cancels an in-flight slow tool call when the request timeout elapses", async () => {
+    const server = await createMockSlowToolServer({ delayMs: 1_000, pollIntervalMs: 5 });
+    const { client, cleanup } = await createSdkTestPair(server, () =>
+      new McpClient({
+        clientInfo: {
+          name: "test-client",
+          version: "1.0.0",
+        },
+        requestTimeoutMs: 100,
+      })
+    );
+
+    try {
+      const callPromise = client.callTool({
+        name: "slow",
+        arguments: {
+          delayMs: 500,
+        },
+      });
+
+      await waitFor(() => server.wasStarted(), "Timed out waiting for slow tool to start");
+
+      await expect(callPromise).rejects.toThrow(
+        'JSON-RPC request "tools/call" timed out after 100ms'
+      );
+      await waitFor(() => server.wasCancelled(), "Timed out waiting for slow tool cancellation");
+      expect(server.getCancelledRequestIds()).toEqual(server.getStartedRequestIds());
+    } finally {
+      await cleanup();
+    }
+  });
+
   it("rejects with JSON-RPC error code and message for unknown tool names", async () => {
     const server = await createMockErrorServer();
     const { client, cleanup } = await createSdkTestPair(server, () =>

package/node_modules/tiny-mcp-client/src/transports.test.ts

@@ -1471,6 +1471,40 @@ describe("JsonRpcMessageLayer sendRequest", () => {
       vi.useRealTimers();
     }
   });
+
+  it("clears pending request state and timeout when a request is cancelled", async () => {
+    vi.useFakeTimers();
+    try {
+      const input = new PassThrough();
+      const output = new PassThrough();
+      trackForCleanup(input, output);
+      const layer = new JsonRpcMessageLayer(input, output, 25);
+      const onTimeout = vi.fn();
+      const pendingCount = () =>
+        (
+          layer as unknown as {
+            pendingRequests: Map<unknown, unknown>;
+          }
+        ).pendingRequests.size;
+
+      const responsePromise = layer.sendRequest("slow/method", undefined, {
+        onTimeout,
+      });
+      expect(pendingCount()).toBe(1);
+
+      expect(layer.cancelRequest(1, "user cancelled")).toBe(true);
+
+      await expect(responsePromise).rejects.toBe("user cancelled");
+      expect(pendingCount()).toBe(0);
+
+      await vi.advanceTimersByTimeAsync(25);
+
+      expect(onTimeout).not.toHaveBeenCalled();
+      expect(layer.cancelRequest(1, "already gone")).toBe(false);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
 });
 
 describe("JsonRpcMessageLayer UTF-8 input", () => {
@@ -2643,6 +2677,22 @@ describe("StdioTransport stderr capture", () => {
     expect(transport.getStderrOutput()).toBe("first second");
   });
 
+  it("preserves UTF-8 characters split across stderr chunks", () => {
+    const child = createMockChildProcess();
+    const spawn = vi.fn<StdioSpawn>(() => child);
+
+    const transport = new StdioTransport({
+      command: "node",
+      spawn,
+    });
+
+    const encoded = Buffer.from("é", "utf8");
+    child.stderr.write(encoded.subarray(0, 1));
+    child.stderr.write(encoded.subarray(1));
+
+    expect(transport.getStderrOutput()).toBe("é");
+  });
+
   it("caps stderr at 64KB keeping the tail", () => {
     const child = createMockChildProcess();
     const spawn = vi.fn<StdioSpawn>(() => child);
@@ -7123,6 +7173,21 @@ describe("McpClient callTool", () => {
       throw new Error("Expected initialized notification line to be written");
     }
 
+    const activeMessageLayer = (
+      client as unknown as {
+        messageLayer: JsonRpcMessageLayer | null;
+      }
+    ).messageLayer;
+    if (activeMessageLayer === null) {
+      throw new Error("Expected message layer to exist after connect");
+    }
+    const pendingCount = () =>
+      (
+        activeMessageLayer as unknown as {
+          pendingRequests: Map<unknown, unknown>;
+        }
+      ).pendingRequests.size;
+
     const abortController = new AbortController();
     const callToolPromise = client.callTool(
       {
@@ -7142,6 +7207,8 @@ describe("McpClient callTool", () => {
     const callToolRequest = JSON.parse(callToolLineResult.value) as {
       id: number;
     };
+    expect(pendingCount()).toBe(1);
+
     abortController.abort("user cancelled");
 
     const cancelledLineResult = await iterator.next();
@@ -7158,6 +7225,7 @@ describe("McpClient callTool", () => {
     });
 
     await callToolRejection;
+    expect(pendingCount()).toBe(0);
     await client.close();
   });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft",
-  "version": "0.0.24",
+  "version": "0.0.26",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -45,7 +45,7 @@
   "dependencies": {
     "@clack/core": "^1.0.0",
     "@clack/prompts": "^1.0.0",
-    "toolcraft-schema": "0.0.24",
+    "toolcraft-schema": "0.0.26",
     "commander": "^14.0.3",
     "jose": "^6.1.2",
     "jsonc-parser": "^3.3.1",