toolstile 0.4.0 → 0.4.1

package/dist/agents.d.ts

@@ -30,7 +30,8 @@ export declare class ManualEditError extends Error {
     constructor(target: Target, reason: string, snippet: string);
 }
 /** Replaces the file in one step and keeps its permission bits; a symlink keeps pointing at it. */
-export declare function writeText(link: string, text: string): void;
+export declare function writeText(link: string, text: string, expected?: string): void;
+export declare function updateText(link: string, update: (text: string | null) => string): void;
 /**
  * Drops `[mcp_servers.<name>]` and its sub-tables, keeping every other line and comment. With
  * `replacement`, that text goes where the table was (or at the end when there was none).

package/dist/agents.js

@@ -1,3 +1,5 @@
+import { fileText, withFileLock } from "./file-lock.js";
+import { randomUUID } from "node:crypto";
 import { chmodSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
 import { dirname, join } from "node:path";
 import { parse as parseToml } from "smol-toml";
@@ -65,7 +67,17 @@ function readText(path) {
     }
 }
 /** Replaces the file in one step and keeps its permission bits; a symlink keeps pointing at it. */
-export function writeText(link, text) {
+export function writeText(link, text, expected) {
+    return withFileLock(link, () => {
+        if (expected !== undefined && fileText(link) !== expected)
+            throw new Error("The config changed while it was being edited; run the command again.");
+        writeTextLocked(link, text);
+    });
+}
+export function updateText(link, update) {
+    return withFileLock(link, () => writeTextLocked(link, update(fileText(link))));
+}
+function writeTextLocked(link, text) {
     let path = link;
     let mode = 0o600;
     try {
@@ -75,7 +87,7 @@ export function writeText(link, text) {
     catch {
         mkdirSync(dirname(path), { recursive: true });
     }
-    const temp = `${path}.toolstile-${process.pid}.tmp`;
+    const temp = `${path}.toolstile-${process.pid}-${randomUUID()}.tmp`;
     try {
         writeFileSync(temp, text, { mode });
         chmodSync(temp, mode);
@@ -142,6 +154,9 @@ export function readEntry(target) {
 /** `replaced` means a hand-written `toolstile` server (not the proxy) was swapped out. */
 const outcome = (command, existing) => !command ? "removed" : existing === undefined ? "added" : isProxyEntry(existing) ? "updated" : "replaced";
 export function writeEntry(target, command) {
+    return withFileLock(target.path, () => writeEntryLocked(target, command));
+}
+function writeEntryLocked(target, command) {
     const text = readText(target.path) ?? "";
     if (target.format === "codex") {
         let current;
@@ -168,7 +183,9 @@ export function writeEntry(target, command) {
             throw new ManualEditError(target, "its toolstile server is written in a form setup cannot edit", command ? tomlEntry(command) : "");
         if (next === text)
             return "unchanged";
-        writeText(target.path, next);
+        if ((readText(target.path) ?? "") !== text)
+            throw new Error("The agent config changed; run setup again.");
+        writeTextLocked(target.path, next);
         return outcome(command, existing);
     }
     const key = serversKey(target.format);
@@ -201,6 +218,8 @@ export function writeEntry(target, command) {
         delete servers[ENTRY];
     object[key] = servers;
     const indent = text.match(/\n([ \t]+)"/)?.[1] ?? "  ";
-    writeText(target.path, `${JSON.stringify(object, null, indent)}\n`);
+    if ((readText(target.path) ?? "") !== text)
+        throw new Error("The agent config changed; run setup again.");
+    writeTextLocked(target.path, `${JSON.stringify(object, null, indent)}\n`);
     return outcome(entry, existing);
 }

package/dist/api.js

@@ -1,3 +1,4 @@
+import { boundedText, deadline } from "./bounds.js";
 export const CLIENT_ID = "toolstile-cli";
 export class ApiError extends Error {
     status;
@@ -10,26 +11,37 @@ export class ApiError extends Error {
     }
 }
 async function request(fetcher, url, init = {}) {
-    let response;
-    try {
-        response = await fetcher(url, {
-            ...init,
-            // Never follow a redirect with a session token to another address.
-            redirect: "error",
-            headers: { "Content-Type": "application/json", Accept: "application/json", ...init.headers },
-        });
-    }
-    catch {
+    return deadline(async (signal) => {
+        let response;
+        try {
+            response = await fetcher(url, {
+                ...init,
+                signal,
+                // Never follow a redirect with a session token to another address.
+                redirect: "error",
+                headers: { "Content-Type": "application/json", Accept: "application/json", ...init.headers },
+            });
+        }
+        catch {
+            throw new ApiError(0, `Could not reach ${new URL(url).origin}. Check your connection.`);
+        }
+        if (response.status === 204)
+            return undefined;
+        const body = (await boundedText(response).then((text) => JSON.parse(text)).catch((error) => {
+            if (error instanceof SyntaxError)
+                return null;
+            throw error;
+        }));
+        if (!response.ok) {
+            const message = body?.error_description ?? body?.message;
+            throw new ApiError(response.status, typeof message === "string" ? message : `Request failed (${response.status})`, typeof body?.error === "string" ? body.error : undefined);
+        }
+        return body;
+    }, 30_000, init.signal ?? undefined).catch((error) => {
+        if (error instanceof ApiError)
+            throw error;
         throw new ApiError(0, `Could not reach ${new URL(url).origin}. Check your connection.`);
-    }
-    if (response.status === 204)
-        return undefined;
-    const body = (await response.json().catch(() => null));
-    if (!response.ok) {
-        const message = body?.error_description ?? body?.message;
-        throw new ApiError(response.status, typeof message === "string" ? message : `Request failed (${response.status})`, typeof body?.error === "string" ? body.error : undefined);
-    }
-    return body;
+    });
 }
 /** The Toolstile endpoints the CLI uses. Session calls carry the device-flow session token. */
 export function createApi(server, fetcher = fetch) {

package/dist/bounds.d.ts

@@ -0,0 +1,3 @@
+/** Bounds short operations even when a transport ignores its abort signal. */
+export declare function deadline<T>(run: (signal: AbortSignal) => Promise<T>, ms: number, parent?: AbortSignal): Promise<T>;
+export declare function boundedText(response: Response, limit?: number): Promise<string>;

package/dist/bounds.js

@@ -0,0 +1,43 @@
+/** Bounds short operations even when a transport ignores its abort signal. */
+export async function deadline(run, ms, parent) {
+    const controller = new AbortController();
+    let timer;
+    let abort = () => { };
+    const stopped = new Promise((_, reject) => {
+        abort = () => { controller.abort(); reject(new Error("Request cancelled or timed out")); };
+        parent?.addEventListener("abort", abort, { once: true });
+        timer = setTimeout(abort, ms);
+    });
+    try {
+        if (parent?.aborted)
+            abort();
+        return await Promise.race([stopped, Promise.resolve().then(() => run(controller.signal))]);
+    }
+    finally {
+        clearTimeout(timer);
+        parent?.removeEventListener("abort", abort);
+    }
+}
+export async function boundedText(response, limit = 1024 * 1024) {
+    if (!response.body)
+        return "";
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let size = 0;
+    let text = "";
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                return text + decoder.decode();
+            size += value.byteLength;
+            if (size > limit)
+                throw new Error("Response exceeded the size limit");
+            text += decoder.decode(value, { stream: true });
+        }
+    }
+    finally {
+        void reader.cancel().catch(() => { });
+        reader.releaseLock();
+    }
+}

package/dist/commands.js

@@ -6,13 +6,24 @@ import { checklist } from "./prompt.js";
 import { runProxy } from "./proxy.js";
 import { tildify } from "./report.js";
 import { CLIENT_NAMES } from "./sources.js";
-import { loadState, saveState } from "./state.js";
+import { loadState, saveState, withCurrentState } from "./state.js";
 /** A failure explained to the user; exits 1 without a stack trace. */
 export class UserError extends Error {
 }
 const stateEnv = (ctx) => ({ home: ctx.home, env: ctx.env, platform: ctx.platform });
 const print = (ctx, text = "") => ctx.stdout.write(`${text}\n`);
 const interactive = (ctx) => ctx.stdin.isTTY === true && ctx.stdout.isTTY === true;
+/** A failed local save must not silently abandon a newly issued remote credential. */
+async function compensate(error, cleanup, remedy) {
+    try {
+        await cleanup();
+    }
+    catch (cleanupError) {
+        if (!(cleanupError instanceof ApiError && cleanupError.status === 404))
+            throw new UserError(`${error instanceof Error ? error.message : "Could not save credentials."} ${remedy}`);
+    }
+    throw error;
+}
 /** HTTPS, except a loopback server for local development. */
 export function normalizeServer(value) {
     let url;
@@ -107,25 +118,37 @@ export async function login(ctx, options) {
             throw error;
         }
     }
-    const account = await api.account(token);
     const previous = state.session;
-    // The old session is ended where it was issued, never sent to the new server.
-    if (previous)
-        await ctx.api(previous.server ?? state.server).signOut(previous.token).catch(() => undefined);
-    if (server !== state.server || (previous && previous.email !== account.email)) {
-        // Another account's workspace and device do not apply; enabled agents keep their own access.
-        delete state.workspace;
-        delete state.device;
+    const previousServer = previous?.server ?? state.server;
+    let deviceLabel;
+    try {
+        const account = await api.account(token);
+        deviceLabel = account.device?.label;
+        if (server !== state.server || (previous && previous.email !== account.email)) {
+            // Another account's workspace and device do not apply; agents keep their own access.
+            delete state.workspace;
+            delete state.device;
+        }
+        state.server = server;
+        state.session = { token, email: account.email, expiresAt: account.expiresAt, server };
+        if (account.device)
+            state.device = account.device;
+        saveState(state, stateEnv(ctx));
     }
-    state.server = server;
-    state.session = { token, email: account.email, expiresAt: account.expiresAt, server };
-    // The device named on the approval page. Agents still on an older device move to it at
-    // the next `mcp setup`.
-    if (account.device)
-        state.device = account.device;
-    saveState(state, stateEnv(ctx));
+    catch (error) {
+        await compensate(error, async () => {
+            // Only discard this sign-in, never the session a concurrent command saved.
+            const winner = loadState(stateEnv(ctx)).session;
+            if (winner?.token !== token || winner.server !== server)
+                await api.signOut(token);
+        }, "Sign-in cleanup failed. Remove this new CLI session in the Toolstile dashboard.");
+    }
+    // End the previous session only after the replacement was safely saved.
+    if (previous && (previous.token !== token || previousServer !== server))
+        await ctx.api(previousServer).signOut(previous.token).catch(() => undefined);
+    const account = state.session;
     print(ctx);
-    print(ctx, `Signed in as ${s.bold(account.email)}${account.device ? ` on ${s.bold(account.device.label)}` : ""}. Next: ${s.bold("toolstile mcp setup")}`);
+    print(ctx, `Signed in as ${s.bold(account.email)}${deviceLabel ? ` on ${s.bold(deviceLabel)}` : ""}. Next: ${s.bold("toolstile mcp setup")}`);
     return 0;
 }
 export async function logout(ctx) {
@@ -134,17 +157,18 @@ export async function logout(ctx) {
         print(ctx, "Not signed in.");
         return 0;
     }
+    const session = state.session;
+    delete state.session;
+    saveState(state, stateEnv(ctx));
     let reached = true;
     await ctx
-        .api(state.session.server ?? state.server)
-        .signOut(state.session.token)
+        .api(session.server ?? state.server)
+        .signOut(session.token)
         .catch((error) => {
         // 401 means the session had already ended; anything else is worth saying.
         if (!(error instanceof ApiError && error.status === 401))
             reached = false;
     });
-    delete state.session;
-    saveState(state, stateEnv(ctx));
     print(ctx, reached ? "Signed out." : "Signed out on this machine. Toolstile could not be reached, so the session ends when it expires.");
     const enabled = Object.keys(state.agents).length;
     if (enabled)
@@ -274,13 +298,12 @@ export async function setup(ctx, options) {
         const want = wanted.has(target.client);
         const link = state.agents[target.client];
         if (want) {
+            let replacedAuthorization = false;
             if (live(target.client) && link && link.endpoint !== endpoint) {
                 link.endpoint = endpoint;
                 saveState(state, stateEnv(ctx));
             }
             if (!live(target.client)) {
-                if (link)
-                    await removeRemote(link).catch(() => undefined);
                 const { id: deviceId } = await ensureDevice();
                 const created = await api.addAgent(session.token, { workspaceId: workspace.id, deviceId, label: target.name });
                 state.agents[target.client] = {
@@ -291,11 +314,22 @@ export async function setup(ctx, options) {
                     label: created.label,
                     token: created.token,
                 };
-                // Saved before touching the agent's config, so a token is never lost.
-                saveState(state, stateEnv(ctx));
+                // Commit before editing config or revoking any previous authorization.
+                try {
+                    saveState(state, stateEnv(ctx));
+                }
+                catch (error) {
+                    await compensate(error, async () => {
+                        const winner = loadState(stateEnv(ctx));
+                        const retained = Object.values(winner.agents).some((agent) => agent?.id === created.id && agent.workspaceId === workspace.id && agent.server === state.server);
+                        if (!retained)
+                            await api.removeAgent(session.token, workspace.id, created.id);
+                    }, `Agent cleanup failed. Remove the new ${target.name} authorization (${created.id}) in the Toolstile dashboard.`);
+                }
+                replacedAuthorization = !!link;
             }
             try {
-                const result = writeEntry(target, proxyCommand(target.client, ctx.version, ctx.platform));
+                const result = withCurrentState(state, stateEnv(ctx), () => writeEntry(target, proxyCommand(target.client, ctx.version, ctx.platform)));
                 if (!live(target.client) || result !== "unchanged")
                     changes.push(`${s.bold("+")} ${target.name}  ${s.dim(tildify(target.path, ctx.home))}`);
                 if (result === "replaced")
@@ -306,20 +340,35 @@ export async function setup(ctx, options) {
                     throw error;
                 manual.push({ target, error, enable: true });
             }
+            finally {
+                // Finish both local writes before yielding to remote cleanup. A later
+                // disable must not be followed by this operation recreating its config.
+                if (replacedAuthorization && link)
+                    await removeRemote(link).catch(() => undefined);
+            }
         }
         else if (link || isProxyEntry(readEntry(target))) {
-            try {
-                writeEntry(target, null);
-            }
-            catch (error) {
-                if (!(error instanceof ManualEditError))
-                    throw error;
-                manual.push({ target, error, enable: false });
-            }
+            const removeLocal = () => {
+                try {
+                    writeEntry(target, null);
+                }
+                catch (error) {
+                    if (!(error instanceof ManualEditError))
+                        throw error;
+                    manual.push({ target, error, enable: false });
+                }
+                if (link)
+                    delete state.agents[target.client];
+            };
+            // Both local writes form one transition, even across separate processes.
+            if (link)
+                saveState(state, stateEnv(ctx), removeLocal);
+            else
+                withCurrentState(state, stateEnv(ctx), removeLocal);
             if (link) {
-                await removeRemote(link);
-                delete state.agents[target.client];
-                saveState(state, stateEnv(ctx));
+                await removeRemote(link).catch(() => {
+                    throw new UserError(`Disabled locally, but remote cleanup failed. Remove ${target.name} authorization (${link.id}) in the Toolstile dashboard.`);
+                });
             }
             changes.push(`${s.bold("-")} ${target.name}`);
         }

package/dist/file-lock.d.ts

@@ -0,0 +1,3 @@
+export declare function fileText(path: string): string | null;
+/** Fail closed rather than steal a lock from a possibly live command. */
+export declare function withFileLock<T>(path: string, run: () => T): T;

package/dist/file-lock.js

@@ -0,0 +1,38 @@
+import { mkdirSync, readFileSync, realpathSync, rmSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+export function fileText(path) {
+    try {
+        return readFileSync(path, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+/** Fail closed rather than steal a lock from a possibly live command. */
+export function withFileLock(path, run) {
+    mkdirSync(dirname(path), { recursive: true });
+    let canonical;
+    try {
+        canonical = realpathSync(path);
+    }
+    catch {
+        canonical = resolve(realpathSync(dirname(path)), path.split(/[\\/]/).pop());
+    }
+    const lock = `${canonical}.toolstile-lock`;
+    try {
+        mkdirSync(lock, { mode: 0o700 });
+    }
+    catch (error) {
+        if (error.code === "EEXIST")
+            throw new Error(`Another command is updating ${path}. Retry when it finishes. If it crashed, remove ${lock}.`);
+        throw error;
+    }
+    try {
+        return run();
+    }
+    finally {
+        rmSync(lock, { recursive: true });
+    }
+}

package/dist/fix.js

@@ -2,7 +2,7 @@ import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, statSync
 import { basename, dirname, join } from "node:path";
 import { applyEdits, modify } from "jsonc-parser";
 import { stringify as stringifyToml } from "smol-toml";
-import { withoutTomlTable, writeText } from "./agents.js";
+import { withoutTomlTable, writeText, updateText } from "./agents.js";
 import { isPinned, packageOf, secretsOf, shellPath, words } from "./checks.js";
 import { audit } from "./index.js";
 import { parseConfig } from "./parse.js";
@@ -474,35 +474,31 @@ export function applyFixes(plan, chosen, opts) {
     const secrets = ok.flatMap((f) => f.secrets);
     let profileAdded = false;
     if (secrets.length) {
-        const stored = readSecrets(plan.secretsFile);
-        let text = "";
-        try {
-            text = readFileSync(plan.secretsFile, "utf8");
-        }
-        catch {
-            text = "# MCP server secrets moved out of agent configs by toolstile audit --fix.\n# Only your user can read this file. Loaded by your shell; see the line in your shell profile.\n";
-        }
-        for (const { name, value } of secrets) {
-            if (stored.get(name) === value)
-                continue;
-            stored.set(name, value);
-            text = `${text.replace(/\n?$/, "\n")}export ${name}=${quote(value)}\n`;
-        }
         mkdirSync(dirname(plan.secretsFile), { recursive: true, mode: 0o700 });
-        writeText(plan.secretsFile, text);
+        updateText(plan.secretsFile, (current) => {
+            const stored = readSecrets(plan.secretsFile);
+            let text = current ?? "# MCP server secrets moved out of agent configs by toolstile audit --fix.\n# Only your user can read this file. Loaded by your shell; see the line in your shell profile.\n";
+            for (const { name, value } of secrets) {
+                if (stored.get(name) === value)
+                    continue;
+                if (stored.has(name))
+                    throw new Error("A saved secret changed; run --fix again.");
+                stored.set(name, value);
+                text = `${text.replace(/\n?$/, "\n")}export ${name}=${quote(value)}\n`;
+            }
+            return text;
+        });
         chmodSync(plan.secretsFile, 0o600);
         if (plan.profile) {
-            let profile = "";
-            try {
-                profile = readFileSync(plan.profile.path, "utf8");
-            }
-            catch { }
-            if (!profile.includes(shellPath(plan.secretsFile, opts.home)) && !profile.includes(plan.secretsFile)) {
-                const mode = existsSync(plan.profile.path) ? statSync(plan.profile.path).mode & 0o777 : 0o644;
-                writeText(plan.profile.path, `${profile}${profile && !profile.endsWith("\n") ? "\n" : ""}\n${plan.profile.line}\n`);
-                chmodSync(plan.profile.path, mode);
+            const mode = existsSync(plan.profile.path) ? statSync(plan.profile.path).mode & 0o777 : 0o644;
+            updateText(plan.profile.path, (current) => {
+                const profile = current ?? "";
+                if (profile.includes(shellPath(plan.secretsFile, opts.home)) || profile.includes(plan.secretsFile))
+                    return profile;
                 profileAdded = true;
-            }
+                return `${profile}${profile && !profile.endsWith("\n") ? "\n" : ""}\n${plan.profile.line}\n`;
+            });
+            chmodSync(plan.profile.path, mode);
         }
     }
     let backups = null;
@@ -521,8 +517,8 @@ export function applyFixes(plan, chosen, opts) {
             copyFileSync(file, copy);
             chmodSync(copy, 0o600);
         }
-        for (const [file, { after }] of texts)
-            writeText(file, after);
+        for (const [file, { before, after }] of texts)
+            writeText(file, after, before);
     }
     for (const fix of ok)
         for (const op of fix.ops)

package/dist/proxy.js

@@ -1,22 +1,61 @@
-import { createInterface } from "node:readline";
+import { boundedText, deadline } from "./bounds.js";
+import { StringDecoder } from "node:string_decoder";
+// Replies and notifications can unblock an active request, even during initialization.
+const urgent = (message) => message.method === undefined ||
+    (message.id === undefined && message.method !== "notifications/initialized");
+function isMessage(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const m = value;
+    if (m.jsonrpc !== "2.0")
+        return false;
+    if ("id" in m && m.id !== null && typeof m.id !== "string" && !(typeof m.id === "number" && Number.isFinite(m.id)))
+        return false;
+    if ("method" in m)
+        return typeof m.method === "string" && !("result" in m) && !("error" in m) &&
+            (!("params" in m) || (m.params !== null && typeof m.params === "object"));
+    if (!("id" in m) || (("result" in m) === ("error" in m)))
+        return false;
+    if ("error" in m) {
+        const e = m.error;
+        return !!e && typeof e === "object" && Number.isInteger(e.code) && typeof e.message === "string";
+    }
+    return true;
+}
 /** Yields each SSE event's data and id. */
 async function* events(body) {
     const decoder = new TextDecoder();
     let buffer = "";
     let data = [];
     let id;
+    let eventBytes = 0;
+    let lineBytes = 0;
+    const append = (part) => {
+        lineBytes += Buffer.byteLength(part, "utf8");
+        if (lineBytes > 1024 * 1024)
+            throw new Error("SSE line exceeded the size limit");
+        buffer += part;
+    };
     for await (const chunk of body) {
-        buffer += decoder.decode(chunk, { stream: true });
+        const text = decoder.decode(chunk, { stream: true });
+        let start = 0;
         let newline;
-        while ((newline = buffer.search(/\r?\n/)) !== -1) {
-            const line = buffer.slice(0, newline);
-            buffer = buffer.slice(buffer[newline] === "\r" ? newline + 2 : newline + 1);
+        while ((newline = text.indexOf("\n", start)) !== -1) {
+            append(text.slice(start, newline));
+            const line = buffer.endsWith("\r") ? buffer.slice(0, -1) : buffer;
+            buffer = "";
+            lineBytes = 0;
+            start = newline + 1;
             if (line === "") {
                 if (data.length)
                     yield { data: data.join("\n"), id };
                 data = [];
+                eventBytes = 0;
                 continue;
             }
+            eventBytes += Buffer.byteLength(line, "utf8");
+            if (eventBytes > 1024 * 1024)
+                throw new Error("SSE event exceeded the size limit");
             if (line.startsWith(":"))
                 continue;
             const colon = line.indexOf(":");
@@ -27,10 +66,37 @@ async function* events(body) {
             else if (field === "id")
                 id = value;
         }
+        append(text.slice(start));
     }
+    append(decoder.decode());
     if (data.length)
         yield { data: data.join("\n"), id };
 }
+/** Frame incrementally rather than letting readline queue unbounded complete lines. */
+async function* inputLines(input) {
+    const decoder = new StringDecoder("utf8");
+    let buffer = "";
+    const append = (part) => {
+        if (Buffer.byteLength(buffer) + Buffer.byteLength(part) > 1024 * 1024)
+            throw new Error("Input line exceeded the size limit");
+        buffer += part;
+    };
+    for await (const chunk of input) {
+        const text = typeof chunk === "string" ? chunk : decoder.write(chunk);
+        let start = 0;
+        let newline;
+        while ((newline = text.indexOf("\n", start)) !== -1) {
+            append(text.slice(start, newline));
+            yield buffer;
+            buffer = "";
+            start = newline + 1;
+        }
+        append(text.slice(start));
+    }
+    append(decoder.end());
+    if (buffer)
+        yield buffer;
+}
 /** How long in-flight requests may finish after the agent closes stdin. */
 const CLOSE_GRACE_MS = 3000;
 export function runProxy(options) {
@@ -39,16 +105,51 @@ export function runProxy(options) {
     let protocolVersion;
     /** The agent's own `initialize`, replayed if the gateway forgets the session. */
     let opening;
-    let listening = false;
+    let listener;
+    let recovering;
     let closed = false;
     /** Aborts every request and the listener's waits once the agent has gone. */
     const shutdown = new AbortController();
     const pending = new Set();
     /** Later messages wait for `initialize`, so they carry the session it opens. */
     let initialized = Promise.resolve();
+    // Requests and control messages have independent budgets. No waiting input queue:
+    // overload is answered locally, and exhausted control/output budgets close the proxy.
+    const LIMIT = 64;
+    let requestCount = 0;
+    let controlCount = 0;
+    let finishForced;
+    const forced = new Promise((resolve) => { finishForced = resolve; });
+    const stop = () => {
+        closed = true;
+        shutdown.abort();
+        options.input.destroy();
+        finishForced();
+    };
+    let writes = Promise.resolve();
+    let queuedWrites = 0;
+    let queuedBytes = 0;
     const write = (message) => {
-        if (!options.output.writableEnded)
-            options.output.write(`${JSON.stringify(message)}\n`);
+        if (closed)
+            return Promise.resolve();
+        const text = `${JSON.stringify(message)}\n`;
+        const bytes = Buffer.byteLength(text);
+        if (queuedWrites >= 128 || queuedBytes + bytes > 8 * 1024 * 1024) {
+            options.log("Proxy output limit exceeded; closing the connection.");
+            stop();
+            return Promise.resolve();
+        }
+        queuedWrites++;
+        queuedBytes += bytes;
+        writes = writes.then(() => new Promise((resolve, reject) => {
+            if (closed || options.output.writableEnded)
+                return resolve();
+            const finish = (error) => error ? reject(error) : resolve();
+            options.output.write(text, finish);
+        })).finally(() => { queuedWrites--; queuedBytes -= bytes; });
+        // Observe immediately; send/readBody await the same promise to apply backpressure.
+        void writes.catch(stop);
+        return writes;
     };
     const headers = (extra = {}) => ({
         Authorization: `Bearer ${options.token}`,
@@ -57,7 +158,9 @@ export function runProxy(options) {
         ...extra,
     });
     /** Never follow a redirect: the token is only for the gateway endpoint. */
-    const request = (init) => fetcher(options.endpoint, { ...init, redirect: "error", signal: shutdown.signal });
+    const request = (init) => shutdown.signal.aborted
+        ? Promise.reject(new Error("The agent closed the connection"))
+        : fetcher(options.endpoint, { ...init, redirect: "error", signal: init.signal ?? shutdown.signal });
     const post = (body) => request({
         method: "POST",
         headers: headers({ "Content-Type": "application/json", Accept: "application/json, text/event-stream" }),
@@ -78,17 +181,24 @@ export function runProxy(options) {
         }
         if (message.method === undefined && message.id !== undefined)
             answered?.add(message.id);
-        write(message);
+        return write(message);
     };
     async function readBody(response, answered, quiet = false) {
         const type = response.headers.get("content-type") ?? "";
-        const take = (message) => (quiet ? answered.add(message.id) : deliver(message, answered));
+        const take = async (message) => {
+            if (!isMessage(message))
+                throw new Error("Invalid JSON-RPC response");
+            if (quiet)
+                answered.add(message.id);
+            else
+                await deliver(message, answered);
+        };
         if (!response.body)
             return;
         if (type.includes("text/event-stream")) {
             for await (const event of events(response.body)) {
                 try {
-                    take(JSON.parse(event.data));
+                    await take(JSON.parse(event.data));
                 }
                 catch {
                     options.log("Ignored a malformed message from Toolstile.");
@@ -97,55 +207,79 @@ export function runProxy(options) {
             return;
         }
         if (type.includes("application/json")) {
-            const body = (await response.json());
+            const body = JSON.parse(await boundedText(response));
             for (const message of Array.isArray(body) ? body : [body])
-                take(message);
+                await take(message);
         }
     }
     const wait = (ms) => new Promise((resolve) => {
-        const timer = setTimeout(resolve, ms);
-        shutdown.signal.addEventListener("abort", () => (clearTimeout(timer), resolve()), { once: true });
+        const done = () => { clearTimeout(timer); shutdown.signal.removeEventListener("abort", done); resolve(); };
+        const timer = setTimeout(done, ms);
+        if (shutdown.signal.aborted)
+            done();
+        else
+            shutdown.signal.addEventListener("abort", done, { once: true });
     });
     /** Server-initiated messages (list changes, approvals) arrive on a long-lived GET stream. */
     async function listen() {
-        if (listening || !sessionId)
+        if (listener || !sessionId || closed)
             return;
-        listening = true;
+        const current = listener = new AbortController();
+        const stop = () => current.abort();
+        shutdown.signal.addEventListener("abort", stop, { once: true });
         let lastEventId;
-        for (let attempt = 0; !closed && attempt < 8; attempt++) {
-            try {
-                const response = await request({
-                    method: "GET",
-                    headers: headers({ Accept: "text/event-stream", ...(lastEventId ? { "Last-Event-ID": lastEventId } : {}) }),
-                });
-                // 405: this server offers no stream; that is allowed.
-                if (response.status === 405 || !response.ok || !response.body)
-                    break;
-                attempt = 0;
-                for await (const event of events(response.body)) {
-                    if (event.id)
-                        lastEventId = event.id;
-                    try {
-                        deliver(JSON.parse(event.data));
+        try {
+            for (let attempt = 0; !closed && !current.signal.aborted && attempt < 8; attempt++) {
+                try {
+                    const response = await request({
+                        method: "GET",
+                        signal: current.signal,
+                        headers: headers({ Accept: "text/event-stream", ...(lastEventId ? { "Last-Event-ID": lastEventId } : {}) }),
+                    });
+                    // 405: this server offers no stream; that is allowed.
+                    if (response.status === 405 || !response.ok || !response.body) {
+                        void response.body?.cancel().catch(() => undefined);
+                        break;
+                    }
+                    attempt = 0;
+                    for await (const event of events(response.body)) {
+                        if (current.signal.aborted)
+                            break;
+                        if (event.id)
+                            lastEventId = event.id;
+                        try {
+                            const message = JSON.parse(event.data);
+                            if (isMessage(message))
+                                await deliver(message);
+                        }
+                        catch { }
                     }
-                    catch { }
                 }
-            }
-            catch {
-                if (closed)
+                catch {
+                    if (closed)
+                        break;
+                }
+                if (current.signal.aborted)
                     break;
+                await wait(Math.min(30_000, 1000 * 2 ** attempt));
             }
-            await wait(Math.min(30_000, 1000 * 2 ** attempt));
         }
-        listening = false;
+        finally {
+            current.abort();
+            shutdown.signal.removeEventListener("abort", stop);
+            if (listener === current)
+                listener = undefined;
+        }
     }
     /**
      * The gateway answers 404 for a session it no longer has (for example after a restart).
      * Open a new one with the agent's original `initialize`, without showing its reply again.
      */
-    async function reopen() {
+    async function replaceSession() {
         if (!opening)
             return false;
+        listener?.abort();
+        listener = undefined;
         sessionId = undefined;
         const response = await post(opening);
         sessionId = response.headers.get("mcp-session-id") ?? undefined;
@@ -153,83 +287,174 @@ export function runProxy(options) {
             return false;
         await readBody(response, new Set(), true);
         await post(JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" })).then((r) => r.body?.cancel());
-        void listen();
+        void listen().catch((error) => options.log(String(error)));
         return true;
     }
-    async function send(line) {
-        let messages;
-        try {
-            const parsed = JSON.parse(line);
-            messages = Array.isArray(parsed) ? parsed : [parsed];
-        }
-        catch {
-            write({ jsonrpc: "2.0", id: null, error: { code: -32700, message: "Parse error" } });
-            return;
-        }
+    function reopen(stale) {
+        if (recovering)
+            return recovering;
+        if (sessionId !== stale)
+            return Promise.resolve(true);
+        recovering = replaceSession().finally(() => { recovering = undefined; });
+        return recovering;
+    }
+    async function send(messages, batch) {
+        const line = JSON.stringify(batch ? messages : messages[0]);
         const requests = messages.filter((m) => m.method !== undefined && m.id !== undefined);
         const answered = new Set();
-        const fail = (message) => {
+        const fail = async (message) => {
             for (const request of requests)
                 if (!answered.has(request.id))
-                    write({ jsonrpc: "2.0", id: request.id, error: { code: -32000, message } });
+                    await write({ jsonrpc: "2.0", id: request.id, error: { code: -32000, message } });
         };
         if (messages.some((m) => m.method === "initialize"))
             opening = line;
         try {
+            if (recovering && !messages.every(urgent))
+                await recovering;
+            const stale = sessionId;
             let response = await post(line);
-            if (response.status === 404 && sessionId && !messages.some((m) => m.method === "initialize")) {
+            if (response.status === 404 && stale && !messages.some((m) => m.method === "initialize")) {
                 await response.body?.cancel();
-                if (await reopen())
+                if (await reopen(stale))
                     response = await post(line);
             }
             const session = response.headers.get("mcp-session-id");
-            if (session)
+            if (session && (sessionId === stale || messages.some((m) => m.method === "initialize")))
                 sessionId = session;
             if (!response.ok) {
-                const text = (await response.text().catch(() => "")).trim().slice(0, 300);
+                const text = (await boundedText(response, 4096).catch(() => "")).trim().slice(0, 300);
                 const message = explain(response.status, text);
                 options.log(message);
-                fail(message);
+                await fail(message);
                 return;
             }
             await readBody(response, answered);
             if (messages.some((m) => m.method === "notifications/initialized"))
-                void listen();
+                void listen().catch((error) => options.log(String(error)));
             // A stream that ended early must still answer every request, or the agent waits forever.
-            fail("Toolstile closed the connection before answering. Try again.");
+            await fail("Toolstile closed the connection before answering. Try again.");
         }
         catch (error) {
             if (closed)
                 return fail("The agent closed the connection.");
             const message = `Could not reach Toolstile: ${error.message}`;
             options.log(message);
-            fail(message);
+            await fail(message);
         }
     }
-    return new Promise((resolve) => {
-        const lines = createInterface({ input: options.input, crlfDelay: Number.POSITIVE_INFINITY });
-        lines.on("line", (line) => {
-            if (!line.trim())
-                return;
-            const opens = /"method"\s*:\s*"initialize"/.test(line);
-            const task = (opens ? send(line) : initialized.then(() => send(line))).finally(() => pending.delete(task));
-            if (opens)
-                initialized = task;
-            pending.add(task);
+    const invalid = (code, message, id = null) => {
+        // Immediate observation plus the global write budgets also bound parse/overload errors.
+        void write({ jsonrpc: "2.0", id, error: { code, message } }).catch(stop);
+    };
+    const accept = (line) => {
+        let parsed;
+        try {
+            parsed = JSON.parse(line);
+        }
+        catch {
+            invalid(-32700, "Parse error");
+            return;
+        }
+        const batch = Array.isArray(parsed);
+        const values = Array.isArray(parsed) ? parsed : [parsed];
+        if (values.length > LIMIT) {
+            invalid(-32600, "Batch exceeds the request limit");
+            return;
+        }
+        if (!values.length) {
+            invalid(-32600, "Invalid Request");
+            return;
+        }
+        const messages = [];
+        let requests = 0;
+        let controls = 0;
+        for (const value of values) {
+            if (!isMessage(value)) {
+                invalid(-32600, "Invalid Request");
+                continue;
+            }
+            if (value.method !== undefined && value.id !== undefined) {
+                if (requestCount + requests >= LIMIT) {
+                    invalid(-32000, "Proxy request limit reached; try again after a request finishes.", value.id);
+                    continue;
+                }
+                requests++;
+            }
+            else {
+                if (controlCount + controls >= LIMIT) {
+                    options.log("Proxy control limit exceeded; closing the connection.");
+                    stop();
+                    return;
+                }
+                controls++;
+            }
+            messages.push(value);
+        }
+        if (!messages.length || closed)
+            return;
+        // A mixed batch must not leave a server reply behind the initialize it unblocks.
+        const immediate = messages.filter(urgent);
+        const regular = messages.filter((message) => !urgent(message));
+        if (regular.length)
+            schedule(regular, batch, requests, controls - immediate.length);
+        if (immediate.length)
+            schedule(immediate, batch, 0, immediate.length);
+    };
+    const schedule = (messages, batch, requests, controls) => {
+        requestCount += requests;
+        controlCount += controls;
+        const opens = messages.some((message) => message.method === "initialize");
+        const task = (opens || messages.every(urgent) ? send(messages, batch) : initialized.then(() => send(messages, batch)))
+            .catch((error) => options.log(`Proxy task failed: ${String(error)}`))
+            .finally(() => {
+            pending.delete(task);
+            requestCount -= requests;
+            controlCount -= controls;
         });
-        lines.on("close", async () => {
-            // Let replies already on their way finish, but never hang on a long call or stream.
-            const grace = setTimeout(() => {
-                closed = true;
-                shutdown.abort();
-            }, CLOSE_GRACE_MS);
+        if (opens)
+            initialized = task;
+        pending.add(task);
+    };
+    let closeTimer;
+    const inputEnded = () => {
+        closeTimer = setTimeout(stop, CLOSE_GRACE_MS);
+    };
+    options.input.once("end", inputEnded);
+    const outputError = () => stop();
+    options.output.on("error", outputError);
+    const work = (async () => {
+        try {
+            for await (const line of inputLines(options.input)) {
+                if (closed)
+                    break;
+                if (line.trim())
+                    accept(line);
+            }
+        }
+        catch (error) {
+            options.log(`Proxy input failed: ${String(error)}`);
+            stop();
+        }
+        // One total deadline covers in-flight work, blocked stdout and best-effort DELETE.
+        await deadline(async (signal) => {
             await Promise.allSettled([...pending]);
-            clearTimeout(grace);
+            await writes;
             closed = true;
             shutdown.abort();
-            if (sessionId)
-                await fetcher(options.endpoint, { method: "DELETE", headers: headers(), redirect: "error" }).catch(() => undefined);
-            resolve();
-        });
+            if (sessionId) {
+                const response = await fetcher(options.endpoint, { method: "DELETE", headers: headers(), redirect: "error", signal });
+                void response.body?.cancel().catch(() => { });
+            }
+        }, CLOSE_GRACE_MS).catch(() => { });
+        closed = true;
+        shutdown.abort();
+    })();
+    return Promise.race([work, forced]).finally(() => {
+        clearTimeout(closeTimer);
+        options.input.removeListener("end", inputEnded);
+        closed = true;
+        shutdown.abort();
+        void writes.then(() => options.output.removeListener("error", outputError), () => options.output.removeListener("error", outputError));
     });
 }

package/dist/state.d.ts

@@ -43,10 +43,8 @@ export interface StateEnv {
 /** `TOOLSTILE_CONFIG_DIR`, else the platform's per-user config folder. */
 export declare function stateDir({ home, env, platform }?: StateEnv): string;
 export declare const statePath: (opts?: StateEnv) => string;
-/**
- * The saved server always wins over `TOOLSTILE_URL`, which only picks the server for a new
- * `auth login`: an environment variable set by a project must not redirect saved tokens.
- */
 export declare function loadState(opts?: StateEnv): State;
+/** Hold the credential revision stable during a synchronous config mutation. */
+export declare function withCurrentState<T>(state: State, opts: StateEnv | undefined, run: () => T): T;
 /** Written to a temporary file and renamed, so a crash never leaves half a file. */
-export declare function saveState(state: State, opts?: StateEnv): void;
+export declare function saveState(state: State, opts?: StateEnv, beforeWrite?: () => void): void;

package/dist/state.js

@@ -1,3 +1,5 @@
+import { fileText, withFileLock } from "./file-lock.js";
+import { randomUUID } from "node:crypto";
 import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -19,6 +21,7 @@ export const statePath = (opts) => join(stateDir(opts), "credentials.json");
  * The saved server always wins over `TOOLSTILE_URL`, which only picks the server for a new
  * `auth login`: an environment variable set by a project must not redirect saved tokens.
  */
+const revisions = new WeakMap();
 export function loadState(opts) {
     const fallback = { server: DEFAULT_SERVER, agents: {} };
     let text;
@@ -26,32 +29,52 @@ export function loadState(opts) {
         text = readFileSync(statePath(opts), "utf8");
     }
     catch (error) {
-        if (error.code === "ENOENT")
+        if (error.code === "ENOENT") {
+            revisions.set(fallback, null);
             return fallback;
+        }
         throw error;
     }
     try {
         const data = JSON.parse(text);
-        return moveLegacyServer({ ...fallback, ...data, agents: data.agents ?? {} });
+        const state = moveLegacyServer({ ...fallback, ...data, agents: data.agents ?? {} });
+        revisions.set(state, text);
+        return state;
     }
     catch {
         throw new Error(`${statePath(opts)} is not valid JSON. Delete it and run toolstile auth login again.`);
     }
 }
+/** Hold the credential revision stable during a synchronous config mutation. */
+export function withCurrentState(state, opts, run) {
+    return withFileLock(statePath(opts), () => {
+        if (!revisions.has(state) || revisions.get(state) !== fileText(statePath(opts)))
+            throw new Error("Toolstile credentials changed in another command. Run this command again.");
+        return run();
+    });
+}
 /** Written to a temporary file and renamed, so a crash never leaves half a file. */
-export function saveState(state, opts) {
+export function saveState(state, opts, beforeWrite) {
     const dir = stateDir(opts);
     mkdirSync(dir, { recursive: true, mode: 0o700 });
     const path = statePath(opts);
-    const temp = `${path}.${process.pid}.tmp`;
-    try {
-        writeFileSync(temp, `${JSON.stringify(state, null, 2)}\n`, { mode: 0o600 });
-        chmodSync(temp, 0o600);
-        renameSync(temp, path);
-    }
-    finally {
-        rmSync(temp, { force: true });
-    }
+    withFileLock(path, () => {
+        const before = fileText(path);
+        if (revisions.has(state) && revisions.get(state) !== before)
+            throw new Error("Toolstile credentials changed in another command. Run this command again.");
+        // Optional synchronous config/state transition shares this credential lock.
+        beforeWrite?.();
+        const temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+        try {
+            writeFileSync(temp, `${JSON.stringify(state, null, 2)}\n`, { mode: 0o600 });
+            chmodSync(temp, 0o600);
+            renameSync(temp, path);
+            revisions.set(state, fileText(path));
+        }
+        finally {
+            rmSync(temp, { force: true });
+        }
+    });
 }
 /** Sign-ins and agents saved for the old bare-domain address keep working on the new hosts. */
 function moveLegacyServer(state) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolstile",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Audit the MCP server configs your AI agents use for plaintext secrets, unpinned packages, auto-approved tools and duplicated setups, and connect those agents to Toolstile without putting tokens in their configs.",
   "keywords": [
     "mcp",