From 52c31ca50a6cbe3374bdbc8a9374fa0f6a5865e3 Mon Sep 17 00:00:00 2001 From: Jack Arturo Date: Wed, 29 Jul 2026 11:06:00 +0200 Subject: [PATCH 1/3] fix: exit orphaned stdio MCP servers on parent death Clients can abandon sessions while a wrapper keeps stdin open, so EOF never arrives and leaked servers thrash swap. Exit on stdin close and add a parent-liveness watchdog (same approach as mcp-automem). --- src/index.ts | 6 +++ src/lifecycle.ts | 109 ++++++++++++++++++++++++++++++++++++++++ tests/lifecycle.test.ts | 35 +++++++++++++ 3 files changed, 150 insertions(+) create mode 100644 src/lifecycle.ts create mode 100644 tests/lifecycle.test.ts diff --git a/src/index.ts b/src/index.ts index e929731..461ac05 100644 --- a/src/index.ts +++ b/src/index.ts @@ -1,6 +1,7 @@ #!/usr/bin/env node import { Server } from '@modelcontextprotocol/sdk/server/index.js'; import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'; +import { installStdioLifecycle } from './lifecycle.js'; import { CallToolRequestSchema, ListToolsRequestSchema, Tool } from '@modelcontextprotocol/sdk/types.js'; import { config } from 'dotenv'; import { PirschAPI } from './pirsch-api.js'; @@ -621,6 +622,11 @@ server.setRequestHandler(CallToolRequestSchema, async (req) => { async function main() { const transport = new StdioServerTransport(); + installStdioLifecycle({ + transport, + onCloseAssignable: server, + envName: 'PIRSCH_PARENT_WATCHDOG_MS', + }); await server.connect(transport); console.error('Pirsch MCP server running'); } diff --git a/src/lifecycle.ts b/src/lifecycle.ts new file mode 100644 index 0000000..4051b9a --- /dev/null +++ b/src/lifecycle.ts @@ -0,0 +1,109 @@ +/** + * Parent-liveness watchdog for the stdio MCP server. + * + * When an intermediate wrapper (npx → npm exec → node bin → server) keeps the + * server's stdin write-end open, a dead client never delivers EOF, so the leaf + * sits in the event loop forever and can thrash swap (multi-GB). stdin + * 'end'/'close', transport close, and signals all miss that orphan case. The + * watchdog catches it by noticing the original parent is gone. + * + * Kept side-effect-free on import so unit tests can cover it without spawning + * the full server. + */ + +export type ParentLivenessProbe = (parentPid: number) => boolean; + +/** Poll interval (ms) used when the env override is unset or invalid. */ +export const DEFAULT_PARENT_WATCHDOG_MS = 30_000; + +const MIN_PARENT_WATCHDOG_MS = 100; + +/** + * Parse PIRSCH_PARENT_WATCHDOG_MS into a safe poll interval. + * + * Non-finite / zero / negative → default. No disable value: an unparseable + * knob must never silently turn orphan protection off. Floored at + * MIN_PARENT_WATCHDOG_MS so tiny inputs can't spin the CPU. + */ +export function parseWatchdogIntervalMs(raw: string | undefined): number { + const n = Number(raw); + if (!Number.isFinite(n) || n <= 0) return DEFAULT_PARENT_WATCHDOG_MS; + return Math.max(n, MIN_PARENT_WATCHDOG_MS); +} + +/** + * Default probe: the server has been reparented away from its original parent. + * POSIX only (Windows does not reparent orphans, so this is a no-op there). + */ +export function parentReparented(parentPid: number): boolean { + return process.ppid !== parentPid; +} + +/** + * Poll for the original parent's death and invoke `onDead` exactly once. + * Interval is unref'd so the watchdog alone never keeps the event loop alive. + */ +export function startParentWatchdog( + parentPid: number, + intervalMs: number, + onDead: () => void, + isParentGone: ParentLivenessProbe = parentReparented +): NodeJS.Timeout { + let fired = false; + const timer = setInterval(() => { + if (fired) return; + if (isParentGone(parentPid)) { + fired = true; + onDead(); + } + }, intervalMs); + timer.unref(); + return timer; +} + +/** + * Install stdin/transport/signal/parent-watchdog shutdown hooks. + * Call before `server.connect(transport)`. Captures `process.ppid` immediately. + */ +export function installStdioLifecycle(options: { + transport: { close?: () => unknown }; + onCloseAssignable?: { onclose?: (() => void) | null }; + envName?: string; + onShutdown?: () => void; +}): () => void { + const parentPid = process.ppid; + let shuttingDown = false; + const shutdown = (code = 0) => { + if (shuttingDown) return; + shuttingDown = true; + try { + options.onShutdown?.(); + } catch { + /* best effort */ + } + try { + void options.transport.close?.(); + } catch { + /* best effort */ + } + process.exit(code); + }; + + process.stdin.on('end', () => shutdown(0)); + process.stdin.on('close', () => shutdown(0)); + if (options.onCloseAssignable) { + options.onCloseAssignable.onclose = () => shutdown(0); + } + for (const sig of ['SIGTERM', 'SIGINT', 'SIGHUP'] as const) { + process.on(sig, () => shutdown(0)); + } + + const envName = options.envName ?? 'PIRSCH_PARENT_WATCHDOG_MS'; + startParentWatchdog( + parentPid, + parseWatchdogIntervalMs(process.env[envName]), + () => shutdown(0) + ); + + return shutdown; +} diff --git a/tests/lifecycle.test.ts b/tests/lifecycle.test.ts new file mode 100644 index 0000000..bdf4437 --- /dev/null +++ b/tests/lifecycle.test.ts @@ -0,0 +1,35 @@ +import { describe, it, expect, vi } from 'vitest'; +import { + DEFAULT_PARENT_WATCHDOG_MS, + parseWatchdogIntervalMs, + startParentWatchdog, +} from '../src/lifecycle.js'; + +describe('parseWatchdogIntervalMs', () => { + it('defaults on unset/invalid/non-positive', () => { + expect(parseWatchdogIntervalMs(undefined)).toBe(DEFAULT_PARENT_WATCHDOG_MS); + expect(parseWatchdogIntervalMs('')).toBe(DEFAULT_PARENT_WATCHDOG_MS); + expect(parseWatchdogIntervalMs('nope')).toBe(DEFAULT_PARENT_WATCHDOG_MS); + expect(parseWatchdogIntervalMs('0')).toBe(DEFAULT_PARENT_WATCHDOG_MS); + expect(parseWatchdogIntervalMs('-1')).toBe(DEFAULT_PARENT_WATCHDOG_MS); + }); + + it('honours positive values floored at 100ms', () => { + expect(parseWatchdogIntervalMs('250')).toBe(250); + expect(parseWatchdogIntervalMs('50')).toBe(100); + }); +}); + +describe('startParentWatchdog', () => { + it('fires once when the probe reports parent gone', async () => { + vi.useFakeTimers(); + const onDead = vi.fn(); + startParentWatchdog(1, 100, onDead, () => true); + expect(onDead).not.toHaveBeenCalled(); + await vi.advanceTimersByTimeAsync(100); + expect(onDead).toHaveBeenCalledTimes(1); + await vi.advanceTimersByTimeAsync(500); + expect(onDead).toHaveBeenCalledTimes(1); + vi.useRealTimers(); + }); +}); From 9ff7d18b73accd705e33d8b09f845938603aca62 Mon Sep 17 00:00:00 2001 From: Jack Arturo Date: Wed, 29 Jul 2026 13:35:41 +0200 Subject: [PATCH 2/3] fix: make soft stdin EOF a true no-op MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Do not transport.close() or process.exit on stdin end/close — that trips SDK onclose and breaks one-shot pipe flows. Hard exit only on parent watchdog reparent and SIGTERM/SIGINT/SIGHUP. Capture parentPid before any await; unit tests assert stdin EOF alone does not exit. --- src/index.ts | 3 +++ src/lifecycle.ts | 28 +++++++++++++++++++++------- tests/lifecycle.test.ts | 28 +++++++++++++++++++++++++++- 3 files changed, 51 insertions(+), 8 deletions(-) diff --git a/src/index.ts b/src/index.ts index 461ac05..d5d5059 100644 --- a/src/index.ts +++ b/src/index.ts @@ -621,11 +621,14 @@ server.setRequestHandler(CallToolRequestSchema, async (req) => { }); async function main() { + // Capture before any await — process.ppid is dynamic. + const parentPid = process.ppid; const transport = new StdioServerTransport(); installStdioLifecycle({ transport, onCloseAssignable: server, envName: 'PIRSCH_PARENT_WATCHDOG_MS', + parentPid, }); await server.connect(transport); console.error('Pirsch MCP server running'); diff --git a/src/lifecycle.ts b/src/lifecycle.ts index 4051b9a..8a7191d 100644 --- a/src/lifecycle.ts +++ b/src/lifecycle.ts @@ -3,9 +3,14 @@ * * When an intermediate wrapper (npx → npm exec → node bin → server) keeps the * server's stdin write-end open, a dead client never delivers EOF, so the leaf - * sits in the event loop forever and can thrash swap (multi-GB). stdin - * 'end'/'close', transport close, and signals all miss that orphan case. The - * watchdog catches it by noticing the original parent is gone. + * sits in the event loop forever and can thrash swap (multi-GB). Soft stdin + * EOF alone is not enough to catch that orphan case. The watchdog catches it + * by noticing the original parent is gone. + * + * Soft stdin EOF is intentional: do NOT call `transport.close()` and do NOT + * `process.exit` on `end`/`close`. Closing the transport trips the MCP SDK + * `onclose` → hard exit and breaks one-shot `echo … | npm start` flows. + * Hard exit is reserved for parent-watchdog reparent + OS signals. * * Kept side-effect-free on import so unit tests can cover it without spawning * the full server. @@ -63,15 +68,21 @@ export function startParentWatchdog( /** * Install stdin/transport/signal/parent-watchdog shutdown hooks. - * Call before `server.connect(transport)`. Captures `process.ppid` immediately. + * Call before `server.connect(transport)`. + * + * If `main()` awaits anything before this call, pass `parentPid` captured + * synchronously at the top of `main()` — `process.ppid` is dynamic, and a + * late capture after reparent would make the watchdog a no-op (mcp-automem #137). */ export function installStdioLifecycle(options: { transport: { close?: () => unknown }; onCloseAssignable?: { onclose?: (() => void) | null }; envName?: string; onShutdown?: () => void; + /** Prefer a pid captured before any `await` in `main()`. */ + parentPid?: number; }): () => void { - const parentPid = process.ppid; + const parentPid = options.parentPid ?? process.ppid; let shuttingDown = false; const shutdown = (code = 0) => { if (shuttingDown) return; @@ -89,8 +100,11 @@ export function installStdioLifecycle(options: { process.exit(code); }; - process.stdin.on('end', () => shutdown(0)); - process.stdin.on('close', () => shutdown(0)); + // Soft stdin EOF → no-op. Do not transport.close() (SDK onclose → hard exit) + // and do not process.exit. One-shot pipes must drain in-flight handlers; + // orphans that keep stdin open are killed by the parent watchdog / signals. + process.stdin.on('end', () => {}); + process.stdin.on('close', () => {}); if (options.onCloseAssignable) { options.onCloseAssignable.onclose = () => shutdown(0); } diff --git a/tests/lifecycle.test.ts b/tests/lifecycle.test.ts index bdf4437..f0624f7 100644 --- a/tests/lifecycle.test.ts +++ b/tests/lifecycle.test.ts @@ -1,6 +1,7 @@ -import { describe, it, expect, vi } from 'vitest'; +import { afterEach, describe, expect, it, vi } from 'vitest'; import { DEFAULT_PARENT_WATCHDOG_MS, + installStdioLifecycle, parseWatchdogIntervalMs, startParentWatchdog, } from '../src/lifecycle.js'; @@ -33,3 +34,28 @@ describe('startParentWatchdog', () => { vi.useRealTimers(); }); }); + +describe('installStdioLifecycle soft stdin EOF', () => { + afterEach(() => { + vi.restoreAllMocks(); + }); + + it('does not close transport or exit on stdin end/close', () => { + const transport = { close: vi.fn() }; + const exitSpy = vi + .spyOn(process, 'exit') + .mockImplementation((() => undefined) as never); + + installStdioLifecycle({ + transport, + parentPid: process.ppid, + envName: 'PIRSCH_PARENT_WATCHDOG_MS', + }); + + process.stdin.emit('end'); + process.stdin.emit('close'); + + expect(transport.close).not.toHaveBeenCalled(); + expect(exitSpy).not.toHaveBeenCalled(); + }); +}); From c93e64385fe39fabe1f3e4380eca5f6a81254960 Mon Sep 17 00:00:00 2001 From: Jack Arturo Date: Wed, 29 Jul 2026 17:40:53 +0200 Subject: [PATCH 3/3] docs: clarify parent watchdog is POSIX-only on Windows Match mcp-automem wording: win32 does not reparent orphans, so the ppid probe is a documented no-op there. --- src/lifecycle.ts | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/lifecycle.ts b/src/lifecycle.ts index 8a7191d..b4a8516 100644 --- a/src/lifecycle.ts +++ b/src/lifecycle.ts @@ -38,7 +38,12 @@ export function parseWatchdogIntervalMs(raw: string | undefined): number { /** * Default probe: the server has been reparented away from its original parent. - * POSIX only (Windows does not reparent orphans, so this is a no-op there). + * + * POSIX only: this relies on the kernel reparenting an orphan (to pid 1 or a + * subreaper) when its parent dies. Windows does not reparent orphans, so + * `process.ppid` never changes there and this probe never fires — the watchdog + * is a no-op on win32. Orphan mitigation on Windows would need a different + * mechanism (e.g. a job object or a stdin heartbeat). Matches mcp-automem. */ export function parentReparented(parentPid: number): boolean { return process.ppid !== parentPid;