From 049f3574d1aa9f2b66c3bd70d0f0ddd9598cb2d3 Mon Sep 17 00:00:00 2001 From: Jack Arturo Date: Wed, 29 Jul 2026 11:06:05 +0200 Subject: [PATCH 1/3] fix: exit orphaned stdio MCP servers on parent death Clients can abandon sessions while a wrapper keeps stdin open, so EOF never arrives and leaked servers thrash swap. Exit on stdin close and add a parent-liveness watchdog (same approach as mcp-automem). --- src/lifecycle.ts | 109 ++++++++++++++++++++++++++++++++++++++++ src/server.ts | 14 +++--- tests/lifecycle.test.ts | 35 +++++++++++++ 3 files changed, 150 insertions(+), 8 deletions(-) create mode 100644 src/lifecycle.ts create mode 100644 tests/lifecycle.test.ts diff --git a/src/lifecycle.ts b/src/lifecycle.ts new file mode 100644 index 0000000..b6732a6 --- /dev/null +++ b/src/lifecycle.ts @@ -0,0 +1,109 @@ +/** + * Parent-liveness watchdog for the stdio MCP server. + * + * When an intermediate wrapper (npx → npm exec → node bin → server) keeps the + * server's stdin write-end open, a dead client never delivers EOF, so the leaf + * sits in the event loop forever and can thrash swap (multi-GB). stdin + * 'end'/'close', transport close, and signals all miss that orphan case. The + * watchdog catches it by noticing the original parent is gone. + * + * Kept side-effect-free on import so unit tests can cover it without spawning + * the full server. + */ + +export type ParentLivenessProbe = (parentPid: number) => boolean; + +/** Poll interval (ms) used when the env override is unset or invalid. */ +export const DEFAULT_PARENT_WATCHDOG_MS = 30_000; + +const MIN_PARENT_WATCHDOG_MS = 100; + +/** + * Parse WORDPRESS_PARENT_WATCHDOG_MS into a safe poll interval. + * + * Non-finite / zero / negative → default. No disable value: an unparseable + * knob must never silently turn orphan protection off. Floored at + * MIN_PARENT_WATCHDOG_MS so tiny inputs can't spin the CPU. + */ +export function parseWatchdogIntervalMs(raw: string | undefined): number { + const n = Number(raw); + if (!Number.isFinite(n) || n <= 0) return DEFAULT_PARENT_WATCHDOG_MS; + return Math.max(n, MIN_PARENT_WATCHDOG_MS); +} + +/** + * Default probe: the server has been reparented away from its original parent. + * POSIX only (Windows does not reparent orphans, so this is a no-op there). + */ +export function parentReparented(parentPid: number): boolean { + return process.ppid !== parentPid; +} + +/** + * Poll for the original parent's death and invoke `onDead` exactly once. + * Interval is unref'd so the watchdog alone never keeps the event loop alive. + */ +export function startParentWatchdog( + parentPid: number, + intervalMs: number, + onDead: () => void, + isParentGone: ParentLivenessProbe = parentReparented +): NodeJS.Timeout { + let fired = false; + const timer = setInterval(() => { + if (fired) return; + if (isParentGone(parentPid)) { + fired = true; + onDead(); + } + }, intervalMs); + timer.unref(); + return timer; +} + +/** + * Install stdin/transport/signal/parent-watchdog shutdown hooks. + * Call before `server.connect(transport)`. Captures `process.ppid` immediately. + */ +export function installStdioLifecycle(options: { + transport: { close?: () => unknown }; + onCloseAssignable?: { onclose?: (() => void) | null }; + envName?: string; + onShutdown?: () => void; +}): () => void { + const parentPid = process.ppid; + let shuttingDown = false; + const shutdown = (code = 0) => { + if (shuttingDown) return; + shuttingDown = true; + try { + options.onShutdown?.(); + } catch { + /* best effort */ + } + try { + void options.transport.close?.(); + } catch { + /* best effort */ + } + process.exit(code); + }; + + process.stdin.on('end', () => shutdown(0)); + process.stdin.on('close', () => shutdown(0)); + if (options.onCloseAssignable) { + options.onCloseAssignable.onclose = () => shutdown(0); + } + for (const sig of ['SIGTERM', 'SIGINT', 'SIGHUP'] as const) { + process.on(sig, () => shutdown(0)); + } + + const envName = options.envName ?? 'WORDPRESS_PARENT_WATCHDOG_MS'; + startParentWatchdog( + parentPid, + parseWatchdogIntervalMs(process.env[envName]), + () => shutdown(0) + ); + + return shutdown; +} diff --git a/src/server.ts b/src/server.ts index cb09479..4eaea85 100644 --- a/src/server.ts +++ b/src/server.ts @@ -5,6 +5,7 @@ dotenv.config(); // Load environment variables from .env first import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js"; import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"; +import { installStdioLifecycle } from "./lifecycle.js"; import { allTools, toolHandlers } from "./tools/index.js"; import { z } from "zod"; import { zodToJsonSchema } from "zod-to-json-schema"; @@ -76,6 +77,11 @@ async function main() { logToFile("Setting up server transport..."); const transport = new StdioServerTransport(); + installStdioLifecycle({ + transport, + onCloseAssignable: server.server, + envName: "WORDPRESS_PARENT_WATCHDOG_MS", + }); await server.connect(transport); logToFile("WordPress MCP Server running on stdio"); logToFile(`Registered ${allTools.length} tools`); @@ -92,14 +98,6 @@ async function main() { // Handle process signals and errors // IMPORTANT: MCP uses stdout for JSON-RPC — never use console.log here -process.on("SIGTERM", () => { - process.stderr.write("[SHUTDOWN] Received SIGTERM, shutting down...\n"); - process.exit(0); -}); -process.on("SIGINT", () => { - process.stderr.write("[SHUTDOWN] Received SIGINT, shutting down...\n"); - process.exit(0); -}); process.on("uncaughtException", (error) => { process.stderr.write( `[FATAL] Uncaught exception: ${error instanceof Error ? error.stack || error.message : error}\n`, diff --git a/tests/lifecycle.test.ts b/tests/lifecycle.test.ts new file mode 100644 index 0000000..bdf4437 --- /dev/null +++ b/tests/lifecycle.test.ts @@ -0,0 +1,35 @@ +import { describe, it, expect, vi } from 'vitest'; +import { + DEFAULT_PARENT_WATCHDOG_MS, + parseWatchdogIntervalMs, + startParentWatchdog, +} from '../src/lifecycle.js'; + +describe('parseWatchdogIntervalMs', () => { + it('defaults on unset/invalid/non-positive', () => { + expect(parseWatchdogIntervalMs(undefined)).toBe(DEFAULT_PARENT_WATCHDOG_MS); + expect(parseWatchdogIntervalMs('')).toBe(DEFAULT_PARENT_WATCHDOG_MS); + expect(parseWatchdogIntervalMs('nope')).toBe(DEFAULT_PARENT_WATCHDOG_MS); + expect(parseWatchdogIntervalMs('0')).toBe(DEFAULT_PARENT_WATCHDOG_MS); + expect(parseWatchdogIntervalMs('-1')).toBe(DEFAULT_PARENT_WATCHDOG_MS); + }); + + it('honours positive values floored at 100ms', () => { + expect(parseWatchdogIntervalMs('250')).toBe(250); + expect(parseWatchdogIntervalMs('50')).toBe(100); + }); +}); + +describe('startParentWatchdog', () => { + it('fires once when the probe reports parent gone', async () => { + vi.useFakeTimers(); + const onDead = vi.fn(); + startParentWatchdog(1, 100, onDead, () => true); + expect(onDead).not.toHaveBeenCalled(); + await vi.advanceTimersByTimeAsync(100); + expect(onDead).toHaveBeenCalledTimes(1); + await vi.advanceTimersByTimeAsync(500); + expect(onDead).toHaveBeenCalledTimes(1); + vi.useRealTimers(); + }); +}); From 15fedc5d45e9b3ad0fbab55693315dfe38deaf36 Mon Sep 17 00:00:00 2001 From: Jack Arturo Date: Wed, 29 Jul 2026 13:35:46 +0200 Subject: [PATCH 2/3] fix: make soft stdin EOF a true no-op MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Do not transport.close() or process.exit on stdin end/close — that trips SDK onclose and breaks one-shot pipe flows. Hard exit only on parent watchdog reparent and SIGTERM/SIGINT/SIGHUP. Capture parentPid before any await; unit tests assert stdin EOF alone does not exit. --- src/lifecycle.ts | 28 +++++++++++++++++++++------- src/server.ts | 3 +++ tests/lifecycle.test.ts | 28 +++++++++++++++++++++++++++- 3 files changed, 51 insertions(+), 8 deletions(-) diff --git a/src/lifecycle.ts b/src/lifecycle.ts index b6732a6..6a670b1 100644 --- a/src/lifecycle.ts +++ b/src/lifecycle.ts @@ -3,9 +3,14 @@ * * When an intermediate wrapper (npx → npm exec → node bin → server) keeps the * server's stdin write-end open, a dead client never delivers EOF, so the leaf - * sits in the event loop forever and can thrash swap (multi-GB). stdin - * 'end'/'close', transport close, and signals all miss that orphan case. The - * watchdog catches it by noticing the original parent is gone. + * sits in the event loop forever and can thrash swap (multi-GB). Soft stdin + * EOF alone is not enough to catch that orphan case. The watchdog catches it + * by noticing the original parent is gone. + * + * Soft stdin EOF is intentional: do NOT call `transport.close()` and do NOT + * `process.exit` on `end`/`close`. Closing the transport trips the MCP SDK + * `onclose` → hard exit and breaks one-shot `echo … | npm start` flows. + * Hard exit is reserved for parent-watchdog reparent + OS signals. * * Kept side-effect-free on import so unit tests can cover it without spawning * the full server. @@ -63,15 +68,21 @@ export function startParentWatchdog( /** * Install stdin/transport/signal/parent-watchdog shutdown hooks. - * Call before `server.connect(transport)`. Captures `process.ppid` immediately. + * Call before `server.connect(transport)`. + * + * If `main()` awaits anything before this call, pass `parentPid` captured + * synchronously at the top of `main()` — `process.ppid` is dynamic, and a + * late capture after reparent would make the watchdog a no-op (mcp-automem #137). */ export function installStdioLifecycle(options: { transport: { close?: () => unknown }; onCloseAssignable?: { onclose?: (() => void) | null }; envName?: string; onShutdown?: () => void; + /** Prefer a pid captured before any `await` in `main()`. */ + parentPid?: number; }): () => void { - const parentPid = process.ppid; + const parentPid = options.parentPid ?? process.ppid; let shuttingDown = false; const shutdown = (code = 0) => { if (shuttingDown) return; @@ -89,8 +100,11 @@ export function installStdioLifecycle(options: { process.exit(code); }; - process.stdin.on('end', () => shutdown(0)); - process.stdin.on('close', () => shutdown(0)); + // Soft stdin EOF → no-op. Do not transport.close() (SDK onclose → hard exit) + // and do not process.exit. One-shot pipes must drain in-flight handlers; + // orphans that keep stdin open are killed by the parent watchdog / signals. + process.stdin.on('end', () => {}); + process.stdin.on('close', () => {}); if (options.onCloseAssignable) { options.onCloseAssignable.onclose = () => shutdown(0); } diff --git a/src/server.ts b/src/server.ts index 4eaea85..d4062fa 100644 --- a/src/server.ts +++ b/src/server.ts @@ -62,6 +62,8 @@ for (const tool of allTools) { } async function main() { + // Capture before any await — process.ppid is dynamic. + const parentPid = process.ppid; const { logToFile } = await import("./wordpress.js"); // Log startup info to stderr (MCP protocol uses stdout) @@ -81,6 +83,7 @@ async function main() { transport, onCloseAssignable: server.server, envName: "WORDPRESS_PARENT_WATCHDOG_MS", + parentPid, }); await server.connect(transport); logToFile("WordPress MCP Server running on stdio"); diff --git a/tests/lifecycle.test.ts b/tests/lifecycle.test.ts index bdf4437..6668097 100644 --- a/tests/lifecycle.test.ts +++ b/tests/lifecycle.test.ts @@ -1,6 +1,7 @@ -import { describe, it, expect, vi } from 'vitest'; +import { afterEach, describe, expect, it, vi } from 'vitest'; import { DEFAULT_PARENT_WATCHDOG_MS, + installStdioLifecycle, parseWatchdogIntervalMs, startParentWatchdog, } from '../src/lifecycle.js'; @@ -33,3 +34,28 @@ describe('startParentWatchdog', () => { vi.useRealTimers(); }); }); + +describe('installStdioLifecycle soft stdin EOF', () => { + afterEach(() => { + vi.restoreAllMocks(); + }); + + it('does not close transport or exit on stdin end/close', () => { + const transport = { close: vi.fn() }; + const exitSpy = vi + .spyOn(process, 'exit') + .mockImplementation((() => undefined) as never); + + installStdioLifecycle({ + transport, + parentPid: process.ppid, + envName: 'WORDPRESS_PARENT_WATCHDOG_MS', + }); + + process.stdin.emit('end'); + process.stdin.emit('close'); + + expect(transport.close).not.toHaveBeenCalled(); + expect(exitSpy).not.toHaveBeenCalled(); + }); +}); From 12f2152bb6f41d637905a211a5ce0d4425ba7466 Mon Sep 17 00:00:00 2001 From: Jack Arturo Date: Wed, 29 Jul 2026 17:40:56 +0200 Subject: [PATCH 3/3] docs: clarify parent watchdog is POSIX-only on Windows Match mcp-automem wording: win32 does not reparent orphans, so the ppid probe is a documented no-op there. --- src/lifecycle.ts | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/lifecycle.ts b/src/lifecycle.ts index 6a670b1..471991d 100644 --- a/src/lifecycle.ts +++ b/src/lifecycle.ts @@ -38,7 +38,12 @@ export function parseWatchdogIntervalMs(raw: string | undefined): number { /** * Default probe: the server has been reparented away from its original parent. - * POSIX only (Windows does not reparent orphans, so this is a no-op there). + * + * POSIX only: this relies on the kernel reparenting an orphan (to pid 1 or a + * subreaper) when its parent dies. Windows does not reparent orphans, so + * `process.ppid` never changes there and this probe never fires — the watchdog + * is a no-op on win32. Orphan mitigation on Windows would need a different + * mechanism (e.g. a job object or a stdin heartbeat). Matches mcp-automem. */ export function parentReparented(parentPid: number): boolean { return process.ppid !== parentPid;