fix: correct 6 bugs across multiple servers

[wishhyt]

Description

This PR fixes 6 confirmed bugs found across multiple server implementations via systematic code audit. Each fix is a separate commit for ease of review.

Bug Fixes

1. CRITICAL: for...in on Map never iterates entries (streamableHttp.ts)

The SIGINT shutdown handler used for...in to iterate a Map<string, StreamableHTTPServerTransport>. Since Map entries are not enumerable own properties, the loop body never executed, meaning active transports were never closed on shutdown — causing resource leaks.

Fix: Changed to for...of which correctly iterates Map entries.

2. HIGH: Inner catch swallows access-denied security error (filesystem/lib.ts)

In validatePath, when a new file's parent directory exists but is outside allowed directories, the "Access denied" error thrown on line 131 was immediately caught by the bare catch on line 134 and replaced with a misleading "Parent directory does not exist" message.

Fix: The inner catch now re-throws errors that start with "Access denied".

3. MEDIUM: Always-false guard condition in parseResourceId (templates.ts)

The guard uri.startsWith(textUriBase) && uri.startsWith(blobUriBase) is always false since a URI cannot start with both "demo://resource/dynamic/text" and "demo://resource/dynamic/blob". The intended check was to reject URIs matching neither prefix.

Fix: Added ! negation to both startsWith checks.

4. MEDIUM: Incorrect idempotentHint on sequential thinking tool (index.ts)

The tool was marked idempotentHint: true, but it appends to thoughtHistory on every call, making repeated identical calls produce different thoughtHistoryLength values and duplicate entries. Clients relying on this hint for auto-retry could corrupt the thinking chain.

Fix: Changed idempotentHint to false.

5. MEDIUM: Memory migration rename error silently swallowed (memory/index.ts)

The nested try/catch structure meant that if fs.rename() failed during memory.json → memory.jsonl migration (e.g. permission error), the exception would bubble into the outer catch which silently returned the new path. The server would start with a non-existent file and overwrite the user's data on the first write.

Fix: Restructured to flat try/catch blocks so rename errors propagate to the caller.

6. MEDIUM: Elicitation response handler references non-existent schema fields (trigger-elicitation-request.ts)

The response handler referenced color and petType fields that were not defined in the elicitation request schema (thus always undefined), while omitting fields that are actually in the schema: firstLine, untitledSingleSelectEnum, untitledMultipleSelectEnum, titledSingleSelectEnum, titledMultipleSelectEnum, and legacyTitledEnum.

Fix: Removed dead field references and added handlers for all schema-defined fields.

Server Details

• Server: everything, filesystem, memory, sequential-thinking
• Changes to: tools, resources, transports, core logic

Motivation and Context

These bugs were found through systematic code audit. Each is a clear, unambiguous defect with a deterministic fix that doesn't alter intended semantics.

How Has This Been Tested?

Each fix was verified by reading the original code, confirming the bug exists, applying the minimal correct fix, and re-reading the modified code. The changes are minimal and localized.

Breaking Changes

None. All fixes correct existing behavior to match documented intent.

Types of changes

• Bug fix (non-breaking change which fixes an issue)

Checklist

• I have read the MCP Protocol Documentation
• My changes follows MCP security best practices
• My code follows the repository's style guidelines
• I have added appropriate error handling

Additional context

All 6 commits are independent and can be cherry-picked individually if needed.

[cliffhall]

@claude review

[claude]

Claude finished @cliffhall's task in 1m 54s —— View job

---

PR Review: fix: correct 6 bugs across multiple servers

• Gather context and read changed files
• Review Fix 1: for...in on Map (streamableHttp.ts)
• Review Fix 2: Access-denied error swallowed (filesystem/lib.ts)
• Review Fix 3: Always-false guard in parseResourceId (templates.ts)
• Review Fix 4: Incorrect idempotentHint (sequentialthinking/index.ts)
• Review Fix 5: Migration rename error swallowed (memory/index.ts)
• Review Fix 6: Elicitation response handler fields (trigger-elicitation-request.ts)
• Post review summary

---

All 6 fixes are legitimate, well-scoped, and correct. The diagnosis in the PR description is accurate for each one. Here is a detailed assessment:

---

Fix 1 — for...in on Map (streamableHttp.ts) ✅

Verdict: Correct. for...in iterates enumerable string-keyed own properties of a plain object. Map entries are not enumerable own properties, so the loop body never executed and no transports were ever closed on SIGINT. Switching to for (const [sessionId, transport] of transports) is the standard and correct idiom.

One additional note: deleting entries from a Map while iterating it with for...of is safe for already-visited entries (ECMAScript spec, §23.1.5.2.1), so the transports.delete(sessionId) inside the loop is fine.

---

Fix 2 — Inner catch swallows access-denied error (filesystem/lib.ts) ✅

Verdict: Correct. The inner catch at lib.ts:134 was catching the "Access denied" error thrown on line 131 and replacing it with a misleading "Parent directory does not exist" message, silently downgrading a security-relevant error.

The fix correctly re-throws when innerError.message.startsWith('Access denied'). The string prefix 'Access denied' consistently matches all three error messages thrown in validatePath (lines 110, 119, 131), so this is safe.

Minor note: This works correctly, but is fragile to message wording changes. A future improvement could use a custom error subclass (e.g. class AccessDeniedError extends Error {}) rather than string-matching. Not a blocker.

---

Fix 3 — Always-false guard in parseResourceId (templates.ts) ✅

Verdict: Correct. The original && condition required the URI to simultaneously start with "demo://resource/dynamic/text" and "demo://resource/dynamic/blob" — logically impossible, so the guard never triggered and every URI was incorrectly treated as valid. The corrected !... && !... throws an error when the URI matches neither valid base, which is the intended semantics.

---

Fix 4 — Incorrect idempotentHint on sequential thinking tool (sequentialthinking/index.ts) ✅

Verdict: Correct. idempotentHint: true promises that repeated calls with identical arguments produce the same result. This tool mutates SequentialThinkingServer.thoughtHistory on every call, so thoughtHistoryLength in the response will differ on subsequent identical calls, and the history will contain duplicates. Setting this to false is semantically accurate.

Worth noting: readOnlyHint: true also appears on this tool (unchanged by this PR). The MCP spec defines readOnlyHint as "does not modify its environment." Since thoughtHistory is in-process memory (not a filesystem or external system), this is arguably acceptable — but it's worth a separate discussion given that the tool clearly has side effects on its own state.

---

Fix 5 — Migration rename error silently swallowed (memory/index.ts) ✅

Verdict: Correct. The original nested try/catch structure had a subtle flaw: if fs.rename() failed (e.g., cross-device link, permission error), that exception propagated to the outer catch, which returned newMemoryPath unconditionally — a path that doesn't exist, because the rename failed. The server would then start and silently overwrite the user's data on the first write.

The refactored flat try/catch structure correctly separates the two control-flow paths. A fs.rename failure now propagates uncaught through the second catch block and up to main(), which calls process.exit(1) — the correct behavior.

---

Fix 6 — Elicitation response handler references non-existent fields (trigger-elicitation-request.ts) ✅

Verdict: Correct. color and petType were never in the requestedSchema, so userData.color and userData.petType would always be undefined, and those lines would silently produce no output. The fix removes them and adds handlers for all the fields that are in the schema.

Minor note: untitledMultipleSelectEnum and titledMultipleSelectEnum are arrays in the schema. Displaying them via template literal interpolation (e.g. ${userData.untitledMultipleSelectEnum}) will produce a comma-joined string like "Guitar,Piano". This is functional for a demo/debugging tool, but .join(', ') would be slightly more readable output. Not a bug.

---

Summary

Fix	File	Severity	Verdict
for...in on Map	streamableHttp.ts	Critical (resource leak on shutdown)	✅ Correct
Access-denied error swallowed	filesystem/lib.ts	High (security error misrepresented)	✅ Correct
Always-false guard	templates.ts	Medium (every URI accepted as valid)	✅ Correct
idempotentHint: true	sequentialthinking/index.ts	Medium (incorrect hint can corrupt chains)	✅ Correct
Rename error swallowed	memory/index.ts	Medium (data loss on migration failure)	✅ Correct
Dead field references	trigger-elicitation-request.ts	Medium (silently missing output)	✅ Correct

All fixes are minimal, targeted, and don't alter intended semantics. No new tests are included, though the changes to validatePath and ensureMemoryFilePath would benefit from test coverage to prevent regressions. Overall this is a clean, well-described PR — I'd recommend merging.

[LuuOW]

Technical audit: Verified MCP server implementation for consistency with current SDK patterns.