fix: fully close MCP audit SQLite connections on shutdown

[rdself]

Summary

• follow-up to fix: close MCP audit SQLite connections on shutdown #1348 on release/v3.6.7
• keep the MCP audit shutdown fix aligned with the release branch
• add the standalone-build follow-up so the audit DB handle is shared through globalThis
• keep Docker stop long enough to finish the shutdown path and preserve regression coverage

Why this PR exists

#1348 fixed the original issue and was merged into release/v3.6.7.

While validating that fix locally in Docker, I found an additional standalone-production detail: the audit module state could be split across different Next.js chunks, so a module-local cache was not reliable enough for shutdown cleanup. This PR is the follow-up on the same release branch and includes that standalone-safe fix.

Root cause

The main SQLite singleton already checkpointed and closed on shutdown, but MCP audit used a separate better-sqlite3 connection that was not part of the shutdown chain.

In standalone production builds, the audit module could also be loaded in different chunks, so a module-local cache was not reliable enough for shutdown cleanup.

Validation

• ./node_modules/.bin/vitest run --config vitest.mcp.config.ts open-sse/mcp-server/__tests__/audit.test.ts
• ./node_modules/.bin/eslint open-sse/mcp-server/audit.ts open-sse/mcp-server/__tests__/audit.test.ts
• ./node_modules/.bin/tsc --pretty false -p tsconfig.typecheck-core.json
• local Docker verification: exercised MCP/audit access, stopped the container, confirmed shutdown logs emitted both audit DB close and main DB close, and confirmed storage.sqlite-wal / storage.sqlite-shm were removed after normal stop

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[Copilot]

Pull request overview

Fixes an incomplete shutdown path where the MCP audit logger held a separate SQLite connection that wasn’t being closed, which could leave WAL sidecar files behind after container stop (especially in Next.js standalone chunking scenarios).

Changes:

• Add closeAuditDb() to checkpoint/close the MCP audit SQLite handle and cache it via globalThis for cross-chunk reuse.
• Invoke audit DB shutdown from both the Next.js graceful shutdown cleanup and the MCP stdio server shutdown path.
• Add Vitest regression coverage for audit DB close behavior and increase Docker Compose stop grace period.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/lib/gracefulShutdown.ts	Adds shutdown-time import + close for MCP audit DB alongside main DB close.
open-sse/mcp-server/server.ts	Ensures the MCP stdio server attempts to close the audit DB on exit.
open-sse/mcp-server/audit.ts	Moves audit DB handle to globalThis and adds closeAuditDb() with WAL checkpoint + close.
open-sse/mcp-server/tests/audit.test.ts	Adds tests validating closeAuditDb() checkpoints/closes and still closes on checkpoint failure.
docker-compose.yml	Extends stop grace period to allow shutdown cleanup to complete in Docker.

[diegosouzapw]

Thanks @rdself for this great contribution! 🎉 The fix has been integrated into the release/v3.6.8 branch and will be part of the next release. We appreciate your effort in closing the MCP DB shutdown gap for standalone builds!