hecks 3.10.0 → 3.12.0

data/lib/hecks/doors/mcp_door.rb

@@ -1,156 +0,0 @@
-require "json"
-require_relative "../../hecks"
-require_relative "../cli/mcp"
-require_relative "mcp_door/tool_definitions"
-require_relative "mcp_door/tool_calls"
-
-module Hecks
-  module Doors
-    # The MCP door onto the storehouse bus: hand-rolled JSON-RPC over stdio, one
-    # server per booted domain. All logic and the JSON shape answered with live in
-    # `Storehouse`; this is plumbing only. A `role:`/`actor_id:` a caller sends is
-    # asserted, not verified, unless Governance is attached.
-    #
-    # There is no authentication: `domain:` boots real Ruby confined to
-    # `Storehouse::BOOT_ROOT`, so this is a code execution surface for anyone who
-    # can write to stdin (ADR 0062). Spawning with `HECKS_DOOR_TOOLS=readers` and
-    # `HECKS_DOOR_DOMAINS=<dir>[:<dir>...]` narrows a door to read-only tools and
-    # named domains (`McpDoorScope`); this limits what one agent can reach and is
-    # not itself authentication.
-    module McpDoor
-      PROTOCOL_VERSION = "2024-11-05".freeze
-
-      TOOLS = ToolDefinitions::TOOLS
-
-      NOTES = [
-        "Identity is self-asserted: role:/actor_id: are claims made by the caller and are not verified.",
-        "state, events, history, follow, describe, catalog and query run with no role check at all.",
-        "domain: boots real Ruby under #{Storehouse::BOOT_ROOT}; anyone who can write to stdin can run it."
-      ].freeze
-
-      # The method that answers each JSON-RPC method that has a response.
-      REPLIES = {
-        "initialize" => :initialize_result,
-        "tools/list" => :tools_list,
-        "tools/call" => :tools_call,
-        "ping"       => :ping_result
-      }.freeze
-
-      module_function
-
-      # Read once, so a bad setting refuses to start the door before anything is
-      # written to stdout.
-      def scope
-        @scope ||= McpDoorScope.start!(server: CLI::Mcp::SERVER)
-      end
-
-      # The standing notes, then what this door's scope says about `domain:`.
-      def warning_notes
-        NOTES[0, 2] + (scope.restricted? ? scope.notes : [NOTES[2]])
-      end
-
-      def serve
-        McpStdioGuard.warn!(server: CLI::Mcp::SERVER, notes: warning_notes)
-        $stdout.sync = true
-
-        $stdin.each_line { |line| answer_line(line.strip) }
-      end
-
-      # Answers one request line; a line that is not JSON is a parse error, not a crash.
-      def answer_line(line)
-        return if line.empty?
-
-        handle_safely(JSON.parse(line))
-      rescue JSON::ParserError => e
-        send_error(nil, -32_700, "Parse error: #{e.message}")
-      end
-
-      # Handles a request, answering an internal error rather than ending the door.
-      def handle_safely(request)
-        handle(request)
-      rescue StandardError => e
-        send_error(request["id"], -32_603, "Internal error: #{e.class}: #{e.message}")
-      end
-
-      # `domain:` is confined to `Storehouse::BOOT_ROOT`, and further to a restricted
-      # door's `HECKS_DOOR_DOMAINS`, before anything boots. An unrestricted door boots the
-      # domain afresh on every call; a restricted door lives for one spawner's session and
-      # keeps each named domain booted until the files of its directory change.
-      def boot(domain)
-        path = Storehouse.confine!(scope.admit_domain!(domain), "domain")
-        return Hecks.boot(path, install_doors: false) unless scope.restricted?
-
-        resident_boot(path)
-      end
-
-      # The runtime a restricted door keeps for `path`, booted again once its files change.
-      def resident_boot(path)
-        resident    = (@resident ||= {})
-        fingerprint = Storehouse.fingerprint(path)
-        return resident[path][:runtime] if resident[path] && resident[path][:fingerprint] == fingerprint
-
-        resident[path] = { fingerprint: fingerprint, runtime: Hecks.boot(path, install_doors: false) }
-        resident[path][:runtime]
-      end
-
-      def answer_tool(name, args)
-        return scope.refusal(name) unless scope.permits_tool?(name)
-
-        ToolCalls.call(name, scope.with_default_domain(args))
-      end
-
-      # One line per allowed command: what it takes and the role it declares, read from the booted
-      # domain the door serves. Nil when the door serves no single domain or it will not boot, so
-      # `tools/list` still answers, with the commands as a bare list.
-      def command_guide
-        return unless scope.commands_mode? && scope.default_domain
-
-        McpGuideCache.remember(scope.default_domain, scope.allowed_commands) do
-          Storehouse.command_guide(boot(scope.default_domain), scope.allowed_commands)
-        end
-      rescue StandardError
-        nil
-      end
-
-      def tool_result(payload)
-        { content: [{ type: "text", text: JSON.pretty_generate(payload) }], isError: payload[:ok] == false }
-      end
-
-      def send_response(id, result)
-        puts JSON.generate({ jsonrpc: "2.0", id: id, result: result })
-      end
-
-      def send_error(id, code, message)
-        puts JSON.generate({ jsonrpc: "2.0", id: id, error: { code: code, message: message } })
-      end
-
-      # Answers one JSON-RPC request. A notification has no id and gets no response.
-      def handle(request)
-        id     = request["id"]
-        method = request["method"]
-        reply  = REPLIES[method]
-        return send_response(id, public_send(reply, request["params"] || {})) if reply
-
-        send_error(id, -32_601, "Method not found: #{method}") unless id.nil? || method == "notifications/initialized"
-      end
-
-      def initialize_result(_params)
-        { protocolVersion: PROTOCOL_VERSION, capabilities: { tools: {} },
-          serverInfo: { name: CLI::Mcp::SERVER, version: "1.1.0" } }
-      end
-
-      # The tools this door's scope permits, each presented with the command guide.
-      def tools_list(_params)
-        served = TOOLS.select { |tool| scope.permits_tool?(tool[:name]) }
-        guide  = command_guide
-        { tools: served.map { |tool| scope.present(tool, guide) } }
-      end
-
-      def tools_call(params)
-        tool_result(answer_tool(params["name"], params["arguments"] || {}))
-      end
-
-      def ping_result(_params) = {}
-    end
-  end
-end

data/lib/hecks/doors/mcp_door_scope/argument_policy.rb

@@ -1,92 +0,0 @@
-require_relative "../../runtime/errors"
-
-module Hecks
-  module Doors
-    class McpDoorScope
-      # What a restricted door lets an argument say: a denied name is refused, a path must resolve
-      # inside the root with symlinks followed, and a git ref must be a plain name.
-      module ArgumentPolicy
-        module_function
-
-        # Checks every argument in `args`, nested or not, and refuses the first one the policy
-        # forbids.
-        #
-        # @param args [Hash, Array, nil] the arguments as the caller gave them
-        # @param label [String] how the door describes its mode, for the refusal
-        # @raise [Runtime::TypeMismatch] on the first argument refused
-        def admit!(args, label)
-          each_argument(args) do |name, value|
-            if DENIED_ARGUMENTS.include?(name)
-              refuse!(name, label, "never passes it on: it names a host, a binary, an output or a change of state")
-            end
-            admit_path!(name, value, label) if PATH_ARGUMENTS.include?(name)
-            admit_ref!(name, value, label) if REF_ARGUMENTS.include?(name)
-          end
-        end
-
-        # Yields every argument name with its value, descending into nested objects and lists, so
-        # `{"file" => {"value" => "x"}}` is checked the way `{"file" => "x"}` is.
-        def each_argument(args, &visit)
-          case args
-          when Hash
-            args.each do |name, value|
-              yield(name.to_s, value)
-              each_argument(value, &visit)
-            end
-          when Array
-            args.each { |item| each_argument(item, &visit) }
-          end
-        end
-
-        # A value written as an object of one field (`{"value" => "x"}`) is that field's value.
-        def scalar(value)
-          return value unless value.is_a?(Hash)
-
-          value.fetch("value") { value.fetch(:value, value) }
-        end
-
-        def refuse!(name, label, why)
-          raise Runtime::TypeMismatch, "argument: #{name.inspect} is refused: this door runs in #{label} and #{why}"
-        end
-
-        def admit_path!(name, value, label)
-          Array(scalar(value)).flat_map { |item| item.to_s.split(",") }.reject(&:empty?).each do |path|
-            next if !path.include?(":") && inside_root?(path)
-
-            refuse!(name, label, "passes a path only when it resolves inside #{Storehouse::BOOT_ROOT} " \
-                                 "and holds no colon: #{path.inspect}")
-          end
-        end
-
-        def admit_ref!(name, value, label)
-          ref = scalar(value).to_s
-          return if ref.match?(PLAIN_REF) && !ref.include?("..")
-
-          refuse!(name, label, "passes only a plain git ref: #{ref.inspect}")
-        end
-
-        def inside_root?(path)
-          root = resolve_real(Storehouse::BOOT_ROOT)
-          resolved = resolve_real(File.expand_path(path, Storehouse::BOOT_ROOT))
-          resolved == root || resolved.start_with?("#{root}#{File::SEPARATOR}")
-        end
-
-        # The real path of `path`, symlinks followed: of the whole path when it exists, else of its
-        # deepest existing parent with the missing names put back, so a link above a file that does
-        # not exist yet still shows where the file would land.
-        def resolve_real(path)
-          missing = []
-          current = File.expand_path(path)
-          until File.exist?(current)
-            parent = File.dirname(current)
-            break if parent == current
-
-            missing.unshift(File.basename(current))
-            current = parent
-          end
-          File.join(File.realpath(current), *missing)
-        end
-      end
-    end
-  end
-end

data/lib/hecks/doors/mcp_door_scope/env_problems.rb

@@ -1,55 +0,0 @@
-module Hecks
-  module Doors
-    class McpDoorScope
-      # What is wrong with the `HECKS_DOOR_*` variables a door was spawned with, as the sentences
-      # that refuse to start it.
-      module EnvProblems
-        module_function
-
-        # Every problem in `env`: a variable the door does not take, then those of the mode.
-        def setting_problems(env)
-          known = [TOOLS_VARIABLE, DOMAINS_VARIABLE, COMMANDS_VARIABLE]
-          problems = (env.keys.select { |name| name.start_with?(ENV_PREFIX) } - known).map do |name|
-            "environment #{name} is not accepted; the door takes only #{known.join(", ")}"
-          end
-          problems + mode_problems(env[TOOLS_VARIABLE], env[DOMAINS_VARIABLE], env[COMMANDS_VARIABLE])
-        end
-
-        def mode_problems(tools, domains, commands)
-          return stray_problems(domains, commands) if tools.nil?
-          unless MODES.include?(tools)
-            return ["#{TOOLS_VARIABLE}=#{tools.inspect} is not accepted; the values are #{MODES.map(&:inspect).join(" and ")}"]
-          end
-
-          problems = []
-          if split_paths(domains.to_s).empty?
-            problems << "#{TOOLS_VARIABLE}=#{tools} needs #{DOMAINS_VARIABLE}, the domains this door may read"
-          end
-          problems + command_problems(tools, commands)
-        end
-
-        def stray_problems(domains, commands)
-          stray = { DOMAINS_VARIABLE => domains, COMMANDS_VARIABLE => commands }.compact.keys
-          return [] if stray.empty?
-
-          ["#{stray.join(" and ")} set without #{TOOLS_VARIABLE}=#{READERS} or #{TOOLS_VARIABLE}=#{COMMANDS}; " \
-           "they only narrow a restricted door"]
-        end
-
-        def command_problems(tools, commands)
-          if tools == COMMANDS && split_names(commands).empty?
-            ["#{TOOLS_VARIABLE}=#{COMMANDS} needs #{COMMANDS_VARIABLE}, the commands this door may dispatch"]
-          elsif tools == READERS && !commands.nil?
-            ["#{COMMANDS_VARIABLE} is set in reader mode; it only narrows a commands door"]
-          else
-            []
-          end
-        end
-
-        def split_paths(value) = value.to_s.split(File::PATH_SEPARATOR).reject(&:empty?)
-
-        def split_names(value) = value.to_s.split(",").map(&:strip).reject(&:empty?).uniq
-      end
-    end
-  end
-end

data/lib/hecks/doors/mcp_door_scope/presenter.rb

@@ -1,78 +0,0 @@
-module Hecks
-  module Doors
-    class McpDoorScope
-      # A tool definition as `tools/list` shows it to one door, and the notes the door starts with.
-      module Presenter
-        module_function
-
-        # The tool as `tools/list` shows it. A door that serves one domain makes `domain:` optional.
-        # On a commands door, `dispatch` also names the commands it serves as an enum, so a caller
-        # sees them as typed choices instead of finding out by being refused, and says what each
-        # takes and which role it declares.
-        #
-        # @param scope [McpDoorScope] the door's scope
-        # @param tool [Hash] a tool definition from `McpDoor::TOOLS`
-        # @param guide [Array<String>, nil] one line per allowed command
-        #   (`Storehouse.command_guide`)
-        # @return [Hash] the definition, narrowed for this door
-        def present(scope, tool, guide)
-          tool = domain_optional(tool, scope.default_domain) if scope.default_domain
-          return tool unless scope.commands_mode? && tool[:name] == "dispatch"
-
-          narrow_dispatch(tool, guide, scope.allowed_commands)
-        end
-
-        # `dispatch`, with the commands the door serves as typed choices.
-        def narrow_dispatch(tool, guide, commands)
-          properties = tool[:inputSchema][:properties]
-          steps      = properties[:steps]
-          narrowed   = properties.merge(command: with_enum(properties[:command], commands),
-                                        steps:   steps.merge(items: step_items(steps[:items], commands)))
-          tool.merge(description: dispatch_description(tool[:description], guide, commands),
-                     inputSchema: tool[:inputSchema].merge(properties: narrowed))
-        end
-
-        def domain_optional(tool, default)
-          schema = tool[:inputSchema]
-          return tool unless schema[:properties].key?(:domain)
-
-          note = "Optional: this door serves one domain, #{default}, and uses it when you leave this out."
-          properties = schema[:properties].merge(domain: schema[:properties][:domain].merge(description: note))
-          tool.merge(inputSchema: schema.merge(properties: properties, required: schema[:required] - ["domain"]))
-        end
-
-        def dispatch_description(base, guide, commands)
-          intro = "#{base} This door dispatches only the commands below, each with the role it declares: pass " \
-                  "that role as `role`. A command that takes `run` takes a key you choose, and the call answers " \
-                  "the record as it stands once its reactions have run; an argument marked * is required."
-          entries = Array(guide).empty? ? commands : guide
-          ([intro] + entries.map { |entry| "- #{entry}" }).join("\n")
-        end
-
-        def with_enum(property, commands)
-          property.merge(enum: commands)
-        end
-
-        def step_items(items, commands)
-          items.merge(properties: items[:properties].merge(command: with_enum(items[:properties][:command], commands)))
-        end
-
-        # What a reader door says about itself when it starts.
-        def reader_notes(domains)
-          ["Reader mode (#{TOOLS_VARIABLE}=#{READERS}): serves #{READER_TOOLS.join(", ")}; " \
-           "refuses dispatch (with dry_run and steps), behaviors and every other tool.",
-           "domain: boots only #{DOMAINS_VARIABLE}: #{domains.join(", ")}.",
-           "Reader mode limits reach and identifies no one; it is not authentication."]
-        end
-
-        # What a commands door says about itself when it starts.
-        def commands_notes(domains, commands)
-          ["Commands mode (#{TOOLS_VARIABLE}=#{COMMANDS}): serves #{READER_TOOLS.join(", ")} and dispatch of only " \
-           "#{COMMANDS_VARIABLE}: #{commands.join(", ")}; refuses behaviors and every other tool.",
-           "domain: boots only #{DOMAINS_VARIABLE}: #{domains.join(", ")}.",
-           "Commands mode limits reach and identifies no one; role: stays self-asserted and it is not authentication."]
-        end
-      end
-    end
-  end
-end

data/lib/hecks/doors/mcp_door_scope.rb

@@ -1,201 +0,0 @@
-require_relative "../runtime/errors"
-
-module Hecks
-  module Doors
-    # What a spawned hecks mcp may do: every tool by default; only reader tools against named
-    # domains in reader mode; and in commands mode those plus `dispatch` of a closed list of
-    # commands — reach, not identity (ADR 0072, ADR 0089).
-    class McpDoorScope
-      ENV_PREFIX         = "HECKS_DOOR_".freeze
-      TOOLS_VARIABLE     = "HECKS_DOOR_TOOLS".freeze
-      DOMAINS_VARIABLE   = "HECKS_DOOR_DOMAINS".freeze
-      COMMANDS_VARIABLE  = "HECKS_DOOR_COMMANDS".freeze
-      READERS            = "readers".freeze
-      COMMANDS           = "commands".freeze
-      MODES              = [READERS, COMMANDS].freeze
-      EXIT_STATUS        = 2
-
-      # The tools a reader door serves — each reads a domain or the door's own
-      # audit log and writes no domain state. `validate` still boots its
-      # domain, so it stays bound to the allowed set like every other tool.
-      READER_TOOLS = %w[query events state catalog describe validate domains history follow].freeze
-
-      # The tools a commands door serves: the reader tools, and `dispatch` for the allowed commands.
-      COMMAND_TOOLS = (READER_TOOLS + %w[dispatch]).freeze
-
-      # Argument names a restricted door never passes on, whatever command carries them: each one
-      # names a host or a URL, a binary to run, a place to write, a port to open, a store to
-      # switch to, or flips a command from a preview to a change of state.
-      DENIED_ARGUMENTS = %w[
-        adapter artifact confirm expected from gem_only header health_path host live no_wait npm_local
-        npm_only output path payload payload_file port rust_binary scheme stage_dir state_path stdio url
-        write
-      ].freeze
-
-      # Argument names whose values are paths (a comma-separated list for some). A restricted door
-      # passes them on only when each resolves, symlinks followed, inside `Storehouse::BOOT_ROOT`,
-      # and holds no colon: `host:repo` and `https://host/x` would otherwise pass as relative paths.
-      PATH_ARGUMENTS = %w[dir domain domains file fixture paths root script].freeze
-
-      # Argument names whose values are git refs: plain names only, so a value cannot read as an
-      # option to git.
-      REF_ARGUMENTS = %w[commit ref].freeze
-
-      # What a plain git ref looks like: no leading dash, no `..`, no spaces.
-      PLAIN_REF = %r{\A[A-Za-z0-9][A-Za-z0-9._/~^@-]*\z}
-
-      # Unrestricted when no HECKS_DOOR_* variable is set.
-      def self.from_env(env = ENV)
-        problems = EnvProblems.setting_problems(env)
-        raise ArgumentError, problems.join("\n") unless problems.empty?
-        return new(allowed_domains: nil) unless env[TOOLS_VARIABLE]
-
-        commands = env[TOOLS_VARIABLE] == COMMANDS ? EnvProblems.split_names(env[COMMANDS_VARIABLE]) : nil
-        new(allowed_domains: EnvProblems.split_paths(env[DOMAINS_VARIABLE]), allowed_commands: commands)
-      end
-
-      # Refuses to stderr, not stdout, which carries the MCP protocol.
-      def self.start!(server:, env: ENV, stderr: $stderr)
-        from_env(env)
-      rescue ArgumentError, Runtime::TypeMismatch => e
-        e.message.each_line { |line| stderr.puts("#{server}: refusing to start: #{line.chomp}") }
-        exit(EXIT_STATUS)
-      end
-
-      # The named domains, resolved against Storehouse::BOOT_ROOT; nil when unrestricted.
-      attr_reader :allowed_domains
-
-      # The command names a commands door dispatches, as the spawner wrote them; nil unless
-      # the door runs in commands mode.
-      attr_reader :allowed_commands
-
-      def initialize(allowed_domains:, allowed_commands: nil)
-        @allowed_domains = allowed_domains&.map { |path| Storehouse.confine!(path, DOMAINS_VARIABLE) }.freeze
-        @allowed_commands = allowed_commands&.dup&.freeze
-      end
-
-      def restricted?
-        !@allowed_domains.nil?
-      end
-
-      def commands_mode?
-        !@allowed_commands.nil?
-      end
-
-      def served_tools
-        commands_mode? ? COMMAND_TOOLS : READER_TOOLS
-      end
-
-      def permits_tool?(name)
-        !restricted? || served_tools.include?(name)
-      end
-
-      def refusal(name)
-        { ok:    false,
-          error: "#{name.inspect} is refused: this door runs in #{mode_label}, " \
-                 "which serves only #{served_tools.join(", ")}" }
-      end
-
-      # Checked before anything boots, so a path outside the allowed set never reaches Kernel.load.
-      def admit_domain!(domain)
-        return domain unless restricted?
-        return domain if @allowed_domains.include?(Storehouse.confine!(domain, "domain"))
-
-        raise Runtime::TypeMismatch,
-              "domain: #{domain.inspect} is refused: this door runs in #{mode_label} " \
-              "and reads only #{DOMAINS_VARIABLE}: #{@allowed_domains.join(", ")}"
-      end
-
-      # A commands door dispatches only the commands it was given. A requested name and each
-      # allowed name resolve through the alias map `dispatch` uses, and the resolved verbs are
-      # compared, so `complete` cannot reach a command of another aggregate that shares its short
-      # name, and an allowed name that resolves to nothing admits nothing.
-      #
-      # @param runtime [Runtime::Dispatcher] the booted domain
-      # @param command [String, nil] the command name the caller asked for
-      # @param args [Hash, nil] the arguments the caller gave it; see `admit_arguments!`
-      # @raise [Runtime::TypeMismatch] when the command is not on the list or an argument is refused
-      def admit_command!(runtime, command, args = nil)
-        return unless commands_mode?
-
-        verbs = Storehouse.verbs_for(runtime, [command, *allowed_commands])
-        unless verbs.first && verbs.drop(1).include?(verbs.first)
-          raise Runtime::TypeMismatch,
-                "command: #{command.to_s.inspect} is refused: this door runs in #{mode_label} " \
-                "and dispatches only #{COMMANDS_VARIABLE}: #{allowed_commands.join(", ")}"
-        end
-
-        admit_arguments!(args)
-      end
-
-      # Every step of a batch is admitted before any step runs.
-      #
-      # @param runtime [Runtime::Dispatcher] the booted domain
-      # @param steps [Array<Hash>] the batch, each `{"command" => ..., "args" => ...}`
-      # @raise [Runtime::TypeMismatch] when a step names a command off the list or a bad argument
-      def admit_steps!(runtime, steps)
-        Array(steps).each do |step|
-          step = {} unless step.is_a?(Hash)
-          admit_command!(runtime, step["command"], step["args"])
-        end
-      end
-
-      # The arguments a restricted door is about to pass to a command or a question. A command
-      # list admits commands, not values, so each argument is checked by its name: a denied name
-      # is refused, a path must resolve inside the root with symlinks followed, and a git ref must
-      # be a plain name. Other names pass; a domain with an argument that reaches outside its own
-      # files should name it in `DENIED_ARGUMENTS` or `PATH_ARGUMENTS` (ADR 0089).
-      #
-      # @param args [Hash, Array, nil] the arguments as the caller gave them, nested or not
-      # @raise [Runtime::TypeMismatch] on the first argument refused
-      def admit_arguments!(args)
-        return unless restricted?
-
-        ArgumentPolicy.admit!(args, mode_label)
-      end
-
-      # The one domain a restricted door serves, when it serves exactly one: a call may leave
-      # `domain:` out and get it. Nil for an unrestricted door and for one that names several.
-      #
-      # @return [String, nil] the domain path as `HECKS_DOOR_DOMAINS` named it, resolved
-      def default_domain
-        @allowed_domains.first if restricted? && @allowed_domains.size == 1
-      end
-
-      # The arguments with the default domain filled in when the caller left it out.
-      #
-      # @param args [Hash] a tool call's arguments
-      # @return [Hash] `args`, with `"domain"` set when the door has a default and none was given
-      def with_default_domain(args)
-        return args unless default_domain && args["domain"].to_s.strip.empty?
-
-        args.merge("domain" => default_domain)
-      end
-
-      # The tool as `tools/list` shows it; see `Presenter.present`.
-      #
-      # @param tool [Hash] a tool definition from `McpDoor::TOOLS`
-      # @param guide [Array<String>, nil] one line per allowed command (`Storehouse.command_guide`)
-      # @return [Hash] the definition, narrowed for this door
-      def present(tool, guide = nil)
-        Presenter.present(self, tool, guide)
-      end
-
-      def notes
-        return [] unless restricted?
-
-        commands_mode? ? Presenter.commands_notes(@allowed_domains, @allowed_commands) : Presenter.reader_notes(@allowed_domains)
-      end
-
-      private
-
-      def mode_label
-        commands_mode? ? "commands mode (#{TOOLS_VARIABLE}=#{COMMANDS})" : "reader mode (#{TOOLS_VARIABLE}=#{READERS})"
-      end
-    end
-  end
-end
-
-require_relative "mcp_door_scope/env_problems"
-require_relative "mcp_door_scope/argument_policy"
-require_relative "mcp_door_scope/presenter"

data/lib/hecks/doors/mcp_guide_cache.rb

@@ -1,75 +0,0 @@
-require "digest"
-require "fileutils"
-require "json"
-require_relative "../cache_dir"
-require_relative "../storehouse"
-require_relative "../bluebook/meta_validator/verdict_cache"
-
-module Hecks
-  module Doors
-    # Remembers the command guide a commands door builds for `tools/list`, so a door that starts
-    # again does not boot its domain to describe its commands. A client waits only a moment for a
-    # server's tools, and a boot at that point costs more than the wait.
-    #
-    # An entry is keyed by the domain directory's files, a digest of the hecks code, and the
-    # allowed commands, so a change to any of them builds a new guide. The file is JSON, read only
-    # from a directory and a file that only this user can write (the verdict cache's own check),
-    # and only when it is a list of strings: a guide is text an agent reads as instructions.
-    module McpGuideCache
-      module_function
-
-      # The guide for a domain and its allowed commands, from the cache or else from the block,
-      # which is then remembered. A cache that cannot be written is not an error: the next start
-      # builds the guide again.
-      #
-      # @param domain [String] the domain directory the guide describes
-      # @param commands [Array<String>] the allowed command names
-      # @yieldreturn [Array<String>, nil] the guide, built when none is remembered
-      # @return [Array<String>, nil] the guide
-      def remember(domain, commands)
-        file = File.join(dir, "#{key(domain, commands)}.json")
-        cached = read(file)
-        return cached if cached
-
-        guide = yield
-        write(file, guide) if guide.is_a?(Array) && guide.any?
-        guide
-      end
-
-      # @return [String] the directory entries live in
-      def dir = Hecks::CacheDir.path("mcp_door_guides")
-
-      # @param domain [String] the domain directory
-      # @param commands [Array<String>] the allowed command names
-      # @return [String] a hex SHA-256 over the domain's files, the hecks code and the commands
-      def key(domain, commands)
-        parts = [Storehouse.fingerprint(domain), Bluebook::MetaValidator::VerdictCache.code_digest,
-                 commands.sort.join(",")]
-        Digest::SHA256.hexdigest(parts.join("\0"))
-      end
-
-      # @param file [String] an entry's path
-      # @return [Array<String>, nil] the guide, or nil when absent, untrusted or malformed
-      def read(file)
-        return unless File.file?(file) && Bluebook::MetaValidator::VerdictCache.trusted?(file)
-
-        guide = JSON.parse(File.read(file))
-        guide if guide.is_a?(Array) && guide.all?(String)
-      rescue StandardError
-        nil
-      end
-
-      # @param file [String] an entry's path
-      # @param guide [Array<String>] the guide to remember
-      # @return [void]
-      def write(file, guide)
-        FileUtils.mkdir_p(dir, mode: 0o700)
-        temp = "#{file}.#{Process.pid}.tmp"
-        File.write(temp, JSON.generate(guide), perm: 0o600)
-        File.rename(temp, file)
-      rescue StandardError
-        FileUtils.rm_f(temp) if temp
-      end
-    end
-  end
-end