@agdf/mcp-server 0.20.1 → 0.30.0

package/src/generation.js

@@ -8,7 +8,7 @@ import { DispatchExecutionError } from './worker.js';
 // One live facade, three directly owned children, no process registry or PID
 // discovery. Capacity includes startup and unconfirmed cleanup, not just current.
 export async function createOwnedGenerationFacade({ runtime, publisher, createControlRuntime, surface, cockpitDir, cockpitMode,
-  Fork = fork, qualifyMs = L.qualify, closeMs = L.close, invokeMs = L.qualify, onEvent = () => {} } = {}) {
+  generationTransport, Fork = fork, qualifyMs = L.qualify, closeMs = L.close, invokeMs = L.qualify, onEvent = () => {} } = {}) {
   if (![qualifyMs, closeMs, invokeMs].every(value => Number.isSafeInteger(value) && value > 0)
     || qualifyMs > L.qualify || closeMs > L.close || invokeMs > L.qualify) throw Error('generation_deadline_invalid');
   const epoch = randomUUID(), slots = new Map(), routes = new Map(), presentations = new Map(), operations = new Map(), receipts = new Map();
@@ -64,10 +64,16 @@ export async function createOwnedGenerationFacade({ runtime, publisher, createCo
       unknown: new Set(), inflight: 0, exited: false, closeAck: false, observed: null };
     slots.set(row.id, row); event(row, 'reserved'); // Reservation precedes acquisition/load/spawn.
     try {
-      const claim = publisher.acquire(packageInfo, { ownerEpoch: epoch, generation: row.id });
-      row.child = Fork(join(packageInfo.packageRoot, 'src/generation-entry.js'), [epoch, String(row.id)],
-        { stdio: ['ignore', 'ignore', 'ignore', 'ipc'], serialization: 'json', execArgv: [] });
-      claim.bindOwnedChild(row.child, { confirmedEnd: () => row.closeAck && !row.inflight && !row.unknown.size });
+      if (generationTransport) {
+        // This is a logical private connection. Actual Worker and claim ownership
+        // stay in the detached owner; no ChildProcess/Worker impersonation.
+        row.child = await generationTransport.open({ packageInfo, epoch, generation: row.id });
+      } else {
+        const claim = publisher.acquire(packageInfo, { ownerEpoch: epoch, generation: row.id });
+        row.child = Fork(join(packageInfo.packageRoot, 'src/generation-entry.js'), [epoch, String(row.id)],
+          { stdio: ['ignore', 'ignore', 'ignore', 'ipc'], serialization: 'json', execArgv: [] });
+        claim.bindOwnedChild(row.child, { confirmedEnd: () => row.closeAck && !row.inflight && !row.unknown.size });
+      }
       row.child.on('message', reply => {
         if (!validGenerationMessage(reply, { epoch, generation: row.id, reply: true })) { event(row, 'invalid_reply'); return; }
         const pending = row.pending.get(reply.request_id);
@@ -81,13 +87,18 @@ export async function createOwnedGenerationFacade({ runtime, publisher, createCo
           pending.resolve(reply);
         }
       });
-      row.child.once('exit', () => {
+      row.child.once('exit', (code, signal) => {
         row.exited = true;
         for (const pending of row.pending.values()) { clearTimeout(pending.timer); pending.reject(new DispatchExecutionError('generation_connection_lost')); }
         row.pending.clear();
-        if (row.closeAck && !row.inflight && !row.unknown.size) { slots.delete(row.id); row.state = 'closed'; event(row, 'confirmed_exit'); row.end?.(true); }
+        if (code === 0 && !signal && row.closeAck && !row.inflight && !row.unknown.size) { slots.delete(row.id); row.state = 'closed'; event(row, 'confirmed_exit'); row.end?.(true); }
         else { row.state = 'close_unconfirmed'; event(row, 'unexpected_exit'); row.end?.(false); }
       });
+      row.child.once('disconnect', () => {
+        row.state = 'close_unconfirmed'; event(row, 'connection_lost');
+        for (const pending of row.pending.values()) { clearTimeout(pending.timer); pending.reject(new DispatchExecutionError('generation_connection_lost')); }
+        row.pending.clear();
+      });
       row.child.once('error', () => { row.state = 'close_unconfirmed'; event(row, 'spawn_failed'); });
       row.state = 'qualifying'; event(row, 'qualifying');
       const qualified = (await request(row, 'qualify', { surface, commandGroups: [...(runtime.trustedContext.commandGroups ?? [])],
@@ -105,6 +116,11 @@ export async function createOwnedGenerationFacade({ runtime, publisher, createCo
   }
   const control = {
     status,
+    originalInput(input) {
+      const prior = receipts.get(input.operation_id);
+      if (!prior) return null;
+      return { known: true, resolution: prior.resolution ?? null };
+    },
     async refresh() { await Promise.all([...slots.values()].filter(row => !row.exited).map(observe)); return status(); },
     inspect(id, input) { const record = receipts.get(id);
       if (record && (record.input.run_id !== input.run_id || record.input.primary_target !== input.primary_target
@@ -112,18 +128,23 @@ export async function createOwnedGenerationFacade({ runtime, publisher, createCo
       return record ? { status: record.result ? 'recorded' : 'pending',
       request_digest: record.digest, result: record.result, current: status(), authorizes: false }
       : { status: 'unknown', reason: 'connection_control_record_unavailable', current: status(), authorizes: false }; },
-    async replace({ input, candidate, requestDigest, revalidate }) {
+    async replace({ input, candidate, requestDigest, resolution, revalidate }) {
       const prior = receipts.get(input.operation_id);
       if (prior) return prior.digest !== requestDigest ? failure('operation_payload_conflict')
         : prior.result ? { ...prior.result, outcome: prior.result.outcome === 'accepted' ? 'already_applied' : prior.result.outcome, historical_effect: true, current: status() }
         : { outcome: 'effect_unknown', reason: 'generation_replacement_pending', current: status(), authorizes: false };
       if (receipts.size >= L.receipts) return failure('connection_control_capacity');
       if (closed || replacing) return failure(closed ? 'connection_closed' : 'generation_replacement_busy');
-      const record = { digest: requestDigest, input, result: null }; receipts.set(input.operation_id, record); replacing = true;
+      const record = { digest: requestDigest, input, resolution, result: null }; receipts.set(input.operation_id, record); replacing = true;
       let candidateRow;
       try {
-        revalidate(); const packageInfo = publisher.resolve(candidate);
-        candidateRow = await reserve(packageInfo, actualContext); revalidate();
+        const recheck = () => {
+          if (closed) throw new DispatchExecutionError('connection_closed', 'not_dispatched');
+          controlRuntimeInstance?.verifyProducer();
+          revalidate();
+        };
+        recheck(); const packageInfo = publisher.resolve(candidate);
+        candidateRow = await reserve(packageInfo, actualContext); recheck();
         const previous = current; current = candidateRow; current.state = 'current';
         if (previous) previous.state = previous.exited ? 'close_unconfirmed' : 'draining';
         event(current, 'admitted'); record.result = { outcome: 'accepted', reason: null, operation_id: input.operation_id,
@@ -135,44 +156,66 @@ export async function createOwnedGenerationFacade({ runtime, publisher, createCo
       record.result.current = status(); return record.result;
     },
   };
-  const controlRuntime = createControlRuntime(control);
+  // Ordinary requests belong to the fully qualified generation. Only the rare
+  // facade control branches need another Core instance; share one initialization.
+  let controlRuntimePromise, controlRuntimeInstance;
+  const getControlRuntime = () => controlRuntimePromise ??= Promise.resolve().then(() => createControlRuntime(control)).then(async created => {
+    const producer = created?.producerIdentity;
+    const code = created?.trustedContext?.expectedVersion !== runtime.trustedContext.expectedVersion ? 'runtime_version_mismatch'
+      : created?.trustedContext?.provenanceStatus !== 'matched'
+      || !producer || producer.server_digest !== publisher.initial.digest || producer.dispatcher_digest !== publisher.initial.dispatcherDigest
+      || producer.sdk_digest !== publisher.initial.sdkDigest || typeof created.verifyProducer !== 'function'
+      ? 'runtime_provenance_invalid' : null;
+    if (code) {
+      await created?.close?.(); throw new DispatchExecutionError(code, 'not_dispatched');
+    }
+    controlRuntimeInstance = created;
+    return created;
+  }).catch(error => { throw new DispatchExecutionError(generationFailureReason(error), 'not_dispatched'); });
   function operationKey(input, id = input.operation_id) { return JSON.stringify([input.primary_target, input.run_id, id]); }
   async function invoke(name, args, host = {}, signal) {
     if (signal?.aborted) throw new DispatchExecutionError('dispatch_cancelled', 'not_dispatched');
     if (closed) throw new DispatchExecutionError('connection_closed', 'not_dispatched');
     actualContext = { client: host.client, uiSupported: host.uiSupported === true };
+    const canonical = Boolean(args.operation_id) && !runtime.isEphemeralControlCommand?.(name,args);
     if (args.operation_id && name === 'agdf_record' && args.command?.kind === 'runtime_generation.replace'
       && operations.has(operationKey(args))) throw new DispatchExecutionError('operation_payload_conflict', 'not_dispatched');
     if (args.operation_id && args.command?.kind !== 'runtime_generation.replace' && receipts.has(args.operation_id))
       throw new DispatchExecutionError('operation_payload_conflict', 'not_dispatched');
     if (name === 'agdf_record' && args.command?.kind === 'runtime_generation.replace'
       || name === 'agdf_inspect' && args.operation === 'runtime-generations') {
+      const controlRuntime = await getControlRuntime();
+      if (closed || signal?.aborted) throw new DispatchExecutionError(closed ? 'connection_closed' : 'dispatch_cancelled', 'not_dispatched');
+      try { controlRuntime.verifyProducer(); } catch (error) { throw new DispatchExecutionError(generationFailureReason(error), 'not_dispatched'); }
       const result = await controlRuntime.tool(name).execute(controlRuntime.tool(name).parse(args));
       return controlRuntime.projectToolResult(name, args, name === 'agdf_inspect' && result.report?.available ? { ...result, report: await control.refresh() } : result);
     }
     if (name === 'agdf_inspect' && args.operation === 'operation-status' && receipts.has(args.module)) {
+      const controlRuntime = await getControlRuntime();
+      if (closed || signal?.aborted) throw new DispatchExecutionError(closed ? 'connection_closed' : 'dispatch_cancelled', 'not_dispatched');
+      try { controlRuntime.verifyProducer(); } catch (error) { throw new DispatchExecutionError(generationFailureReason(error), 'not_dispatched'); }
       const validated = await controlRuntime.tool(name).execute(controlRuntime.tool(name).parse(args));
       return controlRuntime.projectToolResult(name, args, validated.report?.status === 'unknown' || validated.report?.status === 'absent'
         ? { ...validated, report: control.inspect(args.module, args) } : validated);
     }
     const knownSession = args.session_id && routes.get(args.session_id);
     if (args.session_id && !knownSession) throw new DispatchExecutionError('session_expired', 'not_dispatched');
-    const id = name === 'agdf_inspect' && args.operation === 'operation-status' ? args.module : args.operation_id;
+    const id = name === 'agdf_inspect' && args.operation === 'operation-status' ? args.module.split('/').at(-1) : canonical ? args.operation_id : null;
     const key = id && operationKey(args, id), original = key && operations.get(key);
     const presentationId = args.command?.payload?.presentation_id ?? args.presentation_id;
     const presentationOwner = presentationId && presentations.get(operationKey(args, presentationId));
     const row = knownSession ?? original ?? presentationOwner ?? current;
     if (!row || row.exited) throw new DispatchExecutionError('generation_unavailable', 'not_dispatched');
-    if (args.operation_id && !original) {
+    if (canonical && !original) {
       if (operations.size >= L.routes) throw new DispatchExecutionError('generation_route_capacity', 'not_dispatched');
       operations.set(key, row);
     }
     ++row.inflight; event(row, 'invoke', name);
     try {
-      const result = (await request(row, 'invoke', { name, arguments: args }, actualContext, args.operation_id ?? null, invokeMs)).payload;
-      if (args.operation_id && result.outcome === 'effect_unknown') row.unknown.add(key);
+      const result = (await request(row, 'invoke', { name, arguments: args }, actualContext, canonical ? args.operation_id : null, invokeMs)).payload;
+      if (canonical && result.outcome === 'effect_unknown') row.unknown.add(key);
       if (name === 'agdf_inspect' && args.operation === 'operation-status' && result.report?.status === 'recorded'
-        && result.report.receipt?.operation_id === args.module) row.unknown.delete(key);
+        && (result.report.receipt?.operation_id ?? result.report.receipt?.operation?.operation_id) === id) row.unknown.delete(key);
       if (result.app_capability === 'available') nativeRequired = true;
       if (result.family_result?.presentation_id && ['accepted', 'already_applied'].includes(result.outcome)) {
         const presentationKey = operationKey(args, result.family_result.presentation_id);
@@ -185,7 +228,7 @@ export async function createOwnedGenerationFacade({ runtime, publisher, createCo
         }
       }
       return result;
-    } catch (error) { if (args.operation_id && error.dispatch !== 'not_dispatched') row.unknown.add(key); throw error; }
+    } catch (error) { if (canonical && error.dispatch !== 'not_dispatched') row.unknown.add(key); throw error; }
     finally { --row.inflight; if (closed && !row.inflight && !row.unknown.size) void retire(row, true); }
   }
   current = await reserve(publisher.initial, {}); current.state = 'current'; event(current, 'admitted');
@@ -194,16 +237,17 @@ export async function createOwnedGenerationFacade({ runtime, publisher, createCo
   // not wire requests; parsing them again in a child both breaks the contract
   // and copies the entire locale registry into a bounded private message.
   const tools = runtime.tools.map(tool => ({ ...tool, parentOwned: true,
-    parse: input => { tool.parse(input); return input; }, execute: input => invoke(tool.name, input) }));
+    parse: input => { if (runtime.validatePublicInput?.(tool.name, input) !== true) tool.parse(input); return input; }, execute: input => invoke(tool.name, input) }));
   // The server supplies actual initialize/request context only at this seam.
   for (const tool of tools) tool.execute = (input, signal, host) => invoke(tool.name, input, host, signal);
   return Object.freeze({ ...runtime, tools, tool: name => tools.find(tool => tool.name === name),
-    requiresProjectedResult: true, postprocessToolResult: undefined, inspectOwnership: status, runtimeControl: control,
+    requiresProjectedResult: true, prepareInput: undefined, postprocessToolResult: undefined, inspectOwnership: status, runtimeControl: control,
     close() {
       return closing ??= (async () => {
         closed = true;
         const previous = current; current = null; if (previous && !previous.exited) previous.state = 'draining';
         await Promise.allSettled([...slots.values()].map(row => retire(row, true)));
+        if (controlRuntimePromise) await controlRuntimePromise.then(controlRuntime => controlRuntime.close?.(), () => {});
         return status();
       })();
     },

package/src/main.js

@@ -1,15 +1,16 @@
 import { readFileSync } from "node:fs";
 import process from "node:process";
-import { createAgdfWorkerExecutor, serveAgdfStdio } from "./server.js";
 import { loadCockpitResource } from './cockpit-resource.js';
 
-export async function runMcpServer({ surface, cockpitDir, cockpitMode, runtime, executor, ownedPublication, ownedPublisher, onClosed } = {}) {
+export async function runMcpServer({ surface, cockpitDir, cockpitMode, runtime, executor, ownedPublication, ownedPublisher, generationTransport, onClosed } = {}) {
   if (cockpitMode !== undefined && (cockpitMode !== 'plugin' || surface !== 'codex' || cockpitDir !== undefined)) throw Error('AGDF_COCKPIT_TARGET_INVALID');
   const defaultRuntime = runtime === undefined && cockpitDir === undefined && cockpitMode === undefined;
   // A supplied, bound runtime owns its resources. Do not load a second package
   // composition merely to run an explicit adapter/protocol fixture.
-  const dispatcherRuntime = runtime === undefined ? await import('create-agdf/mcp-dispatch-runtime') : null;
-  runtime ??= cockpitDir !== undefined || cockpitMode !== undefined ? await dispatcherRuntime.createMcpCockpitRuntime({ surface, cockpitDir, cockpitMode }) : dispatcherRuntime.createMcpDispatchRuntime({ surface });
+  const thin = defaultRuntime && !!ownedPublication;
+  const dispatcherRuntime = runtime === undefined ? await import(thin ? 'create-agdf/mcp-protocol-runtime' : 'create-agdf/mcp-dispatch-runtime') : null;
+  runtime ??= cockpitDir !== undefined || cockpitMode !== undefined ? await dispatcherRuntime.createMcpCockpitRuntime({ surface, cockpitDir, cockpitMode })
+    : thin ? dispatcherRuntime.createMcpTransportRuntime({ surface }) : dispatcherRuntime.createMcpDispatchRuntime({ surface });
   const serverVersion = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
   if (runtime.trustedContext.expectedVersion !== serverVersion) {
     process.stderr.write("AGDF_MCP_VERSION_MISMATCH\n");
@@ -21,21 +22,52 @@ export async function runMcpServer({ surface, cockpitDir, cockpitMode, runtime,
     process.exitCode = 1;
     return null;
   }
-  if (defaultRuntime && surface === 'codex' && dispatcherRuntime?.createMcpDecisionRuntime) {
+  if (ownedPublication) {
+    // The serving protocol factory freshly inspects all selected source and SDK
+    // bytes. Bind that actual producer to the parent's claimed expectation;
+    // never treat a cross-thread/async observation as fresh inspection evidence.
+    const producer = runtime.producerIdentity;
+    if (!producer || producer.server_digest !== ownedPublication.digest
+      || producer.dispatcher_digest !== ownedPublication.dispatcherDigest || producer.sdk_digest !== ownedPublication.sdkDigest)
+      throw Error('AGDF_MCP_FACADE_IDENTITY_INVALID');
+  }
+  if (defaultRuntime && surface === 'codex') {
     const ui = { uri: dispatcherRuntime.DECISION_UI_URI, mimeType: 'text/html;profile=mcp-app', limit: 4 * 1024 ** 2, kind: 'decision' };
-    ui.digest = loadCockpitResource(ui).digest;
+    // The thin front has no session/qualification consumer. Its facade loads
+    // the resource for the real generation manifest; full runtimes need it here.
+    if (!thin) ui.digest = loadCockpitResource(ui).digest;
     // A shipped resource does not qualify native App-only mediation. Production
     // actions remain disabled until exact package/host evidence is provided.
-    runtime = await dispatcherRuntime.createMcpDecisionRuntime({ runtime, ui });
+    runtime = thin ? await dispatcherRuntime.createMcpDecisionTransportRuntime({ runtime, ui })
+      : await dispatcherRuntime.createMcpDecisionRuntime({ runtime, ui });
   }
   if (runtime.mode === 'cockpit') loadCockpitResource(runtime.ui);
+  let transport;
   if (ownedPublication) {
     const { createOwnedGenerationFacade } = await import('./generation.js');
     if (!ownedPublisher) throw Error('runtime_publication_unowned');
     const publisher = ownedPublisher;
-    runtime = await createOwnedGenerationFacade({ runtime, publisher, surface, cockpitDir, cockpitMode,
-      createControlRuntime: runtimeControl => dispatcherRuntime.createMcpDispatchRuntime({ surface, runtimeControl }) });
-  }
+    let beginTransport;
+    const claimed = new Promise(resolve => { beginTransport = resolve; });
+    const starting = createOwnedGenerationFacade({ runtime, publisher, generationTransport, surface, cockpitDir, cockpitMode,
+      onEvent: event => { if (event.kind === 'qualifying') beginTransport(); },
+      createControlRuntime: async runtimeControl => {
+        const full = thin ? await import('create-agdf/mcp-dispatch-runtime') : dispatcherRuntime;
+        return full.createMcpDispatchRuntime({ surface, runtimeControl });
+      } });
+    // Only a claimed private-generation start releases the SDK import. A
+    // pre-claim failure rejects starting without loading transport code. Its full
+    // qualification and the facade SDK must both finish before public service.
+    // Observe both promises so a transport failure cannot abandon a live child.
+    const transportStarting = Promise.race([claimed, starting]).then(() => import('./server.js'));
+    const [generation, loaded] = await Promise.allSettled([starting, transportStarting]);
+    if (generation.status === 'rejected' || loaded.status === 'rejected') {
+      if (generation.status === 'fulfilled') await generation.value.close();
+      throw generation.status === 'rejected' ? generation.reason : loaded.reason;
+    }
+    runtime = generation.value; transport = loaded.value;
+  } else transport = await import('./server.js');
+  const { createAgdfWorkerExecutor, serveAgdfStdio } = transport;
   const dispatchExecutor = executor ?? (runtime.mode === 'cockpit' ? undefined
     : createAgdfWorkerExecutor(runtime, { releaseOwnedLock: dispatcherRuntime?.releaseAbandonedOwnedLock ?? null }));
   const handle = serveAgdfStdio({

package/src/server.js

@@ -1,11 +1,13 @@
+import { boundStdioOutput } from './stdio-output.js';
 import { McpServer, ProtocolError, ProtocolErrorCode, fromJsonSchema } from "@modelcontextprotocol/server";
-import { serveStdio } from "@modelcontextprotocol/server/stdio";
+import { serveStdio, StdioServerTransport } from "@modelcontextprotocol/server/stdio";
 import { AjvJsonSchemaValidator } from '@modelcontextprotocol/server/validators/ajv';
 import { randomUUID } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
-import { DispatchExecutionError, createWorkerDispatchExecutor } from "./worker.js";
+import { DispatchExecutionError } from "./worker.js";
 import { loadCockpitResource } from './cockpit-resource.js';
-import { requestDeclaresMcpAppUi, requestMcpClientInfo, requestMcpClientCapabilities } from "./ui-capability.js";
+import { requestDeclaresMcpAppUi, requestMcpClientInfo, requestMcpClientCapabilities, requiresMcpAppUi,
+  missingMcpAppUi, capabilityTransport, modernToolUiDenial } from "./ui-capability.js";
 
 export const SERVER_NAME = "agdf-mcp";
 
@@ -38,7 +40,7 @@ function toolResult(runtime, name, input, result, serialize = runtime.serialize,
   return response;
 }
 
-export function buildAgdfServer({ runtime, executor } = {}) {
+export function buildAgdfServer({ runtime, executor, era } = {}) {
   if (!runtime?.definition || typeof runtime.serialize !== "function") {
     throw new TypeError("AGDF MCP runtime is required");
   }
@@ -57,7 +59,14 @@ export function buildAgdfServer({ runtime, executor } = {}) {
     },
     close: async () => runtime.close?.(),
   };
-  const server = new McpServer(
+  const registrations = new Map();
+  class AgdfServer extends McpServer {
+    async connect(transport) {
+      return super.connect(capabilityTransport(transport, message => modernToolUiDenial(message,
+        { era: era ?? (this.server.getNegotiatedProtocolVersion() === '2026-07-28' ? 'modern' : 'legacy'), runtime, registrations })));
+    }
+  }
+  const server = new AgdfServer(
     { name: SERVER_NAME, version: runtime.trustedContext.expectedVersion },
     { capabilities: { tools: {}, ...(runtime.ui ? { resources: {} } : {}) } },
   );
@@ -87,16 +96,26 @@ export function buildAgdfServer({ runtime, executor } = {}) {
   } };
   for (const tool of tools) {
     const { name, definition, serialize } = tool;
-    server.registerTool(
+    const schema = fromJsonSchema(definition.inputSchema, { getValidator(inputSchema) {
+      const validate = deferredSchemas.getValidator(inputSchema);
+      return input => {
+        const checked = validate(input);
+        if (checked.valid) return checked;
+        const hint = runtime.inputValidationHint?.(name, input);
+        return hint ? { ...checked, errorMessage: `${hint} Schema: ${checked.errorMessage}` } : checked;
+      };
+    } });
+    const registered = server.registerTool(
       name,
       {
         description: definition.description,
         annotations: definition.annotations,
-        inputSchema: fromJsonSchema(definition.inputSchema, deferredSchemas),
+        inputSchema: schema,
         ...(definition.outputSchema ? { outputSchema: fromJsonSchema(definition.outputSchema, deferredSchemas) } : {}),
         ...(definition._meta ? { _meta: definition._meta } : {}),
       },
       async (argumentsValue, context) => {
+        const started = performance.now();
         const denied = !uiAllowed(context) ? runtime.unsupportedUiCode ?? 'resource_denied'
           : tool.requiresUi && !supportsUi(context) ? 'host_ui_unsupported' : null;
         if (denied) {
@@ -104,20 +123,25 @@ export function buildAgdfServer({ runtime, executor } = {}) {
           const failure = runtime.projectToolResult(name, argumentsValue, runtime.failure(denied, name, argumentsValue, facts), facts);
           return respond(name, argumentsValue, failure, serialize ?? runtime.serialize, context, facts);
         }
-        let phase = tool.parentOwned ? 'parse' : 'execute';
+        const parentOwned = typeof tool.parentOwned === 'function' ? tool.parentOwned(argumentsValue) : tool.parentOwned;
+        let phase = parentOwned ? 'parse' : 'execute';
         try {
+          phase = 'parse';
+          argumentsValue = runtime.prepareInput?.(name, argumentsValue) ?? argumentsValue;
+          phase = parentOwned ? 'parse' : 'execute';
           let result;
-          if (tool.parentOwned) {
+          if (parentOwned) {
             const parsed = tool.parse(argumentsValue); phase = 'execute';
             result = await tool.execute(parsed, context.signal,
               { client: requestMcpClientInfo(server.server, context), uiSupported: supportsUi(context) });
-          } else result = await dispatchExecutor.execute(argumentsValue, { signal: context.signal, toolName: name });
+          } else result = await dispatchExecutor.execute(argumentsValue, { signal: context.signal, toolName: name,
+            trusted: runtime.prepareDispatch?.(name, argumentsValue) });
           if (runtime.postprocessToolResult) result = await runtime.postprocessToolResult(name, argumentsValue, result,
             { uiSupported: supportsUi(context), client: requestMcpClientInfo(server.server, context) });
           return respond(name, argumentsValue, result, serialize ?? runtime.serialize, context);
         } catch (error) {
           const facts = runtime.normalizeFailure(error, { phase });
-          const failure = runtime.failure(facts.code, name, argumentsValue, facts);
+          const failure = runtime.failure(facts.code, name, argumentsValue, { ...facts, elapsed_ms: performance.now() - started });
           // A local execution/delivery failure is owned here, including malformed
           // producer output. It never causes re-execution or a second write.
           const projected = runtime.projectToolResult(name, argumentsValue, failure, facts);
@@ -125,12 +149,16 @@ export function buildAgdfServer({ runtime, executor } = {}) {
         }
       },
     );
+    registrations.set(name, { tool, schema, registered });
   }
   if (runtime.ui) {
     const resource = loadCockpitResource(runtime.ui);
     server.registerResource(runtime.mode === 'decision' ? 'AGDF Gate Decision' : runtime.ui.label ?? 'AGDF Cockpit', resource.uri, { mimeType: resource.mimeType, _meta: resource._meta },
       async (_uri, context) => {
-        if (!uiAllowed(context) || runtime.mode === 'decision' && !supportsUi(context)) throw new ProtocolError(ProtocolErrorCode.InvalidParams, "resource_denied");
+        if (requiresMcpAppUi(runtime, { requiresUi: runtime.mode === 'decision' }) && !supportsUi(context)) {
+          if ((era ?? (server.server.getNegotiatedProtocolVersion() === '2026-07-28' ? 'modern' : 'legacy')) === 'modern') throw missingMcpAppUi(runtime.ui.mimeType);
+          throw new ProtocolError(ProtocolErrorCode.InvalidParams, "resource_denied");
+        }
         return { contents: [resource] };
       });
     if (gated || runtime.mode === 'decision') {
@@ -155,12 +183,13 @@ export function buildAgdfServer({ runtime, executor } = {}) {
 
 export function serveAgdfStdio({ runtime, executor, onerror } = {}) {
   const instances = new Set();
-  const handle = serveStdio(() => {
-    const server = buildAgdfServer({ runtime, executor });
+  const handle = serveStdio(({ era }) => {
+    const server = buildAgdfServer({ runtime, executor, era });
     instances.add(server);
     return server;
   }, {
     legacy: "serve",
+    transport: boundStdioOutput(new StdioServerTransport()),
     onerror: () => onerror?.("AGDF_MCP_TRANSPORT_ERROR"),
   });
   return Object.freeze({
@@ -177,11 +206,4 @@ export function serveAgdfStdio({ runtime, executor, onerror } = {}) {
   });
 }
 
-export function createAgdfWorkerExecutor(runtime, options = {}) {
-  return createWorkerDispatchExecutor({
-    surface: runtime.trustedContext.surface,
-    expectedVersion: runtime.trustedContext.expectedVersion,
-    commandGroups: runtime.trustedContext.commandGroups,
-    ...options,
-  });
-}
+export { createAgdfWorkerExecutor } from './worker.js';

package/src/stdio-output.js

@@ -0,0 +1,42 @@
+import { OWNER_LIMITS } from './generation-protocol.js';
+
+// One entry-owned SDK wire, one active write. Concurrent SDK responses must not
+// attach one drain/error listener per result to a blocked native Worker stream.
+// Capture exact JSON at admission. Existing result/resource owners bound the
+// one active message; the additional queue has its own strict byte/frame cap.
+// A legal large UI response must still work without lowering its resource cap.
+export function boundStdioOutput(transport) {
+  const originalSend = transport.send.bind(transport), originalClose = transport.close.bind(transport);
+  const queue = [];
+  let active, queuedBytes = 0, closed = false, closing;
+  const capacityError = () => Error('AGDF_MCP_STDIO_CAPACITY');
+  function pump() {
+    if (active || closed || !queue.length) return;
+    const entry = active = queue.shift(); queuedBytes -= entry.bytes;
+    Promise.resolve().then(() => originalSend(entry.message)).then(entry.resolve, entry.reject).finally(() => {
+      active = undefined; pump();
+    });
+  }
+  transport.send = message => {
+    if (closed) return Promise.reject(Error('AGDF_MCP_STDIO_CLOSED'));
+    let snapshot, size;
+    try {
+      const json = JSON.stringify(message); size = Buffer.byteLength(json) + 1;
+      if (queue.length + (active ? 1 : 0) >= OWNER_LIMITS.frames || active && queuedBytes + size > OWNER_LIMITS.bytes) return Promise.reject(capacityError());
+      snapshot = JSON.parse(json); // Preserve SDK JSON semantics and call-time bytes.
+    } catch (error) { return Promise.reject(error); }
+    return new Promise((resolve, reject) => {
+      queuedBytes += size; queue.push({ message: snapshot, bytes: size, resolve, reject }); pump();
+    });
+  };
+  transport.close = () => {
+    if (closing) return closing;
+    closed = true;
+    for (const entry of queue.splice(0)) { queuedBytes -= entry.bytes; entry.reject(Error('AGDF_MCP_STDIO_CLOSED')); }
+    // Close does not prove that an active write drained. Its SDK promise stays
+    // observed; genuine Worker exit is still required by the lifecycle owner.
+    active?.reject(Error('AGDF_MCP_STDIO_CLOSED'));
+    closing = Promise.resolve().then(originalClose); return closing;
+  };
+  return transport;
+}

package/src/ui-capability.js

@@ -1,7 +1,55 @@
-import { CLIENT_CAPABILITIES_META_KEY, CLIENT_INFO_META_KEY } from "@modelcontextprotocol/server";
+import { CLIENT_CAPABILITIES_META_KEY, CLIENT_INFO_META_KEY, MissingRequiredClientCapabilityError, classifyInboundRequest } from "@modelcontextprotocol/server";
 
 // Extension id under which MCP Apps hosts declare UI support (@modelcontextprotocol/ext-apps EXTENSION_ID).
 export const MCP_APP_UI_EXTENSION = "io.modelcontextprotocol/ui";
+export const requiresMcpAppUi = (runtime, tool) => runtime.mode === 'cockpit' && runtime.uiCapabilityRequired === true || tool?.requiresUi === true;
+export const missingMcpAppUi = mimeType => new MissingRequiredClientCapabilityError({
+  requiredCapabilities: { extensions: { [MCP_APP_UI_EXTENSION]: { mimeTypes: [mimeType] } } },
+}, 'resource_denied');
+
+// One narrow Transport decorator; framing, request dispatch, validation and
+// pending-id/drain accounting remain with the original SDK connection.
+export function capabilityTransport(transport, denial) {
+  const wrapped = {
+    onmessage: transport.onmessage,
+    onerror: transport.onerror,
+    onclose: transport.onclose,
+    start: () => transport.start(),
+    send: (message, options) => transport.send(message, options),
+    close: () => transport.close(),
+    get sessionId() { return transport.sessionId; },
+    set sessionId(value) { transport.sessionId = value; },
+    get hasPerRequestStream() { return transport.hasPerRequestStream; },
+  };
+  for (const method of ['setProtocolVersion', 'setSupportedProtocolVersions']) {
+    if (transport[method]) wrapped[method] = (...args) => transport[method](...args);
+  }
+  transport.onerror = error => wrapped.onerror?.(error);
+  transport.onclose = () => wrapped.onclose?.();
+  transport.onmessage = (message, extra) => {
+    const error = denial(message);
+    if (!error) { wrapped.onmessage?.(message, extra); return; }
+    // Sending through the original channel settles its pending request id.
+    Promise.resolve().then(() => transport.send({ jsonrpc: '2.0', id: message.id,
+      error: { code: error.code, message: error.message, data: error.data } }))
+      .catch(cause => wrapped.onerror?.(cause));
+  };
+  return wrapped;
+}
+
+export function modernToolUiDenial(message, { era, runtime, registrations }) {
+  if (era !== 'modern' || message?.method !== 'tools/call') return null;
+  const classified = classifyInboundRequest({ httpMethod: 'POST', body: message });
+  if (classified.kind !== 'modern' || classified.messageKind !== 'request') return null;
+  const entry = registrations.get(message.params?.name);
+  if (!entry?.registered.enabled || !requiresMcpAppUi(runtime, entry.tool)
+      || declaresMcpAppUi(message.params?._meta?.[CLIENT_CAPABILITIES_META_KEY], runtime.ui.mimeType)) return null;
+  const checked = entry.schema['~standard'].validate(message.params.arguments ?? {});
+  // The pinned fromJsonSchema provider is synchronous. Never treat an unknown
+  // asynchronous provider as proof that arguments passed validation.
+  if (checked?.then || checked.issues?.length) return null;
+  return missingMcpAppUi(runtime.ui.mimeType);
+}
 export const requestMcpClientInfo = (server, context) => context?.mcpReq?.envelope?.[CLIENT_INFO_META_KEY] ?? server.getClientVersion();
 export const requestMcpClientCapabilities = (server, context) => context?.mcpReq?.envelope?.[CLIENT_CAPABILITIES_META_KEY] ?? server.getClientCapabilities();
 

package/src/worker-entry.js

@@ -1,6 +1,6 @@
 import { subscribe } from "node:diagnostics_channel";
 import { parentPort, workerData } from "node:worker_threads";
-import { OWNED_LOCK_CHANNEL, createMcpDispatchRuntime } from "create-agdf/mcp-dispatch-runtime";
+import { OWNED_LOCK_CHANNEL, createMcpDispatchRuntime } from "#agdf-dispatch-worker";
 import { ownedLockForwarder } from "./worker.js";
 
 function send(message) {
@@ -14,7 +14,7 @@ subscribe(OWNED_LOCK_CHANNEL, ownedLockForwarder(send));
 let runtime, phase = 'setup';
 try {
   send({ type: 'phase', phase: 'runtime_provenance' });
-  runtime = createMcpDispatchRuntime({ surface: workerData.surface, ...(workerData.commandGroups !== undefined ? { commandGroups: workerData.commandGroups } : {}) });
+  runtime = createMcpDispatchRuntime({ surface: workerData.surface, materialGrants: workerData.materialGrants, inputContext: workerData.inputContext, ...(workerData.commandGroups !== undefined ? { commandGroups: workerData.commandGroups } : {}) });
   if (runtime.trustedContext.provenanceStatus !== "matched") {
     send({ type: "failure", code: "runtime_provenance_invalid", dispatch: "not_dispatched" });
   } else if (runtime.trustedContext.expectedVersion !== workerData.expectedVersion) {