@agdf/mcp-server 0.20.2 → 0.30.0

package/src/generation.js

@@ -8,7 +8,7 @@ import { DispatchExecutionError } from './worker.js';
 // One live facade, three directly owned children, no process registry or PID
 // discovery. Capacity includes startup and unconfirmed cleanup, not just current.
 export async function createOwnedGenerationFacade({ runtime, publisher, createControlRuntime, surface, cockpitDir, cockpitMode,
-  Fork = fork, qualifyMs = L.qualify, closeMs = L.close, invokeMs = L.qualify, onEvent = () => {} } = {}) {
+  generationTransport, Fork = fork, qualifyMs = L.qualify, closeMs = L.close, invokeMs = L.qualify, onEvent = () => {} } = {}) {
   if (![qualifyMs, closeMs, invokeMs].every(value => Number.isSafeInteger(value) && value > 0)
     || qualifyMs > L.qualify || closeMs > L.close || invokeMs > L.qualify) throw Error('generation_deadline_invalid');
   const epoch = randomUUID(), slots = new Map(), routes = new Map(), presentations = new Map(), operations = new Map(), receipts = new Map();
@@ -64,10 +64,16 @@ export async function createOwnedGenerationFacade({ runtime, publisher, createCo
       unknown: new Set(), inflight: 0, exited: false, closeAck: false, observed: null };
     slots.set(row.id, row); event(row, 'reserved'); // Reservation precedes acquisition/load/spawn.
     try {
-      const claim = publisher.acquire(packageInfo, { ownerEpoch: epoch, generation: row.id });
-      row.child = Fork(join(packageInfo.packageRoot, 'src/generation-entry.js'), [epoch, String(row.id)],
-        { stdio: ['ignore', 'ignore', 'ignore', 'ipc'], serialization: 'json', execArgv: [] });
-      claim.bindOwnedChild(row.child, { confirmedEnd: () => row.closeAck && !row.inflight && !row.unknown.size });
+      if (generationTransport) {
+        // This is a logical private connection. Actual Worker and claim ownership
+        // stay in the detached owner; no ChildProcess/Worker impersonation.
+        row.child = await generationTransport.open({ packageInfo, epoch, generation: row.id });
+      } else {
+        const claim = publisher.acquire(packageInfo, { ownerEpoch: epoch, generation: row.id });
+        row.child = Fork(join(packageInfo.packageRoot, 'src/generation-entry.js'), [epoch, String(row.id)],
+          { stdio: ['ignore', 'ignore', 'ignore', 'ipc'], serialization: 'json', execArgv: [] });
+        claim.bindOwnedChild(row.child, { confirmedEnd: () => row.closeAck && !row.inflight && !row.unknown.size });
+      }
       row.child.on('message', reply => {
         if (!validGenerationMessage(reply, { epoch, generation: row.id, reply: true })) { event(row, 'invalid_reply'); return; }
         const pending = row.pending.get(reply.request_id);
@@ -81,13 +87,18 @@ export async function createOwnedGenerationFacade({ runtime, publisher, createCo
           pending.resolve(reply);
         }
       });
-      row.child.once('exit', () => {
+      row.child.once('exit', (code, signal) => {
         row.exited = true;
         for (const pending of row.pending.values()) { clearTimeout(pending.timer); pending.reject(new DispatchExecutionError('generation_connection_lost')); }
         row.pending.clear();
-        if (row.closeAck && !row.inflight && !row.unknown.size) { slots.delete(row.id); row.state = 'closed'; event(row, 'confirmed_exit'); row.end?.(true); }
+        if (code === 0 && !signal && row.closeAck && !row.inflight && !row.unknown.size) { slots.delete(row.id); row.state = 'closed'; event(row, 'confirmed_exit'); row.end?.(true); }
         else { row.state = 'close_unconfirmed'; event(row, 'unexpected_exit'); row.end?.(false); }
       });
+      row.child.once('disconnect', () => {
+        row.state = 'close_unconfirmed'; event(row, 'connection_lost');
+        for (const pending of row.pending.values()) { clearTimeout(pending.timer); pending.reject(new DispatchExecutionError('generation_connection_lost')); }
+        row.pending.clear();
+      });
       row.child.once('error', () => { row.state = 'close_unconfirmed'; event(row, 'spawn_failed'); });
       row.state = 'qualifying'; event(row, 'qualifying');
       const qualified = (await request(row, 'qualify', { surface, commandGroups: [...(runtime.trustedContext.commandGroups ?? [])],
@@ -105,6 +116,11 @@ export async function createOwnedGenerationFacade({ runtime, publisher, createCo
   }
   const control = {
     status,
+    originalInput(input) {
+      const prior = receipts.get(input.operation_id);
+      if (!prior) return null;
+      return { known: true, resolution: prior.resolution ?? null };
+    },
     async refresh() { await Promise.all([...slots.values()].filter(row => !row.exited).map(observe)); return status(); },
     inspect(id, input) { const record = receipts.get(id);
       if (record && (record.input.run_id !== input.run_id || record.input.primary_target !== input.primary_target
@@ -112,18 +128,23 @@ export async function createOwnedGenerationFacade({ runtime, publisher, createCo
       return record ? { status: record.result ? 'recorded' : 'pending',
       request_digest: record.digest, result: record.result, current: status(), authorizes: false }
       : { status: 'unknown', reason: 'connection_control_record_unavailable', current: status(), authorizes: false }; },
-    async replace({ input, candidate, requestDigest, revalidate }) {
+    async replace({ input, candidate, requestDigest, resolution, revalidate }) {
       const prior = receipts.get(input.operation_id);
       if (prior) return prior.digest !== requestDigest ? failure('operation_payload_conflict')
         : prior.result ? { ...prior.result, outcome: prior.result.outcome === 'accepted' ? 'already_applied' : prior.result.outcome, historical_effect: true, current: status() }
         : { outcome: 'effect_unknown', reason: 'generation_replacement_pending', current: status(), authorizes: false };
       if (receipts.size >= L.receipts) return failure('connection_control_capacity');
       if (closed || replacing) return failure(closed ? 'connection_closed' : 'generation_replacement_busy');
-      const record = { digest: requestDigest, input, result: null }; receipts.set(input.operation_id, record); replacing = true;
+      const record = { digest: requestDigest, input, resolution, result: null }; receipts.set(input.operation_id, record); replacing = true;
       let candidateRow;
       try {
-        revalidate(); const packageInfo = publisher.resolve(candidate);
-        candidateRow = await reserve(packageInfo, actualContext); revalidate();
+        const recheck = () => {
+          if (closed) throw new DispatchExecutionError('connection_closed', 'not_dispatched');
+          controlRuntimeInstance?.verifyProducer();
+          revalidate();
+        };
+        recheck(); const packageInfo = publisher.resolve(candidate);
+        candidateRow = await reserve(packageInfo, actualContext); recheck();
         const previous = current; current = candidateRow; current.state = 'current';
         if (previous) previous.state = previous.exited ? 'close_unconfirmed' : 'draining';
         event(current, 'admitted'); record.result = { outcome: 'accepted', reason: null, operation_id: input.operation_id,
@@ -135,44 +156,66 @@ export async function createOwnedGenerationFacade({ runtime, publisher, createCo
       record.result.current = status(); return record.result;
     },
   };
-  const controlRuntime = createControlRuntime(control);
+  // Ordinary requests belong to the fully qualified generation. Only the rare
+  // facade control branches need another Core instance; share one initialization.
+  let controlRuntimePromise, controlRuntimeInstance;
+  const getControlRuntime = () => controlRuntimePromise ??= Promise.resolve().then(() => createControlRuntime(control)).then(async created => {
+    const producer = created?.producerIdentity;
+    const code = created?.trustedContext?.expectedVersion !== runtime.trustedContext.expectedVersion ? 'runtime_version_mismatch'
+      : created?.trustedContext?.provenanceStatus !== 'matched'
+      || !producer || producer.server_digest !== publisher.initial.digest || producer.dispatcher_digest !== publisher.initial.dispatcherDigest
+      || producer.sdk_digest !== publisher.initial.sdkDigest || typeof created.verifyProducer !== 'function'
+      ? 'runtime_provenance_invalid' : null;
+    if (code) {
+      await created?.close?.(); throw new DispatchExecutionError(code, 'not_dispatched');
+    }
+    controlRuntimeInstance = created;
+    return created;
+  }).catch(error => { throw new DispatchExecutionError(generationFailureReason(error), 'not_dispatched'); });
   function operationKey(input, id = input.operation_id) { return JSON.stringify([input.primary_target, input.run_id, id]); }
   async function invoke(name, args, host = {}, signal) {
     if (signal?.aborted) throw new DispatchExecutionError('dispatch_cancelled', 'not_dispatched');
     if (closed) throw new DispatchExecutionError('connection_closed', 'not_dispatched');
     actualContext = { client: host.client, uiSupported: host.uiSupported === true };
+    const canonical = Boolean(args.operation_id) && !runtime.isEphemeralControlCommand?.(name,args);
     if (args.operation_id && name === 'agdf_record' && args.command?.kind === 'runtime_generation.replace'
       && operations.has(operationKey(args))) throw new DispatchExecutionError('operation_payload_conflict', 'not_dispatched');
     if (args.operation_id && args.command?.kind !== 'runtime_generation.replace' && receipts.has(args.operation_id))
       throw new DispatchExecutionError('operation_payload_conflict', 'not_dispatched');
     if (name === 'agdf_record' && args.command?.kind === 'runtime_generation.replace'
       || name === 'agdf_inspect' && args.operation === 'runtime-generations') {
+      const controlRuntime = await getControlRuntime();
+      if (closed || signal?.aborted) throw new DispatchExecutionError(closed ? 'connection_closed' : 'dispatch_cancelled', 'not_dispatched');
+      try { controlRuntime.verifyProducer(); } catch (error) { throw new DispatchExecutionError(generationFailureReason(error), 'not_dispatched'); }
       const result = await controlRuntime.tool(name).execute(controlRuntime.tool(name).parse(args));
       return controlRuntime.projectToolResult(name, args, name === 'agdf_inspect' && result.report?.available ? { ...result, report: await control.refresh() } : result);
     }
     if (name === 'agdf_inspect' && args.operation === 'operation-status' && receipts.has(args.module)) {
+      const controlRuntime = await getControlRuntime();
+      if (closed || signal?.aborted) throw new DispatchExecutionError(closed ? 'connection_closed' : 'dispatch_cancelled', 'not_dispatched');
+      try { controlRuntime.verifyProducer(); } catch (error) { throw new DispatchExecutionError(generationFailureReason(error), 'not_dispatched'); }
       const validated = await controlRuntime.tool(name).execute(controlRuntime.tool(name).parse(args));
       return controlRuntime.projectToolResult(name, args, validated.report?.status === 'unknown' || validated.report?.status === 'absent'
         ? { ...validated, report: control.inspect(args.module, args) } : validated);
     }
     const knownSession = args.session_id && routes.get(args.session_id);
     if (args.session_id && !knownSession) throw new DispatchExecutionError('session_expired', 'not_dispatched');
-    const id = name === 'agdf_inspect' && args.operation === 'operation-status' ? args.module : args.operation_id;
+    const id = name === 'agdf_inspect' && args.operation === 'operation-status' ? args.module.split('/').at(-1) : canonical ? args.operation_id : null;
     const key = id && operationKey(args, id), original = key && operations.get(key);
     const presentationId = args.command?.payload?.presentation_id ?? args.presentation_id;
     const presentationOwner = presentationId && presentations.get(operationKey(args, presentationId));
     const row = knownSession ?? original ?? presentationOwner ?? current;
     if (!row || row.exited) throw new DispatchExecutionError('generation_unavailable', 'not_dispatched');
-    if (args.operation_id && !original) {
+    if (canonical && !original) {
       if (operations.size >= L.routes) throw new DispatchExecutionError('generation_route_capacity', 'not_dispatched');
       operations.set(key, row);
     }
     ++row.inflight; event(row, 'invoke', name);
     try {
-      const result = (await request(row, 'invoke', { name, arguments: args }, actualContext, args.operation_id ?? null, invokeMs)).payload;
-      if (args.operation_id && result.outcome === 'effect_unknown') row.unknown.add(key);
+      const result = (await request(row, 'invoke', { name, arguments: args }, actualContext, canonical ? args.operation_id : null, invokeMs)).payload;
+      if (canonical && result.outcome === 'effect_unknown') row.unknown.add(key);
       if (name === 'agdf_inspect' && args.operation === 'operation-status' && result.report?.status === 'recorded'
-        && result.report.receipt?.operation_id === args.module) row.unknown.delete(key);
+        && (result.report.receipt?.operation_id ?? result.report.receipt?.operation?.operation_id) === id) row.unknown.delete(key);
       if (result.app_capability === 'available') nativeRequired = true;
       if (result.family_result?.presentation_id && ['accepted', 'already_applied'].includes(result.outcome)) {
         const presentationKey = operationKey(args, result.family_result.presentation_id);
@@ -185,7 +228,7 @@ export async function createOwnedGenerationFacade({ runtime, publisher, createCo
         }
       }
       return result;
-    } catch (error) { if (args.operation_id && error.dispatch !== 'not_dispatched') row.unknown.add(key); throw error; }
+    } catch (error) { if (canonical && error.dispatch !== 'not_dispatched') row.unknown.add(key); throw error; }
     finally { --row.inflight; if (closed && !row.inflight && !row.unknown.size) void retire(row, true); }
   }
   current = await reserve(publisher.initial, {}); current.state = 'current'; event(current, 'admitted');
@@ -194,16 +237,17 @@ export async function createOwnedGenerationFacade({ runtime, publisher, createCo
   // not wire requests; parsing them again in a child both breaks the contract
   // and copies the entire locale registry into a bounded private message.
   const tools = runtime.tools.map(tool => ({ ...tool, parentOwned: true,
-    parse: input => { tool.parse(input); return input; }, execute: input => invoke(tool.name, input) }));
+    parse: input => { if (runtime.validatePublicInput?.(tool.name, input) !== true) tool.parse(input); return input; }, execute: input => invoke(tool.name, input) }));
   // The server supplies actual initialize/request context only at this seam.
   for (const tool of tools) tool.execute = (input, signal, host) => invoke(tool.name, input, host, signal);
   return Object.freeze({ ...runtime, tools, tool: name => tools.find(tool => tool.name === name),
-    requiresProjectedResult: true, postprocessToolResult: undefined, inspectOwnership: status, runtimeControl: control,
+    requiresProjectedResult: true, prepareInput: undefined, postprocessToolResult: undefined, inspectOwnership: status, runtimeControl: control,
     close() {
       return closing ??= (async () => {
         closed = true;
         const previous = current; current = null; if (previous && !previous.exited) previous.state = 'draining';
         await Promise.allSettled([...slots.values()].map(row => retire(row, true)));
+        if (controlRuntimePromise) await controlRuntimePromise.then(controlRuntime => controlRuntime.close?.(), () => {});
         return status();
       })();
     },

package/src/main.js

@@ -1,15 +1,16 @@
 import { readFileSync } from "node:fs";
 import process from "node:process";
-import { createAgdfWorkerExecutor, serveAgdfStdio } from "./server.js";
 import { loadCockpitResource } from './cockpit-resource.js';
 
-export async function runMcpServer({ surface, cockpitDir, cockpitMode, runtime, executor, ownedPublication, ownedPublisher, onClosed } = {}) {
+export async function runMcpServer({ surface, cockpitDir, cockpitMode, runtime, executor, ownedPublication, ownedPublisher, generationTransport, onClosed } = {}) {
   if (cockpitMode !== undefined && (cockpitMode !== 'plugin' || surface !== 'codex' || cockpitDir !== undefined)) throw Error('AGDF_COCKPIT_TARGET_INVALID');
   const defaultRuntime = runtime === undefined && cockpitDir === undefined && cockpitMode === undefined;
   // A supplied, bound runtime owns its resources. Do not load a second package
   // composition merely to run an explicit adapter/protocol fixture.
-  const dispatcherRuntime = runtime === undefined ? await import('create-agdf/mcp-dispatch-runtime') : null;
-  runtime ??= cockpitDir !== undefined || cockpitMode !== undefined ? await dispatcherRuntime.createMcpCockpitRuntime({ surface, cockpitDir, cockpitMode }) : dispatcherRuntime.createMcpDispatchRuntime({ surface });
+  const thin = defaultRuntime && !!ownedPublication;
+  const dispatcherRuntime = runtime === undefined ? await import(thin ? 'create-agdf/mcp-protocol-runtime' : 'create-agdf/mcp-dispatch-runtime') : null;
+  runtime ??= cockpitDir !== undefined || cockpitMode !== undefined ? await dispatcherRuntime.createMcpCockpitRuntime({ surface, cockpitDir, cockpitMode })
+    : thin ? dispatcherRuntime.createMcpTransportRuntime({ surface }) : dispatcherRuntime.createMcpDispatchRuntime({ surface });
   const serverVersion = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
   if (runtime.trustedContext.expectedVersion !== serverVersion) {
     process.stderr.write("AGDF_MCP_VERSION_MISMATCH\n");
@@ -21,21 +22,52 @@ export async function runMcpServer({ surface, cockpitDir, cockpitMode, runtime,
     process.exitCode = 1;
     return null;
   }
-  if (defaultRuntime && surface === 'codex' && dispatcherRuntime?.createMcpDecisionRuntime) {
+  if (ownedPublication) {
+    // The serving protocol factory freshly inspects all selected source and SDK
+    // bytes. Bind that actual producer to the parent's claimed expectation;
+    // never treat a cross-thread/async observation as fresh inspection evidence.
+    const producer = runtime.producerIdentity;
+    if (!producer || producer.server_digest !== ownedPublication.digest
+      || producer.dispatcher_digest !== ownedPublication.dispatcherDigest || producer.sdk_digest !== ownedPublication.sdkDigest)
+      throw Error('AGDF_MCP_FACADE_IDENTITY_INVALID');
+  }
+  if (defaultRuntime && surface === 'codex') {
     const ui = { uri: dispatcherRuntime.DECISION_UI_URI, mimeType: 'text/html;profile=mcp-app', limit: 4 * 1024 ** 2, kind: 'decision' };
-    ui.digest = loadCockpitResource(ui).digest;
+    // The thin front has no session/qualification consumer. Its facade loads
+    // the resource for the real generation manifest; full runtimes need it here.
+    if (!thin) ui.digest = loadCockpitResource(ui).digest;
     // A shipped resource does not qualify native App-only mediation. Production
     // actions remain disabled until exact package/host evidence is provided.
-    runtime = await dispatcherRuntime.createMcpDecisionRuntime({ runtime, ui });
+    runtime = thin ? await dispatcherRuntime.createMcpDecisionTransportRuntime({ runtime, ui })
+      : await dispatcherRuntime.createMcpDecisionRuntime({ runtime, ui });
   }
   if (runtime.mode === 'cockpit') loadCockpitResource(runtime.ui);
+  let transport;
   if (ownedPublication) {
     const { createOwnedGenerationFacade } = await import('./generation.js');
     if (!ownedPublisher) throw Error('runtime_publication_unowned');
     const publisher = ownedPublisher;
-    runtime = await createOwnedGenerationFacade({ runtime, publisher, surface, cockpitDir, cockpitMode,
-      createControlRuntime: runtimeControl => dispatcherRuntime.createMcpDispatchRuntime({ surface, runtimeControl }) });
-  }
+    let beginTransport;
+    const claimed = new Promise(resolve => { beginTransport = resolve; });
+    const starting = createOwnedGenerationFacade({ runtime, publisher, generationTransport, surface, cockpitDir, cockpitMode,
+      onEvent: event => { if (event.kind === 'qualifying') beginTransport(); },
+      createControlRuntime: async runtimeControl => {
+        const full = thin ? await import('create-agdf/mcp-dispatch-runtime') : dispatcherRuntime;
+        return full.createMcpDispatchRuntime({ surface, runtimeControl });
+      } });
+    // Only a claimed private-generation start releases the SDK import. A
+    // pre-claim failure rejects starting without loading transport code. Its full
+    // qualification and the facade SDK must both finish before public service.
+    // Observe both promises so a transport failure cannot abandon a live child.
+    const transportStarting = Promise.race([claimed, starting]).then(() => import('./server.js'));
+    const [generation, loaded] = await Promise.allSettled([starting, transportStarting]);
+    if (generation.status === 'rejected' || loaded.status === 'rejected') {
+      if (generation.status === 'fulfilled') await generation.value.close();
+      throw generation.status === 'rejected' ? generation.reason : loaded.reason;
+    }
+    runtime = generation.value; transport = loaded.value;
+  } else transport = await import('./server.js');
+  const { createAgdfWorkerExecutor, serveAgdfStdio } = transport;
   const dispatchExecutor = executor ?? (runtime.mode === 'cockpit' ? undefined
     : createAgdfWorkerExecutor(runtime, { releaseOwnedLock: dispatcherRuntime?.releaseAbandonedOwnedLock ?? null }));
   const handle = serveAgdfStdio({

package/src/server.js

@@ -1,9 +1,10 @@
+import { boundStdioOutput } from './stdio-output.js';
 import { McpServer, ProtocolError, ProtocolErrorCode, fromJsonSchema } from "@modelcontextprotocol/server";
-import { serveStdio } from "@modelcontextprotocol/server/stdio";
+import { serveStdio, StdioServerTransport } from "@modelcontextprotocol/server/stdio";
 import { AjvJsonSchemaValidator } from '@modelcontextprotocol/server/validators/ajv';
 import { randomUUID } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
-import { DispatchExecutionError, createWorkerDispatchExecutor } from "./worker.js";
+import { DispatchExecutionError } from "./worker.js";
 import { loadCockpitResource } from './cockpit-resource.js';
 import { requestDeclaresMcpAppUi, requestMcpClientInfo, requestMcpClientCapabilities, requiresMcpAppUi,
   missingMcpAppUi, capabilityTransport, modernToolUiDenial } from "./ui-capability.js";
@@ -95,7 +96,15 @@ export function buildAgdfServer({ runtime, executor, era } = {}) {
   } };
   for (const tool of tools) {
     const { name, definition, serialize } = tool;
-    const schema = fromJsonSchema(definition.inputSchema, deferredSchemas);
+    const schema = fromJsonSchema(definition.inputSchema, { getValidator(inputSchema) {
+      const validate = deferredSchemas.getValidator(inputSchema);
+      return input => {
+        const checked = validate(input);
+        if (checked.valid) return checked;
+        const hint = runtime.inputValidationHint?.(name, input);
+        return hint ? { ...checked, errorMessage: `${hint} Schema: ${checked.errorMessage}` } : checked;
+      };
+    } });
     const registered = server.registerTool(
       name,
       {
@@ -106,6 +115,7 @@ export function buildAgdfServer({ runtime, executor, era } = {}) {
         ...(definition._meta ? { _meta: definition._meta } : {}),
       },
       async (argumentsValue, context) => {
+        const started = performance.now();
         const denied = !uiAllowed(context) ? runtime.unsupportedUiCode ?? 'resource_denied'
           : tool.requiresUi && !supportsUi(context) ? 'host_ui_unsupported' : null;
         if (denied) {
@@ -113,20 +123,25 @@ export function buildAgdfServer({ runtime, executor, era } = {}) {
           const failure = runtime.projectToolResult(name, argumentsValue, runtime.failure(denied, name, argumentsValue, facts), facts);
           return respond(name, argumentsValue, failure, serialize ?? runtime.serialize, context, facts);
         }
-        let phase = tool.parentOwned ? 'parse' : 'execute';
+        const parentOwned = typeof tool.parentOwned === 'function' ? tool.parentOwned(argumentsValue) : tool.parentOwned;
+        let phase = parentOwned ? 'parse' : 'execute';
         try {
+          phase = 'parse';
+          argumentsValue = runtime.prepareInput?.(name, argumentsValue) ?? argumentsValue;
+          phase = parentOwned ? 'parse' : 'execute';
           let result;
-          if (tool.parentOwned) {
+          if (parentOwned) {
             const parsed = tool.parse(argumentsValue); phase = 'execute';
             result = await tool.execute(parsed, context.signal,
               { client: requestMcpClientInfo(server.server, context), uiSupported: supportsUi(context) });
-          } else result = await dispatchExecutor.execute(argumentsValue, { signal: context.signal, toolName: name });
+          } else result = await dispatchExecutor.execute(argumentsValue, { signal: context.signal, toolName: name,
+            trusted: runtime.prepareDispatch?.(name, argumentsValue) });
           if (runtime.postprocessToolResult) result = await runtime.postprocessToolResult(name, argumentsValue, result,
             { uiSupported: supportsUi(context), client: requestMcpClientInfo(server.server, context) });
           return respond(name, argumentsValue, result, serialize ?? runtime.serialize, context);
         } catch (error) {
           const facts = runtime.normalizeFailure(error, { phase });
-          const failure = runtime.failure(facts.code, name, argumentsValue, facts);
+          const failure = runtime.failure(facts.code, name, argumentsValue, { ...facts, elapsed_ms: performance.now() - started });
           // A local execution/delivery failure is owned here, including malformed
           // producer output. It never causes re-execution or a second write.
           const projected = runtime.projectToolResult(name, argumentsValue, failure, facts);
@@ -174,6 +189,7 @@ export function serveAgdfStdio({ runtime, executor, onerror } = {}) {
     return server;
   }, {
     legacy: "serve",
+    transport: boundStdioOutput(new StdioServerTransport()),
     onerror: () => onerror?.("AGDF_MCP_TRANSPORT_ERROR"),
   });
   return Object.freeze({
@@ -190,11 +206,4 @@ export function serveAgdfStdio({ runtime, executor, onerror } = {}) {
   });
 }
 
-export function createAgdfWorkerExecutor(runtime, options = {}) {
-  return createWorkerDispatchExecutor({
-    surface: runtime.trustedContext.surface,
-    expectedVersion: runtime.trustedContext.expectedVersion,
-    commandGroups: runtime.trustedContext.commandGroups,
-    ...options,
-  });
-}
+export { createAgdfWorkerExecutor } from './worker.js';

package/src/stdio-output.js

@@ -0,0 +1,42 @@
+import { OWNER_LIMITS } from './generation-protocol.js';
+
+// One entry-owned SDK wire, one active write. Concurrent SDK responses must not
+// attach one drain/error listener per result to a blocked native Worker stream.
+// Capture exact JSON at admission. Existing result/resource owners bound the
+// one active message; the additional queue has its own strict byte/frame cap.
+// A legal large UI response must still work without lowering its resource cap.
+export function boundStdioOutput(transport) {
+  const originalSend = transport.send.bind(transport), originalClose = transport.close.bind(transport);
+  const queue = [];
+  let active, queuedBytes = 0, closed = false, closing;
+  const capacityError = () => Error('AGDF_MCP_STDIO_CAPACITY');
+  function pump() {
+    if (active || closed || !queue.length) return;
+    const entry = active = queue.shift(); queuedBytes -= entry.bytes;
+    Promise.resolve().then(() => originalSend(entry.message)).then(entry.resolve, entry.reject).finally(() => {
+      active = undefined; pump();
+    });
+  }
+  transport.send = message => {
+    if (closed) return Promise.reject(Error('AGDF_MCP_STDIO_CLOSED'));
+    let snapshot, size;
+    try {
+      const json = JSON.stringify(message); size = Buffer.byteLength(json) + 1;
+      if (queue.length + (active ? 1 : 0) >= OWNER_LIMITS.frames || active && queuedBytes + size > OWNER_LIMITS.bytes) return Promise.reject(capacityError());
+      snapshot = JSON.parse(json); // Preserve SDK JSON semantics and call-time bytes.
+    } catch (error) { return Promise.reject(error); }
+    return new Promise((resolve, reject) => {
+      queuedBytes += size; queue.push({ message: snapshot, bytes: size, resolve, reject }); pump();
+    });
+  };
+  transport.close = () => {
+    if (closing) return closing;
+    closed = true;
+    for (const entry of queue.splice(0)) { queuedBytes -= entry.bytes; entry.reject(Error('AGDF_MCP_STDIO_CLOSED')); }
+    // Close does not prove that an active write drained. Its SDK promise stays
+    // observed; genuine Worker exit is still required by the lifecycle owner.
+    active?.reject(Error('AGDF_MCP_STDIO_CLOSED'));
+    closing = Promise.resolve().then(originalClose); return closing;
+  };
+  return transport;
+}

package/src/worker-entry.js

@@ -1,6 +1,6 @@
 import { subscribe } from "node:diagnostics_channel";
 import { parentPort, workerData } from "node:worker_threads";
-import { OWNED_LOCK_CHANNEL, createMcpDispatchRuntime } from "create-agdf/mcp-dispatch-runtime";
+import { OWNED_LOCK_CHANNEL, createMcpDispatchRuntime } from "#agdf-dispatch-worker";
 import { ownedLockForwarder } from "./worker.js";
 
 function send(message) {
@@ -14,7 +14,7 @@ subscribe(OWNED_LOCK_CHANNEL, ownedLockForwarder(send));
 let runtime, phase = 'setup';
 try {
   send({ type: 'phase', phase: 'runtime_provenance' });
-  runtime = createMcpDispatchRuntime({ surface: workerData.surface, ...(workerData.commandGroups !== undefined ? { commandGroups: workerData.commandGroups } : {}) });
+  runtime = createMcpDispatchRuntime({ surface: workerData.surface, materialGrants: workerData.materialGrants, inputContext: workerData.inputContext, ...(workerData.commandGroups !== undefined ? { commandGroups: workerData.commandGroups } : {}) });
   if (runtime.trustedContext.provenanceStatus !== "matched") {
     send({ type: "failure", code: "runtime_provenance_invalid", dispatch: "not_dispatched" });
   } else if (runtime.trustedContext.expectedVersion !== workerData.expectedVersion) {

package/src/worker.js

@@ -30,21 +30,30 @@ export function createWorkerDispatchExecutor({
   // Reserve up to one second instead of beginning shutdown at the deadline.
   const terminationReserveMs = Math.min(1_000, Math.max(1, Math.floor(timeoutMs / 4)));
   let active = null;
+  let closed = false;
+  const waiting = [];
+  const rejectWaiting = error => { for (const job of waiting.splice(0)) { job.cleanup(); job.reject(error); } };
+  const drain = () => {
+    if (active || closed || !waiting.length) return;
+    const job = waiting.shift(); job.cleanup();
+    execute(job.argumentsValue, { ...job.options, deadline: job.deadline }).then(job.resolve, job.reject).finally(drain);
+  };
   const event = (phase, started) => {
     try { onEvent({ phase, elapsed_ms: performance.now() - started }); } catch {}
   };
-  return Object.freeze({
-    async execute(argumentsValue, { signal, toolName } = {}) {
+  const execute = async (argumentsValue, { signal, toolName, trusted, deadline: queuedDeadline } = {}) => {
       if (active) throw new DispatchExecutionError("dispatch_busy", 'not_dispatched');
       if (signal?.aborted) throw new DispatchExecutionError("dispatch_cancelled", 'not_dispatched');
       return new Promise((resolve, reject) => {
         let settled = false, exited = false, completion, workerPhase = 'worker_start';
         let confirmExit;
         const actualExit = new Promise(resolve => { confirmExit = resolve; });
-        const started = performance.now(), deadline = started + timeoutMs;
+        const started = performance.now(), deadline = queuedDeadline ?? started + timeoutMs;
+        const budget = deadline - started;
+        if (budget <= 0) { reject(new DispatchExecutionError('dispatch_timeout', 'not_dispatched')); return; }
         let worker;
         try { worker = new WorkerClass(WORKER_URL, {
-          workerData: { surface, expectedVersion, commandGroups, argumentsValue, toolName: toolName ?? null },
+          workerData: { surface, expectedVersion, commandGroups, argumentsValue, toolName: toolName ?? null, materialGrants: trusted?.materialGrants, inputContext: trusted?.inputContext },
         }); } catch { reject(new DispatchExecutionError('dispatch_worker_failed', 'not_dispatched')); return; }
         event('worker_start', started);
         const current = { worker, timer: null, cleanupSignal: null, cancel: () => finish(reject, new DispatchExecutionError("dispatch_cancelled")) };
@@ -62,7 +71,7 @@ export function createWorkerDispatchExecutor({
           try { onEvent({ phase: 'locks_released', elapsed_ms: performance.now() - started, count: released }); } catch {}
         };
         // Called only after actual exit or confirmed termination: the thread no longer runs.
-        const release = () => { releaseHeldLocks(); if (active === current) active = null; };
+        const release = () => { releaseHeldLocks(); if (active === current) { active = null; queueMicrotask(drain); } };
         const finish = (callback, value) => {
           if (settled) return completion;
           settled = true;
@@ -87,6 +96,8 @@ export function createWorkerDispatchExecutor({
             } else {
               // A late actual exit may release capacity; rejection alone never proves termination.
               event('termination_unconfirmed', started);
+              current.unconfirmed = true;
+              rejectWaiting(new DispatchExecutionError('dispatch_busy', 'not_dispatched'));
               reject(new DispatchExecutionError('dispatch_worker_termination_unconfirmed', 'unknown', undefined, {
                 ...(callback === reject && value instanceof DispatchExecutionError ? { cause_code: value.code } : {}),
                 worker_phase: workerPhase,
@@ -100,7 +111,8 @@ export function createWorkerDispatchExecutor({
           current.cleanupSignal = () => signal.removeEventListener("abort", cancel);
           signal.addEventListener("abort", cancel, { once: true });
         }
-        current.timer = setTimeout(() => finish(reject, new DispatchExecutionError("dispatch_timeout")), timeoutMs - terminationReserveMs);
+        current.timer = setTimeout(() => finish(reject, new DispatchExecutionError("dispatch_timeout")),
+          budget - Math.min(terminationReserveMs, Math.max(1, Math.floor(budget / 4))));
         worker.on("message", message => {
           // Lock messages also arrive after settlement while the worker drains.
           if (message?.type === 'lock') {
@@ -127,8 +139,42 @@ export function createWorkerDispatchExecutor({
         // Cover an abort racing listener installation.
         if (signal?.aborted) cancel();
       });
+    };
+  return Object.freeze({
+    execute(argumentsValue, options = {}) {
+      if (closed) return Promise.reject(new DispatchExecutionError(active ? 'dispatch_busy' : 'dispatch_cancelled', 'not_dispatched'));
+      if (options.signal?.aborted) return Promise.reject(new DispatchExecutionError('dispatch_cancelled', 'not_dispatched'));
+      const deadline = performance.now() + timeoutMs;
+      if (!active && !waiting.length) return execute(argumentsValue, { ...options, deadline });
+      // Only immutable Inspect requests wait. Commands still report contention;
+      // no write is replayed, parallelized or admitted after unknown termination.
+      if (options.toolName !== 'agdf_inspect' || active?.unconfirmed)
+        return Promise.reject(new DispatchExecutionError('dispatch_busy', 'not_dispatched'));
+      if (waiting.length >= 8) return Promise.reject(new DispatchExecutionError('resource_limit', 'not_dispatched'));
+      return new Promise((resolve, reject) => {
+        const job = { argumentsValue, options, deadline, resolve, reject };
+        const remove = error => {
+          const index = waiting.indexOf(job);
+          if (index < 0) return;
+          waiting.splice(index, 1); job.cleanup(); reject(error);
+        };
+        const abort = () => remove(new DispatchExecutionError('dispatch_cancelled', 'not_dispatched'));
+        const timer = setTimeout(() => remove(new DispatchExecutionError('dispatch_timeout', 'not_dispatched')), timeoutMs);
+        job.cleanup = () => { clearTimeout(timer); options.signal?.removeEventListener('abort', abort); };
+        waiting.push(job); options.signal?.addEventListener('abort', abort, { once: true });
+        if (options.signal?.aborted) abort();
+      });
     },
-    async close() { await active?.cancel(); },
+    async close() { closed = true; rejectWaiting(new DispatchExecutionError('dispatch_cancelled', 'not_dispatched')); await active?.cancel(); },
     get active() { return Boolean(active); },
   });
 }
+
+export function createAgdfWorkerExecutor(runtime, options = {}) {
+  return createWorkerDispatchExecutor({
+    surface: runtime.trustedContext.surface,
+    expectedVersion: runtime.trustedContext.expectedVersion,
+    commandGroups: runtime.trustedContext.commandGroups,
+    ...options,
+  });
+}