@amalgm/tools 0.1.7-main.34938545892 → 0.1.7-main.35288280075

package/PURPOSE.md

@@ -43,6 +43,10 @@ and parity evidence only.
 
 ## Axioms
 
+MCP execution context belongs to each host-admitted call. It passes unchanged
+to the driver, never comes from model-supplied arguments or metadata, and never
+leaks between concurrent calls sharing a prepared Toolbox view.
+
 Consumer assembly derives exact same-branch dependency pins from the declared
 package manifests and registry candidate records. One pending composition per
 branch preserves human edits; complete consumer checks for the exact merge tree govern its

package/README.md

@@ -158,12 +158,12 @@ the token can be omitted. Authentication does not replace native certification,
 exact source records or artifact integrity; private source repositories do not
 receive npm's public-source provenance.
 
-Managed dependency reconciliation reads this owner’s declared manifests and
-updates exact same-branch registry candidates in one pending composition PR per
-branch. The repository token explicitly dispatches the owner checks. Every declared gate must
-pass for the exact merge tree; an atomic expected-base update prevents merging
-with untested concurrent source. Human additions or amendments are preserved.
-The half-hour CI reconciliation recovers missed dispatch hints. Assembly runs
-no dependency code or lifecycle hooks, and repeated owner checks do not publish
-another candidate for unchanged source. Repository policy must allow GitHub Actions to create pull requests; no
-cross-repository credential or paid auto-merge feature is required.
+Bricks (`@amalgm/*` lane packages) are not pinned in source. `npm run resolve`
+picks the newest good `candidate-<lane>` of each brick named in
+`amalgmComposition` at build time; CI runs it with `--save`, so the packed
+manifest records the exact set. A brick publication dispatches this owner's
+checks on its lane, and a repeated check with an unchanged source and set does
+not publish another candidate. Rollback is an explicit set: dispatch
+`publish-package.yml` with `brick_set`, or set `AMALGM_LANE_SET` locally.
+`preview` mirrors `main` through `mirror-preview.yml`; nothing is merged the
+other way.

package/dist/mcp-server.d.ts

@@ -14,7 +14,7 @@ declare function createMcpServer<T extends Toolbox | ToolboxView = Toolbox>(opti
     mcp?: McpOptions;
 }): {
     toolbox: T;
-    handle: (request: Request) => Promise<unknown>;
+    handle: (request: Request, context?: unknown) => Promise<unknown>;
     start: (input?: Readable, output?: Writable) => readline.Interface;
 };
 export { createMcpServer };

package/dist/mcp-server.js

@@ -8,7 +8,8 @@ function descriptor(tool) {
 function createMcpServer(options = {}) {
     const toolbox = options.toolbox || new Toolbox(options);
     const mcpOptions = options.mcp || {};
-    async function handle(request) {
+    /** Context is supplied by the trusted transport host, never parsed from MCP input. */
+    async function handle(request, context) {
         if (request.method === 'initialize') {
             return {
                 protocolVersion: request.params?.protocolVersion || '2024-11-05',
@@ -23,7 +24,7 @@ function createMcpServer(options = {}) {
             return { tools: tools.map(descriptor) };
         if (request.method === 'tools/call') {
             try {
-                return await callMcpTool(toolbox, String(request.params?.name || ''), request.params?.arguments || {}, mcpOptions);
+                return await callMcpTool(toolbox, String(request.params?.name || ''), request.params?.arguments || {}, context === undefined ? mcpOptions : { ...mcpOptions, context });
             }
             catch (error) {
                 if (error instanceof Error && error.message.startsWith('Unknown tool:')) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amalgm/tools",
-  "version": "0.1.7-main.34938545892",
+  "version": "0.1.7-main.35288280075",
   "description": "Local-first tool definitions, Toolbox registry, and agent execution surfaces.",
   "license": "UNLICENSED",
   "private": false,
@@ -45,18 +45,18 @@
     "test": "tsx --test --test-concurrency=1 --test-timeout=30000 test/*.test.ts",
     "verify": "npm run check && npm run build && npm test",
     "prepack": "npm run build",
+    "resolve": "node scripts/release/resolve.mjs",
     "release:admit": "node scripts/release/package.mjs admit",
     "release:prepare": "node scripts/release/package.mjs prepare",
     "release:examine": "node scripts/release/package.mjs examine",
     "release:publish": "node scripts/release/package.mjs publish",
-    "release:compose": "node scripts/release/compose.mjs",
     "test:release": "node --test scripts/release/*.test.mjs"
   },
   "engines": {
     "node": ">=24"
   },
   "dependencies": {
-    "@amalgm/core": "0.5.1-main.34403884649",
+    "@amalgm/core": "0.5.1-main.35171577680",
     "@modelcontextprotocol/sdk": "1.30.0",
     "better-sqlite3": "^12.6.2"
   },
@@ -83,16 +83,16 @@
     "fsevents@2.3.3": false
   },
   "amalgmComposition": {
-    "schema": 1,
-    "manifests": [
-      "package.json"
+    "schema": 2,
+    "bricks": [
+      "@amalgm/core"
     ]
   },
-  "gitHead": "6e3c10c38651ab68a5694a32a5f6a0292c231066",
+  "gitHead": "8551f8b8b0d7f0bf9699542ef1ef09badf776dd1",
   "amalgmSource": {
     "repository": "amalgm-inc/amalgm-tools",
     "branch": "main",
-    "commit": "6e3c10c38651ab68a5694a32a5f6a0292c231066",
-    "occurrence": "34938545892"
+    "commit": "8551f8b8b0d7f0bf9699542ef1ef09badf776dd1",
+    "occurrence": "35288280075"
   }
 }