@brutalist/mcp 0.6.0 → 0.6.1

package/README.md

@@ -14,6 +14,8 @@ Three brutal CLI agents that can analyze anything. Each agent brings different p
 
 Real file-system analysis. Actual brutal prompts. Intelligent pagination for enterprise codebases. No participation trophies.
 
+## Setup
+
 ### Prerequisites
 
 Install at least one CLI agent:
@@ -21,7 +23,7 @@ Install at least one CLI agent:
 - **Codex**: Install from [OpenAI Codex](https://github.com/openai/codex-cli)
 - **Gemini**: `npm install -g @google/gemini-cli` or authenticate via `gemini auth`
 
-### Setup
+### Installation
 
 <details>
 <summary><strong>Claude Code</strong> — One-liner</summary>

package/dist/brutalist-server.d.ts

@@ -6,12 +6,17 @@ export declare class BrutalistServer {
     private cliOrchestrator;
     private httpTransport?;
     private responseCache;
+    private actualPort?;
+    private shutdownHandler?;
+    private activeSessions;
     constructor(config?: BrutalistServerConfig);
     private handleStreamingEvent;
     private handleProgressUpdate;
     start(): Promise<void>;
     private startStdioServer;
     private startHttpServer;
+    getActualPort(): number | undefined;
+    cleanup(): void;
     private registerTools;
     private registerSpecialTools;
     /**

package/dist/brutalist-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"brutalist-server.d.ts","sourceRoot":"","sources":["../src/brutalist-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAUpE,OAAO,EACL,qBAAqB,EAKtB,MAAM,sBAAsB,CAAC;AAc9B,qBAAa,eAAe;IACnB,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,qBAAqB,CAAC;IACrC,OAAO,CAAC,eAAe,CAAuB;IAC9C,OAAO,CAAC,aAAa,CAAC,CAAgC;IACtD,OAAO,CAAC,aAAa,CAAgB;gBAEzB,MAAM,GAAE,qBAA0B;IAmC9C,OAAO,CAAC,oBAAoB,CAgB1B;IAEF,OAAO,CAAC,oBAAoB,CAmB1B;IAEI,KAAK;YAeG,gBAAgB;YAMhB,eAAe;IAqE7B,OAAO,CAAC,aAAa;IAoBrB,OAAO,CAAC,oBAAoB;IA6F5B;;OAEG;YACW,eAAe;YA4Gf,gBAAgB;IAkK9B,OAAO,CAAC,gBAAgB;YAwFV,wBAAwB;IAuFtC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAwB1B,OAAO,CAAC,kBAAkB;IAwD1B,OAAO,CAAC,uBAAuB;IAoG/B,OAAO,CAAC,mBAAmB;YA8Bb,mBAAmB;CAUlC"}
+{"version":3,"file":"brutalist-server.d.ts","sourceRoot":"","sources":["../src/brutalist-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAUpE,OAAO,EACL,qBAAqB,EAKtB,MAAM,sBAAsB,CAAC;AAc9B,qBAAa,eAAe;IACnB,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,qBAAqB,CAAC;IACrC,OAAO,CAAC,eAAe,CAAuB;IAC9C,OAAO,CAAC,aAAa,CAAC,CAAgC;IACtD,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,UAAU,CAAC,CAAS;IAC5B,OAAO,CAAC,eAAe,CAAC,CAAa;IAErC,OAAO,CAAC,cAAc,CAIjB;gBAEO,MAAM,GAAE,qBAA0B;IAsC9C,OAAO,CAAC,oBAAoB,CAqD1B;IAEF,OAAO,CAAC,oBAAoB,CAkC1B;IAEI,KAAK;YAeG,gBAAgB;YAMhB,eAAe;IAmItB,aAAa,IAAI,MAAM,GAAG,SAAS;IAKnC,OAAO,IAAI,IAAI;IAOtB,OAAO,CAAC,aAAa;IAoBrB,OAAO,CAAC,oBAAoB;IA2F5B;;OAEG;YACW,eAAe;YAyJf,gBAAgB;IAkK9B,OAAO,CAAC,gBAAgB;YA0FV,wBAAwB;IA0FtC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAwB1B,OAAO,CAAC,kBAAkB;IAwD1B,OAAO,CAAC,uBAAuB;IA2G/B,OAAO,CAAC,mBAAmB;YA8Bb,mBAAmB;CAUlC"}

package/dist/brutalist-server.js

@@ -18,11 +18,14 @@ export class BrutalistServer {
     cliOrchestrator;
     httpTransport;
     responseCache;
+    actualPort;
+    shutdownHandler;
+    // Session tracking for security
+    activeSessions = new Map();
     constructor(config = {}) {
         this.config = {
             workingDirectory: process.cwd(),
             defaultTimeout: 1500000, // 25 minutes for thorough CLI analysis
-            enableSandbox: true,
             transport: 'stdio', // Default to stdio for backward compatibility
             httpPort: 3000,
             ...config
@@ -43,44 +46,91 @@ export class BrutalistServer {
             name: "brutalist-mcp",
             version: PACKAGE_VERSION,
             capabilities: {
-                tools: {}
+                tools: {},
+                logging: {},
+                experimental: {
+                    streaming: true
+                }
             }
         });
         this.registerTools();
     }
     handleStreamingEvent = (event) => {
-        // Send streaming event via MCP server (works for both stdio and HTTP transports)
         try {
-            logger.debug(`🔄 Streaming event: ${event.type} from ${event.agent} - ${event.content?.substring(0, 100)}...`);
-            // Convert streaming event to MCP notification format
-            this.server.sendLoggingMessage({
-                level: 'info',
-                data: event,
-                logger: 'brutalist-mcp-streaming'
-            });
-            logger.debug(`✅ Sent logging message for ${event.type} event`);
+            if (!event.sessionId) {
+                logger.warn("⚠️ Streaming event without session ID - dropping for security");
+                return;
+            }
+            logger.debug(`🔄 Session-scoped streaming: ${event.type} from ${event.agent} to session ${event.sessionId.substring(0, 8)}...`);
+            // For HTTP transport: send session-specific notification
+            if (this.httpTransport) {
+                // Use MCP server's notification system with session context
+                this.server.server.notification({
+                    method: "notifications/message",
+                    params: {
+                        level: 'info',
+                        data: {
+                            type: 'streaming_event',
+                            sessionId: event.sessionId,
+                            agent: event.agent,
+                            eventType: event.type,
+                            content: event.content?.substring(0, 1000), // Truncate for safety
+                            timestamp: event.timestamp
+                        },
+                        logger: 'brutalist-mcp-streaming'
+                    }
+                });
+            }
+            // For STDIO transport: still send but with session info
+            else {
+                this.server.sendLoggingMessage({
+                    level: 'info',
+                    data: {
+                        sessionId: event.sessionId,
+                        agent: event.agent,
+                        type: event.type,
+                        content: event.content?.substring(0, 500) // More restrictive for stdio
+                    },
+                    logger: 'brutalist-mcp-streaming'
+                });
+            }
+            // Update session activity
+            if (this.activeSessions.has(event.sessionId)) {
+                this.activeSessions.get(event.sessionId).lastActivity = Date.now();
+            }
         }
         catch (error) {
-            logger.error("Failed to send streaming event", error);
+            logger.error("💥 Failed to send session-scoped streaming event", {
+                error: error instanceof Error ? error.message : String(error),
+                sessionId: event.sessionId?.substring(0, 8)
+            });
         }
     };
-    handleProgressUpdate = (progressToken, progress, total, message) => {
+    handleProgressUpdate = (progressToken, progress, total, message, sessionId) => {
         try {
-            logger.debug(`📊 Progress update: ${progress}/${total} - ${message}`);
-            // Send progress notification via MCP server
+            if (!sessionId) {
+                logger.warn("⚠️ Progress update without session ID - dropping for security");
+                return;
+            }
+            logger.debug(`📊 Session progress: ${progress}/${total} for session ${sessionId.substring(0, 8)}...`);
+            // Send progress notification with session context
             this.server.server.notification({
                 method: "notifications/progress",
                 params: {
                     progressToken,
                     progress,
                     total,
-                    message
+                    message: `[${sessionId.substring(0, 8)}] ${message}`, // Include session prefix
+                    sessionId // Include in notification data
                 }
             });
-            logger.debug(`✅ Sent progress notification: ${progress}/${total}`);
+            logger.debug(`✅ Sent session-scoped progress notification: ${progress}/${total}`);
         }
         catch (error) {
-            logger.error("Failed to send progress notification", error);
+            logger.error("💥 Failed to send progress notification", {
+                error: error instanceof Error ? error.message : String(error),
+                sessionId: sessionId?.substring(0, 8)
+            });
         }
     };
     async start() {
@@ -118,13 +168,57 @@ export class BrutalistServer {
         // Create Express app for HTTP handling
         const app = express();
         app.use(express.json({ limit: '10mb' })); // Add JSON size limit for security
-        // Enable CORS for development
+        // Secure CORS implementation
         app.use((req, res, next) => {
-            res.header('Access-Control-Allow-Origin', '*');
-            res.header('Access-Control-Allow-Methods', 'GET, POST, OPTIONS, DELETE');
-            res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization, Mcp-Session-Id');
+            const origin = req.headers.origin;
+            const isProduction = process.env.NODE_ENV === 'production';
+            // Define safe default origins for development
+            const defaultDevOrigins = [
+                'http://localhost:3000',
+                'http://127.0.0.1:3000',
+                'http://localhost:8080',
+                'http://127.0.0.1:8080',
+                'http://localhost:3001',
+                'http://127.0.0.1:3001'
+            ];
+            // Get allowed origins from config or use defaults
+            const allowedOrigins = this.config.corsOrigins || defaultDevOrigins;
+            const allowWildcard = this.config.allowCORSWildcard === true && !isProduction;
+            // Determine if origin is allowed
+            let allowedOrigin = null;
+            if (allowWildcard) {
+                // Only in development with explicit opt-in
+                allowedOrigin = '*';
+                logger.warn("⚠️ Using wildcard CORS - only safe in development!");
+            }
+            else if (!origin) {
+                // No origin header (same-origin or direct server access)
+                allowedOrigin = defaultDevOrigins[0]; // Default fallback
+            }
+            else if (allowedOrigins.includes(origin)) {
+                // Explicitly allowed origin
+                allowedOrigin = origin;
+            }
+            else {
+                // Rejected origin
+                logger.warn(`🚫 CORS rejected origin: ${origin}`);
+                allowedOrigin = null;
+            }
+            // Set headers only if origin is allowed
+            if (allowedOrigin) {
+                res.header('Access-Control-Allow-Origin', allowedOrigin);
+                res.header('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+                res.header('Access-Control-Allow-Headers', 'Content-Type, Mcp-Session-Id');
+                // Removed Authorization header for security
+                res.header('Access-Control-Allow-Credentials', 'false'); // Explicit false
+            }
             if (req.method === 'OPTIONS') {
-                res.sendStatus(200);
+                if (allowedOrigin) {
+                    res.sendStatus(200);
+                }
+                else {
+                    res.sendStatus(403); // Forbidden for disallowed origins
+                }
                 return;
             }
             next();
@@ -146,21 +240,44 @@ export class BrutalistServer {
             res.json({ status: 'ok', transport: 'http-streaming', version: PACKAGE_VERSION });
         });
         // Start the HTTP server - bind to localhost only for security
-        const port = this.config.httpPort || 3000;
-        const server = app.listen(port, '127.0.0.1', () => {
-            logger.info(`HTTP server listening on port ${port}`);
-            logger.info(`MCP endpoint: http://localhost:${port}/mcp`);
-            logger.info(`Health check: http://localhost:${port}/health`);
-        });
-        // Handle graceful shutdown
-        process.on('SIGTERM', () => {
-            logger.info('Received SIGTERM, shutting down gracefully');
-            server.close(() => {
-                logger.info('HTTP server closed');
-                process.exit(0);
+        const port = this.config.httpPort ?? 3000;
+        return new Promise((resolve, reject) => {
+            const server = app.listen(port, '127.0.0.1', () => {
+                const actualPort = server.address()?.port || port;
+                this.actualPort = actualPort;
+                logger.info(`HTTP server listening on port ${actualPort}`);
+                logger.info(`MCP endpoint: http://localhost:${actualPort}/mcp`);
+                logger.info(`Health check: http://localhost:${actualPort}/health`);
+                resolve();
+            });
+            server.on('error', (error) => {
+                logger.error('HTTP server failed to start', error);
+                reject(error);
             });
+            // Handle graceful shutdown - avoid duplicate listeners
+            if (!this.shutdownHandler) {
+                this.shutdownHandler = () => {
+                    logger.info('Received SIGTERM, shutting down gracefully');
+                    server.close(() => {
+                        logger.info('HTTP server closed');
+                        process.exit(0);
+                    });
+                };
+                process.on('SIGTERM', this.shutdownHandler);
+            }
         });
     }
+    // Getter for actual listening port (useful for tests)
+    getActualPort() {
+        return this.actualPort;
+    }
+    // Cleanup method for tests - remove event listeners
+    cleanup() {
+        if (this.shutdownHandler) {
+            process.removeListener('SIGTERM', this.shutdownHandler);
+            this.shutdownHandler = undefined;
+        }
+    }
     registerTools() {
         // Register all roast tools using unified handler - DRY principle
         TOOL_CONFIGS.forEach(config => {
@@ -180,7 +297,6 @@ export class BrutalistServer {
             debateRounds: z.number().optional().describe("Number of debate rounds (default: 2, max: 10)"),
             context: z.string().optional().describe("Additional context for the debate"),
             workingDirectory: z.string().optional().describe("Working directory for analysis"),
-            enableSandbox: z.boolean().optional().describe("Enable sandbox mode for security"),
             models: z.object({
                 claude: z.string().optional().describe("Claude model: opus, sonnet, or full name like claude-opus-4-1-20250805"),
                 codex: z.string().optional().describe("Codex model: gpt-5, gpt-5-codex, o3, o3-mini, o3-pro, o4-mini"),
@@ -189,7 +305,7 @@ export class BrutalistServer {
         }, async (args) => {
             return this.handleToolExecution(async () => {
                 const debateRounds = Math.min(args.debateRounds || 2, 10); // Limit to max 10 rounds to prevent DoS
-                const responses = await this.executeCLIDebate(args.targetPath, debateRounds, args.context, args.workingDirectory, args.enableSandbox, args.models);
+                const responses = await this.executeCLIDebate(args.targetPath, debateRounds, args.context, args.workingDirectory, args.models);
                 return responses;
             });
         });
@@ -216,7 +332,7 @@ export class BrutalistServer {
                 roster += "- `cli_agent_roster` - This tool (show capabilities)\n\n";
                 roster += "## CLI Agent Capabilities\n";
                 roster += "**Claude Code** - Advanced analysis with direct system prompt injection\n";
-                roster += "**Codex** - Sandboxed execution with embedded brutal prompts\n";
+                roster += "**Codex** - Secure execution with embedded brutal prompts\n";
                 roster += "**Gemini CLI** - Workspace context with environment variable system prompts\n\n";
                 // Add CLI context information
                 const cliContext = await this.cliOrchestrator.detectCLIContext();
@@ -247,6 +363,38 @@ export class BrutalistServer {
     async handleRoastTool(config, args, extra) {
         try {
             const progressToken = extra._meta?.progressToken;
+            // Extract session context for security
+            const sessionId = extra?.sessionId ||
+                extra?._meta?.sessionId ||
+                extra?.headers?.['mcp-session-id'] ||
+                `anonymous-${Date.now()}-${Math.random().toString(36).substring(7)}`;
+            const requestId = `${sessionId}-${Date.now()}-${Math.random().toString(36).substring(7)}`;
+            logger.debug(`🔐 Processing request with session: ${sessionId.substring(0, 8)}..., request: ${requestId.substring(0, 12)}...`);
+            // Track session activity
+            if (!this.activeSessions.has(sessionId)) {
+                this.activeSessions.set(sessionId, {
+                    startTime: Date.now(),
+                    requestCount: 0,
+                    lastActivity: Date.now()
+                });
+            }
+            const sessionInfo = this.activeSessions.get(sessionId);
+            sessionInfo.requestCount++;
+            sessionInfo.lastActivity = Date.now();
+            // Debug logging: Log the received arguments to file
+            const fs = require('fs');
+            const debugLog = `/tmp/brutalist-tool-debug-${Date.now()}.log`;
+            const logMessage = (msg) => {
+                try {
+                    fs.appendFileSync(debugLog, `${new Date().toISOString()}: ${msg}\n`);
+                }
+                catch (e) {
+                    // Ignore filesystem errors
+                }
+            };
+            logMessage(`🔧 ROAST TOOL DEBUG: Tool=${config.name}, primaryArgField=${config.primaryArgField}`);
+            logMessage(`🔧 ROAST TOOL DEBUG: args=${JSON.stringify(args, null, 2)}`);
+            logMessage(`🔧 ROAST TOOL DEBUG: extra=${JSON.stringify(extra, null, 2)}`);
             // Extract pagination parameters
             const paginationParams = extractPaginationParams(args);
             if (args.cursor) {
@@ -255,9 +403,9 @@ export class BrutalistServer {
             }
             // Check cache if analysis_id provided
             if (args.analysis_id && !args.force_refresh) {
-                const cachedContent = await this.responseCache.get(args.analysis_id);
+                const cachedContent = await this.responseCache.get(args.analysis_id, sessionId);
                 if (cachedContent) {
-                    logger.info(`🎯 Using cached result for analysis_id: ${args.analysis_id}`);
+                    logger.info(`🎯 Session-validated cache hit for analysis_id: ${args.analysis_id}`);
                     const cachedResult = {
                         success: true,
                         responses: [{
@@ -269,6 +417,9 @@ export class BrutalistServer {
                     };
                     return this.formatToolResponse(cachedResult, args.verbose, paginationParams, args.analysis_id);
                 }
+                else {
+                    logger.info(`🔍 No valid cache entry for analysis_id: ${args.analysis_id} and session: ${sessionId?.substring(0, 8)}`);
+                }
             }
             // Generate cache key for this request
             const cacheKey = this.responseCache.generateCacheKey(config.cacheKeyFields.reduce((acc, field) => {
@@ -279,7 +430,7 @@ export class BrutalistServer {
             }, {}));
             // Check if we have a cached result (unless forcing refresh)
             if (!args.force_refresh) {
-                const cachedContent = await this.responseCache.get(cacheKey);
+                const cachedContent = await this.responseCache.get(cacheKey, sessionId);
                 if (cachedContent) {
                     const analysisId = this.responseCache.generateAnalysisId(cacheKey);
                     logger.info(`🎯 Cache hit for new request, using analysis_id: ${analysisId}`);
@@ -299,8 +450,10 @@ export class BrutalistServer {
             const context = config.contextBuilder ? config.contextBuilder(args) : args.context;
             // Get the primary argument (targetPath, idea, architecture, etc.)
             const primaryArg = args[config.primaryArgField];
+            logMessage(`🔧 PRIMARY ARG DEBUG: primaryArgField=${config.primaryArgField}, primaryArg="${primaryArg}"`);
+            logMessage(`🔧 PRIMARY ARG DEBUG: config.analysisType="${config.analysisType}"`);
             // Run the analysis
-            const result = await this.executeBrutalistAnalysis(config.analysisType, primaryArg, config.systemPrompt, context, args.workingDirectory, args.enableSandbox, args.preferredCLI, args.verbose, args.models, progressToken);
+            const result = await this.executeBrutalistAnalysis(config.analysisType, primaryArg, config.systemPrompt, context, args.workingDirectory, args.preferredCLI, args.verbose, args.models, progressToken, sessionId, requestId);
             // Cache the result if successful
             let analysisId;
             if (result.success && result.responses.length > 0) {
@@ -312,9 +465,11 @@ export class BrutalistServer {
                             acc[field] = args[field];
                         return acc;
                     }, {});
-                    const { analysisId: newId } = await this.responseCache.set(cacheData, fullContent, cacheKey);
+                    const { analysisId: newId } = await this.responseCache.set(cacheData, fullContent, cacheKey, sessionId, // NEW: Bind to session
+                    requestId // NEW: Track request
+                    );
                     analysisId = newId;
-                    logger.info(`✅ Cached analysis result with ID: ${analysisId}`);
+                    logger.info(`✅ Cached analysis result with ID: ${analysisId} for session: ${sessionId?.substring(0, 8)}`);
                 }
             }
             return this.formatToolResponse(result, args.verbose, paginationParams, analysisId);
@@ -323,12 +478,11 @@ export class BrutalistServer {
             return this.formatErrorResponse(error);
         }
     }
-    async executeCLIDebate(targetPath, debateRounds, context, workingDirectory, enableSandbox, models) {
+    async executeCLIDebate(targetPath, debateRounds, context, workingDirectory, models) {
         logger.debug("Executing CLI debate", {
             targetPath,
             debateRounds,
             workingDirectory,
-            enableSandbox
         });
         try {
             // Get CLI context
@@ -372,13 +526,14 @@ Remember: You are ${agent.toUpperCase()}, the passionate champion of ${position.
                 logger.info(`🎭 ${agent.toUpperCase()} preparing initial position: ${position.split(':')[0]}`);
                 const response = await this.cliOrchestrator.executeSingleCLI(agent, assignedPrompt, assignedPrompt, {
                     workingDirectory: workingDirectory || this.config.workingDirectory,
-                    sandbox: enableSandbox ?? this.config.enableSandbox,
                     timeout: (this.config.defaultTimeout || 60000) * 2,
                     models: models ? { [agent]: models[agent] } : undefined
                 });
                 if (response.success) {
                     debateContext.push(response);
-                    fullDebateTranscript.get(agent)?.push(response.output);
+                    if (response.output) {
+                        fullDebateTranscript.get(agent)?.push(response.output);
+                    }
                 }
             }
             // Subsequent rounds: Turn-based responses attacking specific arguments
@@ -420,13 +575,14 @@ Remember: You are ${currentAgent.toUpperCase()}, passionate advocate for ${assig
                     logger.info(`🔥 Round ${round}: ${currentAgent.toUpperCase()} responding to opponents (${assignedPosition.split(':')[0]})`);
                     const response = await this.cliOrchestrator.executeSingleCLI(currentAgent, confrontationalPrompt, confrontationalPrompt, {
                         workingDirectory: workingDirectory || this.config.workingDirectory,
-                        sandbox: enableSandbox ?? this.config.enableSandbox,
                         timeout: (this.config.defaultTimeout || 60000) * 2,
                         models: models ? { [currentAgent]: models[currentAgent] } : undefined
                     });
                     if (response.success) {
                         debateContext.push(response);
-                        fullDebateTranscript.get(currentAgent)?.push(response.output);
+                        if (response.output) {
+                            fullDebateTranscript.get(currentAgent)?.push(response.output);
+                        }
                     }
                 }
             }
@@ -469,7 +625,9 @@ Remember: You are ${currentAgent.toUpperCase()}, passionate advocate for ${assig
             if (!agentOutputs.has(response.agent)) {
                 agentOutputs.set(response.agent, []);
             }
-            agentOutputs.get(response.agent)?.push(response.output);
+            if (response.output) {
+                agentOutputs.get(response.agent)?.push(response.output);
+            }
         });
         synthesis += `## Key Points of Conflict\n\n`;
         // Extract disagreements by looking for contradictory keywords
@@ -516,15 +674,14 @@ Remember: You are ${currentAgent.toUpperCase()}, passionate advocate for ${assig
         }
         return synthesis;
     }
-    async executeBrutalistAnalysis(analysisType, targetPath, systemPromptSpec, context, workingDirectory, enableSandbox, preferredCLI, verbose, models, progressToken) {
+    async executeBrutalistAnalysis(analysisType, primaryContent, systemPromptSpec, context, workingDirectory, preferredCLI, verbose, models, progressToken, sessionId, requestId) {
         logger.info(`🏢 Starting brutalist analysis: ${analysisType}`);
-        logger.info(`🔧 DEBUG: preferredCLI=${preferredCLI}, targetPath=${targetPath}`);
+        logger.info(`🔧 DEBUG: preferredCLI=${preferredCLI}, primaryContent=${primaryContent}`);
         logger.debug("Executing brutalist analysis", {
-            targetPath,
+            primaryContent,
             analysisType,
             systemPromptSpec,
             workingDirectory,
-            enableSandbox,
             preferredCLI
         });
         try {
@@ -535,16 +692,18 @@ Remember: You are ${currentAgent.toUpperCase()}, passionate advocate for ${assig
             // Execute CLI agent analysis (single or multi-CLI based on preferences)
             logger.info(`🔍 Executing brutalist analysis with timeout: ${this.config.defaultTimeout}ms`);
             logger.info(`🔧 DEBUG: About to call cliOrchestrator.executeBrutalistAnalysis`);
-            const responses = await this.cliOrchestrator.executeBrutalistAnalysis(analysisType, targetPath, systemPromptSpec, context, {
+            const responses = await this.cliOrchestrator.executeBrutalistAnalysis(analysisType, primaryContent, systemPromptSpec, context, {
                 workingDirectory: workingDirectory || this.config.workingDirectory,
-                sandbox: enableSandbox ?? this.config.enableSandbox,
                 timeout: this.config.defaultTimeout,
                 preferredCLI,
                 analysisType: analysisType,
                 models,
                 onStreamingEvent: this.handleStreamingEvent,
                 progressToken,
-                onProgress: progressToken ? this.handleProgressUpdate.bind(this, progressToken) : undefined
+                onProgress: progressToken && sessionId ?
+                    (progress, total, message) => this.handleProgressUpdate(progressToken, progress, total, message, sessionId) : undefined,
+                sessionId,
+                requestId
             });
             logger.info(`🔧 DEBUG: cliOrchestrator.executeBrutalistAnalysis returned ${responses.length} responses`);
             const successfulResponses = responses.filter(r => r.success);
@@ -558,7 +717,7 @@ Remember: You are ${currentAgent.toUpperCase()}, passionate advocate for ${assig
                 responses,
                 synthesis,
                 analysisType,
-                targetPath,
+                targetPath: primaryContent,
                 executionSummary: {
                     totalCLIs: responses.length,
                     successfulCLIs: successfulResponses.length,
@@ -682,39 +841,44 @@ Remember: You are ${currentAgent.toUpperCase()}, passionate advocate for ${assig
         const totalTokens = estimateTokenCount(content);
         // Format response with pagination info
         let paginatedText = '';
-        // Add pagination header with analysis ID
+        // Add header
         paginatedText += `# Brutalist Analysis Results\n\n`;
-        paginatedText += `**📊 Pagination Status:** ${statusLine}\n`;
-        if (analysisId) {
-            paginatedText += `**🔑 Analysis ID:** ${analysisId}\n`;
-        }
-        paginatedText += `**🔢 Token Estimate:** ~${chunkTokens.toLocaleString()} tokens (chunk) / ~${totalTokens.toLocaleString()} tokens (total)\n\n`;
-        if (pagination.hasMore) {
+        // Only show pagination metadata if pagination is actually needed
+        const needsPagination = pagination.totalChunks > 1 || pagination.hasMore;
+        if (needsPagination) {
+            paginatedText += `**📊 Pagination Status:** ${statusLine}\n`;
             if (analysisId) {
-                paginatedText += `**⏭️ Continue Reading:** Use \`analysis_id: "${analysisId}", offset: ${endOffset}\`\n\n`;
+                paginatedText += `**🔑 Analysis ID:** ${analysisId}\n`;
             }
-            else {
-                paginatedText += `**⏭️ Continue Reading:** Use \`offset: ${endOffset}\` for next chunk\n\n`;
+            paginatedText += `**🔢 Token Estimate:** ~${chunkTokens.toLocaleString()} tokens (chunk) / ~${totalTokens.toLocaleString()} tokens (total)\n\n`;
+            if (pagination.hasMore) {
+                if (analysisId) {
+                    paginatedText += `**⏭️ Continue Reading:** Use \`analysis_id: "${analysisId}", offset: ${endOffset}\`\n\n`;
+                }
+                else {
+                    paginatedText += `**⏭️ Continue Reading:** Use \`offset: ${endOffset}\` for next chunk\n\n`;
+                }
             }
         }
         paginatedText += `---\n\n`;
         // Add the actual content chunk
         paginatedText += chunkContent;
-        // Add footer for continuation
-        if (pagination.hasMore) {
+        // Add footer
+        if (needsPagination) {
             paginatedText += `\n\n---\n\n`;
-            paginatedText += `📖 **End of chunk ${pagination.chunkIndex}/${pagination.totalChunks}**\n`;
-            if (analysisId) {
-                paginatedText += `🔄 To continue: Include \`analysis_id: "${analysisId}"\` with \`offset: ${endOffset}\` in next request`;
+            if (pagination.hasMore) {
+                paginatedText += `📖 **End of chunk ${pagination.chunkIndex}/${pagination.totalChunks}**\n`;
+                if (analysisId) {
+                    paginatedText += `🔄 To continue: Include \`analysis_id: "${analysisId}"\` with \`offset: ${endOffset}\` in next request`;
+                }
+                else {
+                    paginatedText += `🔄 To continue: Use same tool with \`offset: ${endOffset}\``;
+                }
             }
             else {
-                paginatedText += `🔄 To continue: Use same tool with \`offset: ${endOffset}\``;
+                paginatedText += `✅ **Complete analysis shown** (${content.length.toLocaleString()} characters total)`;
             }
         }
-        else {
-            paginatedText += `\n\n---\n\n`;
-            paginatedText += `✅ **Complete analysis shown** (${content.length.toLocaleString()} characters total)`;
-        }
         // Add verbose execution details if requested
         if (verbose && result.executionSummary) {
             paginatedText += `\n\n### Execution Summary\n`;
@@ -742,7 +906,7 @@ Remember: You are ${currentAgent.toUpperCase()}, passionate advocate for ${assig
                 sanitizedMessage = "Analysis timed out - try reducing scope or increasing timeout";
             }
             else if (error.message.includes('ENOENT') || error.message.includes('no such file')) {
-                sanitizedMessage = "Target path not found";
+                sanitizedMessage = `DEBUG: Target path not found - Original error: ${error.message}`;
             }
             else if (error.message.includes('EACCES') || error.message.includes('permission denied')) {
                 sanitizedMessage = "Permission denied - check file access";