@cyanheads/mcp-ts-core 0.10.8 → 0.10.10

package/AGENTS.md

@@ -1,7 +1,7 @@
 # Developer Protocol
 
 **Package:** `@cyanheads/mcp-ts-core`
-**Version:** 0.10.8
+**Version:** 0.10.10
 **Engines:** Bun ≥1.3.0, Node ≥24.0.0
 **MCP SDK:** `@modelcontextprotocol/sdk` ^1.29.0
 **Zod:** ^4.4.3

package/CLAUDE.md

@@ -1,7 +1,7 @@
 # Developer Protocol
 
 **Package:** `@cyanheads/mcp-ts-core`
-**Version:** 0.10.8
+**Version:** 0.10.10
 **Engines:** Bun ≥1.3.0, Node ≥24.0.0
 **MCP SDK:** `@modelcontextprotocol/sdk` ^1.29.0
 **Zod:** ^4.4.3

package/README.md

@@ -5,7 +5,7 @@
 
 <div align="center">
 
-[![Version](https://img.shields.io/badge/Version-0.10.8-blue.svg?style=flat-square)](./CHANGELOG.md) [![License](https://img.shields.io/badge/License-Apache%202.0-orange.svg?style=flat-square)](./LICENSE) [![MCP Spec](https://img.shields.io/badge/MCP%20Spec-2025--11--25-8A2BE2.svg?style=flat-square)](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2025-11-25/changelog.mdx)
+[![Version](https://img.shields.io/badge/Version-0.10.10-blue.svg?style=flat-square)](./CHANGELOG.md) [![License](https://img.shields.io/badge/License-Apache%202.0-orange.svg?style=flat-square)](./LICENSE) [![MCP Spec](https://img.shields.io/badge/MCP%20Spec-2025--11--25-8A2BE2.svg?style=flat-square)](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2025-11-25/changelog.mdx)
 
 [![MCP SDK](https://img.shields.io/badge/MCP%20SDK-^1.29.0-green.svg?style=flat-square)](https://modelcontextprotocol.io/) [![TypeScript](https://img.shields.io/badge/TypeScript-^6.0.3-3178C6.svg?style=flat-square)](https://www.typescriptlang.org/) [![Bun](https://img.shields.io/badge/Bun-v1.3.0%2B-blueviolet.svg?style=flat-square)](https://bun.sh/)
 
@@ -301,15 +301,6 @@ bun run lint:mcp       # validate MCP definitions against spec
 bun run test:all       # vitest: unit + Workers pool + integration
 ```
 
-## Contributing
-
-Issues and pull requests welcome. Run checks before submitting:
-
-```bash
-bun run devcheck
-bun run test:all
-```
-
 ## License
 
 Apache 2.0 — see [LICENSE](./LICENSE).

package/biome.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.5.0/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.1/schema.json",
   "vcs": {
     "enabled": true,
     "clientKind": "git",

package/changelog/0.10.x/0.10.10.md

@@ -0,0 +1,39 @@
+---
+summary: "js-yaml v4 → v5 migration: YamlParser uses YAML11_SCHEMA to preserve YAML 1.1 load semantics after v5 defaults to CORE_SCHEMA, namespace import replaces the removed default export, @types/js-yaml dropped (v5 self-types). Breaking: the js-yaml peer dependency moves ^4 → ^5. Plus biome 2.5.1 and a dependency refresh."
+breaking: true
+security: false
+agent-notes: |
+  The js-yaml peer dependency moved ^4 → ^5 (major). A consumer server that
+  installs js-yaml directly to use the Tier-3 YamlParser must bump it to ^5. No
+  consumer code change is required — the framework now loads with YAML11_SCHEMA,
+  preserving the prior YAML 1.1 semantics, so parsing behavior is unchanged.
+---
+
+# 0.10.10 — 2026-06-30
+
+## Changed
+
+- **`YamlParser.parse`** — js-yaml v5 removed `DEFAULT_SCHEMA` and defaults `load()` to the stricter YAML 1.2 `CORE_SCHEMA`; the parser now passes `YAML11_SCHEMA` to preserve the prior YAML 1.1 load semantics (`yes`/`no`/`on`/`off` → boolean, `!!timestamp` → `Date`) that LLM-generated YAML relies on.
+- **`scripts/fetch-openapi-spec.ts`** — switched to `import * as yaml from 'js-yaml'`; v5 dropped the default export.
+- **`biome.json`** — `$schema` `2.5.0` → `2.5.1`, tracking the `@biomejs/biome` bump.
+
+## Removed
+
+- **`@types/js-yaml`** — js-yaml v5 ships its own type declarations, so the separate `@types` package is gone.
+- **`js-yaml` resolution pin** — dropped the `resolutions`/`overrides` `js-yaml: ^4.2.0` entry; the v5 upgrade resolves the dependency tree without it.
+
+### Dependency bumps
+
+- `js-yaml` `^4.2.0` → `^5.2.0` (peer `^4.1.1` → `^5.2.0`)
+- `@hono/node-server` `^2.0.5` → `^2.0.6`
+- `hono` `^4.12.26` → `^4.12.27`
+- `@biomejs/biome` `2.5.0` → `2.5.1`
+- `@cloudflare/vitest-pool-workers` `^0.16.18` → `^0.16.20`
+- `@cloudflare/workers-types` `4.20260620.1` → `4.20260630.1`
+- `@supabase/supabase-js` `^2.108.2` → `^2.109.0`
+- `@types/node` `26.0.0` → `26.0.1`
+- `defuddle` `^0.19.0` → `^0.19.1`
+- `node-cron` `^4.4.1` → `^4.5.0`
+- `openai` `^6.44.0` → `^6.45.0`
+- `repomix` `^1.15.0` → `^1.16.0`
+- `vite` `8.0.16` → `8.1.0`

package/changelog/0.10.x/0.10.9.md

@@ -0,0 +1,16 @@
+---
+summary: "devcheck gains two static guards: floating dependency specifiers (latest/*/dist-tags) in package.json + bun.lock workspaces, and plugin marketplace manifest correctness (descriptions + scoped/unscoped identity)"
+breaking: false
+security: false
+---
+
+# 0.10.9 — 2026-06-20
+
+## Added
+
+- **`check-dependency-specifiers` devcheck step** — new `scripts/check-dependency-specifiers.ts`, registered in `ALL_CHECKS` (`Dependency Specifiers`, flag `--no-dep-specifiers`), hard-fails on floating specifiers in the manifests we control: `package.json`'s four dependency sections and `bun.lock`'s `workspaces` specifier maps (never the `packages` section, which records third-party nested declarations that legitimately float). `latest` fails in every section; `*` and the pre-release dist-tags `next`/`beta`/`canary`/`rc` fail in `dependencies`/`devDependencies` but are allowed in `peerDependencies`/`optionalDependencies` ("any host version"). Catches the case where `bun update --latest` writes a literal `latest` dist-tag into the lock's workspace map — correct at write time, so it clears every other gate, then lets the next `bun install` re-resolve the dep past the `package.json` range and past any intentional hold. Static and local (no network, no git), so it runs in the default and `--fast` passes; ships to consumers via `package.json` `files:`. ([#246](https://github.com/cyanheads/mcp-ts-core/issues/246))
+- **Plugin marketplace manifest checks in `lint:packaging`** — `scripts/lint-packaging.ts` gains check 10, validating `.claude-plugin/plugin.json`, `.codex-plugin/plugin.json`, and `.codex-plugin/mcp.json` when present: non-empty descriptions, display fields (`name`, server key, `interface.displayName`) carrying the **unscoped** machine name, and the `npx -y` install arg carrying the **full** `package.json` name. An unscoped install arg for a scoped package is a guaranteed install 404 — the high-value catch. Gated by a new `devcheck.config.json` `packaging.pluginManifests` flag (default on; surfaced in `templates/devcheck.config.json`); each manifest is skipped cleanly when absent, so HTTP-only and non-plugin consumers are unaffected. The `devcheck` "Packaging" gate, previously skipped unless `manifest.json` existed, now also runs when any plugin manifest is present. `skills/polish-docs-meta` step 10 documents the automated subset. ([#240](https://github.com/cyanheads/mcp-ts-core/issues/240))
+
+## Changed
+
+- **Dependency:** `@cloudflare/workers-types` 4.20260619.1 → 4.20260620.1

package/dist/utils/parsing/yamlParser.d.ts

@@ -13,7 +13,7 @@ export declare class YamlParser {
      * This method is async because `js-yaml` is loaded lazily on first call.
      * If the input begins with a `<think>...</think>` block, that block is stripped
      * and its content logged before parsing the remainder. Uses `js-yaml`'s
-     * `DEFAULT_SCHEMA` for parsing.
+     * `YAML11_SCHEMA` (YAML 1.1 load semantics) for parsing.
      *
      * @template T - The expected type of the parsed result. Defaults to `unknown`.
      * @param yamlString - The YAML string to parse. May be prefixed with a `<think>` block.

package/dist/utils/parsing/yamlParser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"yamlParser.d.ts","sourceRoot":"","sources":["../../../src/utils/parsing/yamlParser.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,KAAK,cAAc,EAAyB,MAAM,oCAAoC,CAAC;AAQhG;;;;;;GAMG;AACH,qBAAa,UAAU;IACrB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC;CAyDnF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,UAAU,YAAmB,CAAC"}
+{"version":3,"file":"yamlParser.d.ts","sourceRoot":"","sources":["../../../src/utils/parsing/yamlParser.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,KAAK,cAAc,EAAyB,MAAM,oCAAoC,CAAC;AAQhG;;;;;;GAMG;AACH,qBAAa,UAAU;IACrB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC;CA4DnF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,UAAU,YAAmB,CAAC"}

package/dist/utils/parsing/yamlParser.js

@@ -27,7 +27,7 @@ export class YamlParser {
      * This method is async because `js-yaml` is loaded lazily on first call.
      * If the input begins with a `<think>...</think>` block, that block is stripped
      * and its content logged before parsing the remainder. Uses `js-yaml`'s
-     * `DEFAULT_SCHEMA` for parsing.
+     * `YAML11_SCHEMA` (YAML 1.1 load semantics) for parsing.
      *
      * @template T - The expected type of the parsed result. Defaults to `unknown`.
      * @param yamlString - The YAML string to parse. May be prefixed with a `<think>` block.
@@ -75,7 +75,10 @@ export class YamlParser {
         }
         try {
             const yaml = await getYaml();
-            return yaml.load(stringToParse, { schema: yaml.DEFAULT_SCHEMA });
+            // js-yaml v5 removed DEFAULT_SCHEMA and defaults load() to the stricter 1.2
+            // CORE_SCHEMA; YAML11_SCHEMA preserves the prior 1.1 load semantics
+            // (yes/no/on/off → boolean, !!timestamp → Date) that LLM YAML output relies on.
+            return yaml.load(stringToParse, { schema: yaml.YAML11_SCHEMA });
         }
         catch (e) {
             const error = e instanceof Error ? e : new Error(String(e));

package/dist/utils/parsing/yamlParser.js.map

@@ -1 +1 @@
-{"version":3,"file":"yamlParser.js","sourceRoot":"","sources":["../../../src/utils/parsing/yamlParser.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAuB,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChG,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,MAAM,OAAO,GAAG,UAAU,CACxB,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EACvB,wDAAwD,CACzD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,OAAO,UAAU;IACrB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,KAAK,CAAC,KAAK,CAAc,UAAkB,EAAE,OAAwB;QACnE,IAAI,aAAa,GAAG,UAAU,CAAC;QAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAEhD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAC5C,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAEpC,MAAM,UAAU,GACd,OAAO;gBACP,qBAAqB,CAAC,oBAAoB,CAAC;oBACzC,SAAS,EAAE,uBAAuB;iBACnC,CAAC,CAAC;YACL,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE;oBACrD,GAAG,UAAU;oBACb,YAAY;iBACb,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,UAAU,CAAC,CAAC;YAChE,CAAC;YACD,aAAa,GAAG,YAAY,CAAC;QAC/B,CAAC;QAED,aAAa,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;QAErC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,eAAe,CACnB,iEAAiE,EACjE,OAAO,CACR,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,CAAM,CAAC;QACxE,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5D,MAAM,eAAe,GACnB,OAAO;gBACP,qBAAqB,CAAC,oBAAoB,CAAC;oBACzC,SAAS,EAAE,uBAAuB;iBACnC,CAAC,CAAC;YACL,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE;gBAC5C,GAAG,eAAe;gBAClB,YAAY,EAAE,KAAK,CAAC,OAAO;gBAC3B,gBAAgB,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;aAClD,CAAC,CAAC;YAEH,MAAM,eAAe,CAAC,yBAAyB,KAAK,CAAC,OAAO,EAAE,EAAE;gBAC9D,GAAG,OAAO;gBACV,qBAAqB,EACnB,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7E,QAAQ,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC/D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC"}
+{"version":3,"file":"yamlParser.js","sourceRoot":"","sources":["../../../src/utils/parsing/yamlParser.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAuB,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChG,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,MAAM,OAAO,GAAG,UAAU,CACxB,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EACvB,wDAAwD,CACzD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,OAAO,UAAU;IACrB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,KAAK,CAAC,KAAK,CAAc,UAAkB,EAAE,OAAwB;QACnE,IAAI,aAAa,GAAG,UAAU,CAAC;QAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAEhD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAC5C,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAEpC,MAAM,UAAU,GACd,OAAO;gBACP,qBAAqB,CAAC,oBAAoB,CAAC;oBACzC,SAAS,EAAE,uBAAuB;iBACnC,CAAC,CAAC;YACL,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE;oBACrD,GAAG,UAAU;oBACb,YAAY;iBACb,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,UAAU,CAAC,CAAC;YAChE,CAAC;YACD,aAAa,GAAG,YAAY,CAAC;QAC/B,CAAC;QAED,aAAa,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;QAErC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,eAAe,CACnB,iEAAiE,EACjE,OAAO,CACR,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;YAC7B,4EAA4E;YAC5E,oEAAoE;YACpE,gFAAgF;YAChF,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,CAAM,CAAC;QACvE,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5D,MAAM,eAAe,GACnB,OAAO;gBACP,qBAAqB,CAAC,oBAAoB,CAAC;oBACzC,SAAS,EAAE,uBAAuB;iBACnC,CAAC,CAAC;YACL,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE;gBAC5C,GAAG,eAAe;gBAClB,YAAY,EAAE,KAAK,CAAC,OAAO;gBAC3B,gBAAgB,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;aAClD,CAAC,CAAC;YAEH,MAAM,eAAe,CAAC,yBAAyB,KAAK,CAAC,OAAO,EAAE,EAAE;gBAC9D,GAAG,OAAO;gBACV,qBAAqB,EACnB,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7E,QAAQ,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC/D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyanheads/mcp-ts-core",
-  "version": "0.10.8",
+  "version": "0.10.10",
   "mcpName": "io.github.cyanheads/mcp-ts-core",
   "description": "Agent-native TypeScript framework for building MCP servers. Declarative definitions with auth, multi-backend storage, OpenTelemetry, and first-class support for Bun/Node/Cloudflare Workers.",
   "main": "dist/core/index.js",
@@ -10,6 +10,7 @@
     "dist/",
     "scripts/build-changelog.ts",
     "scripts/build.ts",
+    "scripts/check-dependency-specifiers.ts",
     "scripts/check-docs-sync.ts",
     "scripts/check-framework-antipatterns.ts",
     "scripts/check-skill-versions.ts",
@@ -192,13 +193,10 @@
     "release:github": "bun run scripts/release-github.ts",
     "publish-mcp": "mcp-publisher login github -token \"$(security find-generic-password -a \"$USER\" -s mcp-publisher-github-pat -w)\" && mcp-publisher publish"
   },
-  "resolutions": {
-    "js-yaml": "^4.2.0"
-  },
   "devDependencies": {
-    "@biomejs/biome": "2.5.0",
-    "@cloudflare/vitest-pool-workers": "^0.16.18",
-    "@cloudflare/workers-types": "4.20260619.1",
+    "@biomejs/biome": "2.5.1",
+    "@cloudflare/vitest-pool-workers": "^0.16.20",
+    "@cloudflare/workers-types": "4.20260630.1",
     "@duckdb/node-api": "^1.5.4-r.1",
     "@hono/otel": "^1.1.2",
     "@opentelemetry/exporter-metrics-otlp-http": "^0.219.0",
@@ -210,10 +208,9 @@
     "@opentelemetry/sdk-node": "^0.219.0",
     "@opentelemetry/sdk-trace-node": "^2.8.0",
     "@opentelemetry/semantic-conventions": "^1.41.1",
-    "@supabase/supabase-js": "^2.108.2",
+    "@supabase/supabase-js": "^2.109.0",
     "@types/bun": "^1.3.14",
-    "@types/js-yaml": "^4.0.9",
-    "@types/node": "26.0.0",
+    "@types/node": "26.0.1",
     "@types/papaparse": "^5.5.2",
     "@types/sanitize-html": "^2.16.1",
     "@types/validator": "^13.15.10",
@@ -223,29 +220,29 @@
     "bun-types": "^1.3.14",
     "chrono-node": "^2.9.1",
     "clipboardy": "^5.3.1",
-    "defuddle": "^0.19.0",
+    "defuddle": "^0.19.1",
     "depcheck": "^1.4.7",
     "diff": "^9.0.0",
     "execa": "^9.6.1",
     "fast-check": "^4.8.0",
     "fast-xml-parser": "^5.9.3",
     "ignore": "^7.0.5",
-    "js-yaml": "^4.2.0",
+    "js-yaml": "^5.2.0",
     "linkedom": "^0.18.12",
-    "node-cron": "^4.4.1",
-    "openai": "^6.44.0",
+    "node-cron": "^4.5.0",
+    "openai": "^6.45.0",
     "papaparse": "^5.5.4",
     "partial-json": "^0.1.7",
     "pdf-lib": "^1.17.1",
     "pino-pretty": "^13.1.3",
-    "repomix": "^1.15.0",
+    "repomix": "^1.16.0",
     "sanitize-html": "^2.17.5",
     "tsc-alias": "^1.8.17",
     "typedoc": "^0.28.19",
     "typescript": "^6.0.3",
     "unpdf": "^1.6.2",
     "validator": "^13.15.35",
-    "vite": "8.0.16",
+    "vite": "8.1.0",
     "vitest": "^4.1.9"
   },
   "keywords": [
@@ -298,12 +295,12 @@
   },
   "dependencies": {
     "@hono/mcp": "^0.3.0",
-    "@hono/node-server": "^2.0.5",
+    "@hono/node-server": "^2.0.6",
     "@modelcontextprotocol/ext-apps": "^1.7.4",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@opentelemetry/api": "^1.9.1",
     "dotenv": "^17.4.2",
-    "hono": "^4.12.26",
+    "hono": "^4.12.27",
     "jose": "^6.2.3",
     "pino": "^10.3.1",
     "zod": "^4.4.3"
@@ -328,7 +325,7 @@
     "fast-check": "^4.0.0",
     "vitest": ">=4.0.0",
     "fast-xml-parser": "^5.8.0",
-    "js-yaml": "^4.1.1",
+    "js-yaml": "^5.2.0",
     "linkedom": "^0.18.12",
     "node-cron": "^4.2.1",
     "openai": "^6.34.0",

package/scripts/check-dependency-specifiers.ts

@@ -0,0 +1,190 @@
+#!/usr/bin/env node
+/**
+ * @fileoverview Rejects floating dependency specifiers — `latest`, `*`, and
+ * pre-release dist-tags (`next`/`beta`/`canary`/`rc`) — in the manifests we
+ * control: `package.json`'s dependency sections and `bun.lock`'s `workspaces`
+ * specifier maps. `bun update --latest` bumps `package.json` to a caret range
+ * but writes the literal `latest` dist-tag into the lock's workspace map; the
+ * concrete resolution is correct at write time, so it clears every other gate
+ * and ships unnoticed, letting the next `bun install` re-resolve the dep past
+ * the `package.json` range and past any intentional version hold (#246).
+ *
+ * Section-specific rules — `peer`/`optional` may legitimately float to "any
+ * host version", so `*` and dist-tags are allowed there; `latest` never is:
+ *
+ *   | specifier                 | dependencies / devDependencies | peer / optional |
+ *   |---------------------------|:------------------------------:|:---------------:|
+ *   | latest                    | fail                           | fail            |
+ *   | *                         | fail                           | allow           |
+ *   | next / beta / canary / rc | fail                           | allow           |
+ *
+ * Only the `workspaces` section of `bun.lock` is inspected — the `packages`
+ * section records third-party packages' own nested declarations, which can
+ * legitimately be `latest`/`*` (e.g. a vendored `"@edge-runtime/vm": "*"`), so
+ * a naive whole-file grep false-positives on those. The lock is JSONC (trailing
+ * commas), so it is normalized before parsing.
+ *
+ * Shipped to consumers via `package.json` `files:` because `devcheck` invokes
+ * it. Runs standalone (`bun run scripts/check-dependency-specifiers.ts`) and as
+ * a devcheck step; no network, no git — runs in the default and `--fast` passes.
+ *
+ * @module scripts/check-dependency-specifiers
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import process from 'node:process';
+
+const ROOT = resolve('.');
+
+const DEP_SECTIONS = [
+  'dependencies',
+  'devDependencies',
+  'peerDependencies',
+  'optionalDependencies',
+] as const;
+type DepSection = (typeof DEP_SECTIONS)[number];
+
+/** Sections where a host project legitimately accepts "any version" (`*`/dist-tag). */
+const HOST_SECTIONS = new Set<DepSection>(['peerDependencies', 'optionalDependencies']);
+
+/** Pre-release dist-tags that float like `latest`, narrower in reach. */
+const FLOATING_DIST_TAGS = new Set(['next', 'beta', 'canary', 'rc']);
+
+interface Offender {
+  location: string;
+  name: string;
+  specifier: string;
+}
+
+type DepMap = Record<string, string>;
+type SectionedManifest = Partial<Record<DepSection, DepMap>>;
+
+/** A specifier floats if it can re-resolve to a different version over time. */
+function isFloating(specifier: string, section: DepSection): boolean {
+  const spec = specifier.trim();
+  if (spec === 'latest') return true; // never reproducible, in any section
+  if (HOST_SECTIONS.has(section)) return false; // `*` / dist-tags are legitimate here
+  return spec === '*' || FLOATING_DIST_TAGS.has(spec);
+}
+
+/** Scan the four dependency sections of one manifest object. */
+function scanManifest(manifest: SectionedManifest, label: string): Offender[] {
+  const offenders: Offender[] = [];
+  for (const section of DEP_SECTIONS) {
+    const deps = manifest[section];
+    if (!deps || typeof deps !== 'object') continue;
+    for (const [name, specifier] of Object.entries(deps)) {
+      if (typeof specifier === 'string' && isFloating(specifier, section)) {
+        offenders.push({ name, specifier, location: `${label} ${section}` });
+      }
+    }
+  }
+  return offenders;
+}
+
+/**
+ * Minimal JSONC → object parse: strips `//` and block comments and trailing
+ * commas while preserving string contents verbatim, then `JSON.parse`s.
+ * `bun.lock` is emitted with trailing commas, which strict `JSON.parse` rejects.
+ */
+function parseJsonc<T>(text: string): T {
+  let out = '';
+  let i = 0;
+  const n = text.length;
+  while (i < n) {
+    const ch = text[i] as string;
+    if (ch === '"') {
+      // Copy a string literal verbatim, honoring escapes.
+      out += ch;
+      i++;
+      while (i < n) {
+        const c = text[i] as string;
+        out += c;
+        if (c === '\\') {
+          out += text[i + 1] ?? '';
+          i += 2;
+          continue;
+        }
+        i++;
+        if (c === '"') break;
+      }
+      continue;
+    }
+    if (ch === '/' && text[i + 1] === '/') {
+      const nl = text.indexOf('\n', i);
+      if (nl === -1) break;
+      i = nl;
+      continue;
+    }
+    if (ch === '/' && text[i + 1] === '*') {
+      const end = text.indexOf('*/', i + 2);
+      i = end === -1 ? n : end + 2;
+      continue;
+    }
+    if (ch === ',') {
+      // Drop the comma when the next significant char closes an object/array.
+      let j = i + 1;
+      while (j < n && /\s/.test(text[j] as string)) j++;
+      if (text[j] === '}' || text[j] === ']') {
+        i++;
+        continue;
+      }
+    }
+    out += ch;
+    i++;
+  }
+  return JSON.parse(out) as T;
+}
+
+const offenders: Offender[] = [];
+
+// ── package.json (all four dependency sections) ──
+const pkgPath = resolve(ROOT, 'package.json');
+if (existsSync(pkgPath)) {
+  try {
+    offenders.push(
+      ...scanManifest(
+        JSON.parse(readFileSync(pkgPath, 'utf-8')) as SectionedManifest,
+        'package.json',
+      ),
+    );
+  } catch (err) {
+    console.error(`Failed to parse package.json: ${err instanceof Error ? err.message : err}`);
+    process.exit(2);
+  }
+}
+
+// ── bun.lock (workspaces specifier maps only — never the `packages` section) ──
+const lockPath = resolve(ROOT, 'bun.lock');
+if (existsSync(lockPath)) {
+  try {
+    const lock = parseJsonc<{ workspaces?: Record<string, SectionedManifest> }>(
+      readFileSync(lockPath, 'utf-8'),
+    );
+    for (const [ws, manifest] of Object.entries(lock.workspaces ?? {})) {
+      const label = ws === '' ? 'bun.lock workspaces[root]' : `bun.lock workspaces["${ws}"]`;
+      offenders.push(...scanManifest(manifest, label));
+    }
+  } catch (err) {
+    console.error(`Failed to parse bun.lock: ${err instanceof Error ? err.message : err}`);
+    process.exit(2);
+  }
+}
+
+if (offenders.length === 0) {
+  console.log('No floating dependency specifiers found.');
+  process.exit(0);
+}
+
+const lines = [
+  `${offenders.length} floating dependency specifier(s) found:`,
+  '',
+  ...offenders.map((o) => `  - ${o.name} → ${o.specifier} (${o.location})`),
+  '',
+  'Fix: pin to a concrete semver range (e.g. ^1.2.3). A `latest`/`*`/dist-tag',
+  'specifier lets `bun install` re-resolve the dep past the package.json range',
+  'and past any intentional hold. After `bun update --latest`, run a plain',
+  '`bun install` to reconcile bun.lock to the package.json ranges.',
+];
+console.error(lines.join('\n'));
+process.exit(1);

package/scripts/devcheck.ts

@@ -437,10 +437,16 @@ const ALL_CHECKS: Check[] = [
     flag: '--no-packaging',
     canFix: false,
     // Validates env var alignment between manifest.json (MCPB bundle) and
-    // server.json (MCP Registry). Skipped cleanly when manifest.json is absent
-    // — consumers who deleted it for an HTTP-only deploy are unaffected.
+    // server.json (MCP Registry), plus plugin marketplace manifests (#240).
+    // Runs when manifest.json OR any plugin manifest is present; skipped cleanly
+    // when none exist — consumers on an HTTP-only deploy are unaffected.
     getCommand: () => {
-      if (!existsSync(path.join(ROOT_DIR, 'manifest.json'))) return null;
+      const hasManifest = existsSync(path.join(ROOT_DIR, 'manifest.json'));
+      const hasPluginManifest =
+        existsSync(path.join(ROOT_DIR, '.claude-plugin/plugin.json')) ||
+        existsSync(path.join(ROOT_DIR, '.codex-plugin/plugin.json')) ||
+        existsSync(path.join(ROOT_DIR, '.codex-plugin/mcp.json'));
+      if (!hasManifest && !hasPluginManifest) return null;
       return ['bun', 'run', 'scripts/lint-packaging.ts'];
     },
     tip: (c) =>
@@ -458,6 +464,18 @@ const ALL_CHECKS: Check[] = [
     tip: (c) =>
       `Remove the flagged SDK-coupling shortcut. See ${c.bold('scripts/check-framework-antipatterns.ts')} for rule rationale.`,
   },
+  {
+    name: 'Dependency Specifiers',
+    flag: '--no-dep-specifiers',
+    canFix: false,
+    // Rejects floating specifiers (latest/*/dist-tags) in package.json + the
+    // bun.lock workspaces map (#246). Static and local — no network, no git —
+    // so it runs in the default and --fast passes. Shipped to consumers via
+    // package.json `files:`; reads package.json/bun.lock directly, no guard.
+    getCommand: () => ['bun', 'run', 'scripts/check-dependency-specifiers.ts'],
+    tip: (c) =>
+      `Pin the flagged dep to a concrete range; after ${c.bold('bun update --latest')} run a plain ${c.bold('bun install')} to reconcile ${c.bold('bun.lock')}.`,
+  },
   {
     name: 'Open-Indexed Interfaces',
     flag: '--no-open-index',

package/scripts/lint-packaging.ts

@@ -32,6 +32,15 @@
  *      `createWorkerHandler()` (src/index.ts, src/worker.ts) and manifest
  *      `display_name` must equal the unscoped package name; a partial
  *      `name`/`title` pair warns without failing (issue #231).
+ *  10. Plugin marketplace manifests (`.claude-plugin/plugin.json`,
+ *      `.codex-plugin/plugin.json`, `.codex-plugin/mcp.json`): non-empty
+ *      descriptions, and identity/install correctness — display fields
+ *      (`name`, server key, `interface.displayName`) carry the unscoped machine
+ *      name while the `npx -y` install arg carries the full `package.json`
+ *      name (scoped if scoped). An unscoped install arg for a scoped package
+ *      is a guaranteed install 404. Gated by `devcheck.config.json`
+ *      `packaging.pluginManifests` (default on); each manifest is skipped
+ *      cleanly when absent (issue #240).
  *
  * Every check skips cleanly when its input is absent — consumers who deleted
  * `manifest.json` for an HTTP-only deploy, or who haven't built a bundle,
@@ -374,6 +383,128 @@ export function checkManifestIdentity(manifest: Manifest, unscopedName: string):
   return [];
 }
 
+/** Parsed plugin marketplace manifests; an absent manifest is `undefined`. */
+export interface PluginManifestInputs {
+  claudePlugin?: unknown;
+  codexMcp?: unknown;
+  codexPlugin?: unknown;
+}
+
+const isRecord = (v: unknown): v is Record<string, unknown> => typeof v === 'object' && v !== null;
+const isNonEmptyString = (v: unknown): boolean => typeof v === 'string' && v.trim().length > 0;
+
+/** The `npx -y <pkg>` install target is the arg after the `-y` flag (args[1]). */
+function installArg(entry: Record<string, unknown>): unknown {
+  return Array.isArray(entry.args) ? entry.args[1] : undefined;
+}
+
+/**
+ * Check 10: plugin marketplace manifests. Display fields (`name`, server key,
+ * `interface.displayName`) must equal the unscoped machine name; the install
+ * arg must equal the full `package.json` name (the real `npx` target). Empty
+ * descriptions ship blank marketplace cards. Each manifest is validated only
+ * when present, so HTTP-only and non-plugin consumers are unaffected. The
+ * caller gates the whole check on `packaging.pluginManifests`.
+ */
+export function checkPluginManifests(
+  inputs: PluginManifestInputs,
+  unscopedName: string,
+  fullName: string,
+): string[] {
+  const errors: string[] = [];
+  const optOut =
+    '(or set "packaging": { "pluginManifests": false } in devcheck.config.json to opt out)';
+
+  // ── .claude-plugin/plugin.json ──
+  const claude = inputs.claudePlugin;
+  if (isRecord(claude)) {
+    const f = '.claude-plugin/plugin.json';
+    if (!isNonEmptyString(claude.description)) {
+      errors.push(`${f} "description" is empty — populate it ${optOut}`);
+    }
+    if (claude.name !== unscopedName) {
+      errors.push(
+        `${f} "name" is "${String(claude.name)}" — must equal the unscoped package name "${unscopedName}"`,
+      );
+    }
+    const servers = claude.mcpServers;
+    if (isRecord(servers)) {
+      if (!(unscopedName in servers)) {
+        errors.push(
+          `${f} mcpServers has no "${unscopedName}" entry — the server key must be the unscoped package name`,
+        );
+      }
+      const entry = servers[unscopedName];
+      if (isRecord(entry) && installArg(entry) !== fullName) {
+        errors.push(
+          `${f} mcpServers["${unscopedName}"] install arg is "${String(installArg(entry))}" — ` +
+            `must be the full package name "${fullName}" (the npx -y target; an unscoped arg for a scoped package 404s)`,
+        );
+      }
+    }
+  }
+
+  // ── .codex-plugin/plugin.json ──
+  const codex = inputs.codexPlugin;
+  if (isRecord(codex)) {
+    const f = '.codex-plugin/plugin.json';
+    if (!isNonEmptyString(codex.description)) {
+      errors.push(`${f} "description" is empty — populate it ${optOut}`);
+    }
+    if (codex.name !== unscopedName) {
+      errors.push(
+        `${f} "name" is "${String(codex.name)}" — must equal the unscoped package name "${unscopedName}"`,
+      );
+    }
+    const iface = codex.interface;
+    if (isRecord(iface)) {
+      if (iface.displayName !== unscopedName) {
+        errors.push(
+          `${f} interface.displayName is "${String(iface.displayName)}" — must equal the unscoped package name "${unscopedName}"`,
+        );
+      }
+      if (!isNonEmptyString(iface.shortDescription)) {
+        errors.push(`${f} interface.shortDescription is empty — populate it ${optOut}`);
+      }
+      if (!isNonEmptyString(iface.longDescription)) {
+        errors.push(`${f} interface.longDescription is empty — populate it ${optOut}`);
+      }
+    } else {
+      errors.push(
+        `${f} is missing the "interface" object (displayName / shortDescription / longDescription)`,
+      );
+    }
+  }
+
+  // ── .codex-plugin/mcp.json ──
+  const codexMcp = inputs.codexMcp;
+  if (isRecord(codexMcp)) {
+    const f = '.codex-plugin/mcp.json';
+    if (!(unscopedName in codexMcp)) {
+      errors.push(
+        `${f} has no "${unscopedName}" server entry — the server key must be the unscoped package name`,
+      );
+    }
+    const entry = codexMcp[unscopedName];
+    if (isRecord(entry) && installArg(entry) !== fullName) {
+      errors.push(
+        `${f} "${unscopedName}" install arg is "${String(installArg(entry))}" — ` +
+          `must be the full package name "${fullName}" (the npx -y target)`,
+      );
+    }
+  }
+
+  return errors;
+}
+
+/** Read `packaging.pluginManifests` from devcheck.config.json; default on. */
+function pluginManifestsEnabled(): boolean {
+  const cfg = tryReadJson<{ packaging?: { pluginManifests?: boolean } }>(
+    resolve('devcheck.config.json'),
+  );
+  return cfg?.packaging?.pluginManifests ?? true;
+}
+
 async function main(): Promise<void> {
   const errors: string[] = [];
   const warnings: string[] = [];
@@ -496,6 +627,27 @@ async function main(): Promise<void> {
     }
   }
 
+  // ── Plugin marketplace manifests (check 10) ──
+  if (unscopedName && pkg?.name) {
+    if (pluginManifestsEnabled()) {
+      errors.push(
+        ...checkPluginManifests(
+          {
+            claudePlugin: tryReadJson(resolve('.claude-plugin/plugin.json')),
+            codexPlugin: tryReadJson(resolve('.codex-plugin/plugin.json')),
+            codexMcp: tryReadJson(resolve('.codex-plugin/mcp.json')),
+          },
+          unscopedName,
+          pkg.name,
+        ),
+      );
+    } else {
+      notes.push(
+        'Plugin-manifest checks disabled via devcheck.config.json packaging.pluginManifests.',
+      );
+    }
+  }
+
   for (const note of notes) console.log(note);
   for (const warning of warnings) console.warn(`  ⚠ ${warning}`);
 

package/skills/api-utils/references/parsing.md

@@ -23,7 +23,7 @@ All parsers are **Tier 3** — lazy-load their peer dependency on first call. Al
 |:-------|:----------|
 | `parse` | `<T = unknown>(yamlString, context?) -> Promise<T>` |
 
-Uses `js-yaml` `DEFAULT_SCHEMA`. Throws `ConfigurationError` if dep missing, `ValidationError` on empty/malformed input.
+Uses `js-yaml` (v5) `YAML11_SCHEMA` (YAML 1.1 load semantics). Throws `ConfigurationError` if dep missing, `ValidationError` on empty/malformed input.
 
 ```ts
 const config = await yamlParser.parse<ServerConfig>(yamlString);

package/skills/polish-docs-meta/SKILL.md

@@ -4,7 +4,7 @@ description: >
   Finalize documentation and project metadata for a ship-ready MCP server. Use after implementation is complete, tests pass, and devcheck is clean. Safe to run at any stage — each step checks current state and only acts on what still needs work.
 metadata:
   author: cyanheads
-  version: "2.8"
+  version: "2.9"
   audience: external
   type: workflow
 ---
@@ -169,20 +169,22 @@ Never hand-edit `CHANGELOG.md` when using this pattern — it's a build artifact
 
 ### 10. Plugin Metadata (Codex / Claude Code)
 
+`lint:packaging` (run by `devcheck`) now enforces the high-value subset automatically when these manifests are present: non-empty descriptions, and identity/install correctness — display fields (`name`, server key, `interface.displayName`) must be the **unscoped** machine name, while the `npx -y` install arg must be the full `package.json` `name` (scoped if scoped). Opt out per project with `"packaging": { "pluginManifests": false }` in `devcheck.config.json`. The checks below cover the fields the gate doesn't (version / repository / license sync, category, env vars).
+
 If `.codex-plugin/plugin.json` exists, verify it's populated and in sync with `package.json` and `server.json`:
 
-- `name` matches `package.json` `name`
+- `name` is the unscoped `package.json` `name` (display identity is the machine name on every surface)
 - `version` matches `package.json` `version`
 - `description` matches `package.json` `description`
 - `repository` matches `package.json` `repository.url`
 - `license` matches `package.json` `license`
-- `interface.displayName` = `package.json` `name`
+- `interface.displayName` is the unscoped `package.json` `name`
 - `interface.shortDescription` matches `package.json` `description`
 - `interface.category` is set to a meaningful category
 
-If `.codex-plugin/mcp.json` exists, verify the server name key matches `package.json` `name` and env vars include any required API keys from the server config schema.
+If `.codex-plugin/mcp.json` exists, verify the server-name key is the unscoped `package.json` `name`, the `npx -y` install arg is the full `package.json` `name`, and env vars include any required API keys from the server config schema.
 
-If `.claude-plugin/plugin.json` exists, apply the same checks: `name`, `version`, `description`, `repository`, `license` from `package.json`. Verify the inline `mcpServers` entry key matches `package.json` `name` and env vars include any required API keys.
+If `.claude-plugin/plugin.json` exists, apply the same checks: `name` (unscoped), `version`, `description`, `repository`, `license` from `package.json`. Verify the inline `mcpServers` entry key is the unscoped name, its `npx -y` install arg is the full `package.json` `name`, and env vars include any required API keys.
 
 ### 11. MCPB Bundling Artifacts
 

package/skills/polish-docs-meta/references/readme.md

@@ -21,7 +21,6 @@ Framework badge                         ← solo spotlight row — `Built on @cy
 ## Running the server                   ← dev, production, Workers/Docker
 ## Project structure                    ← directory/purpose table
 ## Development guide                    ← link to CLAUDE.md/AGENTS.md, key rules
-## Contributing                         ← brief
 ## License                              ← one line
 ```
 
@@ -484,19 +483,6 @@ See [`CLAUDE.md`/`AGENTS.md`](./CLAUDE.md) for development guidelines and archit
 - Wrap external API calls: validate raw → normalize to domain type → return output schema; never fabricate missing fields
 ```
 
-### Contributing
-
-```markdown
-## Contributing
-
-Issues and pull requests are welcome. Run checks and tests before submitting:
-
-\`\`\`sh
-bun run devcheck
-bun run test
-\`\`\`
-```
-
 ### License
 
 One line referencing the LICENSE file.

package/templates/devcheck.config.json

@@ -12,5 +12,8 @@
   },
   "outdated": {
     "allowlist": []
+  },
+  "packaging": {
+    "pluginManifests": true
   }
 }

package/dist/logs/combined.log

@@ -1,8 +0,0 @@
-{"level":40,"time":1781913320360,"env":"testing","version":"0.10.8","pid":20168,"transport":"http","requestId":"WSD7Y-6FNIU","timestamp":"2026-06-19T23:55:20.360Z","operation":"TransportManager.start","component":"HttpTransportSetup","msg":"MCP_ALLOWED_ORIGINS is not set — CORS is wildcard for CLI clients; browser Origin headers are restricted to loopback. Set MCP_ALLOWED_ORIGINS for production deployments accepting remote browser origins."}
-{"level":40,"time":1781913322185,"env":"testing","version":"0.10.8","pid":20168,"component":"HttpTransport","requestId":"Y3XD8-YV6FO","timestamp":"2026-06-19T23:55:22.184Z","operation":"HttpRpcRequest","sessionId":"not-a-real-session-1781913322182","msg":"Session validation failed - invalid or hijacked session"}
-{"level":50,"time":1781913329461,"env":"testing","version":"0.0.0-test","pid":20387,"requestId":"5JUEU-0VDJE","timestamp":"2026-06-19T23:55:29.461Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"da08fbd6c9656cf3f0b23b60935dfa84e7923c134e40b457be98bda811ed2efc","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"da08fbd6c9656cf3f0b23b60935dfa84e7923c134e40b457be98bda811ed2efc","toolName":"scoped_echo","requestId":"5JUEU-0VDJE","timestamp":"2026-06-19T23:55:29.461Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n    at forbidden (file:///Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:54)\n    at withRequiredScopes (file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n    at file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:283:17\n    at McpServer.executeToolHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:233:42)\n    at file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43\n    at async wrappedHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js:125:32)"},"stack":"McpError: Insufficient permissions.\n    at ErrorHandler.handleError (file:///Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:19)\n    at file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:332:26\n    at McpServer.executeToolHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:233:42)\n    at file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43\n    at async wrappedHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js:125:32)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
-{"level":50,"time":1781913329472,"env":"testing","version":"0.0.0-test","pid":20387,"requestId":"R7MGX-J7GDG","timestamp":"2026-06-19T23:55:29.472Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"d784c7b4dd86d4f145dee03c30c3a68ae51a8606097461f46ebb719cfd85d619","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"d784c7b4dd86d4f145dee03c30c3a68ae51a8606097461f46ebb719cfd85d619","toolName":"scoped_echo","requestId":"R7MGX-J7GDG","timestamp":"2026-06-19T23:55:29.472Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n    at forbidden (file:///Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:54)\n    at withRequiredScopes (file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n    at file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:283:17\n    at McpServer.executeToolHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:233:42)\n    at file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43\n    at async wrappedHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js:125:32)"},"stack":"McpError: Insufficient permissions.\n    at ErrorHandler.handleError (file:///Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:19)\n    at file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:332:26\n    at McpServer.executeToolHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:233:42)\n    at file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43\n    at async wrappedHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js:125:32)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
-{"level":40,"time":1781913343027,"env":"testing","version":"0.10.8","pid":20630,"transport":"http","requestId":"GF046-IMNJH","timestamp":"2026-06-19T23:55:43.027Z","operation":"TransportManager.start","component":"HttpTransportSetup","msg":"MCP_ALLOWED_ORIGINS is not set — CORS is wildcard for CLI clients; browser Origin headers are restricted to loopback. Set MCP_ALLOWED_ORIGINS for production deployments accepting remote browser origins."}
-{"level":40,"time":1781913344790,"env":"testing","version":"0.10.8","pid":20630,"component":"HttpTransport","requestId":"Z5YGA-X0LTR","timestamp":"2026-06-19T23:55:44.790Z","operation":"HttpRpcRequest","sessionId":"not-a-real-session-1781913344790","msg":"Session validation failed - invalid or hijacked session"}
-{"level":50,"time":1781913345263,"env":"testing","version":"0.0.0-test","pid":20668,"requestId":"4BROD-WQSCR","timestamp":"2026-06-19T23:55:45.262Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"25c684941147a157673abe23c7519112dbe02be9c0262c28478ff1fc436ebf1b","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"25c684941147a157673abe23c7519112dbe02be9c0262c28478ff1fc436ebf1b","toolName":"scoped_echo","requestId":"4BROD-WQSCR","timestamp":"2026-06-19T23:55:45.262Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n    at forbidden (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:58)\n    at withRequiredScopes (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:283:17)\n    at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n    at processTicksAndRejections (native:7:39)"},"stack":"McpError: Insufficient permissions.\n    at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:332:26)\n    at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n    at processTicksAndRejections (native:7:39)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
-{"level":50,"time":1781913345270,"env":"testing","version":"0.0.0-test","pid":20668,"requestId":"3OCQP-0V3O2","timestamp":"2026-06-19T23:55:45.270Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"10e3337a2b2dbc0eb5bf700bf8e875b1b829ebb783a65abcf06d9ffbf3006536","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"10e3337a2b2dbc0eb5bf700bf8e875b1b829ebb783a65abcf06d9ffbf3006536","toolName":"scoped_echo","requestId":"3OCQP-0V3O2","timestamp":"2026-06-19T23:55:45.270Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n    at forbidden (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:58)\n    at withRequiredScopes (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:283:17)\n    at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n    at processTicksAndRejections (native:7:39)"},"stack":"McpError: Insufficient permissions.\n    at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:332:26)\n    at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n    at processTicksAndRejections (native:7:39)","msg":"Error in tool:scoped_echo: Insufficient permissions."}

package/dist/logs/error.log

@@ -1,4 +0,0 @@
-{"level":50,"time":1781913329461,"env":"testing","version":"0.0.0-test","pid":20387,"requestId":"5JUEU-0VDJE","timestamp":"2026-06-19T23:55:29.461Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"da08fbd6c9656cf3f0b23b60935dfa84e7923c134e40b457be98bda811ed2efc","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"da08fbd6c9656cf3f0b23b60935dfa84e7923c134e40b457be98bda811ed2efc","toolName":"scoped_echo","requestId":"5JUEU-0VDJE","timestamp":"2026-06-19T23:55:29.461Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n    at forbidden (file:///Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:54)\n    at withRequiredScopes (file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n    at file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:283:17\n    at McpServer.executeToolHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:233:42)\n    at file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43\n    at async wrappedHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js:125:32)"},"stack":"McpError: Insufficient permissions.\n    at ErrorHandler.handleError (file:///Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:19)\n    at file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:332:26\n    at McpServer.executeToolHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:233:42)\n    at file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43\n    at async wrappedHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js:125:32)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
-{"level":50,"time":1781913329472,"env":"testing","version":"0.0.0-test","pid":20387,"requestId":"R7MGX-J7GDG","timestamp":"2026-06-19T23:55:29.472Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"d784c7b4dd86d4f145dee03c30c3a68ae51a8606097461f46ebb719cfd85d619","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"d784c7b4dd86d4f145dee03c30c3a68ae51a8606097461f46ebb719cfd85d619","toolName":"scoped_echo","requestId":"R7MGX-J7GDG","timestamp":"2026-06-19T23:55:29.472Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n    at forbidden (file:///Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:54)\n    at withRequiredScopes (file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n    at file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:283:17\n    at McpServer.executeToolHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:233:42)\n    at file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43\n    at async wrappedHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js:125:32)"},"stack":"McpError: Insufficient permissions.\n    at ErrorHandler.handleError (file:///Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:19)\n    at file:///Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:332:26\n    at McpServer.executeToolHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:233:42)\n    at file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43\n    at async wrappedHandler (file:///Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js:125:32)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
-{"level":50,"time":1781913345263,"env":"testing","version":"0.0.0-test","pid":20668,"requestId":"4BROD-WQSCR","timestamp":"2026-06-19T23:55:45.262Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"25c684941147a157673abe23c7519112dbe02be9c0262c28478ff1fc436ebf1b","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"25c684941147a157673abe23c7519112dbe02be9c0262c28478ff1fc436ebf1b","toolName":"scoped_echo","requestId":"4BROD-WQSCR","timestamp":"2026-06-19T23:55:45.262Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["tool:other:read"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n    at forbidden (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:58)\n    at withRequiredScopes (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:283:17)\n    at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n    at processTicksAndRejections (native:7:39)"},"stack":"McpError: Insufficient permissions.\n    at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:332:26)\n    at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n    at processTicksAndRejections (native:7:39)","msg":"Error in tool:scoped_echo: Insufficient permissions."}
-{"level":50,"time":1781913345270,"env":"testing","version":"0.0.0-test","pid":20668,"requestId":"3OCQP-0V3O2","timestamp":"2026-06-19T23:55:45.270Z","operation":"HandleToolRequest","critical":false,"errorCode":-32005,"originalErrorType":"McpError","finalErrorType":"McpError","sessionId":"10e3337a2b2dbc0eb5bf700bf8e875b1b829ebb783a65abcf06d9ffbf3006536","toolName":"scoped_echo","tenantId":"authz-tenant","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"errorData":{"sessionId":"10e3337a2b2dbc0eb5bf700bf8e875b1b829ebb783a65abcf06d9ffbf3006536","toolName":"scoped_echo","requestId":"3OCQP-0V3O2","timestamp":"2026-06-19T23:55:45.270Z","tenantId":"authz-tenant","operation":"HandleToolRequest","auth":{"sub":"authz-user","scopes":["openid","email","profile","offline_access"],"clientId":"authz-client","tenantId":"authz-tenant","token":"[REDACTED]"},"originalErrorName":"McpError","originalMessage":"Insufficient permissions.","originalStack":"McpError: Insufficient permissions.\n    at forbidden (/Users/casey/Developer/github/mcp-ts-core/dist/types-global/errors.js:84:58)\n    at withRequiredScopes (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/transports/auth/lib/authUtils.js:68:15)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:283:17)\n    at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n    at processTicksAndRejections (native:7:39)"},"stack":"McpError: Insufficient permissions.\n    at handleError (/Users/casey/Developer/github/mcp-ts-core/dist/utils/internal/error-handler/errorHandler.js:170:23)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/dist/mcp-server/tools/utils/toolHandlerFactory.js:332:26)\n    at executeToolHandler (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:231:34)\n    at <anonymous> (/Users/casey/Developer/github/mcp-ts-core/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js:126:43)\n    at processTicksAndRejections (native:7:39)","msg":"Error in tool:scoped_echo: Insufficient permissions."}