@finchagentic/mcp 4.7.1 → 4.7.3

package/dist/config.js

@@ -88,8 +88,9 @@ function writeConfig(patch) {
     fs.writeFileSync(CONFIG_FILE, JSON.stringify(updated, null, 2), { mode: 0o600 });
 }
 function getSavedToken() {
-    // env var always wins over saved config
-    return env("FINCH_SESSION_TOKEN", "FINCH_SESSION_TOKEN") ?? readConfig().sessionToken;
+    // FINCH_API_KEY (persistent finch_sk_* key) wins - MCP clients should hold
+    // a key, not a session token that expires and silently disconnects them.
+    return process.env.FINCH_API_KEY ?? env("FINCH_SESSION_TOKEN", "FINCH_SESSION_TOKEN") ?? readConfig().sessionToken;
 }
 /** Accept finch_sk_* (new) and noel_sk_* (backend still issues these). */
 function isApiKey(value) {

package/dist/enrichment-router.js

@@ -1,22 +1,9 @@
 "use strict";
-// Generalized enrichment router for deep_research synthesis.
-//
-// Old behavior: Firecrawl scraped 5–10 pages and the LLM synthesized. When
-// pages were thin or outdated, the LLM filled gaps with plausible fiction.
-//
-// New behavior: detect the topic domain and hit primary-source APIs in
-// parallel before synthesis. Inject results as "AUTHORITATIVE LIVE DATA"
-// the LLM is instructed to lead with.
-//
-// All APIs used here are free, public, no auth required:
-//   - DefiLlama, CoinGecko (crypto)
-//   - HackerNews Algolia (tech news, ~real-time)
-//   - GitHub search (repos, no auth needed for public read)
-//   - arXiv (academic papers)
-//   - Wikipedia REST (foundational facts)
-//
-// All calls are best-effort with short timeouts - if any fail, the
-// synthesis runs without that block.
+// Enrichment router for deep_research synthesis - detects topic domain and
+// hits free primary-source APIs in parallel (DefiLlama/CoinGecko, HN
+// Algolia, GitHub search, arXiv, Wikipedia), injected as "AUTHORITATIVE
+// LIVE DATA" so the LLM leads with real data instead of filling thin
+// scraped pages with plausible fiction. Best-effort, short timeouts.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.enrichQuery = enrichQuery;
 exports.todayContext = todayContext;

package/dist/finch-output.js

@@ -1,4 +1,8 @@
 "use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatMoney = formatMoney;
+exports.truncate = truncate;
+exports.processResponse = processResponse;
 /**
  * Output quality post-processor (CallTool choke point).
  * Normalizes every tool response before it reaches the client:
@@ -10,38 +14,35 @@
  *      shapes - the client renders those natively.
  */
 const MAX_LINES = 200;
-
-const MONEY_RE = /\$\s?([\d,]+\.\d{4,})/g;   // $0.00012345 -> $0.00012 (4dp cap)
-const ZEROS_RE = /\$0\.0+\d{0,2}(?=\b)/g;       // leave tiny prices alone
-
+const MONEY_RE = /\$\s?([\d,]+\.\d{4,})/g; // $0.00012345 -> $0.00012 (4dp cap)
 function formatMoney(text) {
-  // Cap runaway precision: $0.00345678 -> $0.00346. Keeps tokens readable.
-  return text.replace(MONEY_RE, (m, num) => {
-    const n = Number(num.replace(/,/g, ""));
-    if (!Number.isFinite(n)) return m;
-    const trimmed = n.toFixed(4).replace(/0+$/, "").replace(/\.$/, "");
-    return `$${trimmed}`;
-  });
+    // Cap runaway precision: $0.00345678 -> $0.00346. Keeps tokens readable.
+    return text.replace(MONEY_RE, (m, num) => {
+        const n = Number(num.replace(/,/g, ""));
+        if (!Number.isFinite(n))
+            return m;
+        const trimmed = n.toFixed(4).replace(/0+$/, "").replace(/\.$/, "");
+        return `$${trimmed}`;
+    });
 }
-
 function truncate(text) {
-  const lines = text.split("\n");
-  if (lines.length <= MAX_LINES) return text;
-  const head = lines.slice(0, MAX_LINES).join("\n");
-  return `${head}\n\n… ${lines.length - MAX_LINES} more lines — narrow your query (smaller limit, fewer fields) for the full output.`;
+    const lines = text.split("\n");
+    if (lines.length <= MAX_LINES)
+        return text;
+    const head = lines.slice(0, MAX_LINES).join("\n");
+    return `${head}\n\n… ${lines.length - MAX_LINES} more lines — narrow your query (smaller limit, fewer fields) for the full output.`;
 }
-
 function processResponse(response) {
-  if (!response || response.isError) return response;
-  const first = response.content?.[0];
-  if (!first || first.type !== "text" || typeof first.text !== "string") return response;
-  let text = first.text;
-  text = formatMoney(text);
-  text = truncate(text);
-  if (text !== first.text) {
-    return { ...response, content: [{ ...first, text }] };
-  }
-  return response;
+    if (!response || response.isError)
+        return response;
+    const first = response.content?.[0];
+    if (!first || first.type !== "text" || typeof first.text !== "string")
+        return response;
+    let text = first.text;
+    text = formatMoney(text);
+    text = truncate(text);
+    if (text !== first.text) {
+        return { ...response, content: [{ ...first, text }, ...response.content.slice(1)] };
+    }
+    return response;
 }
-
-module.exports = { processResponse, formatMoney, truncate };

package/dist/finch-status.js

@@ -1,37 +1,96 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FINCH_STATUS_TOOL = void 0;
+exports.handleFinchStatus = handleFinchStatus;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
 const config_js_1 = require("./config.js");
 const convex_js_1 = require("./convex.js");
+// Same pattern as server.ts's own PKG_VERSION - fs.readFileSync, not
+// require(), since this project's eslint config forbids require() imports.
+function readPkgVersion() {
+    try {
+        const raw = fs.readFileSync(path.join(__dirname, "..", "package.json"), "utf8");
+        return JSON.parse(raw).version ?? "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+}
+// Local-only, no-auth-required status check. Replaces the old finch_status
+// (which lived in tools/os.ts, made 6 Promise.allSettled backend calls, and
+// silently defaulted every field to zero/basic on ANY failure - including a
+// 401 - producing a dashboard that read "empty but healthy" instead of
+// surfacing the real problem). This version makes exactly ONE cheap authed
+// call when a token is configured, and reports the REAL auth state instead.
 exports.FINCH_STATUS_TOOL = {
     name: "finch_status",
-    description: "Check Finch MCP is working - no sign-in needed. Returns the version, how many tools are available, whether the session token is configured, and a ready-to-paste MCP client config snippet. Run this FIRST if anything feels off: it tells you instantly whether the problem is auth (missing token), network (backend unreachable), or the tool itself.",
+    description: "Check Finch MCP is working - no sign-in needed. Returns the version, how many tools are available, " +
+        "whether the session token is configured, and a ready-to-paste MCP client config snippet. Run this FIRST " +
+        "if anything feels off: it tells you instantly whether the problem is auth (missing token), network " +
+        "(backend unreachable), or the tool itself.",
     inputSchema: { type: "object", properties: {}, additionalProperties: false },
     annotations: { title: "Finch status", readOnlyHint: true, openWorldHint: false },
 };
-
-// `finch_status` handler - never throws on auth; when a token is configured
-// it makes ONE cheap authed call (/memory/profile) and reports the REAL
-// auth state instead of a fake-healthy dashboard (the old Promise.allSettled
-// version swallowed 401s and showed empty-but-healthy, which hid expired
-// credentials entirely).
-exports.handleFinchStatus = async function handleFinchStatus() {
-    const pkg = require("./../package.json");
+async function handleFinchStatus(toolCount) {
+    const version = readPkgVersion();
     let tokenSet = false;
     let authState = "none";
     let authDetail = "";
     try {
         tokenSet = Boolean((0, config_js_1.getSavedToken)());
-    } catch { tokenSet = false; }
+    }
+    catch {
+        tokenSet = false;
+    }
     if (tokenSet) {
         try {
             const data = await (0, convex_js_1.callConvex)("/memory/profile", "GET", undefined, "finch_status", 8000, true);
             authState = (data?.status === "ok") ? "valid" : "rejected";
-            if (authState === "rejected") authDetail = "the session token was rejected by the backend - re-copy it from app.finchagentic.com";
-        } catch (err) {
+            if (authState === "rejected") {
+                authDetail = "the session token was rejected by the backend - re-copy it from app.finchagentic.com";
+            }
+        }
+        catch (err) {
             const msg = String(err?.message ?? err);
             if (msg.includes("Authentication required")) {
                 authState = "invalid";
                 authDetail = "the backend rejected the token as expired or invalid - re-copy it from app.finchagentic.com";
-            } else {
+            }
+            else {
                 authState = "unreachable";
                 authDetail = msg.slice(0, 120);
             }
@@ -41,41 +100,47 @@ exports.handleFinchStatus = async function handleFinchStatus() {
         mcpServers: {
             finch: {
                 command: "npx",
-                args: ["-y", "@finchagentic/mcp@" + pkg.version],
+                args: ["-y", `@finchagentic/mcp@${version}`],
                 env: { FINCH_SESSION_TOKEN: "<your token>" },
             },
         },
     }, null, 2);
     const lines = tokenSet && authState === "valid"
         ? [
-            "**Finch MCP v" + pkg.version + "** - runtime layer for agentic AI", "",
-            "- Session token: \u2705 valid (verified against the backend)",
-            "- Tools: **116** registered (surface depends on FINCH_TOOLS filter)",
+            `**Finch MCP v${version}** - runtime layer for agentic AI`,
+            "",
+            "- Session token: ✅ valid (verified against the backend)",
+            `- Tools: **${toolCount}** registered (surface depends on FINCH_TOOLS filter)`,
             "- Resources: finch://vault/<key> - Prompts: crypto-thesis and friends",
             "- Tool presets: FINCH_PRESET=core|defi|research|memory (default core) - FINCH_TOOLS=all for everything",
             "",
-            "All set. Good first calls: `memory_add` (persist a note instantly), `get_market` (live prices), `deep_research` (multi-step reports, streaming progress).",
+            "All set. Good first calls: `memory_add` (persist a note instantly), `get_market_data` (live prices), `deep_research` (multi-step reports, streaming progress).",
         ]
         : tokenSet
-        ? [
-            "**Finch MCP v" + pkg.version + "** - runtime layer for agentic AI", "",
-            `- Session token: \u26a0\ufe0f configured but **${authState}**`,
-            authDetail ? `- ${authDetail}` : "",
-            "- Tools are registered, but every backend-backed call will fail until the token is replaced.",
-            "",
-            "**Fix:** re-copy a fresh token from app.finchagentic.com, update FINCH_SESSION_TOKEN in your MCP config, restart the client.",
-        ]
-        : [
-            "**Finch MCP v" + pkg.version + "** - runtime layer for agentic AI", "",
-            "- Session token: \u274c not set", "",
-            "**To sign in (60 seconds):**", "",
-            "1. Sign in at https://app.finchagentic.com (wallet or Google)",
-            "2. Copy your session token from the app",
-            "3. Add to your MCP client config:",
-            "```json",
-            configJson,
-            "```", "",
-            "Once the token is set, restart the MCP client and re-run this tool.",
-        ];
-    return { content: [{ type: "text", text: lines.join("\n") }] };
-};
+            ? [
+                `**Finch MCP v${version}** - runtime layer for agentic AI`,
+                "",
+                `- Session token: ⚠️ configured but **${authState}**`,
+                authDetail ? `- ${authDetail}` : "",
+                "- Tools are registered, but every backend-backed call will fail until the token is replaced.",
+                "",
+                "**Fix:** re-copy a fresh token from app.finchagentic.com, update FINCH_SESSION_TOKEN in your MCP config, restart the client.",
+            ]
+            : [
+                `**Finch MCP v${version}** - runtime layer for agentic AI`,
+                "",
+                "- Session token: ❌ not set",
+                "",
+                "**To sign in (60 seconds):**",
+                "",
+                "1. Sign in at https://app.finchagentic.com (wallet or Google)",
+                "2. Copy your session token from the app",
+                "3. Add to your MCP client config:",
+                "```json",
+                configJson,
+                "```",
+                "",
+                "Once the token is set, restart the MCP client and re-run this tool.",
+            ];
+    return { content: [{ type: "text", text: lines.filter((l) => l !== undefined).join("\n") }] };
+}

package/dist/local-vault.js

@@ -54,18 +54,11 @@ const path = __importStar(require("path"));
 const crypto = __importStar(require("crypto"));
 const config_js_1 = require("./config.js");
 const _text_search_js_1 = require("./_text-search.js");
-// Fully-local, user-owned Noel-Vault backend. Mirrors the two-tier pattern of
-// local-memory.ts: when the user opts in (`vaultBackend: "local"`), the vault
-// tools store versioned artifacts on the user's own disk under
-// ~/.finch/vault/ - no Finch account, no Convex, no network, no cost to
-// the platform. Zero runtime dependencies (plain JSON + one content file per
-// version), same spirit as codebase-memory-mcp's local-first SQLite store.
-//
-// Every exported function returns objects shaped like the Convex /vault/*
-// responses so tools/vault.ts can swap the data source with a one-line branch
-// and reuse all of its existing rendering. Not-found cases THROW an Error whose
-// message contains "not found", matching how callConvex surfaces a 404 (the
-// vault handlers already catch and format that).
+// Fully-local, user-owned vault backend (`vaultBackend: "local"`) - versioned
+// artifacts on disk under ~/.finch/vault/, no account/Convex/network. Every
+// export returns Convex /vault/*-shaped objects so tools/vault.ts can swap
+// data source with a one-line branch. Not-found throws an Error containing
+// "not found", matching callConvex's own 404 format.
 const VAULT_DIR = path.join(os.homedir(), ".finch", "vault");
 // Local vault is enabled purely by config - it needs no server, just the
 // filesystem. Returns null (→ "use Convex") when the user hasn't opted in.

package/dist/output-schemas.js

@@ -1,17 +1,8 @@
 "use strict";
 // Central registry of MCP tool `outputSchema` declarations (spec 2025-06-18).
-//
-// A tool that declares an outputSchema SHOULD also return `structuredContent`
-// conforming to it (its handler does; the human-readable `content` text stays
-// for backward compatibility). Keeping every schema in one file - rather than
-// inline on each tool definition across ~25 modules - makes the machine-readable
-// surface reviewable in one place, mirrors how annotations.ts centralises
-// behavioural hints, and lets a new tool opt in by adding one entry here plus a
-// structuredContent return in its handler (no tool-definition edit needed).
-//
-// Attached to the listed tools by withAnnotations() (annotations.ts) at
-// tools/list time. Only tools whose handler genuinely emits matching
-// structuredContent belong here.
+// One file instead of inline per tool (mirrors annotations.ts). Attached by
+// withAnnotations() at tools/list time - only tools whose handler actually
+// emits matching structuredContent belong here.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OUTPUT_SCHEMAS = void 0;
 const number_null = { type: ["number", "null"] };

package/dist/project.js

@@ -4,19 +4,10 @@ exports.isLocalVaultActive = isLocalVaultActive;
 exports.resolveProjectId = resolveProjectId;
 const convex_js_1 = require("./convex.js");
 const local_vault_js_1 = require("./local-vault.js");
-// MCP has no persistent "active project" UI state the way the webapp Sidebar
-// switcher does - a caller (vault_save, agent_spawn) names the project it
-// wants by string on each call instead. Resolution + auto-create both happen
-// server-side (POST /projects/resolve, see convex/http.ts +
-// convex/projects.ts's resolveOrCreateProjectForUser) so the match/dedup
-// logic exists in exactly one place, shared with the webapp's own project
-// picker.
-//
-// Local-vault mode (vaultBackend: "local") has no project concept at all -
-// it's a flat, unauthenticated file store on the user's own machine with no
-// server to resolve a name against. Callers should check
-// isLocalVaultActive() first and skip resolution entirely rather than call
-// this and get a confusing network-style failure.
+// No persistent "active project" state here - callers name the project by
+// string each call; resolution/auto-create happens server-side (POST
+// /projects/resolve), shared with the webapp's own picker. Local-vault mode
+// has no project concept at all - check isLocalVaultActive() first.
 function isLocalVaultActive() {
     return !!(0, local_vault_js_1.getLocalVaultConfig)();
 }

package/dist/server.js

@@ -45,6 +45,8 @@ const resources_js_1 = require("./resources.js");
 const prompts_js_1 = require("./prompts.js");
 const tool_filter_js_1 = require("./tool-filter.js");
 const annotations_js_1 = require("./annotations.js");
+const finch_status_js_1 = require("./finch-status.js");
+const finch_output_js_1 = require("./finch-output.js");
 // Read version from package.json so the server announces the same version
 // MCP clients see in the npm tarball. Falls back to "unknown" if the file
 // can't be loaded - never blocks server startup.
@@ -58,8 +60,6 @@ const PKG_VERSION = (() => {
     }
 })();
 const market_js_1 = require("./tools/market.js");
-const finch_output_js_1 = require("./finch-output.js");
-const finch_status_js_1 = require("./finch-status.js");
 const defi_js_1 = require("./tools/defi.js");
 const automation_js_1 = require("./tools/automation.js");
 const insight_js_1 = require("./tools/insight.js");
@@ -132,8 +132,7 @@ exports.ALL_TOOLS = [
     ...rh_orders_js_1.RH_ORDER_TOOLS, // 5 - rh_dca_create, rh_bracket_create, rh_orders_list, rh_order_cancel, rh_orders_tick (RH automated DCA/TP/SL)
     ...rh_bridge_js_1.BRIDGE_TOOLS, // 1 - rh_stock_bridge (tokenized stock vs real equity)
     ...memory_js_1.MEMORY_TOOLS, // 9 - memory_add, memory_search, memory_context, memory_profile, memory_list, memory_delete, memory_insight, memory_extract, memory_consolidate. memory_publish removed - promised a "Memory Marketplace" that doesn't exist at any layer (no browse route, no query, no UI), see tools/memory.ts
-    ...os_js_1.OS_TOOLS.filter((t) => t.name !== "finch_status"), // finch_status lives in finch-status.js (dedup)
-    // 2 - finch_diagnostics, finch_shell_chat
+    ...os_js_1.OS_TOOLS, // 3 - finch_status, finch_diagnostics, finch_shell_chat
     ...research_js_1.RESEARCH_TOOLS, // 2 - web_scrape, web_search
     ...deep_research_js_1.DEEP_RESEARCH_TOOLS, // 1 - deep_research (search → scrape → rank → cited evidence pack; caller synthesises)
     ...research_compare_js_1.RESEARCH_COMPARE_TOOLS, // 1 - research_compare (diff two reports across time)
@@ -143,21 +142,10 @@ exports.ALL_TOOLS = [
     ...chronicle_js_1.CHRONICLE_TOOLS, // 4 - chronicle_add, chronicle_list, chronicle_search, chronicle_stats
     ...packets_js_1.PACKET_TOOLS, // 4 - packet_create, packet_run, packet_list, packet_share
     ...stake_js_1.STAKE_TOOLS, // 5 - stake_finch_status, stake_finch, unstake_finch, claim_vested_rewards, stake_auto_restake (custodial wallet; requires `finch login`)
-    // total: 116 tools as measured by ALL_TOOLS.length - do not hand-maintain a
-    // count in this comment (drifted stale multiple times already: before
-    // staking was added, after the P1 audit removed 9 dead framework/agent-
-    // schedule tools, after memory_publish was removed for promising a
-    // marketplace that doesn't exist, after stake_auto_restake was added,
-    // after claim_vested_rewards was added to close the gap where the
-    // stake-lifecycle notification told users to "run claimVestedRewards" but
-    // no MCP tool by that name existed, after code_session_save was added so
-    // coding sessions persist the same way deep_research already auto-saves
-    // research, and after list_projects was added alongside `workspaceProject`
-    // support on vault_save/agent_spawn - MCP tools can now file into the same
-    // Projects the webapp Agents page organizes by, resolved/auto-created
-    // server-side via POST /projects/resolve; ALL_TOOLS.length is the only
-    // number that can't lie). Per-category counts above are best-effort
-    // documentation, not load-bearing anywhere.
+    // Total tool count: use ALL_TOOLS.length, not a hardcoded number here -
+    // this comment has drifted stale repeatedly. Per-category counts above
+    // are best-effort docs, not load-bearing.
+    finch_status_js_1.FINCH_STATUS_TOOL, // 1 - finch_status now lives in finch-status.ts, not OS_TOOLS - see that file's header for why
 ];
 exports.HANDLER_MAP = new Map([
     ...market_js_1.MARKET_TOOLS.map(t => [t.name, market_js_1.handleMarketTool]),
@@ -189,6 +177,7 @@ exports.HANDLER_MAP = new Map([
     ...chronicle_js_1.CHRONICLE_TOOLS.map(t => [t.name, (n, a) => (0, chronicle_js_1.handleChronicle)(n, a)]),
     ...packets_js_1.PACKET_TOOLS.map(t => [t.name, (n, a) => (0, packets_js_1.handlePacket)(n, a)]),
     ...stake_js_1.STAKE_TOOLS.map(t => [t.name, stake_js_1.handleStakeTool]),
+    [finch_status_js_1.FINCH_STATUS_TOOL.name, ((_name, _args) => (0, finch_status_js_1.handleFinchStatus)(exports.ALL_TOOLS.length))],
 ]);
 // `instructions` is returned in the initialize result - it tells the client
 // (and, through it, the model) what this server is and how to reach for it.
@@ -218,10 +207,7 @@ exports.server = new index_js_1.Server({ name: "finch", version: PKG_VERSION },
 // withAnnotations attaches MCP behavioural hints (readOnly/destructive/etc) so
 // clients can auto-run reads and prompt before destructive/fund-moving calls.
 exports.server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => ({
-    tools: [
-        finch_status_js_1.FINCH_STATUS_TOOL,
-        ...(0, annotations_js_1.withAnnotations)((0, tool_filter_js_1.filterTools)(exports.ALL_TOOLS)),
-    ],
+    tools: (0, annotations_js_1.withAnnotations)((0, tool_filter_js_1.filterTools)(exports.ALL_TOOLS)),
 }));
 // MCP Resources - vault entries surface as `finch://vault/<key>`.
 // Clients can pull them via the standard resource flow instead of a Tool
@@ -289,9 +275,6 @@ exports.server.setRequestHandler(types_js_1.CallToolRequestSchema, async (reques
             return { content: [{ type: "text", text: `Error: ${err.message}` }], isError: true };
         }
     }
-    if (name === "finch_status") {
-        return finch_status_js_1.handleFinchStatus();
-    }
     const handler = exports.HANDLER_MAP.get(name);
     if (!handler) {
         return { content: [{ type: "text", text: `Unknown tool: ${name}` }], isError: true };
@@ -299,20 +282,15 @@ exports.server.setRequestHandler(types_js_1.CallToolRequestSchema, async (reques
     try {
         // Hard timeout guard: a hung tool must never wedge the client session.
         // 180s covers deep_research's multi-stage pipeline with margin.
-        const HARD_TIMEOUT_MS = 180_000;
+        const HARD_TIMEOUT_MS = 180000;
         let timer;
         const timeoutPromise = new Promise((_, reject) => {
-            timer = setTimeout(() => reject(new Error(
-                `Tool timed out after 180s (${name}). The operation may still complete server-side - check the app before re-running.`
-            )), HARD_TIMEOUT_MS);
+            timer = setTimeout(() => reject(new Error(`Tool timed out after 180s (${name}). The operation may still complete server-side - check the app before re-running.`)), HARD_TIMEOUT_MS);
         });
-        const result = await Promise.race([
-            handler(name, args),
-            timeoutPromise,
-        ]);
+        const result = await Promise.race([handler(name, args), timeoutPromise]);
         clearTimeout(timer);
         if (result)
-            return (0, finch_output_js_1.processResponse)(result);
+            return (0, finch_output_js_1.processResponse)(result) ?? result;
         return { content: [{ type: "text", text: `Unknown tool: ${name}` }], isError: true };
     }
     catch (err) {

package/dist/tool-filter.js

@@ -1,20 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.filterTools = filterTools;
-// Tool-subset filter. Each user keeps the full handler map (so any tool
-// can still be invoked by name if explicitly referenced), but the LIST
-// response sent to MCP clients is trimmed based on FINCH_TOOLS.
+// Tool-subset filter. Full handler map stays intact (any tool can still be
+// invoked by name); only the LIST response sent to clients is trimmed by
+// FINCH_TOOLS, to cut LLM context cost. Default = "core".
 //
-// Default = "core" - runtime essentials only (memory, vault, agents,
-// chronicle, status). Opt-in presets let token-conscious users cut LLM
-// context cost while keeping the full surface accessible by name:
-//
-//   FINCH_TOOLS=core         runtime essentials (memory, vault, agents)
-//   FINCH_TOOLS=defi         Base + market + DeFi execution
-//   FINCH_TOOLS=research     research + memory + vault
-//   FINCH_TOOLS=memory       memory + vault + agents only
-//   FINCH_TOOLS=memory,defi  comma-separated combination
-//   FINCH_TOOLS=all          every registered tool
+//   FINCH_TOOLS=core|defi|research|memory|all, or comma-separated
 //
 // Unknown presets fall back to all to avoid silently hiding tools.
 // Each preset's regex is checked against every tool name in ALL_TOOLS by

package/dist/tools/_solidity-scan.js

@@ -1,18 +1,9 @@
 "use strict";
-// Static heuristic scanner for Solidity audit grounding.
-//
-// The LLM-only audit path was dangerous: a model could say "this contract
-// looks safe" without any structural basis, and a user might trust that
-// claim with real funds. This module runs a regex/pattern scan over the
-// source BEFORE the LLM call and forces the LLM to address each finding
-// (either confirm the risk or explain why it's a false positive). The
-// resulting report leads with "automated static checks", then "LLM review
-// over those findings", then a mandatory disclaimer.
-//
-// This is NOT a substitute for a professional audit. It catches obvious
-// antipatterns. Subtle vulnerabilities (reentrancy guarded by state ordering,
-// signature replay, oracle manipulation under non-obvious conditions) still
-// need human review or specialized tooling (Slither, Mythril, Echidna).
+// Static heuristic scanner for Solidity audit grounding - runs a
+// regex/pattern scan before the LLM call and forces it to address each
+// finding, instead of letting it claim "looks safe" with no structural
+// basis. Not a substitute for a professional audit (Slither/Mythril/
+// Echidna) - catches obvious antipatterns only.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AUDIT_DISCLAIMER = void 0;
 exports.staticScanSolidity = staticScanSolidity;

package/dist/tools/agents.js

@@ -9,6 +9,7 @@ const llm_js_1 = require("../llm.js");
 const local_vault_js_1 = require("../local-vault.js");
 const memory_js_1 = require("./memory.js");
 const project_js_1 = require("../project.js");
+const _zod_helpers_js_1 = require("../_zod-helpers.js");
 // ─── Agent Learning Memory (v3.25) ──────────────────────────────────────────
 // After every agent_update, an LLM reviews the new progress in context of the
 // agent's goal + prior learnings to extract a single repeatable insight. The
@@ -104,23 +105,10 @@ function withAgentLock(agentName, fn) {
     });
     return next;
 }
-// list_agents/hire_agent were removed (not disabled - deleted) because their
-// backend routes, /agents/list and /agents/hire, were never actually
-// registered in app/convex/http.ts - only dangling section-header comments
-// exist there, no matching http.route(...) call. Every call to either tool
-// always 404'd. Re-add them (and the matching handler blocks below) only
-// alongside building those two routes for real.
-//
-// Same story, same fix, applied again here: agent_identity, agent_schedule,
-// agent_unschedule, agent_pause, agent_resume and agent_runs called
-// /agents/identity, /agents/schedule, /agents/unschedule, /agents/pause and
-// /agents/runs - none of which exist in http.ts, and none of which have any
-// backing data model in schema.ts (no agent-identity table, no scheduler,
-// no run-history table; there isn't even a cron for it in crons.ts). This
-// isn't a missing route, it's an unbuilt subsystem, so the tools were
-// removed rather than stubbed. Re-add only alongside building that
-// autonomous-scheduling backend for real: identity/schedule storage, a cron
-// that actually wakes agents up, and run-history writes.
+// list_agents/hire_agent/agent_identity/agent_schedule/agent_unschedule/
+// agent_pause/agent_resume/agent_runs deleted - their backend routes never
+// existed (dangling comments in http.ts, no actual route/data model). Not a
+// missing route, an unbuilt subsystem. Re-add only alongside building it.
 exports.AGENT_TOOLS = [
     {
         name: "agent_spawn",
@@ -226,9 +214,9 @@ function buildAgentLedger(name, versions) {
 }
 async function handleAgentTool(name, args) {
     if (name === "agent_spawn") {
-        const parsed = SpawnAgentSchema.safeParse(args);
-        if (!parsed.success)
-            return { content: [{ type: "text", text: `${parsed.error.issues[0].message}` }], isError: true };
+        const parsed = (0, _zod_helpers_js_1.parseOrError)(SpawnAgentSchema, args);
+        if (!parsed.ok)
+            return parsed.error;
         const { name: agentName, goal, context, workspaceProject } = parsed.data;
         const content = JSON.stringify({
             goal,
@@ -269,9 +257,9 @@ async function handleAgentTool(name, args) {
         };
     }
     if (name === "agent_recall") {
-        const parsed = RecallAgentSchema.safeParse(args);
-        if (!parsed.success)
-            return { content: [{ type: "text", text: `${parsed.error.issues[0].message}` }], isError: true };
+        const parsed = (0, _zod_helpers_js_1.parseOrError)(RecallAgentSchema, args);
+        if (!parsed.ok)
+            return parsed.error;
         const localVault = (0, local_vault_js_1.getLocalVaultConfig)();
         let data;
         try {
@@ -334,9 +322,9 @@ async function handleAgentTool(name, args) {
         return { content: [{ type: "text", text: lines.join("\n") }] };
     }
     if (name === "agent_update") {
-        const parsed = UpdateAgentSchema.safeParse(args);
-        if (!parsed.success)
-            return { content: [{ type: "text", text: `${parsed.error.issues[0].message}` }], isError: true };
+        const parsed = (0, _zod_helpers_js_1.parseOrError)(UpdateAgentSchema, args);
+        if (!parsed.ok)
+            return parsed.error;
         const { name: agentName, progress, findings, status = "active", nextStep } = parsed.data;
         return withAgentLock(agentName, async () => {
             const localVault = (0, local_vault_js_1.getLocalVaultConfig)();