@flyingrobots/graft 0.5.0 → 0.6.0

package/ARCHITECTURE.md

@@ -1,386 +1,139 @@
-# Graft Architecture
-
-This document is the contributor-facing system map for Graft. It sits
-between the operator docs in `README.md` / `docs/GUIDE.md` and the
-directional docs in `docs/BEARING.md` / `docs/VISION.md`.
-
-If you need the shortest possible summary:
-
-- **CLI** is the human/debug surface.
-- **MCP** is the primary agent surface.
-- **Hooks** are a Claude-side safety net for native `Read`.
-- **Policy** decides what kind of read is allowed.
-- **Repo state** gives layered worldline context about the current
-  checkout and working tree.
-- **WARP** stores and serves structural history over Git.
-
-## Product surfaces
-
-### CLI
-
-Runtime entry:
-- [graft.js](/Users/james/git/graft/bin/graft.js)
-- [main.ts](/Users/james/git/graft/src/cli/main.ts)
-
-Purpose:
-- human-facing debugging
-- local testing of MCP peer commands
-- bootstrap and admin commands such as `init` and `index`
-
-Current shape:
-- `graft` with no args prints help for humans
-- `graft serve` starts the stdio MCP server explicitly
-- grouped namespaces mirror the core MCP surface:
-  - `read`
-  - `struct`
-  - `symbol`
-  - `diag`
-
-The CLI is intentionally not the primary product contract. It exists so
-operators and contributors can inspect the same bounded surfaces without
-having to attach a separate MCP client.
-
-### MCP
-
-Runtime entry:
-- [server.ts](/Users/james/git/graft/src/mcp/server.ts)
-- [stdio.ts](/Users/james/git/graft/src/mcp/stdio.ts)
-- [stdio-server.ts](/Users/james/git/graft/src/mcp/stdio-server.ts)
-
-Purpose:
-- primary agent surface
-- structured tool responses with receipts and versioned `_schema`
-  metadata
-- policy-aware bounded read access
-
-Current shape:
-- `graft serve` runs one repo-rooted stdio server per process
-- `graft daemon` runs one local daemon host per process and many daemon
-  sessions beneath it
-- daemon mode now includes a central authorization and inspection
-  control plane for workspaces and sessions
-- daemon mode now also includes one repo-scoped persistent monitor
-  runtime per canonical repo, currently used for background incremental
-  WARP indexing
-- each server or daemon session owns one `SessionTracker`,
-  `ObservationCache`, `Metrics`, and `RepoStateTracker` slice
-- lazy WARP initialization still happens only when a WARP-backed tool
-  needs it
-
-This is now enough to make the local daemon and first monitor contract
-real without pretending the broader system-wide story is finished.
-
-### Hooks
-
-Runtime entry:
-- [pretooluse-read.ts](/Users/james/git/graft/src/hooks/pretooluse-read.ts)
-- [posttooluse-read.ts](/Users/james/git/graft/src/hooks/posttooluse-read.ts)
-- [shared.ts](/Users/james/git/graft/src/hooks/shared.ts)
-
-Purpose:
-- govern Claude Code native `Read` calls when the agent bypasses graft's
-  MCP tools
-- block obviously banned reads before they happen
-- show what `safe_read` would have returned after a native read
-
-Hooks are not the full product surface. They are a safety rail around a
-host tool that Graft does not control directly.
-
-## Request flow
-
-The normal happy path for an MCP tool looks like this:
-
-1. A client calls a tool such as `safe_read`.
-2. [server.ts](/Users/james/git/graft/src/mcp/server.ts) validates the
-   input with Zod when the tool declares a schema.
-3. The server records session/tool metrics and refreshes repo-state
-   observation.
-4. If the tool is marked `policyCheck: true`, middleware performs a
-   path-based precheck before the handler runs.
-5. The tool handler executes with a shared
-   [ToolContext](/Users/james/git/graft/src/mcp/context.ts).
-6. The handler returns data through `ctx.respond(...)`.
-7. [receipt.ts](/Users/james/git/graft/src/mcp/receipt.ts) attaches
-   `_receipt` and versioned `_schema` metadata.
-
-That flow is the key architectural rule: handlers should compose shared
-infrastructure rather than doing their own ad hoc parsing, shaping, and
-serialization.
-
-## Shared policy seam
-
-Core modules:
-- [evaluate.ts](/Users/james/git/graft/src/policy/evaluate.ts)
-- [graftignore.ts](/Users/james/git/graft/src/policy/graftignore.ts)
-- [policy.ts](/Users/james/git/graft/src/mcp/policy.ts)
-
-Policy is the heart of Graft. It decides:
-- whether content is allowed at all
-- whether content should be returned as full text, outline, diff, or
-  refusal
-- whether session depth or budget should tighten the response
-- whether `.graftignore` suppresses the path entirely
-
-Important distinction:
-- `src/policy/*` holds the domain logic
-- `src/mcp/policy.ts` adapts that domain logic to the MCP runtime
-  contract
-
-The repo’s current doctrine is that bounded-read surfaces should share
-one policy contract across:
-- MCP tools
-- CLI peers
-- hooks
-- working-tree and git-backed structural reads
-
-One explicit exception remains:
-- `run_capture` is a shell escape hatch outside the bounded-read policy
-  contract, and it declares that explicitly through `policyBoundary`
-
-## Layered worldline model
-
-Core module:
-- [repo-state.ts](/Users/james/git/graft/src/mcp/repo-state.ts)
-
-Graft no longer treats “current repo state” as a single flat idea. The
-MCP surface now distinguishes three layers:
-
-- `commit_worldline`
-  - durable history grounded in commits
-- `ref_view`
-  - branch/ref comparisons over that durable history
-- `workspace_overlay`
-  - the current dirty working tree and checkout state
-
-`RepoStateTracker` infers lightweight semantic transitions such as:
-- `checkout`
-- `reset`
-- `merge`
-- `rebase`
-
-The current implementation is tool-call-driven, not watcher-driven. In
-other words, repo-state is refreshed between requests, not from a
-continuous filesystem daemon yet.
-
-This is also where the current architecture still shows strain:
-- raw git process access
-- status/reflog parsing
-- transition inference
-- observation shaping
-
-all still live in one module. That is why `repo-state` remains a known
-cleanup hotspot in backlog.
-
-## WARP: write path vs read path
-
-### Write path
-
-Core modules:
-- [indexer.ts](/Users/james/git/graft/src/warp/indexer.ts)
-- [open.ts](/Users/james/git/graft/src/warp/open.ts)
-
-The write side turns Git history into structural graph facts.
-
-High-level flow:
-1. open a WARP graph backed by Git plumbing
-2. enumerate commits to index
-3. compute changed files for each commit
-4. extract structural outlines and diffs
-5. write structural patch facts into the graph
-
-This is the “materialize history into structure” side of Graft.
-
-### Read path
-
-Core modules:
-- [observers.ts](/Users/james/git/graft/src/warp/observers.ts)
-- [precision.ts](/Users/james/git/graft/src/mcp/tools/precision.ts)
-- [graft-diff.ts](/Users/james/git/graft/src/mcp/tools/graft-diff.ts)
-- [since.ts](/Users/james/git/graft/src/mcp/tools/since.ts)
-- [map.ts](/Users/james/git/graft/src/mcp/tools/map.ts)
-
-The read side does not traverse graph internals by hand. Instead it
-uses the Observer Law:
-
-- write facts into WARP
-- read projections through observers/lenses
-- keep graph traversal knowledge localized
+# ARCHITECTURE
 
-This is why [observers.ts](/Users/james/git/graft/src/warp/observers.ts)
-is small but important. It is the canonical read vocabulary for the
-graph.
-
-## Parser and operations layer
-
-Core modules:
-- [lang.ts](/Users/james/git/graft/src/parser/lang.ts)
-- [outline.ts](/Users/james/git/graft/src/parser/outline.ts)
-- [diff.ts](/Users/james/git/graft/src/parser/diff.ts)
-- [safe-read.ts](/Users/james/git/graft/src/operations/safe-read.ts)
-- [file-outline.ts](/Users/james/git/graft/src/operations/file-outline.ts)
-- [read-range.ts](/Users/james/git/graft/src/operations/read-range.ts)
-- [graft-diff.ts](/Users/james/git/graft/src/operations/graft-diff.ts)
-
-This layer is where Graft turns files into structural meaning.
-
-Responsibilities:
-- detect supported languages
-- extract outlines and jump tables
-- compute structural diffs
-- implement bounded read behavior independently of transport
-
-This separation matters because it lets MCP, CLI, and tests share the
-same behavior without duplicating core logic.
-
-## Ports and adapters
-
-Ports:
-- [filesystem.ts](/Users/james/git/graft/src/ports/filesystem.ts)
-- [codec.ts](/Users/james/git/graft/src/ports/codec.ts)
-
-Adapters:
-- [node-fs.ts](/Users/james/git/graft/src/adapters/node-fs.ts)
-- [canonical-json.ts](/Users/james/git/graft/src/adapters/canonical-json.ts)
+Graft is an industrial-grade context governor converging on a strict Hexagonal (Ports and Adapters) architecture.
 
-Graft is not purely hexagonal everywhere, but it does follow the
-pattern in important places:
-- core logic avoids reaching straight into `node:fs` when a stable port
-  exists
-- JSON shaping/serialization is pushed through a codec boundary
-- shared runtime dependencies are injected through `ToolContext`
+Repo truth today is narrower than a finished strict-hex claim:
 
-The largest remaining hexagonal gap is process execution. Git and shell
-work still happen through direct subprocess calls in a few hotspots,
-which is already tracked in backlog.
+- explicit ports and adapters exist
+- foundational dependency guardrails are mechanically enforced
+- primary adapters and composition roots are still mid-migration
+- WARP is still becoming a first-class port boundary rather than an ambient capability
 
-## Session, cache, receipts
+## Official Entry Points
 
-Core modules:
-- [tracker.ts](/Users/james/git/graft/src/session/tracker.ts)
-- [cache.ts](/Users/james/git/graft/src/mcp/cache.ts)
-- [cached-file.ts](/Users/james/git/graft/src/mcp/cached-file.ts)
-- [receipt.ts](/Users/james/git/graft/src/mcp/receipt.ts)
-- [metrics.ts](/Users/james/git/graft/src/mcp/metrics.ts)
+Graft now has three official product entry points:
 
-These modules are what make Graft a governor instead of just a fancy
-file reader.
+1. **API** — the direct package/library surface exported from the root
+   package entry point
+2. **CLI** — the operator and debugging surface
+3. **MCP** — the agent transport surface
 
-They provide:
-- session-depth awareness
-- budget tracking
-- tripwires
-- re-read suppression
-- structural diffs for changed files
-- cumulative metrics
-- response receipts and schema metadata
+Repo truth today:
 
-In practice:
-- policy decides *what* can be returned
-- cache/session/metrics decide *how expensive and how repeated* the
-  interaction has become
-
-## Current architectural tensions
-
-The repo has a clear shape, but a few real tensions remain:
-
-1. **Repo-scoped stdio server vs shared daemon future**
-   - current MCP shape assumes one rooted context per process
-   - future system-wide use needs explicit repo/worktree/session binding
-
-2. **Daemon/system-wide seams are still broader than they should be**
-   - filesystem, codec, git, and process ports now exist
-   - daemon hosting, control-plane projection, and monitor orchestration
-     still want narrower seams before more system-wide behavior lands
-
-3. **Docs and direction are strong, contributor map was missing**
-   - this file exists to close exactly that gap
-
-## Daemon evolution path
-
-Current repo-local path:
-
-- `graft serve` starts one repo-rooted stdio server
-- `startStdioServer(cwd)` passes that cwd into `createGraftServer()`
-- one process holds one rooted `SessionTracker`, `ObservationCache`,
-  `Metrics`, and `RepoStateTracker`
-
-Current local shared-daemon path:
-
-- `graft daemon` owns local-only transport and session lifecycle
-- daemon sessions start unbound
-- a daemon-only workspace bind step resolves repo/worktree identity
-  server-side before repo-scoped tools run
-- MCP traffic lives at `/mcp`, and liveness lives at `/healthz`
-- each daemon transport session owns its own daemon-mode MCP server
-- state splits cleanly across:
-  - canonical repo identity and default WARP ownership (`git common
-    dir`)
-  - live worktree identity (resolved worktree root)
-  - session-local cache, budget, receipts, and saved state
-- one repo-scoped WARP instance per canonical repo remains the default
-  assumption even if several daemon sessions or worktrees bind into that
-  repo
-
-This split is the bridge from repo-local stdio to a same-user local
-daemon without pretending control-plane and multi-repo concerns are
-already solved.
-
-## Multi-repo coordination contract
-
-The current daemon can now be described lawfully in system-wide terms:
-
-- canonical repo identity is keyed by `git common dir`
-- live worktree identity is keyed by resolved worktree root
-- daemon session identity remains transport-scoped and session-local
-
-The architectural rule is:
-
-- repo-scoped truth may be coordinated system-wide
-- worktree-scoped truth may be projected beneath a repo
-- session-scoped truth must not silently become daemon-global state
-
-The current multi-repo overview surface now shows:
-
-- one bounded row per authorized canonical repo through `daemon_repos`
-- compact worktree, session-count, monitor, backlog, and last-activity
-  summaries
-- filtered drill-down derived from the authorization registry and
-  daemon-owned runtime state
-
-Follow-on system-wide work may still add:
-
-- daemon-wide fairness and resource-pressure summaries
-- broader aggregate counts across many repos and worker kinds
-
-What it must not show by default:
-
-- raw receipt bodies
-- cache content
-- saved state content
-- runtime-log payloads
-- shell-output artifacts
-
-This keeps multi-repo coordination observational and authorization-
-filtered instead of turning it into an accidental side channel or a
-permission grant.
-
-## Where to read next
-
-If you are onboarding as a contributor:
-
-1. Read [README.md](/Users/james/git/graft/README.md) for the product
-   claim.
-2. Read [docs/GUIDE.md](/Users/james/git/graft/docs/GUIDE.md) for the
-   operator setup surface.
-3. Read [docs/BEARING.md](/Users/james/git/graft/docs/BEARING.md) for
-   current direction and readiness bars.
-4. Read [METHOD.md](/Users/james/git/graft/METHOD.md) for local process.
-5. Then open:
-   - [server.ts](/Users/james/git/graft/src/mcp/server.ts)
-   - [repo-state.ts](/Users/james/git/graft/src/mcp/repo-state.ts)
-   - [evaluate.ts](/Users/james/git/graft/src/policy/evaluate.ts)
-   - [indexer.ts](/Users/james/git/graft/src/warp/indexer.ts)
-   - [observers.ts](/Users/james/git/graft/src/warp/observers.ts)
+- API is first-class, not a side door
+- CLI and MCP remain primary adapters
+- not every capability is symmetric across all three entry points yet
+- every capability should explicitly declare which entry points it is
+  available on and, for API, whether the exposure is a direct typed
+  surface or an MCP-style tool bridge
 
-That sequence gives the clearest current picture of how the system
-actually works.
+The convergence target is:
+
+- one application core
+- three thin primary adapters
+- explicit surface metadata and invariants
+- capability parity where parity is intended, with narrow documented
+  exceptions where it is not
+
+## Repo Topology
+
+The source tree should make the three entry points visible:
+
+- `src/api/` is the API primary adapter home
+- `src/cli/` is the CLI primary adapter home
+- `src/mcp/` is the MCP primary adapter home
+
+The package export root is:
+
+- `src/index.ts`
+
+That root file is intentionally thinner than the adapter homes. It is
+the public package entrypoint, not the place where API behavior should
+accumulate.
+
+Supporting roles stay explicit too:
+
+- `src/hooks/` is an adjunct entrypoint for local automation and
+  governance, not one of the three official product surfaces
+- `src/operations/`, `src/policy/`, `src/session/`, `src/git/`,
+  `src/metrics/`, and `src/release/` are the current application/core
+  areas
+- `src/contracts/`, `src/ports/`, `src/guards/`, and `src/format/`
+  carry foundational contracts and helpers
+- `src/adapters/`, `src/parser/`, and `src/warp/` remain secondary
+  adapters or infrastructure bindings
+
+See [docs/repo-topology.md](./docs/repo-topology.md) for the repo-local
+topology contract.
+
+## Core Boundary
+
+The Graft core is TypeScript. Platform-specific concerns are intended to enter through explicit secondary ports:
+
+| Port | Responsibility | Official Adapter |
+| :--- | :--- | :--- |
+| **`FileSystem`** | Path resolution, file reads, directory creation | `nodeFs` |
+| **`JsonCodec`** | Canonical JSON shaping and serialization | `CanonicalJsonCodec` |
+| **`GitClient`** | Git history enumeration and status observation | `nodeGit` |
+| **`ProcessRunner`** | Shell execution and diagnostic capture | `nodeProcessRunner` |
+
+Primary adapters should sit above that core boundary:
+
+| Primary Adapter | Responsibility |
+| :--- | :--- |
+| **API** | Direct typed package surface for in-process integrations |
+| **CLI** | Human/operator command surface and scripting |
+| **MCP** | Agent-facing transport surface with receipts and schemas |
+
+The architecture rule is that none of these primary adapters own
+business flow. They validate input, call application services, and
+shape edge-specific output.
+
+## Pipeline: From File to Governance
+
+```mermaid
+flowchart TD
+    subgraph Core["Graft Core (Policy)"]
+        P1[Read Governance]
+        P2[Budget / Session Caps]
+    end
+    subgraph Parser["Parser (Meaning)"]
+        PA1[Tree-Sitter WASM]
+        PA2[Structural Outlines / Diffs]
+    end
+    subgraph Host["Host (Execution)"]
+        H1[Daemon Authority]
+        H2[Worker Execution]
+    end
+
+    PA2 --> P1
+    P1 --> P2
+    P2 --> H1
+    H1 --> H2
+```
+
+## Layered Worldline Model
+
+Graft models repository state through three distinct layers:
+
+1. **`commit_worldline`**: Durable structural history grounded in Git commits.
+2. **`ref_view`**: Branch and reference comparisons over durable history.
+3. **`workspace_overlay`**: The current dirty working tree and reactive edit signals.
+
+## WARP: Structural Worldline Memory
+
+### Write Path (Indexer)
+The write path turns Git history into structural worldline facts by extracting AST outlines and writing them into the WARP graph.
+
+### Read Path (Observers)
+The read path uses the **Observer Law**: projections are read through lenses (e.g., `graft_diff`, `code_show`) rather than traversing graph internals directly.
+
+## Execution Authority: The Daemon
+
+The Daemon is the system-wide authority for multi-repo coordination. It manages:
+- **Authorization**: Workspace and session binding.
+- **Scheduling**: Job queueing and fairness.
+- **Resources**: Shared worker pools for heavy indexing and parsing tasks.
+
+---
+**The goal is to move the repository from a collection of bytes to a provenance-aware professional bedrock.**

package/CHANGELOG.md

@@ -7,24 +7,105 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.6.0] - 2026-04-18
+
+### Added
+
+- **Runtime port guards**: `assertFileSystem()`, `assertJsonCodec()`,
+  and `assertToolContext()` validate adapter contracts at construction
+  time. Plumbing conformance test catches drift against
+  `@git-stunts/plumbing`.
+- **Secret scrubbing**: shared `scrubSecrets()` and
+  `sanitizeArgValues()` redact sensitive keys, truncate oversized
+  values, and scrub secret patterns across both `run_capture` output
+  and observability arg logging.
+- **Path escape invariants**: dedicated test suite for traversal
+  attacks, symlink escapes, and root-confinement.
+- **Worktree identity canonicalization**: `fs.realpathSync` resolves
+  path aliases (`/tmp` vs `/private/tmp`) before deriving workspace
+  IDs.
+- **Tool-call provenance footprints**: `ToolCallFootprint` records
+  paths, symbols, and line regions per tool invocation. Read-family
+  and search tools instrumented.
+- **Canonical symbol identity projection**: `graft_diff` and
+  `graft_since` enrich diff entries with `identityId` from WARP
+  `sid:*` anchors when indexed. Graceful degradation when unavailable.
+- **Dynamic project root**: `GRAFT_PROJECT_ROOT` env var overrides
+  the default `process.cwd()` binding. Git root auto-detection
+  fallback.
+- **Implicit daemon binding**: daemon-mode sessions auto-bind when
+  a repo-scoped tool is called with path evidence, removing the
+  mandatory `workspace_bind` step.
+- **Attribution fallback hardening**: transport session, environment
+  inference (CI/CD, editor detection), and session continuity
+  strategies reduce `actor:unknown` to the exception path.
+- **Anti-sludge policy**: semgrep rules and shell checks for
+  boundary discipline, banned patterns, and core-layer hygiene.
+- **`toJsonObject()` DTO bridge**: universal serialization boundary
+  between typed operation results and `ctx.respond()`.
+
 ### Changed
 
+- **Explicit execution context**: `ToolHandler` now receives `ctx`
+  as an explicit parameter `(args, ctx)` instead of closing over it
+  via `createHandler(ctx)`. `AsyncLocalStorage` removed from
+  execution context threading.
+- **Session concept disambiguation**: `SessionTracker` renamed to
+  `GovernorTracker`, `RegisteredSession` to `RegisteredTransport`,
+  `WorkspaceSessionMode` to `WorkspaceMode`. Wire format preserved.
+- **MCP composition decomposition**: `server.ts` split into barrel +
+  `server-context.ts` + `server-invocation.ts`. `repo-state.ts` into
+  4 sub-modules. `daemon-control-plane.ts` into `control-plane/`.
+  `daemon-repos.ts` into `repo-overview/`. `daemon-worker-pool.ts`
+  into 3 sub-modules. `persistent-monitor-runtime.ts` into 3
+  sub-modules. `workspace-router.ts` gains capability and history
+  sub-modules.
+- **Parser decomposition**: markdown extraction split into
+  `src/parser/markdown.ts`. Parser reclassified as application module
+  (Layer 3) with enforced hex layer guardrails.
+- **Result type hardening**: `MetricsSnapshot`, `MetricsDelta`,
+  `DecisionEntry`, `StateSaveResult`, `StateLoadResult` promoted to
+  runtime classes. `[key: string]: unknown` index signatures removed
+  from all operation results. Receipt builder uses mutable draft
+  instead of `as` casts.
 - **`code_find` approximate discovery**: plain-text queries now use
   case-insensitive exact/prefix/substring matching with deterministic
-  ranking. Explicit glob queries such as `handle*` keep the existing
-  glob behavior.
+  ranking.
 - **Claude hook governed reads**: `PreToolUse` now redirects large
-  JS/TS native `Read` calls to graft's bounded-read path before the
-  full file lands in context. `PostToolUse` remains a backstop message
-  for oversized code reads that still slip through.
-- **Codex bootstrap posture**: `graft init --write-codex-mcp` now seeds
-  `AGENTS.md` alongside `.codex/config.toml`, and the setup docs now
-  distinguish MCP availability from actual governed-read posture by
-  client.
-- **MCP runtime observability**: MCP sessions now emit metadata-only
-  session/tool-call/failure events to `.graft/logs/mcp-runtime.ndjson`,
-  receipts carry `traceId` and `latencyMs`, and `doctor` reports the
-  active runtime log posture.
+  JS/TS native `Read` calls to graft's bounded-read path.
+- **Codex bootstrap posture**: `graft init --write-codex-mcp` now
+  seeds `AGENTS.md` alongside `.codex/config.toml`.
+- **MCP runtime observability**: sessions emit metadata-only events
+  to `.graft/logs/mcp-runtime.ndjson`, receipts carry `traceId` and
+  `latencyMs`.
+- **Map tool collector extraction**: `map.ts` reduced from 328 to
+  52 lines; collection logic in `map-collector.ts`.
+- **Typed diagnostic responses**: `DoctorResponse`, `StatsResponse`,
+  `ExplainResponse`, `SetBudgetResponse`, `RunCaptureResponse`.
+
+### Fixed
+
+- **Worktree identity drift on macOS**: `/tmp` and `/private/tmp`
+  aliases no longer produce different workspace IDs.
+- **`GRAFT_PROJECT_ROOT` env var**: MCP servers no longer hardcoded
+  to their own repo path.
+- **Path resolver security**: absolute paths now confined to project
+  root. Symlink escapes detected via `fs.realpathSync` double-check.
+- **WARP symbol disambiguation**: `symNodeId` uses qualified names
+  (`Header.render` vs `Footer.render`) — same-named methods across
+  classes no longer collide.
+- **WARP indexer error propagation**: `IndexResult` is a discriminated
+  union. Git failures propagate instead of producing silently empty
+  graphs.
+- **Daemon session cleanup**: session directories removed on close
+  instead of leaking forever.
+- **Rotating log preservation**: oversized entries preserved instead
+  of erasing the entire log during rotation.
+- **`graft_map` output caps**: `MAX_MAP_FILES=100`, `MAX_MAP_BYTES=50000`
+  with automatic summary-only fallback. Budget-exhausted sessions get
+  compact `BUDGET_EXHAUSTED` response.
+- **hono vulnerability**: override to >=4.12.14 patches HTML
+  injection in `hono/jsx` SSR (Dependabot alert #10).
 
 ## [0.5.0] - 2026-04-11