@hegemonart/get-design-done 1.33.0 → 1.33.6

package/sdk/event-stream/types.ts

@@ -146,10 +146,32 @@ export type ParallelismVerdictEvent = BaseEvent & {
   payload: { task_ids: string[]; verdict: 'parallel' | 'sequential'; reason: string };
 };
 
-/** Phase 10.1 cost-telemetry event-stream sink. */
+/**
+ * Phase 10.1 cost-telemetry event-stream sink.
+ *
+ * Phase 33.6 / Plan 33.6-03 (SC#6) extension — additive/back-compat: the
+ * payload gains an OPTIONAL `provider?: string`, set to `'openrouter'` when the
+ * model for this cost row was resolved via the OpenRouter tier-resolver adapter
+ * (`scripts/lib/tier-resolver-openrouter.cjs`). Absent on every pre-33.6 event
+ * (and on native-resolution rows) — exactly the same additive discipline as the
+ * Phase-27 `runtime_role`/`peer_id` extension documented above. The cost-row
+ * emit site that threads it is
+ * `scripts/lib/budget-enforcer.cjs#buildCostEventPayload`.
+ */
 export type CostUpdateEvent = BaseEvent & {
   type: 'cost.update';
-  payload: { agent: string; tier: string; usd: number; tokens_in: number; tokens_out: number };
+  payload: {
+    agent: string;
+    tier: string;
+    usd: number;
+    tokens_in: number;
+    tokens_out: number;
+    /**
+     * Phase 33.6 SC#6. Set to `'openrouter'` when the model was resolved via the
+     * OpenRouter adapter; omitted otherwise (native-resolution + pre-33.6 rows).
+     */
+    provider?: string;
+  };
 };
 
 /** Rate-guard / backoff stream (Plan 20-10, 20-11). */

package/sdk/mcp/gdd-state/schemas/add_blocker.schema.json

@@ -15,10 +15,12 @@
         "text": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 8192,
           "description": "Human-readable blocker description."
         },
         "stage": {
           "type": "string",
+          "maxLength": 64,
           "description": "Optional. Defaults to <position>.stage."
         },
         "date": {

package/sdk/mcp/gdd-state/schemas/add_decision.schema.json

@@ -15,6 +15,7 @@
         "text": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 8192,
           "description": "Human-readable decision text."
         },
         "status": {

package/sdk/mcp/gdd-state/schemas/add_must_have.schema.json

@@ -15,6 +15,7 @@
         "text": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 8192,
           "description": "Human-readable must-have criterion."
         },
         "status": {

package/sdk/mcp/gdd-state/schemas/checkpoint.schema.json

@@ -14,6 +14,7 @@
         "label": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 256,
           "description": "Optional label for the timestamp entry key. When absent the key is `<stage>_checkpoint_at`."
         }
       }

package/sdk/mcp/gdd-state/schemas/frontmatter_update.schema.json

@@ -17,7 +17,7 @@
           "minProperties": 1,
           "additionalProperties": {
             "oneOf": [
-              { "type": "string" },
+              { "type": "string", "maxLength": 8192 },
               { "type": "number" },
               { "type": "boolean" }
             ]

package/sdk/mcp/gdd-state/schemas/get.schema.json

@@ -13,7 +13,8 @@
       "properties": {
         "fields": {
           "type": "array",
-          "items": { "type": "string", "minLength": 1 },
+          "maxItems": 64,
+          "items": { "type": "string", "minLength": 1, "maxLength": 256 },
           "description": "Optional projection. When present, limit data.state to these top-level keys. Unknown keys are ignored (no error)."
         }
       }

package/sdk/mcp/gdd-state/schemas/probe_connections.schema.json

@@ -15,6 +15,7 @@
         "probe_results": {
           "type": "array",
           "minItems": 1,
+          "maxItems": 256,
           "items": {
             "type": "object",
             "additionalProperties": false,
@@ -23,6 +24,7 @@
               "name": {
                 "type": "string",
                 "minLength": 1,
+                "maxLength": 256,
                 "description": "Connection name (e.g. \"figma\", \"refero\")."
               },
               "status": {

package/sdk/mcp/gdd-state/schemas/resolve_blocker.schema.json

@@ -23,6 +23,7 @@
         "text": {
           "type": "string",
           "minLength": 1,
+          "maxLength": 8192,
           "description": "Exact text match against blocker.text. First matching row is removed. Mutually exclusive with index."
         }
       }

package/sdk/mcp/gdd-state/server.js

@@ -1,8 +1,10 @@
 #!/usr/bin/env -S node --experimental-strip-types
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name12 in all)
@@ -16,6 +18,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // sdk/mcp/gdd-state/server.ts
@@ -26,7 +36,7 @@ __export(server_exports, {
 });
 module.exports = __toCommonJS(server_exports);
 var import_node_fs4 = require("node:fs");
-var import_node_path2 = require("node:path");
+var import_node_path3 = require("node:path");
 var import_server = require("@modelcontextprotocol/sdk/server/index.js");
 var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
 var import_types8 = require("@modelcontextprotocol/sdk/types.js");
@@ -220,11 +230,11 @@ var DEFAULTS = {
   maxWaitMs: 5e3,
   pollMs: 50
 };
-async function acquire(path, opts = {}) {
+async function acquire(path2, opts = {}) {
   const staleMs = opts.staleMs ?? DEFAULTS.staleMs;
   const maxWaitMs = opts.maxWaitMs ?? DEFAULTS.maxWaitMs;
   const pollMs = opts.pollMs ?? DEFAULTS.pollMs;
-  const lockPath = `${path}.lock`;
+  const lockPath = `${path2}.lock`;
   const startedAt = Date.now();
   const payload = {
     pid: process.pid,
@@ -289,9 +299,9 @@ function makeRelease(lockPath) {
     }
   };
 }
-function readLockSafe(path) {
+function readLockSafe(path2) {
   try {
-    return (0, import_node_fs.readFileSync)(path, "utf8");
+    return (0, import_node_fs.readFileSync)(path2, "utf8");
   } catch (err) {
     const code = getErrnoCode(err);
     if (code === "ENOENT") return null;
@@ -1717,15 +1727,15 @@ function gateFor(from, to) {
 }
 
 // sdk/state/index.ts
-async function read(path) {
-  const raw = (0, import_node_fs2.readFileSync)(path, "utf8");
+async function read(path2) {
+  const raw = (0, import_node_fs2.readFileSync)(path2, "utf8");
   return parse(raw).state;
 }
-async function mutate(path, fn) {
-  const release = await acquire(path);
-  const tmpPath = `${path}.tmp`;
+async function mutate(path2, fn) {
+  const release = await acquire(path2);
+  const tmpPath = `${path2}.tmp`;
   try {
-    const raw = (0, import_node_fs2.readFileSync)(path, "utf8");
+    const raw = (0, import_node_fs2.readFileSync)(path2, "utf8");
     const { state, raw_bodies, raw_frontmatter, block_gaps, line_ending } = parse(raw);
     const clone = structuredClone(state);
     const next = fn(clone);
@@ -1737,12 +1747,12 @@ async function mutate(path, fn) {
     });
     (0, import_node_fs2.writeFileSync)(tmpPath, out, "utf8");
     try {
-      (0, import_node_fs2.renameSync)(tmpPath, path);
+      (0, import_node_fs2.renameSync)(tmpPath, path2);
     } catch (err) {
       const code = typeof err === "object" && err !== null && "code" in err ? err.code : void 0;
       if (code === "EPERM" || code === "EBUSY") {
         await new Promise((r) => setTimeout(r, 50));
-        (0, import_node_fs2.renameSync)(tmpPath, path);
+        (0, import_node_fs2.renameSync)(tmpPath, path2);
       } else {
         throw err;
       }
@@ -1758,8 +1768,8 @@ async function mutate(path, fn) {
     await release();
   }
 }
-async function transition(path, toStage) {
-  const beforeMutate = await read(path);
+async function transition(path2, toStage) {
+  const beforeMutate = await read(path2);
   const from = beforeMutate.position.stage;
   if (!isStage(from)) {
     throw new TransitionGateFailed(toStage, [
@@ -1777,7 +1787,7 @@ async function transition(path, toStage) {
     throw new TransitionGateFailed(toStage, gateResult.blockers);
   }
   const nowIso = (/* @__PURE__ */ new Date()).toISOString();
-  const nextState = await mutate(path, (s) => {
+  const nextState = await mutate(path2, (s) => {
     s.frontmatter.stage = toStage;
     s.frontmatter.last_checkpoint = nowIso;
     s.position.stage = toStage;
@@ -1787,6 +1797,9 @@ async function transition(path, toStage) {
   return { pass: true, blockers: gateResult.blockers, state: nextState };
 }
 
+// sdk/mcp/gdd-state/tools/shared.ts
+var import_node_path2 = __toESM(require("node:path"));
+
 // sdk/event-stream/index.ts
 var import_node_os2 = require("node:os");
 
@@ -2001,8 +2014,73 @@ function getSessionId() {
 }
 function resolveStatePath() {
   const override = process.env["GDD_STATE_PATH"];
-  if (typeof override === "string" && override.length > 0) return override;
-  return ".design/STATE.md";
+  if (typeof override !== "string" || override.length === 0) {
+    return ".design/STATE.md";
+  }
+  if (import_node_path2.default.isAbsolute(override)) {
+    return import_node_path2.default.resolve(override);
+  }
+  const root = import_node_path2.default.resolve(process.cwd());
+  const resolved = import_node_path2.default.resolve(root, override);
+  const withSep = root.endsWith(import_node_path2.default.sep) ? root : root + import_node_path2.default.sep;
+  if (resolved !== root && !resolved.startsWith(withSep)) {
+    throwValidation(
+      "STATE_PATH_ESCAPE",
+      `GDD_STATE_PATH (relative) escapes the project boundary: ${override}`,
+      { raw: override, resolved, root }
+    );
+  }
+  return resolved;
+}
+var MAX_INPUT_BYTES = 64 * 1024;
+var MAX_STRING_LEN = 8192;
+var MAX_DEPTH = 32;
+function assertInputWithinLimits(input, opts) {
+  const maxBytes = opts?.maxInputBytes ?? MAX_INPUT_BYTES;
+  const maxStr = opts?.maxStringLen ?? MAX_STRING_LEN;
+  const maxDepth = opts?.maxDepth ?? MAX_DEPTH;
+  const walk = (node, depth) => {
+    if (depth > maxDepth) {
+      throwValidation(
+        "INPUT_TOO_DEEP",
+        `Input nesting exceeds the maximum depth of ${maxDepth}`,
+        { maxDepth }
+      );
+    }
+    if (typeof node === "string") {
+      if (node.length > maxStr) {
+        throwValidation(
+          "INPUT_FIELD_TOO_LARGE",
+          `A string field exceeds the maximum length of ${maxStr}`,
+          { maxStringLen: maxStr, length: node.length }
+        );
+      }
+      return;
+    }
+    if (Array.isArray(node)) {
+      for (const item of node) walk(item, depth + 1);
+      return;
+    }
+    if (node !== null && typeof node === "object") {
+      for (const value of Object.values(node)) {
+        walk(value, depth + 1);
+      }
+    }
+  };
+  walk(input, 0);
+  let bytes;
+  try {
+    bytes = Buffer.byteLength(JSON.stringify(input) ?? "");
+  } catch {
+    throwValidation("INPUT_TOO_LARGE", "Input is not serializable JSON", {});
+  }
+  if (bytes > maxBytes) {
+    throwValidation(
+      "INPUT_TOO_LARGE",
+      `Serialized input (${bytes} bytes) exceeds the maximum of ${maxBytes} bytes`,
+      { maxInputBytes: maxBytes, bytes }
+    );
+  }
 }
 function isStageValue(value) {
   return value === "brief" || value === "explore" || value === "plan" || value === "design" || value === "verify";
@@ -2062,12 +2140,13 @@ function project(state, fields) {
 }
 async function handle(input) {
   try {
+    assertInputWithinLimits(input);
     const typed = input ?? {};
-    const path = resolveStatePath();
-    const state = await read(path);
+    const path2 = resolveStatePath();
+    const state = await read(path2);
     const fields = Array.isArray(typed.fields) ? typed.fields : null;
     const stateOut = fields === null || fields.length === 0 ? state : project(state, fields);
-    return okResponse({ state: stateOut, path });
+    return okResponse({ state: stateOut, path: path2 });
   } catch (err) {
     return errorResponse(err);
   }
@@ -2091,6 +2170,7 @@ var STATUSES = /* @__PURE__ */ new Set([
 ]);
 async function handle2(input) {
   try {
+    assertInputWithinLimits(input);
     const typed = input ?? {};
     if (typed.task_progress === void 0 && typed.status === void 0) {
       throwValidation(
@@ -2112,9 +2192,9 @@ async function handle2(input) {
         `status "${typed.status}" is not one of initialized/in_progress/completed/blocked`
       );
     }
-    const path = resolveStatePath();
+    const path2 = resolveStatePath();
     const diff = {};
-    const after = await mutate(path, (s) => {
+    const after = await mutate(path2, (s) => {
       if (typed.task_progress !== void 0) {
         diff["task_progress"] = {
           before: s.position.task_progress,
@@ -2146,6 +2226,7 @@ var name3 = "gdd_state__transition_stage";
 var schemaPath3 = "../schemas/transition_stage.schema.json";
 async function handle3(input) {
   try {
+    assertInputWithinLimits(input);
     const typed = input ?? {};
     if (!isStage(typed.to)) {
       throwValidation(
@@ -2153,11 +2234,11 @@ async function handle3(input) {
         `to "${String(typed.to)}" is not a recognized Stage`
       );
     }
-    const path = resolveStatePath();
-    const before = await read(path);
+    const path2 = resolveStatePath();
+    const before = await read(path2);
     const fromValue = before.position.stage;
     try {
-      const result = await transition(path, typed.to);
+      const result = await transition(path2, typed.to);
       const fromNarrow = isStage(fromValue) ? fromValue : typed.to;
       emitStateTransition(fromNarrow, typed.to, true, [], result.state);
       return okResponse({
@@ -2198,6 +2279,7 @@ function today() {
 }
 async function handle4(input) {
   try {
+    assertInputWithinLimits(input);
     const typed = input ?? {};
     if (typeof typed.text !== "string" || typed.text.length === 0) {
       throwValidation("MISSING_FIELD", "add_blocker requires a non-empty text");
@@ -2208,10 +2290,10 @@ async function handle4(input) {
         `date "${typed.date}" must be YYYY-MM-DD`
       );
     }
-    const path = resolveStatePath();
+    const path2 = resolveStatePath();
     let appended = null;
     let countAfter = 0;
-    const after = await mutate(path, (s) => {
+    const after = await mutate(path2, (s) => {
       const blocker = {
         stage: typed.stage ?? s.position.stage ?? "",
         date: typed.date ?? today(),
@@ -2243,6 +2325,7 @@ var name5 = "gdd_state__resolve_blocker";
 var schemaPath5 = "../schemas/resolve_blocker.schema.json";
 async function handle5(input) {
   try {
+    assertInputWithinLimits(input);
     const typed = input ?? {};
     const hasIndex = typeof typed.index === "number";
     const hasText = typeof typed.text === "string" && typed.text.length > 0;
@@ -2255,10 +2338,10 @@ async function handle5(input) {
     if (hasIndex && typed.index < 0) {
       throwValidation("INDEX_NEGATIVE", "index must be >= 0");
     }
-    const path = resolveStatePath();
+    const path2 = resolveStatePath();
     let removed = null;
     let countAfter = 0;
-    const after = await mutate(path, (s) => {
+    const after = await mutate(path2, (s) => {
       if (hasIndex) {
         const idx = typed.index;
         if (idx >= s.blockers.length) {
@@ -2319,6 +2402,7 @@ function nextDecisionId(existing) {
 }
 async function handle6(input) {
   try {
+    assertInputWithinLimits(input);
     const typed = input ?? {};
     if (typeof typed.text !== "string" || typed.text.length === 0) {
       throwValidation("MISSING_FIELD", "add_decision requires a non-empty text");
@@ -2332,10 +2416,10 @@ async function handle6(input) {
     if (typed.id !== void 0 && !ID_RE.test(typed.id)) {
       throwValidation("ID_FORMAT", `id "${typed.id}" must match D-<digits>`);
     }
-    const path = resolveStatePath();
+    const path2 = resolveStatePath();
     let appended = null;
     let countAfter = 0;
-    const after = await mutate(path, (s) => {
+    const after = await mutate(path2, (s) => {
       const decision = {
         id: typed.id ?? nextDecisionId(s.decisions),
         text: typed.text,
@@ -2379,6 +2463,7 @@ function nextMustHaveId(existing) {
 }
 async function handle7(input) {
   try {
+    assertInputWithinLimits(input);
     const typed = input ?? {};
     if (typeof typed.text !== "string" || typed.text.length === 0) {
       throwValidation(
@@ -2395,11 +2480,11 @@ async function handle7(input) {
     if (typed.id !== void 0 && !ID_RE2.test(typed.id)) {
       throwValidation("ID_FORMAT", `id "${typed.id}" must match M-<digits>`);
     }
-    const path = resolveStatePath();
+    const path2 = resolveStatePath();
     let written = null;
     let action = "insert";
     let countAfter = 0;
-    const after = await mutate(path, (s) => {
+    const after = await mutate(path2, (s) => {
       const mh = {
         id: typed.id ?? nextMustHaveId(s.must_haves),
         text: typed.text,
@@ -2448,6 +2533,7 @@ var STATUSES2 = /* @__PURE__ */ new Set([
 ]);
 async function handle8(input) {
   try {
+    assertInputWithinLimits(input);
     const typed = input ?? {};
     if (typeof typed.status !== "string" || !STATUSES2.has(typed.status)) {
       throwValidation(
@@ -2455,9 +2541,9 @@ async function handle8(input) {
         `status "${String(typed.status)}" is not one of initialized/in_progress/completed/blocked`
       );
     }
-    const path = resolveStatePath();
+    const path2 = resolveStatePath();
     const diff = {};
-    const after = await mutate(path, (s) => {
+    const after = await mutate(path2, (s) => {
       diff["status"] = { before: s.position.status, after: typed.status };
       s.position.status = typed.status;
       return s;
@@ -2480,14 +2566,15 @@ var name9 = "gdd_state__checkpoint";
 var schemaPath9 = "../schemas/checkpoint.schema.json";
 async function handle9(input) {
   try {
+    assertInputWithinLimits(input);
     const typed = input ?? {};
     if (typed.label !== void 0 && (typeof typed.label !== "string" || typed.label.length === 0)) {
       throwValidation("LABEL_FORMAT", "label must be a non-empty string");
     }
-    const path = resolveStatePath();
+    const path2 = resolveStatePath();
     const nowIso = (/* @__PURE__ */ new Date()).toISOString();
     let timestampKey = "";
-    const after = await mutate(path, (s) => {
+    const after = await mutate(path2, (s) => {
       s.frontmatter.last_checkpoint = nowIso;
       const stage = typeof s.position.stage === "string" ? s.position.stage : "";
       timestampKey = typed.label !== void 0 ? `${typed.label}_at` : stage.length > 0 ? `${stage}_checkpoint_at` : "checkpoint_at";
@@ -2516,6 +2603,7 @@ var name10 = "gdd_state__probe_connections";
 var schemaPath10 = "../schemas/probe_connections.schema.json";
 async function handle10(input) {
   try {
+    assertInputWithinLimits(input);
     const typed = input ?? {};
     if (!Array.isArray(typed.probe_results) || typed.probe_results.length === 0) {
       throwValidation(
@@ -2537,10 +2625,10 @@ async function handle10(input) {
         );
       }
     }
-    const path = resolveStatePath();
+    const path2 = resolveStatePath();
     const updated = [];
     const diff = {};
-    const after = await mutate(path, (s) => {
+    const after = await mutate(path2, (s) => {
       for (const p of typed.probe_results) {
         const before = Object.prototype.hasOwnProperty.call(s.connections, p.name) ? s.connections[p.name] : null;
         s.connections[p.name] = p.status;
@@ -2575,6 +2663,7 @@ function isScalar(v) {
 }
 async function handle11(input) {
   try {
+    assertInputWithinLimits(input);
     const typed = input ?? {};
     if (typed.patch === void 0 || typed.patch === null || typeof typed.patch !== "object") {
       throwValidation(
@@ -2603,9 +2692,9 @@ async function handle11(input) {
         );
       }
     }
-    const path = resolveStatePath();
+    const path2 = resolveStatePath();
     const diff = {};
-    const after = await mutate(path, (s) => {
+    const after = await mutate(path2, (s) => {
       for (const k of keys) {
         const before = s.frontmatter[k];
         const value = typed.patch[k];
@@ -2641,16 +2730,16 @@ var TOOL_COUNT = TOOL_MODULES.length;
 var SERVER_NAME = "gdd-state";
 var SERVER_VERSION = "1.20.0";
 function here() {
-  const expectedRel = (0, import_node_path2.join)("sdk", "mcp", "gdd-state");
+  const expectedRel = (0, import_node_path3.join)("sdk", "mcp", "gdd-state");
   const entry = process.argv[1];
   if (typeof entry === "string" && entry.length > 0) {
-    const entryDir = (0, import_node_path2.dirname)((0, import_node_path2.resolve)(entry));
-    if ((0, import_node_fs4.existsSync)((0, import_node_path2.join)(entryDir, "tools", "index.ts"))) {
+    const entryDir = (0, import_node_path3.dirname)((0, import_node_path3.resolve)(entry));
+    if ((0, import_node_fs4.existsSync)((0, import_node_path3.join)(entryDir, "tools", "index.ts"))) {
       return entryDir;
     }
   }
-  const candidate = (0, import_node_path2.resolve)(process.cwd(), expectedRel);
-  if ((0, import_node_fs4.existsSync)((0, import_node_path2.join)(candidate, "tools", "index.ts"))) {
+  const candidate = (0, import_node_path3.resolve)(process.cwd(), expectedRel);
+  if ((0, import_node_fs4.existsSync)((0, import_node_path3.join)(candidate, "tools", "index.ts"))) {
     return candidate;
   }
   return candidate;
@@ -2658,7 +2747,7 @@ function here() {
 function loadTools() {
   const baseDir = here();
   return TOOL_MODULES.map((m) => {
-    const absPath = (0, import_node_path2.join)(baseDir, "tools", m.schemaPath);
+    const absPath = (0, import_node_path3.join)(baseDir, "tools", m.schemaPath);
     const raw = (0, import_node_fs4.readFileSync)(absPath, "utf8");
     const parsed = JSON.parse(raw);
     const rawInput = parsed.properties?.input;

package/sdk/mcp/gdd-state/tools/add_blocker.ts

@@ -8,6 +8,7 @@
 import { mutate } from '../../../state/index.ts';
 import type { Blocker } from '../../../state/types.ts';
 import {
+  assertInputWithinLimits,
   emitStateMutation,
   errorResponse,
   okResponse,
@@ -34,6 +35,7 @@ function today(): string {
 
 export async function handle(input: unknown): Promise<ToolResponse> {
   try {
+    assertInputWithinLimits(input);
     const typed = (input ?? {}) as AddBlockerInput;
     if (typeof typed.text !== 'string' || typed.text.length === 0) {
       throwValidation('MISSING_FIELD', 'add_blocker requires a non-empty text');

package/sdk/mcp/gdd-state/tools/add_decision.ts

@@ -8,6 +8,7 @@
 import { mutate } from '../../../state/index.ts';
 import type { Decision } from '../../../state/types.ts';
 import {
+  assertInputWithinLimits,
   emitStateMutation,
   errorResponse,
   okResponse,
@@ -46,6 +47,7 @@ function nextDecisionId(existing: Decision[]): string {
 
 export async function handle(input: unknown): Promise<ToolResponse> {
   try {
+    assertInputWithinLimits(input);
     const typed = (input ?? {}) as AddDecisionInput;
     if (typeof typed.text !== 'string' || typed.text.length === 0) {
       throwValidation('MISSING_FIELD', 'add_decision requires a non-empty text');

package/sdk/mcp/gdd-state/tools/add_must_have.ts

@@ -12,6 +12,7 @@
 import { mutate } from '../../../state/index.ts';
 import type { MustHave } from '../../../state/types.ts';
 import {
+  assertInputWithinLimits,
   emitStateMutation,
   errorResponse,
   okResponse,
@@ -46,6 +47,7 @@ function nextMustHaveId(existing: MustHave[]): string {
 
 export async function handle(input: unknown): Promise<ToolResponse> {
   try {
+    assertInputWithinLimits(input);
     const typed = (input ?? {}) as AddMustHaveInput;
     if (typeof typed.text !== 'string' || typed.text.length === 0) {
       throwValidation(

package/sdk/mcp/gdd-state/tools/checkpoint.ts

@@ -8,6 +8,7 @@
 
 import { mutate } from '../../../state/index.ts';
 import {
+  assertInputWithinLimits,
   emitStateMutation,
   errorResponse,
   okResponse,
@@ -25,6 +26,7 @@ export interface CheckpointInput {
 
 export async function handle(input: unknown): Promise<ToolResponse> {
   try {
+    assertInputWithinLimits(input);
     const typed = (input ?? {}) as CheckpointInput;
     if (
       typed.label !== undefined &&

package/sdk/mcp/gdd-state/tools/frontmatter_update.ts

@@ -10,6 +10,7 @@
 
 import { mutate } from '../../../state/index.ts';
 import {
+  assertInputWithinLimits,
   emitStateMutation,
   errorResponse,
   okResponse,
@@ -38,6 +39,7 @@ function isScalar(v: unknown): v is string | number | boolean {
 
 export async function handle(input: unknown): Promise<ToolResponse> {
   try {
+    assertInputWithinLimits(input);
     const typed = (input ?? {}) as FrontmatterUpdateInput;
     if (
       typed.patch === undefined ||

package/sdk/mcp/gdd-state/tools/get.ts

@@ -9,6 +9,7 @@
 import { read } from '../../../state/index.ts';
 import type { ParsedState } from '../../../state/types.ts';
 import {
+  assertInputWithinLimits,
   errorResponse,
   okResponse,
   resolveStatePath,
@@ -38,6 +39,7 @@ function project(state: ParsedState, fields: string[]): Record<string, unknown>
 
 export async function handle(input: unknown): Promise<ToolResponse> {
   try {
+    assertInputWithinLimits(input);
     const typed = (input ?? {}) as GetInput;
     const path = resolveStatePath();
     const state = await read(path);