@integrity-labs/agt-cli 0.28.1136 → 0.28.1138

package/dist/mcp/index.js

@@ -22462,6 +22462,37 @@ function describeAssignProject(o) {
   return `${head} ${from} To undo: ${tool} with ${idArg}="${o.leafId}", ${undoArg}.`;
 }
 
+// src/project-summary-render.ts
+function projectPastDue(p2, today) {
+  return p2.status === "active" && !!p2.target_date && p2.target_date < today;
+}
+function ownerLabel(p2) {
+  if (!p2.owner_person_id) return null;
+  return p2.owner_name ? `${p2.owner_name} (person_id ${p2.owner_person_id})` : `person_id ${p2.owner_person_id}`;
+}
+function dueLabel(p2, today) {
+  if (!p2.target_date) return null;
+  return projectPastDue(p2, today) ? `${p2.target_date} (PAST DUE)` : p2.target_date;
+}
+function projectListLine(p2, today) {
+  const extra = [
+    ownerLabel(p2) ? `owner ${ownerLabel(p2)}` : null,
+    dueLabel(p2, today) ? `due ${dueLabel(p2, today)}` : null
+  ].filter((s) => s !== null);
+  const tail = extra.length ? `, ${extra.join(", ")}` : "";
+  return `- ${p2.name} [${p2.status}] (id: ${p2.id}, created ${p2.created_at}${tail})`;
+}
+function projectOwnerDateLines(p2, today) {
+  return [`Owner: ${ownerLabel(p2) ?? "none"}`, `Target date: ${dueLabel(p2, today) ?? "none"}`];
+}
+function todayInTz(timeZone, now = /* @__PURE__ */ new Date()) {
+  try {
+    return new Intl.DateTimeFormat("en-CA", { timeZone, year: "numeric", month: "2-digit", day: "2-digit" }).format(now);
+  } catch {
+    return now.toISOString().slice(0, 10);
+  }
+}
+
 // src/kanban-assign-result.ts
 function kanbanAssignResultText(data, fallbackTargetAgent, fallbackTargetTeam) {
   if (!data.ok) return `Failed to assign task to ${fallbackTargetAgent}.`;
@@ -31050,6 +31081,25 @@ var FLAG_REGISTRY = [
     // it back on for their own org.
     platformAdminOnly: true
   },
+  {
+    key: "two-factor-settings",
+    description: "Show Settings > Two-factor authentication, where a console user sets up or removes an authenticator app (ENG-11619). Gates SETTING UP only: anyone who already has an authenticator is asked for a code before a console page loads whatever this flag says, so switching it off never turns an existing user's two-factor off. Phase 1: console pages only, not the API.",
+    flagType: "boolean",
+    // PUBLIC (ADR-0022 §2): the nav reads it via usePublicBooleanFlag and the
+    // page via getPublicBooleanFlagServer, so it is in the GET /flags map. No
+    // env override (UI rollout, not an operator gate). Ships dark (default
+    // false). The staff factor reset on the admin organization page is in
+    // place, so a lost phone is recoverable.
+    public: true,
+    defaultValue: false,
+    // Platform admin only until ENG-11619 phase 2. Phase 1 gates console PAGE
+    // LOADS: an enrolled user's password-only (aal1) session is still accepted
+    // by the Hono API and the webapp's /api/* handlers. An org admin switching
+    // this on would reasonably believe a stolen password is now useless, and
+    // it is not yet (Obi Wan be8af20e689c on #7092). Drop this once phase 2
+    // refuses aal1 there too.
+    platformAdminOnly: true
+  },
   {
     key: "platform-maintenance-mode",
     description: 'Platform-wide maintenance mode (ENG-6506; widened to modes by ENG-11436). off = normal operation (ships dark; channels behave exactly as today). tools-offline = every agent KEEPS conversing but every Augmented tool that WRITES to the control plane refuses with a reason, so nothing is created during a window whose database restore would discard it; reads are untouched. fleet-offline = the previous boolean-true behaviour AND the write gate: admitted human inbound gets a "we are offline for maintenance" notice instead of being dispatched, for whole-platform downtime such as DB upgrades. The modes are CUMULATIVE \u2014 fleet-offline gates writes too, because silencing channel inbound does not stop a /loop or a scheduled task filing work. Read host-side per inbound and per tool call from the flags cache (no MCP restart). (Proactive "back online" follow-up is the ENG-6508 fast-follow, not this flag.)',
@@ -40194,7 +40244,7 @@ function object(shape, params) {
   return new ZodMiniObject(def);
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.27.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
 function isZ4Schema(s) {
   const schema = s;
   return !!schema._zod;
@@ -40278,17 +40328,33 @@ function normalizeObjectSchema(schema) {
   }
   return void 0;
 }
+function getDotPath(path) {
+  if (path.length === 0) {
+    return "object root";
+  }
+  return path.reduce((acc, seg, index) => {
+    if (index === 0) {
+      return String(seg);
+    }
+    if (typeof seg === "number") {
+      return `${acc}[${seg}]`;
+    }
+    return `${acc}.${seg}`;
+  }, "");
+}
 function getParseErrorMessage(error2) {
   if (error2 && typeof error2 === "object") {
+    if ("issues" in error2 && Array.isArray(error2.issues) && error2.issues.length > 0) {
+      return error2.issues.map((i) => {
+        if (!i.path?.length) {
+          return i.message;
+        }
+        return `${i.message} at ${getDotPath(i.path)}`;
+      }).join("\n");
+    }
     if ("message" in error2 && typeof error2.message === "string") {
       return error2.message;
     }
-    if ("issues" in error2 && Array.isArray(error2.issues) && error2.issues.length > 0) {
-      const firstIssue = error2.issues[0];
-      if (firstIssue && typeof firstIssue === "object" && "message" in firstIssue) {
-        return String(firstIssue.message);
-      }
-    }
     try {
       return JSON.stringify(error2);
     } catch {
@@ -41033,7 +41099,7 @@ function preprocess(fn, schema) {
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v4/classic/external.js
 config(en_default2());
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.27.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
 var LATEST_PROTOCOL_VERSION = "2025-11-25";
 var SUPPORTED_PROTOCOL_VERSIONS = [LATEST_PROTOCOL_VERSION, "2025-06-18", "2025-03-26", "2024-11-05", "2024-10-07"];
 var RELATED_TASK_META_KEY = "io.modelcontextprotocol/related-task";
@@ -41043,10 +41109,9 @@ var ProgressTokenSchema = union([string2(), number2().int()]);
 var CursorSchema = string2();
 var TaskCreationParamsSchema = looseObject({
   /**
-   * Time in milliseconds to keep task results available after completion.
-   * If null, the task has unlimited lifetime until manually cleaned up.
+   * Requested duration in milliseconds to retain task from creation.
    */
-  ttl: union([number2(), _null3()]).optional(),
+  ttl: number2().optional(),
   /**
    * Time in milliseconds to wait between task status requests.
    */
@@ -41346,7 +41411,11 @@ var ClientCapabilitiesSchema = object2({
   /**
    * Present if the client supports task creation.
    */
-  tasks: ClientTasksCapabilitySchema.optional()
+  tasks: ClientTasksCapabilitySchema.optional(),
+  /**
+   * Extensions that the client supports. Keys are extension identifiers (vendor-prefix/extension-name).
+   */
+  extensions: record(string2(), AssertObjectSchema).optional()
 });
 var InitializeRequestParamsSchema = BaseRequestParamsSchema.extend({
   /**
@@ -41407,7 +41476,11 @@ var ServerCapabilitiesSchema = object2({
   /**
    * Present if the server supports task creation.
    */
-  tasks: ServerTasksCapabilitySchema.optional()
+  tasks: ServerTasksCapabilitySchema.optional(),
+  /**
+   * Extensions that the server supports. Keys are extension identifiers (vendor-prefix/extension-name).
+   */
+  extensions: record(string2(), AssertObjectSchema).optional()
 });
 var InitializeResultSchema = ResultSchema.extend({
   /**
@@ -41599,6 +41672,12 @@ var ResourceSchema = object2({
    * The MIME type of this resource, if known.
    */
   mimeType: optional(string2()),
+  /**
+   * The size of the raw resource content, in bytes (i.e., before base64 encoding or any tokenization), if known.
+   *
+   * This can be used by Hosts to display file sizes and estimate context window usage.
+   */
+  size: optional(number2()),
   /**
    * Optional annotations for the client.
    */
@@ -42551,7 +42630,7 @@ var UrlElicitationRequiredError = class extends McpError {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.27.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
 function isTerminal(status) {
   return status === "completed" || status === "failed" || status === "cancelled";
 }
@@ -43840,7 +43919,7 @@ var zodToJsonSchema = (schema, options) => {
   return combined;
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.27.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
 function mapMiniTarget(t) {
   if (!t)
     return "draft-7";
@@ -43882,7 +43961,7 @@ function parseWithCompat(schema, data) {
   return result.data;
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.27.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
 var DEFAULT_REQUEST_TIMEOUT_MSEC = 6e4;
 var Protocol = class {
   constructor(_options) {
@@ -43923,6 +44002,9 @@ var Protocol = class {
       this.setRequestHandler(GetTaskPayloadRequestSchema, async (request, extra) => {
         const handleTaskResult = async () => {
           const taskId = request.params.taskId;
+          if (!await this._taskStore.getTask(taskId, extra.sessionId)) {
+            throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
+          }
           if (this._taskMessageQueue) {
             let queuedMessage;
             while (queuedMessage = await this._taskMessageQueue.dequeue(taskId, extra.sessionId)) {
@@ -43953,12 +44035,12 @@ var Protocol = class {
             throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
           }
           if (!isTerminal(task.status)) {
-            await this._waitForTaskUpdate(taskId, extra.signal);
+            await this._waitForTaskUpdate(taskId, extra.signal, extra.sessionId);
             return await handleTaskResult();
           }
           if (isTerminal(task.status)) {
             const result = await this._taskStore.getTaskResult(taskId, extra.sessionId);
-            this._clearTaskQueue(taskId);
+            this._clearTaskQueue(taskId, extra.sessionId);
             return {
               ...result,
               _meta: {
@@ -43995,7 +44077,7 @@ var Protocol = class {
             throw new McpError(ErrorCode.InvalidParams, `Cannot cancel task in terminal status: ${task.status}`);
           }
           await this._taskStore.updateTaskStatus(request.params.taskId, "cancelled", "Client cancelled task execution.", extra.sessionId);
-          this._clearTaskQueue(request.params.taskId);
+          this._clearTaskQueue(request.params.taskId, extra.sessionId);
           const cancelledTask = await this._taskStore.getTask(request.params.taskId, extra.sessionId);
           if (!cancelledTask) {
             throw new McpError(ErrorCode.InvalidParams, `Task not found after cancellation: ${request.params.taskId}`);
@@ -44094,6 +44176,10 @@ var Protocol = class {
     this._progressHandlers.clear();
     this._taskProgressTokens.clear();
     this._pendingDebouncedNotifications.clear();
+    for (const info of this._timeoutInfo.values()) {
+      clearTimeout(info.timeoutId);
+    }
+    this._timeoutInfo.clear();
     for (const controller of this._requestHandlerAbortControllers.values()) {
       controller.abort();
     }
@@ -44119,6 +44205,19 @@ var Protocol = class {
     const handler = this._requestHandlers.get(request.method) ?? this.fallbackRequestHandler;
     const capturedTransport = this._transport;
     const relatedTaskId = request.params?._meta?.[RELATED_TASK_META_KEY]?.taskId;
+    const sessionId = capturedTransport?.sessionId;
+    const store = this._taskStore;
+    let relatedTaskFound = true;
+    let relatedTaskLookup;
+    if (relatedTaskId && store && this._taskMessageQueue && sessionId !== void 0) {
+      relatedTaskFound = false;
+      relatedTaskLookup = (async () => {
+        if (!await store.getTask(relatedTaskId, sessionId)) {
+          throw new McpError(ErrorCode.InvalidParams, `Task not found: ${relatedTaskId}`);
+        }
+        relatedTaskFound = true;
+      })();
+    }
     if (handler === void 0) {
       const errorResponse = {
         jsonrpc: "2.0",
@@ -44128,7 +44227,10 @@ var Protocol = class {
           message: "Method not found"
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && relatedTaskLookup) {
+        const queuedError = { type: "error", message: errorResponse, timestamp: Date.now() };
+        relatedTaskLookup.then(() => this._enqueueTaskMessage(relatedTaskId, queuedError, sessionId), () => capturedTransport?.send(errorResponse)).catch((error2) => this._onerror(new Error(`Failed to send an error response: ${error2}`)));
+      } else if (relatedTaskId && this._taskMessageQueue) {
         this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -44179,7 +44281,10 @@ var Protocol = class {
       closeSSEStream: extra?.closeSSEStream,
       closeStandaloneSSEStream: extra?.closeStandaloneSSEStream
     };
-    Promise.resolve().then(() => {
+    (relatedTaskLookup ?? Promise.resolve()).then(() => {
+      if (relatedTaskLookup && abortController.signal.aborted) {
+        throw new McpError(ErrorCode.ConnectionClosed, "Request was cancelled");
+      }
       if (taskCreationParams) {
         this.assertTaskHandlerCapability(request.method);
       }
@@ -44214,7 +44319,7 @@ var Protocol = class {
           ...error2["data"] !== void 0 && { data: error2["data"] }
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && this._taskMessageQueue && relatedTaskFound) {
         await this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -44224,7 +44329,9 @@ var Protocol = class {
         await capturedTransport?.send(errorResponse);
       }
     }).catch((error2) => this._onerror(new Error(`Failed to send response: ${error2}`))).finally(() => {
-      this._requestHandlerAbortControllers.delete(request.id);
+      if (this._requestHandlerAbortControllers.get(request.id) === abortController) {
+        this._requestHandlerAbortControllers.delete(request.id);
+      }
     });
   }
   _onprogress(notification) {
@@ -44692,7 +44799,7 @@ var Protocol = class {
       throw new Error("Cannot enqueue task message: taskStore and taskMessageQueue are not configured");
     }
     const maxQueueSize = this._options?.maxTaskQueueSize;
-    await this._taskMessageQueue.enqueue(taskId, message, sessionId, maxQueueSize);
+    await this._taskMessageQueue.enqueue(taskId, message, sessionId ?? this._transport?.sessionId, maxQueueSize);
   }
   /**
    * Clears the message queue for a task and rejects any pending request resolvers.
@@ -44721,12 +44828,13 @@ var Protocol = class {
    * Uses polling to check for updates at the task's configured poll interval.
    * @param taskId The task ID to wait for
    * @param signal Abort signal to cancel the wait
+   * @param sessionId Session of the request that waits, passed to the task store
    * @returns Promise that resolves when an update occurs or rejects if aborted
    */
-  async _waitForTaskUpdate(taskId, signal) {
+  async _waitForTaskUpdate(taskId, signal, sessionId) {
     let interval = this._options?.defaultTaskPollInterval ?? 1e3;
     try {
-      const task = await this._taskStore?.getTask(taskId);
+      const task = await this._taskStore?.getTask(taskId, sessionId);
       if (task?.pollInterval) {
         interval = task.pollInterval;
       }
@@ -44830,7 +44938,7 @@ function mergeCapabilities(base, additional) {
   return result;
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.27.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
 var import_ajv = __toESM(require_ajv(), 1);
 var import_ajv_formats3 = __toESM(require_dist(), 1);
 function createDefaultAjvInstance() {
@@ -44898,7 +45006,7 @@ var AjvJsonSchemaValidator = class {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.27.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
 var ExperimentalServerTasks = class {
   constructor(_server) {
     this._server = _server;
@@ -45111,7 +45219,7 @@ var ExperimentalServerTasks = class {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.27.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
 function assertToolsCallTaskCapability(requests, method, entityName) {
   if (!requests) {
     throw new Error(`${entityName} does not support task creation (required for ${method})`);
@@ -45146,7 +45254,7 @@ function assertClientRequestTaskCapability(requests, method, entityName) {
   }
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.27.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
 var Server = class extends Protocol {
   /**
    * Initializes this server with the given name and version information.
@@ -45212,16 +45320,7 @@ var Server = class extends Protocol {
     if (!methodSchema) {
       throw new Error("Schema is missing a method literal");
     }
-    let methodValue;
-    if (isZ4Schema(methodSchema)) {
-      const v4Schema = methodSchema;
-      const v4Def = v4Schema._zod?.def;
-      methodValue = v4Def?.value ?? v4Schema.value;
-    } else {
-      const v3Schema = methodSchema;
-      const legacyDef = v3Schema._def;
-      methodValue = legacyDef?.value ?? v3Schema.value;
-    }
+    const methodValue = getLiteralValue(methodSchema);
     if (typeof methodValue !== "string") {
       throw new Error("Schema method literal must be a string");
     }
@@ -45526,7 +45625,7 @@ var Server = class extends Protocol {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.27.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/completable.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/completable.js
 var COMPLETABLE_SYMBOL = /* @__PURE__ */ Symbol.for("mcp.completable");
 function isCompletable(schema) {
   return !!schema && typeof schema === "object" && COMPLETABLE_SYMBOL in schema;
@@ -45540,7 +45639,7 @@ var McpZodTypeKind;
   McpZodTypeKind2["Completable"] = "McpCompletable";
 })(McpZodTypeKind || (McpZodTypeKind = {}));
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.27.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/toolNameValidation.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/toolNameValidation.js
 var TOOL_NAME_REGEX = /^[A-Za-z0-9._-]{1,128}$/;
 function validateToolName(name) {
   const warnings = [];
@@ -45598,7 +45697,7 @@ function validateAndWarnToolName(name) {
   return result.isValid;
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.27.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/mcp-server.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/mcp-server.js
 var ExperimentalMcpServerTasks = class {
   constructor(_mcpServer) {
     this._mcpServer = _mcpServer;
@@ -45613,7 +45712,43 @@ var ExperimentalMcpServerTasks = class {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.27.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
+function toolInputElementCount(value, max) {
+  let count = 0;
+  const stack = [value];
+  while (stack.length > 0) {
+    const node = stack.pop();
+    if (node === null || typeof node !== "object")
+      continue;
+    if (Array.isArray(node)) {
+      for (const child of node) {
+        if (++count > max)
+          return count;
+        if (child !== null && typeof child === "object")
+          stack.push(child);
+      }
+    } else {
+      for (const key in node) {
+        if (!Object.prototype.hasOwnProperty.call(node, key))
+          continue;
+        if (++count > max)
+          return count;
+        const child = node[key];
+        if (child !== null && typeof child === "object")
+          stack.push(child);
+      }
+    }
+  }
+  return count;
+}
+function resolveMaxToolInputElements(value) {
+  if (value === void 0 || value === Infinity)
+    return void 0;
+  if (typeof value !== "number" || Number.isNaN(value) || value < 1) {
+    throw new RangeError(`maxToolInputElements must be a number of at least 1, or Infinity, got ${String(value)}`);
+  }
+  return value;
+}
 var McpServer = class {
   constructor(serverInfo, options) {
     this._registeredResources = {};
@@ -45625,6 +45760,7 @@ var McpServer = class {
     this._resourceHandlersInitialized = false;
     this._promptHandlersInitialized = false;
     this.server = new Server(serverInfo, options);
+    this._maxToolInputElements = resolveMaxToolInputElements(options?.maxToolInputElements);
   }
   /**
    * Access experimental features.
@@ -45755,12 +45891,15 @@ var McpServer = class {
    * Validates tool input arguments against the tool's input schema.
    */
   async validateToolInput(tool, args, toolName) {
+    if (this._maxToolInputElements !== void 0 && toolInputElementCount(args, this._maxToolInputElements) > this._maxToolInputElements) {
+      throw new McpError(ErrorCode.InvalidParams, `Invalid arguments for tool ${toolName}: arguments contain more than the maximum of ${this._maxToolInputElements} elements`);
+    }
     if (!tool.inputSchema) {
       return void 0;
     }
     const inputObj = normalizeObjectSchema(tool.inputSchema);
     const schemaToParse = inputObj ?? tool.inputSchema;
-    const parseResult = await safeParseAsync2(schemaToParse, args);
+    const parseResult = await safeParseAsync2(schemaToParse, args ?? {});
     if (!parseResult.success) {
       const error2 = "error" in parseResult ? parseResult.error : "Unknown error";
       const errorMessage = getParseErrorMessage(error2);
@@ -45998,7 +46137,7 @@ var McpServer = class {
       }
       if (prompt.argsSchema) {
         const argsObj = normalizeObjectSchema(prompt.argsSchema);
-        const parseResult = await safeParseAsync2(argsObj, request.params.arguments);
+        const parseResult = await safeParseAsync2(argsObj, request.params.arguments ?? {});
         if (!parseResult.success) {
           const error2 = "error" in parseResult ? parseResult.error : "Unknown error";
           const errorMessage = getParseErrorMessage(error2);
@@ -46237,6 +46376,9 @@ var McpServer = class {
           annotations = rest.shift();
         }
       } else if (typeof firstArg === "object" && firstArg !== null) {
+        if (Object.values(firstArg).some((v) => typeof v === "object" && v !== null)) {
+          throw new Error(`Tool ${name} expected a Zod schema or ToolAnnotations, but received an unrecognized object`);
+        }
         annotations = rest.shift();
       }
     }
@@ -46355,6 +46497,9 @@ function getZodSchemaObject(schema) {
   if (isZodRawShapeCompat(schema)) {
     return objectFromShape(schema);
   }
+  if (!isZodSchemaInstance(schema)) {
+    throw new Error("inputSchema must be a Zod schema or raw shape, received an unrecognized object");
+  }
   return schema;
 }
 function promptArgumentsFromSchema(schema) {
@@ -46399,12 +46544,21 @@ var EMPTY_COMPLETION_RESULT = {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.27.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 import process2 from "process";
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.27.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
+var STDIO_DEFAULT_MAX_BUFFER_SIZE = 10 * 1024 * 1024;
 var ReadBuffer = class {
+  constructor(options) {
+    this._maxBufferSize = options?.maxBufferSize ?? STDIO_DEFAULT_MAX_BUFFER_SIZE;
+  }
   append(chunk) {
+    const newSize = (this._buffer?.length ?? 0) + chunk.length;
+    if (newSize > this._maxBufferSize) {
+      this.clear();
+      throw new Error(`ReadBuffer exceeded maximum size of ${this._maxBufferSize} bytes`);
+    }
     this._buffer = this._buffer ? Buffer.concat([this._buffer, chunk]) : chunk;
   }
   readMessage() {
@@ -46430,20 +46584,26 @@ function serializeMessage(message) {
   return JSON.stringify(message) + "\n";
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.27.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 var StdioServerTransport = class {
-  constructor(_stdin = process2.stdin, _stdout = process2.stdout) {
+  constructor(_stdin = process2.stdin, _stdout = process2.stdout, options) {
     this._stdin = _stdin;
     this._stdout = _stdout;
-    this._readBuffer = new ReadBuffer();
     this._started = false;
     this._ondata = (chunk) => {
-      this._readBuffer.append(chunk);
-      this.processReadBuffer();
+      try {
+        this._readBuffer.append(chunk);
+        this.processReadBuffer();
+      } catch (error2) {
+        this.onerror?.(error2);
+        this.close().catch(() => {
+        });
+      }
     };
     this._onerror = (error2) => {
       this.onerror?.(error2);
     };
+    this._readBuffer = new ReadBuffer({ maxBufferSize: options?.maxBufferSize });
   }
   /**
    * Starts listening for messages on stdin.
@@ -47350,6 +47510,15 @@ var ARTEFACT_KINDS_MCP = [
 ];
 
 // src/kanban-write-outcome.ts
+function approvalRedirectNotice(data, match = {}) {
+  const entries = data?.approval_wait_redirects;
+  if (!Array.isArray(entries) || entries.length === 0) return "";
+  const relevant = entries.filter((e) => match.id === void 0 || e?.id === void 0 || e.id === match.id);
+  return relevant.map((e) => {
+    if (typeof e?.message === "string" && e.message.trim()) return ` ${e.message.trim()}`;
+    return typeof e?.approval_request_id === "string" ? ` This card is already waiting on approval ${e.approval_request_id}; it stays parked on that approval.` : "";
+  }).filter((m) => m.length > 0).join("");
+}
 function noticeCloseNotice(data) {
   const entries = data?.notice_close_warnings;
   if (!Array.isArray(entries) || entries.length === 0) return "";
@@ -47951,6 +48120,19 @@ function describeButtonsRequestResult(resp, channelId, optionCount) {
 }
 
 // src/approval-tools.ts
+function describeKanbanLink(requestedCardId, resp) {
+  if (!requestedCardId) return "";
+  if (resp.duplicate) {
+    return ` The card link was not re-checked on this retry; confirm card ${requestedCardId} shows as waiting on the approval with kanban_get.`;
+  }
+  const link = resp.kanban_link;
+  if (link?.linked) return ` Card ${link.kanban_item_id} is now parked on this approval; the approver can decide it from the card.`;
+  const why = link?.reason ?? "not_reported";
+  if (why === "link_stamp_failed") {
+    return ` Card ${requestedCardId} was parked on this approval but the link could not be recorded (link_stamp_failed), so the approver can NOT decide it from the card: they have to use the Approvals page. Do not re-park the card; tell the approver to decide it on the Approvals page.`;
+  }
+  return ` Card ${requestedCardId} was NOT linked to this approval (${why}), so the card is not waiting on it and answering the card will not decide it. Leave the request as is (the approver can still decide it from the Approvals page) and do not park the card as a human Approve/Deny wait.`;
+}
 function statusToOutcome(status) {
   switch (status) {
     case "active":
@@ -47976,7 +48158,8 @@ function render(result) {
     outcome: result.outcome,
     ...result.reason ? { reason: result.reason } : {},
     ...result.result_payload != null ? { result_payload: result.result_payload } : {},
-    ...result.expires_at ? { expires_at: result.expires_at } : {}
+    ...result.expires_at ? { expires_at: result.expires_at } : {},
+    ...result.kanban_link ? { kanban_link: result.kanban_link } : {}
   })].filter(Boolean);
   return { content: [{ type: "text", text: lines.join("\n") }] };
 }
@@ -47992,7 +48175,10 @@ function registerApprovalTools(server2, deps) {
       detail: external_exports.record(external_exports.unknown()).optional().describe(
         "Optional structured context for the approver (display + audit only; never executed). When the action is sending an email, include email: { to, from, subject } (to: an address or a list of them; from: the mailbox it goes out from) so the approval card shows From / To / Subject. Asking again with a different detail under the same idempotency_key is a different request."
       ),
-      ttl_seconds: external_exports.number().int().optional().describe("How long the request stays open before it times out (default 3600; clamped to [60, 86400]).")
+      ttl_seconds: external_exports.number().int().optional().describe("How long the request stays open before it times out (default 3600; clamped to [60, 86400])."),
+      kanban_item_id: external_exports.string().uuid().optional().describe(
+        'The id of YOUR kanban card this approval is about. Pass it whenever the ask belongs to a card: the platform tries to park that card as waiting on this approval, so the approver can Approve/Deny from the card itself and the answer reaches this request. The result says whether the link happened (kanban_link); if it did not, the reason is given and the card is NOT waiting on the approval. Do NOT also park the card as a "human" wait with your own Approve/Deny choices; that creates a second ask the approval never hears, and the request expires.'
+      )
     },
     async (params) => {
       try {
@@ -48002,11 +48188,18 @@ function registerApprovalTools(server2, deps) {
           reason: params.reason,
           idempotency_key: params.idempotency_key,
           detail: params.detail,
-          ttl_seconds: params.ttl_seconds
+          ttl_seconds: params.ttl_seconds,
+          ...params.kanban_item_id ? { kanban_item_id: params.kanban_item_id } : {}
         });
         const outcome = resp.outcome ?? statusToOutcome(resp.status);
         const note = resp.duplicate ? `An open request for this idempotency_key already exists \u2014 re-attached to it (request_id ${resp.request_id}). Poll it with check_approval.` : resp.notification_status === "failed" ? `Approval filed (request_id ${resp.request_id}) but the Manager notification failed (${resp.notification_failure_reason ?? "unknown"}). ${resp.escalated ? "Your org admins were alerted that it is waiting for a decision." : "No human was pinged; tell your operator."} Poll with check_approval.` : `Approval requested (request_id ${resp.request_id}). Your Manager was notified. End your turn; poll with check_approval later.`;
-        return render({ request_id: resp.request_id, outcome, expires_at: resp.expires_at ?? null, note });
+        return render({
+          request_id: resp.request_id,
+          outcome,
+          expires_at: resp.expires_at ?? null,
+          note: note + describeKanbanLink(params.kanban_item_id, resp),
+          ...resp.kanban_link ? { kanban_link: resp.kanban_link } : {}
+        });
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         return {
@@ -48906,7 +49099,9 @@ server.tool(
       data,
       { id: params.id, title: params.title },
       label,
-      () => `Moved "${label}" \u2192 ${params.status}.`
+      // CS-2178: say so when the server kept the card on its pending approval
+      // instead of the human wait asked for, or the agent re-asks on the card.
+      () => `Moved "${label}" \u2192 ${params.status}.${approvalRedirectNotice(data, { id: params.id })}`
     );
     return {
       content: [{ type: "text", text: outcome.text }],
@@ -52208,6 +52403,7 @@ server.tool(
     content: [{ type: "text", text: await resolveArtefactText(params.url) }]
   })
 );
+var todayInAgentTz = () => todayInTz();
 async function listProjectsText(params) {
   const data = await apiPost("/host/my-projects", {
     agent_id: AGT_AGENT_ID,
@@ -52217,7 +52413,8 @@ async function listProjectsText(params) {
   if (!data.projects.length) {
     return "No projects yet. Create one with projects_create (ask the human first), or a human can create one in the console, to group your work under.";
   }
-  return data.projects.map((p2) => `- ${p2.name} [${p2.status}] (id: ${p2.id}, created ${p2.created_at})`).join("\n");
+  const today = data.today ?? todayInAgentTz();
+  return data.projects.map((p2) => projectListLine(p2, today)).join("\n");
 }
 async function getProjectText(projectId) {
   const data = await apiPost(
@@ -52229,6 +52426,7 @@ async function getProjectText(projectId) {
     `Project: ${p2.name} [${p2.status}]`,
     `Id: ${p2.id}`,
     p2.linear_project_id ? `Linear project: ${p2.linear_project_id}` : null,
+    ...projectOwnerDateLines(p2, data.today ?? todayInAgentTz()),
     `Created: ${p2.created_at}`,
     `Last updated: ${p2.updated_at}`
   ].filter((s) => s !== null).join("\n");
@@ -52259,7 +52457,9 @@ async function createProjectText(params) {
     agent_id: AGT_AGENT_ID,
     name: params.name,
     status: params.status,
-    linear_project_id: params.linear_project_id
+    linear_project_id: params.linear_project_id,
+    owner_person_id: params.owner_person_id,
+    target_date: params.target_date
   });
   const p2 = data.project;
   return `Created project "${p2.name}" [${p2.status}] (id: ${p2.id}). Tag artefacts with artefacts_assign_project and tasks with kanban_assign_project.`;
@@ -52270,7 +52470,9 @@ server.tool(
   {
     name: external_exports.string().min(1).max(200).describe('Human-readable project name (e.g. "Q3 launch microsite")'),
     status: external_exports.enum(["active", "archived"]).optional().describe('Project status (default "active")'),
-    linear_project_id: external_exports.string().optional().describe("Optional id of a Linear project to deep-link this project to")
+    linear_project_id: external_exports.string().optional().describe("Optional id of a Linear project to deep-link this project to"),
+    owner_person_id: external_exports.string().uuid().optional().describe("Optional: the ONE person accountable for the project (a person_id from directory_lookup, in your organization)"),
+    target_date: external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional().describe("Optional: the date the outcome is due, YYYY-MM-DD")
   },
   async (params) => ({
     content: [{ type: "text", text: await createProjectText(params) }]
@@ -52283,7 +52485,9 @@ async function updateProjectText(params) {
       agent_id: AGT_AGENT_ID,
       name: params.name,
       status: params.status,
-      linear_project_id: params.linear_project_id
+      linear_project_id: params.linear_project_id,
+      owner_person_id: params.owner_person_id,
+      target_date: params.target_date
     }
   );
   const p2 = data.project;
@@ -52291,13 +52495,15 @@ async function updateProjectText(params) {
 }
 server.tool(
   "projects_update",
-  'Rename a project, archive or unarchive it, or set/clear its Linear link. Pass only the fields to change. A project is shared by your whole team, so ask the human to confirm before renaming or archiving one, naming the project and the change (e.g. archive "Theoretical Store Profitability"). Archiving hides it from active lists but keeps its tasks and artefacts; set status "active" to undo. Projects have no cover image, so there is nothing to set for one.',
+  'Rename a project, archive or unarchive it, or set/clear its Linear link. Pass only the fields to change. A project is shared by your whole team, so ask the human to confirm before renaming or archiving one, naming the project and the change (e.g. archive "Theoretical Store Profitability"). Archiving hides it from active lists but keeps its tasks and artefacts; set status "active" to undo. Projects have no cover image, so there is nothing to set for one. You can also set or clear its one accountable owner (a person_id from directory_lookup) and its target date (YYYY-MM-DD); pass null to clear either.',
   {
     project_id: external_exports.string().uuid().describe("The project id returned by projects_list"),
     // Trim BEFORE the length check, as the host does (CodeRabbit on #6642).
     name: external_exports.string().trim().min(1).max(200).optional().describe("New project name"),
     status: external_exports.enum(["active", "archived"]).optional().describe('"archived" to archive, "active" to unarchive'),
-    linear_project_id: external_exports.string().nullable().optional().describe("Linear project id to deep-link, or null to clear the link")
+    linear_project_id: external_exports.string().nullable().optional().describe("Linear project id to deep-link, or null to clear the link"),
+    owner_person_id: external_exports.string().uuid().nullable().optional().describe("The ONE accountable person (a person_id from directory_lookup), or null to clear"),
+    target_date: external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/).nullable().optional().describe("Date the outcome is due, YYYY-MM-DD, or null to clear")
   },
   async (params) => ({
     content: [{ type: "text", text: await updateProjectText(params) }]