@j0hanz/filesystem-mcp 2.7.5 → 2.8.0

package/dist/core/input-required.js.map

@@ -1 +1 @@
-{"version":3,"file":"input-required.js","sourceRoot":"","sources":["../../src/core/input-required.ts"],"names":[],"mappings":"AAoBA,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,aAAa,GACd,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAyD5C;;;;;;;GAOG;AACH,SAAS,yBAAyB;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAChD,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC;QACrC,MAAM,CAAC,IAAI,CACT,2BAA2B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,8HAA8H,CAC9K,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,GAAkB;IAC7C,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,uBAAuB,CAAe;IACpC,GAAG,EAAE,yBAAyB,EAAE,IAAI,WAAW,CAAC,EAAE,CAAC;IACnD,IAAI,EAAE,mBAAmB;CAC1B,CAAC,CAAC;AAEL,+EAA+E;AAC/E,2EAA2E;AAC3E,gFAAgF;AAChF,yEAAyE;AACzE,iFAAiF;AACjF,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;AACrF,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACvD,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AAErE;;;;;;;;;GASG;AACH,SAAS,kBAAkB,CAAC,KAAmB;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,cAAc,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;KAChG,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAqB,EACrB,MAA+B,EAC/B,GAAkB;IAElB,MAAM,aAAa,GAAiC,EAAE,CAAC;IACvD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC;YAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC;SAC3C,CAAC,CAAC;IACL,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAC/C;QACE,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE;QAChC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,EACD,GAAG,CACJ,CAAC;IACF,OAAO,aAAa,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;AACxD,CAAC;AAuBD;;;;GAIG;AACH,MAAM,mBAAmB,GAAwC;IAC/D,MAAM,EACJ,+EAA+E;QAC/E,0GAA0G;IAC5G,IAAI,EACF,oFAAoF;QACpF,0EAA0E;IAC5E,IAAI,EACF,oFAAoF;QACpF,kGAAkG;IACpG,MAAM,EACJ,6EAA6E;QAC7E,0HAA0H;IAC5H,KAAK,EACH,yGAAyG;QACzG,mEAAmE;CACtE,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CAAC,EAAa,EAAE,YAA4C;IAClF,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO;IACvC,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,CAAC;IAC7C,IACE,WAAW,KAAK,SAAS;QACzB,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,IAAI,WAAW,CAAC,GAAG,KAAK,SAAS,CAAC,EACjE,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,OAAO,CAAC,SAAS,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,mBAAmB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAe,EACf,IAA0B;IAE1B,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC;IACnC,sEAAsE;IACtE,0EAA0E;IAC1E,qEAAqE;IACrE,uEAAuE;IACvE,8DAA8D;IAC9D,qEAAqE;IACrE,yBAAyB;IACzB,IAAI,KAAK,EAAE,EAAE,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;QAC1B,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACjD,OAAO,kBAAkB,CACvB,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,EACpC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAC9B,GAAG,CAAC,SAAS,CACd,CAAC;IACJ,CAAC;IACD,6EAA6E;IAC7E,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,OAAO,CACf,SAAS,CAAC,aAAa,EACvB,GAAG,IAAI,CAAC,EAAE,mDAAmD,CAC9D,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,qDAAqD;IACrD,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,GAAG,CAAC,wBAAwB,EAAE,MAAM,EAAE,CAAC;QACpE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACnD,OAAO,kBAAkB,CACvB,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EACpD,MAAM,EACN,GAAG,CAAC,SAAS,CACd,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,WAAW,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAA8C,EAC9C,GAAW;IAEX,OAAO,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE,cAAc,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAA8C,EAC9C,GAAW;IAEX,OAAO,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAA8C,EAC9C,GAAW;IAEX,OAAO,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAoE,EACpE,GAAW;IAEX,IAAI,GAAG,CAAC,wBAAwB,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO,8GAA8G,CAAC;IACxH,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACpD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,cAAc,CAAC;IAClD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,sBAAsB,CAAC;IAC7D,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,uBAAuB,CAAC;IAC7D,OAAO,iCAAiC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,CAAoB,EAAE,CAAoB;IAC5D,4EAA4E;IAC5E,8EAA8E;IAC9E,wEAAwE;IACxE,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAChF,CAAC","sourcesContent":["// Shared infrastructure for the SEP-2577 `input_required` multi-round-trip\n// destructive-confirmation flows (recursive delete, move overwrite, out-of-root\n// access grant). A handler returns `inputRequired(...)` instead of the deprecated\n// push-style server-to-client elicitation request; the client retries the same\n// `tools/call` carrying `inputResponses`, and the handler re-enters from the top\n// reading the verified `requestState` and the accepted responses.\n//\n// `requestState` round-trips through the client (attacker-controlled on\n// re-entry), so it is sealed with the SDK's HMAC-SHA256 codec. The payload binds\n// each confirmation to its operation kind and sorted target-path set (spec R9,\n// R10); the handler additionally rejects any retry whose decoded paths do not\n// match the retried request's parameters (the codec only proves the state was\n// not tampered — it cannot see the current args).\nimport type {\n  ClientCapabilities,\n  InputRequest,\n  InputRequiredResult,\n  RequestStateCodec,\n  ServerContext,\n} from '@modelcontextprotocol/server';\nimport {\n  acceptedContent,\n  createRequestStateCodec,\n  inputRequired,\n  inputResponse,\n} from '@modelcontextprotocol/server';\n\nimport { randomBytes } from 'node:crypto';\n\nimport * as z from 'zod/v4';\n\nimport { ErrorCode, FsError } from './errors.ts';\nimport { Logger } from './observability.ts';\n\n/** The destructive operation a pending confirmation authorizes. */\ntype PendingOp = 'delete' | 'move' | 'copy' | 'create' | 'grant';\n\n/**\n * Integrity-protected state minted into an `input_required` result and echoed\n * back by the client on retry. `paths` is the sorted canonical set of target\n * paths the confirmation covers; the handler compares it to the retried\n * request's parameters and rejects a mismatch (R9).\n */\nexport interface PendingState {\n  readonly op: PendingOp;\n  readonly paths: readonly string[];\n  /**\n   * Set on the state of a round minted because the previous round's answer\n   * was dropped by the SDK (`droppedInputResponseKeys`). Sealed in the HMAC\n   * payload, so a client cannot clear it: the re-issue happens once.\n   */\n  readonly reissued?: true;\n}\n\n/** The per-round confirmation context; `ToolCtx` satisfies it structurally. */\nexport interface PendingCtx {\n  readonly requestState?: (() => PendingState | undefined) | undefined;\n  /**\n   * What the client declared it can do, or `undefined` when this connection\n   * cannot say. Only positively-absent form support short-circuits; see\n   * {@link assertCanElicit}.\n   */\n  readonly clientCapabilities?: ClientCapabilities | undefined;\n  /** `ctx.mcpReq.droppedInputResponseKeys` for this round; see `ToolCtx`. */\n  readonly droppedInputResponseKeys?: readonly string[] | undefined;\n  readonly inputResponses?: Record<string, unknown> | undefined;\n  /** The live handler context; the codec binds the minted state to its method and caller. */\n  readonly serverCtx: ServerContext;\n}\n\n/** One embedded form-mode confirmation, keyed within the call. */\nexport interface PendingInput {\n  /** Server-assigned key, unique within the `tools/call`. */\n  readonly key: string;\n  /** Human-readable prompt for this item. */\n  readonly message: string;\n  /**\n   * When set, the form offers a single-select enum (`choice` field) over\n   * these values instead of a boolean `confirm`.\n   */\n  readonly choices?: readonly string[];\n  /**\n   * When set with `choices`, the form offers a multi-select enum: `choice` is\n   * a string array (`MultiSelectEnumSchema` shape) and the caller reads the\n   * accepted set with `readAcceptedMultiChoice`. Single-select otherwise.\n   */\n  readonly multi?: boolean;\n}\n\n/**\n * HMAC key for the requestState codec. Read once from\n * `FS_REQUEST_STATE_KEY` (UTF-8, must be >=32 bytes); a random\n * 32-byte key is generated at boot when the env var is unset or too short. A\n * per-process key is correct for stdio and the single-node HTTP leg (decision\n * record 11). A server restart invalidates in-flight tokens; the client\n * re-requests, which is fail-closed and safe.\n */\nfunction configuredRequestStateKey(): Uint8Array | undefined {\n  const env = process.env['FS_REQUEST_STATE_KEY'];\n  if (env) {\n    const bytes = Buffer.from(env, 'utf8');\n    if (bytes.length >= 32) return bytes;\n    Logger.warn(\n      `FS_REQUEST_STATE_KEY is ${String(bytes.length)} bytes; 32 are required. Falling back to a random per-boot key — in-flight input_required rounds will not survive a restart.`,\n    );\n  }\n  return undefined;\n}\n\n/**\n * What a minted `requestState` is bound to: the JSON-RPC method of the\n * request that minted it and the authenticated caller (`ctx.http` is absent\n * on stdio, so the caller part is empty there and constant across rounds).\n * The SDK stores an HMAC tag of this value in the token and refuses an echo\n * whose context yields a different value.\n */\nfunction requestStateBinding(ctx: ServerContext): string {\n  return `${ctx.mcpReq.method}\\0${ctx.http?.authInfo?.clientId ?? ''}`;\n}\n\n/**\n * The codec: `mint` seals a `PendingState` into the opaque wire string a\n * handler returns from `inputRequired({ requestState })`; `verify` drops into\n * `ServerOptions.requestState.verify` and throws on tamper, expiry, or bind\n * mismatch (the seam answers with the frozen `-32602`).\n */\nexport const requestStateCodec: RequestStateCodec<PendingState> =\n  createRequestStateCodec<PendingState>({\n    key: configuredRequestStateKey() ?? randomBytes(32),\n    bind: requestStateBinding,\n  });\n\n// Response shapes handed to the SDK's schema-aware `acceptedContent` overload:\n// it returns `undefined` for a missing key, a decline/cancel, a non-elicit\n// response, AND a payload that fails validation — one call covers every refusal\n// case the readers below used to hand-check. `buildInputRequired` reuses\n// `ConfirmContent` as the no-choices form schema (below), so these sit above it.\nconst ConfirmContent = z.object({ confirm: z.boolean().meta({ title: 'Confirm' }) });\nconst ChoiceContent = z.object({ choice: z.string() });\nconst MultiChoiceContent = z.object({ choice: z.array(z.string()) });\n\n/**\n * The form the client renders for one pending input, as the Zod schema the\n * SDK converts to the elicitation wire shape. A boolean `confirm` when no\n * choices are offered; otherwise a `choice` enum over the offered values,\n * wrapped in an array for multi-select so the client may accept a subset.\n * The offered lists are never empty by construction (single-select always\n * offers two literals; multi-select only runs with two or more grant dirs),\n * so no empty-array guard is added. Each field carries a `title` so a host\n * that renders the form labels it instead of showing the property name.\n */\nfunction requestedSchemaFor(input: PendingInput): z.ZodObject {\n  if (!input.choices) return ConfirmContent;\n  const value = z.enum(input.choices);\n  return z.object({\n    choice: input.multi ? z.array(value).meta({ title: 'Allow' }) : value.meta({ title: 'Action' }),\n  });\n}\n\n/**\n * Build an `input_required` result carrying one boolean confirmation per pending\n * item, plus the integrity-protected `requestState` sealing the operation kind\n * and sorted target paths. `mint` is async (HMAC + base64url).\n */\nexport async function buildInputRequired(\n  pending: PendingState,\n  inputs: readonly PendingInput[],\n  ctx: ServerContext,\n): Promise<InputRequiredResult> {\n  const inputRequests: Record<string, InputRequest> = {};\n  for (const input of inputs) {\n    inputRequests[input.key] = inputRequired.elicit({\n      message: input.message,\n      requestedSchema: requestedSchemaFor(input),\n    });\n  }\n  const requestState = await requestStateCodec.mint(\n    {\n      op: pending.op,\n      paths: [...pending.paths].sort(),\n      ...(pending.reissued ? { reissued: true as const } : {}),\n    },\n    ctx,\n  );\n  return inputRequired({ inputRequests, requestState });\n}\n\n/**\n * The shared read-state → `buildInputRequired` → mismatch-throw flow used by\n * every destructive-confirmation handler (delete, move, grant). No verified\n * state, OR a verified state belonging to a different `op` (e.g. a chained\n * call's grant round already resolved and this is now that same call's own\n * delete/move confirmation round), mints a fresh `input_required` for this\n * op. A retry whose verified state matches this op but not the pending path\n * set throws `FsError(INVALID_INPUT)` (R9) — uniformly surfaced as an\n * `isError` tool result by the handler's catch. Returns `undefined` on a\n * matching same-op retry so the caller proceeds.\n *\n * One home for the R9 binding check means a future fix cannot miss two of three\n * sites. The caller passes the round's `PendingCtx` and supplies `buildInputs`\n * so only the prompt text varies.\n */\ninterface PendingRoundTripOpts {\n  readonly op: PendingOp;\n  readonly pending: readonly string[];\n  readonly buildInputs: (pending: readonly string[]) => readonly PendingInput[];\n}\n\n/**\n * What to tell the model when the round-trip cannot happen. Each names the way\n * forward that does not need a confirmation, or says plainly that there is\n * none — a dead end the model can report is worth more than a retry loop.\n */\nconst NO_ELICITATION_HINT: Readonly<Record<PendingOp, string>> = {\n  delete:\n    'Deleting a non-empty directory needs a confirmation this client cannot show. ' +\n    'Delete the entries inside it individually, or connect a client that declares the elicitation capability.',\n  move:\n    'Overwriting an existing destination needs a confirmation this client cannot show. ' +\n    'Delete the destination first, or move to a path that does not exist yet.',\n  copy:\n    'Overwriting an existing destination needs a confirmation this client cannot show. ' +\n    'Pass overwrite=true to replace it without confirming, or copy to a path that does not exist yet.',\n  create:\n    'Overwriting an existing file needs a confirmation this client cannot show. ' +\n    'Pass overwrite: true on that entry to replace it without confirming, append: true to add to it, or read it and use edit.',\n  grant:\n    'Granting access to a directory outside the allowed roots needs a confirmation this client cannot show. ' +\n    'Call list_roots and use a path under one of the roots it returns.',\n};\n\n/**\n * Fail early, and legibly, when the client cannot answer an embedded form.\n * The SDK checks each `inputRequests` entry against the declared client\n * capabilities and rejects the whole call with `-32021` before anything reaches\n * the wire — a protocol error the model never sees. Throwing `FsError` here\n * instead lands in the tool executor's catch and reaches the model as an\n * `isError` result carrying the workaround.\n *\n * `undefined` capabilities mean the connection cannot report them, NOT that the\n * client has none: proceed and let the SDK decide, exactly as before this check\n * existed.\n */\nfunction assertCanElicit(op: PendingOp, capabilities: ClientCapabilities | undefined): void {\n  if (capabilities === undefined) return;\n  const elicitation = capabilities.elicitation;\n  if (\n    elicitation !== undefined &&\n    (elicitation.form !== undefined || elicitation.url === undefined)\n  ) {\n    return;\n  }\n  throw new FsError(ErrorCode.INVALID_INPUT, `${op}: ${NO_ELICITATION_HINT[op]}`);\n}\n\nexport async function pendingRoundTrip(\n  ctx: PendingCtx,\n  opts: PendingRoundTripOpts,\n): Promise<InputRequiredResult | undefined> {\n  const state = ctx.requestState?.();\n  // No verified state yet, OR the verified state belongs to a different\n  // flow (e.g. an access-grant round's state is still the retried request's\n  // requestState after the grant was applied, and this call is now the\n  // destructive-confirmation round for the SAME tool call) — either way,\n  // this op has not yet had its own round-trip, so mint a fresh\n  // input_required rather than treating a foreign-but-valid state as a\n  // tamper/mismatch error.\n  if (state?.op !== opts.op) {\n    assertCanElicit(opts.op, ctx.clientCapabilities);\n    return buildInputRequired(\n      { op: opts.op, paths: opts.pending },\n      opts.buildInputs(opts.pending),\n      ctx.serverCtx,\n    );\n  }\n  // Retry for THIS op (R9): the verified state must bind the same pending set.\n  if (!pathsEqual(state.paths, opts.pending)) {\n    throw new FsError(\n      ErrorCode.INVALID_INPUT,\n      `${opts.op}: confirmation does not match the requested paths`,\n    );\n  }\n  // The client answered, but in a shape the SDK discards before the handler\n  // runs (`{ method, result }` around the bare result). Ask the same question\n  // once more rather than report a refusal the user never made; the sealed\n  // `reissued` flag stops a second retry from looping.\n  if (state.reissued !== true && ctx.droppedInputResponseKeys?.length) {\n    const dropped = new Set(ctx.droppedInputResponseKeys);\n    const inputs = opts.buildInputs(opts.pending);\n    if (inputs.some((input) => dropped.has(input.key))) {\n      return buildInputRequired(\n        { op: opts.op, paths: opts.pending, reissued: true },\n        inputs,\n        ctx.serverCtx,\n      );\n    }\n  }\n  return undefined;\n}\n\n/**\n * Round-trip key for `pendingSorted[index]` — the single home of the\n * `confirm_${i}` convention. The build side mints it with the map index; the\n * read side re-derives it from the same sorted pending set the requestState\n * binds (R9), so a format change lands here once instead of at six call\n * sites.\n */\nexport function confirmKey(index: number): string {\n  return `confirm_${index}`;\n}\n\n/**\n * Read one pending item's boolean confirmation from a retried request's\n * `inputResponses`. Returns `true` only when the client explicitly accepted AND\n * the `confirm` field is `true`; every other outcome (decline, cancel, missing\n * key, accept-without-confirm) returns `false`, which the caller reports as\n * `CANCELLED` (R3 proceed, R4/R5 cancelled).\n */\nexport function readAcceptedConfirm(\n  responses: Record<string, unknown> | undefined,\n  key: string,\n): boolean {\n  return acceptedContent(responses, key, ConfirmContent)?.confirm === true;\n}\n\n/**\n * Read one pending item's enum selection from a retried request's\n * `inputResponses`. Returns the chosen `value` only when the client explicitly\n * accepted AND the `choice` field is a string; every other outcome (decline,\n * cancel, missing key, accept-without-choice) returns `undefined`, which the\n * caller reports as `CANCELLED` — same contract as the boolean reader.\n *\n * The shape is SDK-validated, but the returned value is NOT checked for\n * membership in the `choices` offered in the request schema. Callers must\n * compare against the expected values (e.g. `choice === 'overwrite'`) before\n * acting — never echo the string back into a path or trust it as an enum\n * member.\n */\nexport function readAcceptedChoice(\n  responses: Record<string, unknown> | undefined,\n  key: string,\n): string | undefined {\n  return acceptedContent(responses, key, ChoiceContent)?.choice;\n}\n\n/**\n * Read one pending item's multi-select enum selection from a retried request's\n * `inputResponses`. Returns the accepted `value`s only when the client\n * explicitly accepted AND `choice` is a string array of strings; every other\n * outcome (decline, cancel, missing key, accept-without-choice, non-array\n * `choice`, non-string elements) returns `undefined`, which the caller reports\n * as `CANCELLED` — same contract as the single-select reader.\n *\n * As with `readAcceptedChoice`, the returned values are NOT checked for\n * membership in the offered `choices`; callers must compare against the\n * expected set before acting.\n */\nexport function readAcceptedMultiChoice(\n  responses: Record<string, unknown> | undefined,\n  key: string,\n): string[] | undefined {\n  return acceptedContent(responses, key, MultiChoiceContent)?.choice;\n}\n\n/**\n * Refusal wording for the `CANCELLED` error; call after a `readAccepted*` reader\n * returned nothing. Pass the round's ctx so a dropped answer is named as such\n * rather than as 'not answered'.\n */\nexport function describeRefusal(\n  ctx: Pick<PendingCtx, 'inputResponses' | 'droppedInputResponseKeys'>,\n  key: string,\n): string {\n  if (ctx.droppedInputResponseKeys?.includes(key)) {\n    return 'answered in a shape this server cannot read (a wrapped result instead of the bare elicitation result), twice';\n  }\n  const view = inputResponse(ctx.inputResponses, key);\n  if (view.kind !== 'elicit') return 'not answered';\n  if (view.action === 'decline') return 'declined by the user';\n  if (view.action === 'cancel') return 'dismissed by the user';\n  return 'answered without a valid choice';\n}\n\n/**\n * Order-independent equality of two sorted, de-duplicated path lists. Used to\n * compare a recomputed pending set against the `requestState`-bound set (R9):\n * both are sorted by construction, so a straight element-wise compare settles\n * it without allocating.\n */\nfunction pathsEqual(a: readonly string[], b: readonly string[]): boolean {\n  // The length check is load-bearing, not an early-out: `every` alone returns\n  // true whenever `a` is a prefix of a longer `b`, so a confirmation minted for\n  // ['/x'] would authorize a retry for ['/x', '/y'] — a direct R9 bypass.\n  return a.length === b.length && a.every((value, index) => value === b[index]);\n}\n"]}
+{"version":3,"file":"input-required.js","sourceRoot":"","sources":["../../src/core/input-required.ts"],"names":[],"mappings":"AAoBA,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,aAAa,GACd,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAoE5C;;;;;;;GAOG;AACH,SAAS,yBAAyB;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAChD,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC;QACrC,MAAM,CAAC,IAAI,CACT,2BAA2B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,8HAA8H,CAC9K,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,GAAkB;IAC7C,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,uBAAuB,CAAe;IACpC,GAAG,EAAE,yBAAyB,EAAE,IAAI,WAAW,CAAC,EAAE,CAAC;IACnD,IAAI,EAAE,mBAAmB;CAC1B,CAAC,CAAC;AAEL,+EAA+E;AAC/E,2EAA2E;AAC3E,gFAAgF;AAChF,yEAAyE;AACzE,iFAAiF;AACjF,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;AACrF,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACvD,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AAErE;;;;;;;;;GASG;AACH,SAAS,kBAAkB,CAAC,KAAmB;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,cAAc,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;KAChG,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAqB,EACrB,MAA+B,EAC/B,GAAkB;IAElB,MAAM,aAAa,GAAiC,EAAE,CAAC;IACvD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC;YAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC;SAC3C,CAAC,CAAC;IACL,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAC/C;QACE,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE;QAChC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,EACD,GAAG,CACJ,CAAC;IACF,OAAO,aAAa,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;AACxD,CAAC;AAwBD;;;;GAIG;AACH,MAAM,mBAAmB,GAAwC;IAC/D,MAAM,EACJ,+EAA+E;QAC/E,0GAA0G;IAC5G,IAAI,EACF,oFAAoF;QACpF,0EAA0E;IAC5E,IAAI,EACF,oFAAoF;QACpF,kGAAkG;IACpG,MAAM,EACJ,6EAA6E;QAC7E,0HAA0H;IAC5H,KAAK,EACH,yGAAyG;QACzG,mEAAmE;CACtE,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CAAC,EAAa,EAAE,YAA4C;IAClF,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO;IACvC,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,CAAC;IAC7C,IACE,WAAW,KAAK,SAAS;QACzB,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,IAAI,WAAW,CAAC,GAAG,KAAK,SAAS,CAAC,EACjE,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,OAAO,CAAC,SAAS,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,mBAAmB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAe,EACf,IAA0B;IAE1B,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC;IACnC,sEAAsE;IACtE,0EAA0E;IAC1E,qEAAqE;IACrE,uEAAuE;IACvE,8DAA8D;IAC9D,qEAAqE;IACrE,yBAAyB;IACzB,IAAI,KAAK,EAAE,EAAE,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;QAC1B,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACjD,OAAO,kBAAkB,CACvB;YACE,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,OAAO;YACnB,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E,EACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAC9B,GAAG,CAAC,SAAS,CACd,CAAC;IACJ,CAAC;IACD,6EAA6E;IAC7E,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,OAAO,CACf,SAAS,CAAC,aAAa,EACvB,GAAG,IAAI,CAAC,EAAE,mDAAmD,CAC9D,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,qDAAqD;IACrD,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,GAAG,CAAC,wBAAwB,EAAE,MAAM,EAAE,CAAC;QACpE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACnD,OAAO,kBAAkB,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,WAAW,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAA8C,EAC9C,GAAW;IAEX,OAAO,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE,cAAc,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAA8C,EAC9C,GAAW;IAEX,OAAO,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAA8C,EAC9C,GAAW;IAEX,OAAO,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAoE,EACpE,GAAW;IAEX,IAAI,GAAG,CAAC,wBAAwB,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO,8GAA8G,CAAC;IACxH,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACpD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,cAAc,CAAC;IAClD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,sBAAsB,CAAC;IAC7D,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,uBAAuB,CAAC;IAC7D,OAAO,iCAAiC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,CAAoB,EAAE,CAAoB;IAC5D,4EAA4E;IAC5E,8EAA8E;IAC9E,wEAAwE;IACxE,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAChF,CAAC","sourcesContent":["// Shared infrastructure for the SEP-2577 `input_required` multi-round-trip\n// destructive-confirmation flows (recursive delete, move overwrite, out-of-root\n// access grant). A handler returns `inputRequired(...)` instead of the deprecated\n// push-style server-to-client elicitation request; the client retries the same\n// `tools/call` carrying `inputResponses`, and the handler re-enters from the top\n// reading the verified `requestState` and the accepted responses.\n//\n// `requestState` round-trips through the client (attacker-controlled on\n// re-entry), so it is sealed with the SDK's HMAC-SHA256 codec. The payload binds\n// each confirmation to its operation kind and sorted target-path set (spec R9,\n// R10); the handler additionally rejects any retry whose decoded paths do not\n// match the retried request's parameters (the codec only proves the state was\n// not tampered — it cannot see the current args).\nimport type {\n  ClientCapabilities,\n  InputRequest,\n  InputRequiredResult,\n  RequestStateCodec,\n  ServerContext,\n} from '@modelcontextprotocol/server';\nimport {\n  acceptedContent,\n  createRequestStateCodec,\n  inputRequired,\n  inputResponse,\n} from '@modelcontextprotocol/server';\n\nimport { randomBytes } from 'node:crypto';\n\nimport * as z from 'zod/v4';\n\nimport { ErrorCode, FsError } from './errors.ts';\nimport type { FileType } from './fs.ts';\nimport { Logger } from './observability.ts';\n\n/** The destructive operation a pending confirmation authorizes. */\ntype PendingOp = 'delete' | 'move' | 'copy' | 'create' | 'grant';\n\n/** The original filesystem object covered by a recursive-delete confirmation. */\nexport interface PendingDeleteIdentity {\n  readonly path: string;\n  readonly itemType: FileType;\n  readonly dev: number;\n  readonly ino: number;\n  readonly birthtimeMs: number;\n}\n\n/**\n * Integrity-protected state minted into an `input_required` result and echoed\n * back by the client on retry. `paths` is the sorted canonical set of target\n * paths the confirmation covers; the handler compares it to the retried\n * request's parameters and rejects a mismatch (R9).\n */\nexport interface PendingState {\n  readonly op: PendingOp;\n  readonly paths: readonly string[];\n  /** Original objects, preserved on reissue; legacy tokens without these cannot authorize delete. */\n  readonly deleteIdentities?: readonly PendingDeleteIdentity[];\n  /**\n   * Set on the state of a round minted because the previous round's answer\n   * was dropped by the SDK (`droppedInputResponseKeys`). Sealed in the HMAC\n   * payload, so a client cannot clear it: the re-issue happens once.\n   */\n  readonly reissued?: true;\n}\n\n/** The per-round confirmation context; `ToolCtx` satisfies it structurally. */\nexport interface PendingCtx {\n  readonly requestState?: (() => PendingState | undefined) | undefined;\n  /**\n   * What the client declared it can do, or `undefined` when this connection\n   * cannot say. Only positively-absent form support short-circuits; see\n   * {@link assertCanElicit}.\n   */\n  readonly clientCapabilities?: ClientCapabilities | undefined;\n  /** `ctx.mcpReq.droppedInputResponseKeys` for this round; see `ToolCtx`. */\n  readonly droppedInputResponseKeys?: readonly string[] | undefined;\n  readonly inputResponses?: Record<string, unknown> | undefined;\n  /** The live handler context; the codec binds the minted state to its method and caller. */\n  readonly serverCtx: ServerContext;\n}\n\n/** One embedded form-mode confirmation, keyed within the call. */\nexport interface PendingInput {\n  /** Server-assigned key, unique within the `tools/call`. */\n  readonly key: string;\n  /** Human-readable prompt for this item. */\n  readonly message: string;\n  /**\n   * When set, the form offers a single-select enum (`choice` field) over\n   * these values instead of a boolean `confirm`.\n   */\n  readonly choices?: readonly string[];\n  /**\n   * When set with `choices`, the form offers a multi-select enum: `choice` is\n   * a string array (`MultiSelectEnumSchema` shape) and the caller reads the\n   * accepted set with `readAcceptedMultiChoice`. Single-select otherwise.\n   */\n  readonly multi?: boolean;\n}\n\n/**\n * HMAC key for the requestState codec. Read once from\n * `FS_REQUEST_STATE_KEY` (UTF-8, must be >=32 bytes); a random\n * 32-byte key is generated at boot when the env var is unset or too short. A\n * per-process key is correct for stdio and the single-node HTTP leg (decision\n * record 11). A server restart invalidates in-flight tokens; the client\n * re-requests, which is fail-closed and safe.\n */\nfunction configuredRequestStateKey(): Uint8Array | undefined {\n  const env = process.env['FS_REQUEST_STATE_KEY'];\n  if (env) {\n    const bytes = Buffer.from(env, 'utf8');\n    if (bytes.length >= 32) return bytes;\n    Logger.warn(\n      `FS_REQUEST_STATE_KEY is ${String(bytes.length)} bytes; 32 are required. Falling back to a random per-boot key — in-flight input_required rounds will not survive a restart.`,\n    );\n  }\n  return undefined;\n}\n\n/**\n * What a minted `requestState` is bound to: the JSON-RPC method of the\n * request that minted it and the authenticated caller (`ctx.http` is absent\n * on stdio, so the caller part is empty there and constant across rounds).\n * The SDK stores an HMAC tag of this value in the token and refuses an echo\n * whose context yields a different value.\n */\nfunction requestStateBinding(ctx: ServerContext): string {\n  return `${ctx.mcpReq.method}\\0${ctx.http?.authInfo?.clientId ?? ''}`;\n}\n\n/**\n * The codec: `mint` seals a `PendingState` into the opaque wire string a\n * handler returns from `inputRequired({ requestState })`; `verify` drops into\n * `ServerOptions.requestState.verify` and throws on tamper, expiry, or bind\n * mismatch (the seam answers with the frozen `-32602`).\n */\nexport const requestStateCodec: RequestStateCodec<PendingState> =\n  createRequestStateCodec<PendingState>({\n    key: configuredRequestStateKey() ?? randomBytes(32),\n    bind: requestStateBinding,\n  });\n\n// Response shapes handed to the SDK's schema-aware `acceptedContent` overload:\n// it returns `undefined` for a missing key, a decline/cancel, a non-elicit\n// response, AND a payload that fails validation — one call covers every refusal\n// case the readers below used to hand-check. `buildInputRequired` reuses\n// `ConfirmContent` as the no-choices form schema (below), so these sit above it.\nconst ConfirmContent = z.object({ confirm: z.boolean().meta({ title: 'Confirm' }) });\nconst ChoiceContent = z.object({ choice: z.string() });\nconst MultiChoiceContent = z.object({ choice: z.array(z.string()) });\n\n/**\n * The form the client renders for one pending input, as the Zod schema the\n * SDK converts to the elicitation wire shape. A boolean `confirm` when no\n * choices are offered; otherwise a `choice` enum over the offered values,\n * wrapped in an array for multi-select so the client may accept a subset.\n * The offered lists are never empty by construction (single-select always\n * offers two literals; multi-select only runs with two or more grant dirs),\n * so no empty-array guard is added. Each field carries a `title` so a host\n * that renders the form labels it instead of showing the property name.\n */\nfunction requestedSchemaFor(input: PendingInput): z.ZodObject {\n  if (!input.choices) return ConfirmContent;\n  const value = z.enum(input.choices);\n  return z.object({\n    choice: input.multi ? z.array(value).meta({ title: 'Allow' }) : value.meta({ title: 'Action' }),\n  });\n}\n\n/**\n * Build an `input_required` result carrying one boolean confirmation per pending\n * item, plus the integrity-protected `requestState` sealing the operation kind\n * and sorted target paths. `mint` is async (HMAC + base64url).\n */\nexport async function buildInputRequired(\n  pending: PendingState,\n  inputs: readonly PendingInput[],\n  ctx: ServerContext,\n): Promise<InputRequiredResult> {\n  const inputRequests: Record<string, InputRequest> = {};\n  for (const input of inputs) {\n    inputRequests[input.key] = inputRequired.elicit({\n      message: input.message,\n      requestedSchema: requestedSchemaFor(input),\n    });\n  }\n  const requestState = await requestStateCodec.mint(\n    {\n      op: pending.op,\n      paths: [...pending.paths].sort(),\n      ...(pending.deleteIdentities ? { deleteIdentities: pending.deleteIdentities } : {}),\n      ...(pending.reissued ? { reissued: true as const } : {}),\n    },\n    ctx,\n  );\n  return inputRequired({ inputRequests, requestState });\n}\n\n/**\n * The shared read-state → `buildInputRequired` → mismatch-throw flow used by\n * every destructive-confirmation handler (delete, move, grant). No verified\n * state, OR a verified state belonging to a different `op` (e.g. a chained\n * call's grant round already resolved and this is now that same call's own\n * delete/move confirmation round), mints a fresh `input_required` for this\n * op. A retry whose verified state matches this op but not the pending path\n * set throws `FsError(INVALID_INPUT)` (R9) — uniformly surfaced as an\n * `isError` tool result by the handler's catch. Returns `undefined` on a\n * matching same-op retry so the caller proceeds.\n *\n * One home for the R9 binding check means a future fix cannot miss two of three\n * sites. The caller passes the round's `PendingCtx` and supplies `buildInputs`\n * so only the prompt text varies.\n */\ninterface PendingRoundTripOpts {\n  readonly op: PendingOp;\n  readonly pending: readonly string[];\n  readonly deleteIdentities?: readonly PendingDeleteIdentity[];\n  readonly buildInputs: (pending: readonly string[]) => readonly PendingInput[];\n}\n\n/**\n * What to tell the model when the round-trip cannot happen. Each names the way\n * forward that does not need a confirmation, or says plainly that there is\n * none — a dead end the model can report is worth more than a retry loop.\n */\nconst NO_ELICITATION_HINT: Readonly<Record<PendingOp, string>> = {\n  delete:\n    'Deleting a non-empty directory needs a confirmation this client cannot show. ' +\n    'Delete the entries inside it individually, or connect a client that declares the elicitation capability.',\n  move:\n    'Overwriting an existing destination needs a confirmation this client cannot show. ' +\n    'Delete the destination first, or move to a path that does not exist yet.',\n  copy:\n    'Overwriting an existing destination needs a confirmation this client cannot show. ' +\n    'Pass overwrite=true to replace it without confirming, or copy to a path that does not exist yet.',\n  create:\n    'Overwriting an existing file needs a confirmation this client cannot show. ' +\n    'Pass overwrite: true on that entry to replace it without confirming, append: true to add to it, or read it and use edit.',\n  grant:\n    'Granting access to a directory outside the allowed roots needs a confirmation this client cannot show. ' +\n    'Call list_roots and use a path under one of the roots it returns.',\n};\n\n/**\n * Fail early, and legibly, when the client cannot answer an embedded form.\n * The SDK checks each `inputRequests` entry against the declared client\n * capabilities and rejects the whole call with `-32021` before anything reaches\n * the wire — a protocol error the model never sees. Throwing `FsError` here\n * instead lands in the tool executor's catch and reaches the model as an\n * `isError` result carrying the workaround.\n *\n * `undefined` capabilities mean the connection cannot report them, NOT that the\n * client has none: proceed and let the SDK decide, exactly as before this check\n * existed.\n */\nfunction assertCanElicit(op: PendingOp, capabilities: ClientCapabilities | undefined): void {\n  if (capabilities === undefined) return;\n  const elicitation = capabilities.elicitation;\n  if (\n    elicitation !== undefined &&\n    (elicitation.form !== undefined || elicitation.url === undefined)\n  ) {\n    return;\n  }\n  throw new FsError(ErrorCode.INVALID_INPUT, `${op}: ${NO_ELICITATION_HINT[op]}`);\n}\n\nexport async function pendingRoundTrip(\n  ctx: PendingCtx,\n  opts: PendingRoundTripOpts,\n): Promise<InputRequiredResult | undefined> {\n  const state = ctx.requestState?.();\n  // No verified state yet, OR the verified state belongs to a different\n  // flow (e.g. an access-grant round's state is still the retried request's\n  // requestState after the grant was applied, and this call is now the\n  // destructive-confirmation round for the SAME tool call) — either way,\n  // this op has not yet had its own round-trip, so mint a fresh\n  // input_required rather than treating a foreign-but-valid state as a\n  // tamper/mismatch error.\n  if (state?.op !== opts.op) {\n    assertCanElicit(opts.op, ctx.clientCapabilities);\n    return buildInputRequired(\n      {\n        op: opts.op,\n        paths: opts.pending,\n        ...(opts.deleteIdentities ? { deleteIdentities: opts.deleteIdentities } : {}),\n      },\n      opts.buildInputs(opts.pending),\n      ctx.serverCtx,\n    );\n  }\n  // Retry for THIS op (R9): the verified state must bind the same pending set.\n  if (!pathsEqual(state.paths, opts.pending)) {\n    throw new FsError(\n      ErrorCode.INVALID_INPUT,\n      `${opts.op}: confirmation does not match the requested paths`,\n    );\n  }\n  // The client answered, but in a shape the SDK discards before the handler\n  // runs (`{ method, result }` around the bare result). Ask the same question\n  // once more rather than report a refusal the user never made; the sealed\n  // `reissued` flag stops a second retry from looping.\n  if (state.reissued !== true && ctx.droppedInputResponseKeys?.length) {\n    const dropped = new Set(ctx.droppedInputResponseKeys);\n    const inputs = opts.buildInputs(opts.pending);\n    if (inputs.some((input) => dropped.has(input.key))) {\n      return buildInputRequired({ ...state, reissued: true }, inputs, ctx.serverCtx);\n    }\n  }\n  return undefined;\n}\n\n/**\n * Round-trip key for `pendingSorted[index]` — the single home of the\n * `confirm_${i}` convention. The build side mints it with the map index; the\n * read side re-derives it from the same sorted pending set the requestState\n * binds (R9), so a format change lands here once instead of at six call\n * sites.\n */\nexport function confirmKey(index: number): string {\n  return `confirm_${index}`;\n}\n\n/**\n * Read one pending item's boolean confirmation from a retried request's\n * `inputResponses`. Returns `true` only when the client explicitly accepted AND\n * the `confirm` field is `true`; every other outcome (decline, cancel, missing\n * key, accept-without-confirm) returns `false`, which the caller reports as\n * `CANCELLED` (R3 proceed, R4/R5 cancelled).\n */\nexport function readAcceptedConfirm(\n  responses: Record<string, unknown> | undefined,\n  key: string,\n): boolean {\n  return acceptedContent(responses, key, ConfirmContent)?.confirm === true;\n}\n\n/**\n * Read one pending item's enum selection from a retried request's\n * `inputResponses`. Returns the chosen `value` only when the client explicitly\n * accepted AND the `choice` field is a string; every other outcome (decline,\n * cancel, missing key, accept-without-choice) returns `undefined`, which the\n * caller reports as `CANCELLED` — same contract as the boolean reader.\n *\n * The shape is SDK-validated, but the returned value is NOT checked for\n * membership in the `choices` offered in the request schema. Callers must\n * compare against the expected values (e.g. `choice === 'overwrite'`) before\n * acting — never echo the string back into a path or trust it as an enum\n * member.\n */\nexport function readAcceptedChoice(\n  responses: Record<string, unknown> | undefined,\n  key: string,\n): string | undefined {\n  return acceptedContent(responses, key, ChoiceContent)?.choice;\n}\n\n/**\n * Read one pending item's multi-select enum selection from a retried request's\n * `inputResponses`. Returns the accepted `value`s only when the client\n * explicitly accepted AND `choice` is a string array of strings; every other\n * outcome (decline, cancel, missing key, accept-without-choice, non-array\n * `choice`, non-string elements) returns `undefined`, which the caller reports\n * as `CANCELLED` — same contract as the single-select reader.\n *\n * As with `readAcceptedChoice`, the returned values are NOT checked for\n * membership in the offered `choices`; callers must compare against the\n * expected set before acting.\n */\nexport function readAcceptedMultiChoice(\n  responses: Record<string, unknown> | undefined,\n  key: string,\n): string[] | undefined {\n  return acceptedContent(responses, key, MultiChoiceContent)?.choice;\n}\n\n/**\n * Refusal wording for the `CANCELLED` error; call after a `readAccepted*` reader\n * returned nothing. Pass the round's ctx so a dropped answer is named as such\n * rather than as 'not answered'.\n */\nexport function describeRefusal(\n  ctx: Pick<PendingCtx, 'inputResponses' | 'droppedInputResponseKeys'>,\n  key: string,\n): string {\n  if (ctx.droppedInputResponseKeys?.includes(key)) {\n    return 'answered in a shape this server cannot read (a wrapped result instead of the bare elicitation result), twice';\n  }\n  const view = inputResponse(ctx.inputResponses, key);\n  if (view.kind !== 'elicit') return 'not answered';\n  if (view.action === 'decline') return 'declined by the user';\n  if (view.action === 'cancel') return 'dismissed by the user';\n  return 'answered without a valid choice';\n}\n\n/**\n * Order-independent equality of two sorted, de-duplicated path lists. Used to\n * compare a recomputed pending set against the `requestState`-bound set (R9):\n * both are sorted by construction, so a straight element-wise compare settles\n * it without allocating.\n */\nfunction pathsEqual(a: readonly string[], b: readonly string[]): boolean {\n  // The length check is load-bearing, not an early-out: `every` alone returns\n  // true whenever `a` is a prefix of a longer `b`, so a confirmation minted for\n  // ['/x'] would authorize a retry for ['/x', '/y'] — a direct R9 bypass.\n  return a.length === b.length && a.every((value, index) => value === b[index]);\n}\n"]}

package/dist/core/observability.d.ts

@@ -15,5 +15,7 @@ export declare const Logger: {
     error: (message: string, ...args: unknown[]) => void;
     debug: (message: string, ...args: unknown[]) => void;
 };
+/** A failed notify means the connection went away: nothing to recover, so log and drop it. */
+export declare function voidSend(send: Promise<unknown> | undefined, label: string, fields?: object): void;
 export declare function logRuntimeFailure(id: string, scope: string, method: string, error: unknown): void;
 //# sourceMappingURL=observability.d.ts.map

package/dist/core/observability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"observability.d.ts","sourceRoot":"","sources":["../../src/core/observability.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,YAAY,GACtB,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,GAAG,WAAW,CAAC;AA2DzF;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAM,GAAG,MAAM,CAEjE;AAED,eAAO,MAAM,MAAM;kBACH,YAAY,WAAW,MAAM;oBAG3B,MAAM,WAAW,OAAO,EAAE;oBAG1B,MAAM,WAAW,OAAO,EAAE;qBAGzB,MAAM,WAAW,OAAO,EAAE;qBAG1B,MAAM,WAAW,OAAO,EAAE;CAG5C,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAEjG"}
+{"version":3,"file":"observability.d.ts","sourceRoot":"","sources":["../../src/core/observability.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,YAAY,GACtB,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,GAAG,WAAW,CAAC;AA2DzF;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAM,GAAG,MAAM,CAEjE;AAED,eAAO,MAAM,MAAM;kBACH,YAAY,WAAW,MAAM;oBAG3B,MAAM,WAAW,OAAO,EAAE;oBAG1B,MAAM,WAAW,OAAO,EAAE;qBAGzB,MAAM,WAAW,OAAO,EAAE;qBAG1B,MAAM,WAAW,OAAO,EAAE;CAG5C,CAAC;AAEF,8FAA8F;AAC9F,wBAAgB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAIjG;AAED,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAEjG"}

package/dist/core/observability.js

@@ -1,4 +1,5 @@
 import { cli } from "./config.js";
+import { formatUnknownErrorMessage } from "./errors.js";
 import { warnInvalidSetting } from "./path-utils.js";
 // RFC 5424 severities, most severe first. A message is emitted when its
 // severity is at least as high as the configured minimum.
@@ -82,6 +83,12 @@ export const Logger = {
         write('debug', message, args);
     },
 };
+/** A failed notify means the connection went away: nothing to recover, so log and drop it. */
+export function voidSend(send, label, fields) {
+    void send?.catch((error) => {
+        Logger.debug(`${label} not delivered`, { ...fields, error: formatUnknownErrorMessage(error) });
+    });
+}
 export function logRuntimeFailure(id, scope, method, error) {
     write('error', `Runtime failure: ${id} [${scope}.${method}]`, [error]);
 }

package/dist/core/observability.js.map

@@ -1 +1 @@
-{"version":3,"file":"observability.js","sourceRoot":"","sources":["../../src/core/observability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAKrD,wEAAwE;AACxE,0DAA0D;AAC1D,MAAM,WAAW,GAA4B;IAC3C,WAAW;IACX,OAAO;IACP,UAAU;IACV,OAAO;IACP,SAAS;IACT,QAAQ;IACR,MAAM;IACN,OAAO;CACR,CAAC;AAEF,SAAS,cAAc,CAAC,KAAa;IACnC,OAAQ,WAAiC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,aAAa,CAAC,GAAuB;IAC5C,IAAI,CAAC,GAAG;QAAE,OAAO,MAAM,CAAC;IACxB,8EAA8E;IAC9E,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACpC,kBAAkB,CAAC,cAAc,EAAE,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IACvE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,sEAAsE;AACtE,6EAA6E;AAC7E,IAAI,SAA6B,CAAC;AAClC,IAAI,WAAW,GAAiB,MAAM,CAAC;AAEvC;;;;;GAKG;AACH,SAAS,WAAW;IAClB,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,SAAS,GAAG,GAAG,CAAC;QAChB,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,yEAAyE;AACzE,SAAS,cAAc,CAAC,KAAmB,EAAE,UAAwB,WAAW,EAAE;IAChF,OAAO,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,KAAK,CAAC,KAAmB,EAAE,OAAe,EAAE,IAAwB;IAC3E,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO;IACnC,MAAM,MAAM,GAAG,IAAI,KAAK,GAAG,CAAC;IAC5B,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,GAAG,GAAG,GAAG;IACvD,OAAO,KAAK,CAAC,OAAO,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,IAAI,EAAE,CAAC,KAAmB,EAAE,OAAe,EAAE,EAAE;QAC7C,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE;QAC5C,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE;QAC5C,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,KAAK,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE;QAC7C,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IACD,KAAK,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE;QAC7C,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;CACF,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,EAAU,EAAE,KAAa,EAAE,MAAc,EAAE,KAAc;IACzF,KAAK,CAAC,OAAO,EAAE,oBAAoB,EAAE,KAAK,KAAK,IAAI,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;AACzE,CAAC","sourcesContent":["import { cli } from './config.ts';\nimport { warnInvalidSetting } from './path-utils.ts';\n\nexport type LoggingLevel =\n  'debug' | 'info' | 'notice' | 'warning' | 'error' | 'critical' | 'alert' | 'emergency';\n\n// RFC 5424 severities, most severe first. A message is emitted when its\n// severity is at least as high as the configured minimum.\nconst LEVEL_ORDER: readonly LoggingLevel[] = [\n  'emergency',\n  'alert',\n  'critical',\n  'error',\n  'warning',\n  'notice',\n  'info',\n  'debug',\n];\n\nfunction isLoggingLevel(value: string): value is LoggingLevel {\n  return (LEVEL_ORDER as readonly string[]).includes(value);\n}\n\nfunction parseLogLevel(raw: string | undefined): LoggingLevel {\n  if (!raw) return 'info';\n  // `warn` is the common short form; the canonical RFC 5424 level is `warning`.\n  if (raw === 'warn') return 'warning';\n  if (isLoggingLevel(raw)) return raw;\n  warnInvalidSetting('FS_LOG_LEVEL', raw, LEVEL_ORDER.join('|'), 'info');\n  return 'info';\n}\n\n// Seeded to the value `parseLogLevel(undefined)` returns, so an unset\n// FS_LOG_LEVEL — the initial `cachedRaw` — needs no first-call special case.\nlet cachedRaw: string | undefined;\nlet cachedLevel: LoggingLevel = 'info';\n\n/**\n * Minimum severity that reaches stderr, from `FS_LOG_LEVEL` / `--log-level`.\n * Memoized on the raw value, not resolved once: `cli.logLevel` lands after\n * `parseArgs`, and writes happen before that. Keying on the raw string keeps it\n * live while the invalid-value warning fires once per setting, not per line.\n */\nfunction getLogLevel(): LoggingLevel {\n  const raw = (cli.logLevel ?? process.env['FS_LOG_LEVEL'])?.trim().toLowerCase();\n  if (raw !== cachedRaw) {\n    cachedRaw = raw;\n    cachedLevel = parseLogLevel(raw);\n  }\n  return cachedLevel;\n}\n\n/** True when `level` is at least as severe as the configured minimum. */\nfunction isLevelEnabled(level: LoggingLevel, minimum: LoggingLevel = getLogLevel()): boolean {\n  return LEVEL_ORDER.indexOf(level) <= LEVEL_ORDER.indexOf(minimum);\n}\n\nfunction write(level: LoggingLevel, message: string, args: readonly unknown[]): void {\n  if (!isLevelEnabled(level)) return;\n  const prefix = `[${level}]`;\n  console.error(`${prefix} ${message}`, ...args);\n}\n\n/**\n * A client-supplied value (a JSON-RPC id, a `traceparent`, a tool's own log\n * message) made safe for one stderr line: a control character or a Unicode\n * line/paragraph separator (U+2028/U+2029, which `\\p{Cc}` misses) would let\n * a caller forge extra log lines, and an unbounded value would let it flood\n * one. `max` bounds the value; pass `Infinity` for free text that is only\n * flattened.\n */\nexport function sanitizeLogField(value: string, max = 128): string {\n  return value.replace(/[\\p{Cc}\\p{Zl}\\p{Zp}]+/gu, ' ').slice(0, max);\n}\n\nexport const Logger = {\n  emit: (level: LoggingLevel, message: string) => {\n    write(level, message, []);\n  },\n  info: (message: string, ...args: unknown[]) => {\n    write('info', message, args);\n  },\n  warn: (message: string, ...args: unknown[]) => {\n    write('warning', message, args);\n  },\n  error: (message: string, ...args: unknown[]) => {\n    write('error', message, args);\n  },\n  debug: (message: string, ...args: unknown[]) => {\n    write('debug', message, args);\n  },\n};\n\nexport function logRuntimeFailure(id: string, scope: string, method: string, error: unknown): void {\n  write('error', `Runtime failure: ${id} [${scope}.${method}]`, [error]);\n}\n"]}
+{"version":3,"file":"observability.js","sourceRoot":"","sources":["../../src/core/observability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAKrD,wEAAwE;AACxE,0DAA0D;AAC1D,MAAM,WAAW,GAA4B;IAC3C,WAAW;IACX,OAAO;IACP,UAAU;IACV,OAAO;IACP,SAAS;IACT,QAAQ;IACR,MAAM;IACN,OAAO;CACR,CAAC;AAEF,SAAS,cAAc,CAAC,KAAa;IACnC,OAAQ,WAAiC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,aAAa,CAAC,GAAuB;IAC5C,IAAI,CAAC,GAAG;QAAE,OAAO,MAAM,CAAC;IACxB,8EAA8E;IAC9E,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACpC,kBAAkB,CAAC,cAAc,EAAE,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IACvE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,sEAAsE;AACtE,6EAA6E;AAC7E,IAAI,SAA6B,CAAC;AAClC,IAAI,WAAW,GAAiB,MAAM,CAAC;AAEvC;;;;;GAKG;AACH,SAAS,WAAW;IAClB,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,SAAS,GAAG,GAAG,CAAC;QAChB,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,yEAAyE;AACzE,SAAS,cAAc,CAAC,KAAmB,EAAE,UAAwB,WAAW,EAAE;IAChF,OAAO,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,KAAK,CAAC,KAAmB,EAAE,OAAe,EAAE,IAAwB;IAC3E,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO;IACnC,MAAM,MAAM,GAAG,IAAI,KAAK,GAAG,CAAC;IAC5B,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,GAAG,GAAG,GAAG;IACvD,OAAO,KAAK,CAAC,OAAO,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,IAAI,EAAE,CAAC,KAAmB,EAAE,OAAe,EAAE,EAAE;QAC7C,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE;QAC5C,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE;QAC5C,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,KAAK,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE;QAC7C,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IACD,KAAK,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE;QAC7C,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;CACF,CAAC;AAEF,8FAA8F;AAC9F,MAAM,UAAU,QAAQ,CAAC,IAAkC,EAAE,KAAa,EAAE,MAAe;IACzF,KAAK,IAAI,EAAE,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAClC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,gBAAgB,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAAU,EAAE,KAAa,EAAE,MAAc,EAAE,KAAc;IACzF,KAAK,CAAC,OAAO,EAAE,oBAAoB,EAAE,KAAK,KAAK,IAAI,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;AACzE,CAAC","sourcesContent":["import { cli } from './config.ts';\nimport { formatUnknownErrorMessage } from './errors.ts';\nimport { warnInvalidSetting } from './path-utils.ts';\n\nexport type LoggingLevel =\n  'debug' | 'info' | 'notice' | 'warning' | 'error' | 'critical' | 'alert' | 'emergency';\n\n// RFC 5424 severities, most severe first. A message is emitted when its\n// severity is at least as high as the configured minimum.\nconst LEVEL_ORDER: readonly LoggingLevel[] = [\n  'emergency',\n  'alert',\n  'critical',\n  'error',\n  'warning',\n  'notice',\n  'info',\n  'debug',\n];\n\nfunction isLoggingLevel(value: string): value is LoggingLevel {\n  return (LEVEL_ORDER as readonly string[]).includes(value);\n}\n\nfunction parseLogLevel(raw: string | undefined): LoggingLevel {\n  if (!raw) return 'info';\n  // `warn` is the common short form; the canonical RFC 5424 level is `warning`.\n  if (raw === 'warn') return 'warning';\n  if (isLoggingLevel(raw)) return raw;\n  warnInvalidSetting('FS_LOG_LEVEL', raw, LEVEL_ORDER.join('|'), 'info');\n  return 'info';\n}\n\n// Seeded to the value `parseLogLevel(undefined)` returns, so an unset\n// FS_LOG_LEVEL — the initial `cachedRaw` — needs no first-call special case.\nlet cachedRaw: string | undefined;\nlet cachedLevel: LoggingLevel = 'info';\n\n/**\n * Minimum severity that reaches stderr, from `FS_LOG_LEVEL` / `--log-level`.\n * Memoized on the raw value, not resolved once: `cli.logLevel` lands after\n * `parseArgs`, and writes happen before that. Keying on the raw string keeps it\n * live while the invalid-value warning fires once per setting, not per line.\n */\nfunction getLogLevel(): LoggingLevel {\n  const raw = (cli.logLevel ?? process.env['FS_LOG_LEVEL'])?.trim().toLowerCase();\n  if (raw !== cachedRaw) {\n    cachedRaw = raw;\n    cachedLevel = parseLogLevel(raw);\n  }\n  return cachedLevel;\n}\n\n/** True when `level` is at least as severe as the configured minimum. */\nfunction isLevelEnabled(level: LoggingLevel, minimum: LoggingLevel = getLogLevel()): boolean {\n  return LEVEL_ORDER.indexOf(level) <= LEVEL_ORDER.indexOf(minimum);\n}\n\nfunction write(level: LoggingLevel, message: string, args: readonly unknown[]): void {\n  if (!isLevelEnabled(level)) return;\n  const prefix = `[${level}]`;\n  console.error(`${prefix} ${message}`, ...args);\n}\n\n/**\n * A client-supplied value (a JSON-RPC id, a `traceparent`, a tool's own log\n * message) made safe for one stderr line: a control character or a Unicode\n * line/paragraph separator (U+2028/U+2029, which `\\p{Cc}` misses) would let\n * a caller forge extra log lines, and an unbounded value would let it flood\n * one. `max` bounds the value; pass `Infinity` for free text that is only\n * flattened.\n */\nexport function sanitizeLogField(value: string, max = 128): string {\n  return value.replace(/[\\p{Cc}\\p{Zl}\\p{Zp}]+/gu, ' ').slice(0, max);\n}\n\nexport const Logger = {\n  emit: (level: LoggingLevel, message: string) => {\n    write(level, message, []);\n  },\n  info: (message: string, ...args: unknown[]) => {\n    write('info', message, args);\n  },\n  warn: (message: string, ...args: unknown[]) => {\n    write('warning', message, args);\n  },\n  error: (message: string, ...args: unknown[]) => {\n    write('error', message, args);\n  },\n  debug: (message: string, ...args: unknown[]) => {\n    write('debug', message, args);\n  },\n};\n\n/** A failed notify means the connection went away: nothing to recover, so log and drop it. */\nexport function voidSend(send: Promise<unknown> | undefined, label: string, fields?: object): void {\n  void send?.catch((error: unknown) => {\n    Logger.debug(`${label} not delivered`, { ...fields, error: formatUnknownErrorMessage(error) });\n  });\n}\n\nexport function logRuntimeFailure(id: string, scope: string, method: string, error: unknown): void {\n  write('error', `Runtime failure: ${id} [${scope}.${method}]`, [error]);\n}\n"]}

package/dist/core/path-completer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path-completer.d.ts","sourceRoot":"","sources":["../../src/core/path-completer.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAyK3C;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA6BzF"}
+{"version":3,"file":"path-completer.d.ts","sourceRoot":"","sources":["../../src/core/path-completer.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAyJ3C;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAyBzF"}

package/dist/core/path-completer.js

@@ -1,9 +1,8 @@
-import { opendir, stat } from 'node:fs/promises';
+import { opendir } from 'node:fs/promises';
 import { basename, dirname, isAbsolute, join, parse, resolve, sep } from 'node:path';
 import { isSkippableErrno, rethrowIfAborted } from "./errors.js";
 import { Logger } from "./observability.js";
-import { isPathWithinDirectories, isSamePath, isSlash, normalizePath, toPosixPath, } from "./path-utils.js";
-import { resolveRealPath } from "./path.js";
+import { isSamePath, isSlash, normalizePath, toPosixPath } from "./path-utils.js";
 // ─── pure path-completion helpers ───────────────────────────────────────────
 function hasTrailingSeparator(value) {
     return value.length > 0 && isSlash(value.charCodeAt(value.length - 1));
@@ -43,26 +42,6 @@ function resolveNamedRootContext(currentValue, allowed) {
     const trailingSeparator = hasTrailingSeparator(currentValue);
     return resolveFromBase(root, parsed.remainder, trailingSeparator);
 }
-async function isAllowedCompletionDirectory(path, allowed) {
-    if (!isPathWithinDirectories(path, allowed))
-        return false;
-    try {
-        const stats = await stat(path);
-        if (!stats.isDirectory())
-            return false;
-        const real = await resolveRealPath(path);
-        return real !== null && isPathWithinDirectories(real, allowed);
-    }
-    catch (err) {
-        if (!isSkippableErrno(err)) {
-            Logger.debug('isAllowedCompletionDirectory: unexpected probe error', {
-                path,
-                error: String(err),
-            });
-        }
-        return false;
-    }
-}
 function withDirectorySeparator(value) {
     return value.endsWith(sep) ? value : `${value}${sep}`;
 }
@@ -87,9 +66,13 @@ function mergeCompletionMatches(dirMatches, rootMatches) {
     const isDir = (v) => v.endsWith(sep);
     return [...new Set([...dirMatches, ...rootMatches])].sort((left, right) => Number(isDir(right)) - Number(isDir(left)) || left.localeCompare(right));
 }
-async function findMatchesInDirectory(searchDir, prefix, allowed, isSensitive) {
+async function findMatchesInDirectory(searchDir, prefix, pathGuard) {
     const matches = [];
-    if (!(await isAllowedCompletionDirectory(searchDir, allowed)))
+    // The guard owns what a listing may enter: containment through the real
+    // path, device names, the sensitive list, is-a-directory. A refusal is
+    // "nothing to list", never an error, so root suggestions survive it.
+    const listable = await pathGuard.validateExistingDirectory(searchDir).then(() => true, () => false);
+    if (!listable)
         return matches;
     try {
         // Stream via opendir and collect every match. Do not cap here: the
@@ -105,7 +88,7 @@ async function findMatchesInDirectory(searchDir, prefix, allowed, isSensitive) {
                 if (prefix !== '' && !entry.name.toLowerCase().startsWith(lowerPrefix))
                     continue;
                 const fullPath = join(searchDir, entry.name);
-                if (isSensitive?.(fullPath))
+                if (pathGuard.isSensitive(fullPath))
                     continue;
                 matches.push(entry.isDirectory() ? `${fullPath}${sep}` : fullPath);
             }
@@ -147,10 +130,8 @@ function getSearchContext(currentValue, allowed) {
  * every match, sorted; the SDK truncates to 100 and reports the total.
  */
 export async function suggestPaths(pathGuard, value) {
-    // Roots to pick, name and list; the containment set also holds each root's
-    // realpath alias, so it only gates what a directory listing may enter.
+    // Roots to pick, name and list.
     const roots = pathGuard.getRoots();
-    const allowed = pathGuard.getAllowedDirectories();
     try {
         if (!value) {
             return roots;
@@ -160,7 +141,7 @@ export async function suggestPaths(pathGuard, value) {
             return findRootPrefixMatches(value, roots);
         }
         const { searchDir, prefix } = context;
-        const dirMatches = await findMatchesInDirectory(searchDir, prefix, allowed, (p) => pathGuard.isSensitive(p));
+        const dirMatches = await findMatchesInDirectory(searchDir, prefix, pathGuard);
         const rootMatches = findMatchingRoots(searchDir, prefix, roots);
         return mergeCompletionMatches(dirMatches, rootMatches);
     }

package/dist/core/path-completer.js.map

@@ -1 +1 @@
-{"version":3,"file":"path-completer.js","sourceRoot":"","sources":["../../src/core/path-completer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EACL,uBAAuB,EACvB,UAAU,EACV,OAAO,EACP,aAAa,EACb,WAAW,GACZ,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,+EAA+E;AAE/E,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,QAAgB,EAChB,iBAA0B;IAE1B,MAAM,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/D,IAAI,iBAAiB;QAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACzE,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,eAAe,CAAC;QACnC,MAAM,EAAE,QAAQ,CAAC,eAAe,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,eAAe,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,eAAe;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,UAAU,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACtD,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB,EAAE,OAA0B;IACzE,MAAM,kBAAkB,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAClD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,KAAK,kBAAkB,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,uBAAuB,CAC9B,YAAoB,EACpB,OAA0B;IAE1B,MAAM,MAAM,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAC7D,OAAO,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,IAAY,EACZ,OAA0B;IAE1B,IAAI,CAAC,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;YAAE,OAAO,KAAK,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,KAAK,IAAI,IAAI,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,KAAK,CAAC,sDAAsD,EAAE;gBACnE,IAAI;gBACJ,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;aACnB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,GAAG,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAA0B,EAC1B,SAAoC;IAEpC,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,qBAAqB,CAAC,YAAoB,EAAE,OAA0B;IAC7E,MAAM,UAAU,GAAG,mBAAmB,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IACnF,OAAO,mBAAmB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3C,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CACpD,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,SAAiB,EACjB,MAAc,EACd,OAA0B;IAE1B,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACzC,MAAM,mBAAmB,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACrD,OAAO,mBAAmB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;QAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,mBAAmB,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAC7B,UAA6B,EAC7B,WAA8B;IAE9B,MAAM,KAAK,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CACvD,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CACzF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,SAAiB,EACjB,MAAc,EACd,OAA0B,EAC1B,WAAuC;IAEvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,CAAC,MAAM,4BAA4B,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC;IAC9E,IAAI,CAAC;QACH,mEAAmE;QACnE,qEAAqE;QACrE,sEAAsE;QACtE,kEAAkE;QAClE,oEAAoE;QACpE,uCAAuC;QACvC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;YACzC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;gBAC9B,IAAI,MAAM,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;oBAAE,SAAS;gBACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC7C,IAAI,WAAW,EAAE,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBACtC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC3B,kDAAkD;YACpD,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;gBAClE,SAAS;gBACT,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CACvB,YAAoB,EACpB,OAA0B;IAE1B,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAC7D,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,OAAO,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,IAAI,GAAG,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACxE,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAC;IAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,IAAI;YAAE,OAAO,eAAe,CAAC,IAAI,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAoB,EAAE,KAAa;IACpE,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,SAAS,CAAC,qBAAqB,EAAE,CAAC;IAElD,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QACtC,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAChF,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CACzB,CAAC;QACF,MAAM,WAAW,GAAG,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAChE,OAAO,sBAAsB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE;YACnE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/E,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import { opendir, stat } from 'node:fs/promises';\nimport { basename, dirname, isAbsolute, join, parse, resolve, sep } from 'node:path';\n\nimport { isSkippableErrno, rethrowIfAborted } from './errors.ts';\nimport { Logger } from './observability.ts';\nimport {\n  isPathWithinDirectories,\n  isSamePath,\n  isSlash,\n  normalizePath,\n  toPosixPath,\n} from './path-utils.ts';\nimport type { PathGuard } from './path.ts';\nimport { resolveRealPath } from './path.ts';\n\n// ─── pure path-completion helpers ───────────────────────────────────────────\n\nfunction hasTrailingSeparator(value: string): boolean {\n  return value.length > 0 && isSlash(value.charCodeAt(value.length - 1));\n}\n\nfunction resolveFromBase(\n  base: string,\n  rawValue: string,\n  trailingSeparator: boolean,\n): { searchDir: string; prefix: string } {\n  const normalizedValue = normalizePath(resolve(base, rawValue));\n  if (trailingSeparator) return { searchDir: normalizedValue, prefix: '' };\n  return {\n    searchDir: dirname(normalizedValue),\n    prefix: basename(normalizedValue),\n  };\n}\n\nfunction parseNamedRootInput(value: string): { rootName: string; remainder: string } | undefined {\n  const normalizedInput = toPosixPath(value);\n  if (!normalizedInput) return undefined;\n  const slashIndex = normalizedInput.indexOf('/');\n  if (slashIndex === -1) return { rootName: normalizedInput, remainder: '' };\n  const rootName = normalizedInput.slice(0, slashIndex);\n  if (!rootName) return undefined;\n  return { rootName, remainder: normalizedInput.slice(slashIndex + 1) };\n}\n\nfunction findAllowedRootByName(rootName: string, allowed: readonly string[]): string | undefined {\n  const normalizedRootName = rootName.toLowerCase();\n  return allowed.find((candidate) => basename(candidate).toLowerCase() === normalizedRootName);\n}\n\nfunction resolveNamedRootContext(\n  currentValue: string,\n  allowed: readonly string[],\n): { searchDir: string; prefix: string } | undefined {\n  const parsed = parseNamedRootInput(currentValue);\n  if (!parsed) return undefined;\n  const root = findAllowedRootByName(parsed.rootName, allowed);\n  if (!root) return undefined;\n  const trailingSeparator = hasTrailingSeparator(currentValue);\n  return resolveFromBase(root, parsed.remainder, trailingSeparator);\n}\n\nasync function isAllowedCompletionDirectory(\n  path: string,\n  allowed: readonly string[],\n): Promise<boolean> {\n  if (!isPathWithinDirectories(path, allowed)) return false;\n  try {\n    const stats = await stat(path);\n    if (!stats.isDirectory()) return false;\n    const real = await resolveRealPath(path);\n    return real !== null && isPathWithinDirectories(real, allowed);\n  } catch (err) {\n    if (!isSkippableErrno(err)) {\n      Logger.debug('isAllowedCompletionDirectory: unexpected probe error', {\n        path,\n        error: String(err),\n      });\n    }\n    return false;\n  }\n}\n\nfunction withDirectorySeparator(value: string): string {\n  return value.endsWith(sep) ? value : `${value}${sep}`;\n}\n\nfunction collectAllowedRoots(\n  allowed: readonly string[],\n  predicate: (root: string) => boolean,\n): string[] {\n  return allowed.filter(predicate).map(withDirectorySeparator);\n}\n\nfunction findRootPrefixMatches(currentValue: string, allowed: readonly string[]): string[] {\n  const rootPrefix = parseNamedRootInput(currentValue)?.rootName.toLowerCase() ?? '';\n  return collectAllowedRoots(allowed, (root) =>\n    basename(root).toLowerCase().startsWith(rootPrefix),\n  );\n}\n\nfunction findMatchingRoots(\n  searchDir: string,\n  prefix: string,\n  allowed: readonly string[],\n): string[] {\n  const lowerPrefix = prefix.toLowerCase();\n  const normalizedSearchDir = normalizePath(searchDir);\n  return collectAllowedRoots(allowed, (root) => {\n    const rootDir = dirname(root);\n    if (!isSamePath(rootDir, normalizedSearchDir)) return false;\n    return basename(root).toLowerCase().startsWith(lowerPrefix);\n  });\n}\n\nfunction mergeCompletionMatches(\n  dirMatches: readonly string[],\n  rootMatches: readonly string[],\n): string[] {\n  const isDir = (v: string): boolean => v.endsWith(sep);\n  return [...new Set([...dirMatches, ...rootMatches])].sort(\n    (left, right) => Number(isDir(right)) - Number(isDir(left)) || left.localeCompare(right),\n  );\n}\n\nasync function findMatchesInDirectory(\n  searchDir: string,\n  prefix: string,\n  allowed: readonly string[],\n  isSensitive?: (path: string) => boolean,\n): Promise<string[]> {\n  const matches: string[] = [];\n  if (!(await isAllowedCompletionDirectory(searchDir, allowed))) return matches;\n  try {\n    // Stream via opendir and collect every match. Do not cap here: the\n    // SDK's completion result keeps the first 100 values and reports the\n    // full length as `total` / `hasMore`, so the list must reach it whole\n    // and already sorted (mergeCompletionMatches). Capping here would\n    // keep the opendir-first 100, not the alphabetically-first 100, and\n    // hide the true count from the client.\n    const dir = await opendir(searchDir);\n    try {\n      const lowerPrefix = prefix.toLowerCase();\n      for await (const entry of dir) {\n        if (prefix !== '' && !entry.name.toLowerCase().startsWith(lowerPrefix)) continue;\n        const fullPath = join(searchDir, entry.name);\n        if (isSensitive?.(fullPath)) continue;\n        matches.push(entry.isDirectory() ? `${fullPath}${sep}` : fullPath);\n      }\n    } finally {\n      await dir.close().catch(() => {\n        /* dir already closed or opendir never resolved */\n      });\n    }\n  } catch (err) {\n    if (!isSkippableErrno(err)) {\n      Logger.warn('PathCompleter.findMatchesInDirectory: readdir failed', {\n        searchDir,\n        error: String(err),\n      });\n    }\n  }\n  return matches;\n}\n\nfunction getSearchContext(\n  currentValue: string,\n  allowed: readonly string[],\n): { searchDir: string; prefix: string } | undefined {\n  const trailingSeparator = hasTrailingSeparator(currentValue);\n  if (isAbsolute(currentValue)) {\n    return resolveFromBase(parse(currentValue).root || sep, currentValue, trailingSeparator);\n  }\n  const namedRootContext = resolveNamedRootContext(currentValue, allowed);\n  if (namedRootContext) return namedRootContext;\n  if (allowed.length === 1) {\n    const base = allowed[0];\n    if (base) return resolveFromBase(base, currentValue, trailingSeparator);\n  }\n  return undefined;\n}\n\n/**\n * Path suggestions for `completion/complete` on the file template. One\n * `opendir` per call; clients debounce, so nothing is cached here. Returns\n * every match, sorted; the SDK truncates to 100 and reports the total.\n */\nexport async function suggestPaths(pathGuard: PathGuard, value: string): Promise<string[]> {\n  // Roots to pick, name and list; the containment set also holds each root's\n  // realpath alias, so it only gates what a directory listing may enter.\n  const roots = pathGuard.getRoots();\n  const allowed = pathGuard.getAllowedDirectories();\n\n  try {\n    if (!value) {\n      return roots;\n    }\n\n    const context = getSearchContext(value, roots);\n    if (!context) {\n      return findRootPrefixMatches(value, roots);\n    }\n\n    const { searchDir, prefix } = context;\n    const dirMatches = await findMatchesInDirectory(searchDir, prefix, allowed, (p) =>\n      pathGuard.isSensitive(p),\n    );\n    const rootMatches = findMatchingRoots(searchDir, prefix, roots);\n    return mergeCompletionMatches(dirMatches, rootMatches);\n  } catch (error) {\n    rethrowIfAborted(error);\n    Logger.warn('suggestPaths: completion failed, returning empty list', {\n      error: error instanceof Error ? (error.stack ?? error.message) : String(error),\n    });\n    return [];\n  }\n}\n"]}
+{"version":3,"file":"path-completer.js","sourceRoot":"","sources":["../../src/core/path-completer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGlF,+EAA+E;AAE/E,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,QAAgB,EAChB,iBAA0B;IAE1B,MAAM,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/D,IAAI,iBAAiB;QAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACzE,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,eAAe,CAAC;QACnC,MAAM,EAAE,QAAQ,CAAC,eAAe,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,eAAe,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,eAAe;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,UAAU,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACtD,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB,EAAE,OAA0B;IACzE,MAAM,kBAAkB,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAClD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,KAAK,kBAAkB,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,uBAAuB,CAC9B,YAAoB,EACpB,OAA0B;IAE1B,MAAM,MAAM,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAC7D,OAAO,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,GAAG,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAA0B,EAC1B,SAAoC;IAEpC,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,qBAAqB,CAAC,YAAoB,EAAE,OAA0B;IAC7E,MAAM,UAAU,GAAG,mBAAmB,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IACnF,OAAO,mBAAmB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3C,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CACpD,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,SAAiB,EACjB,MAAc,EACd,OAA0B;IAE1B,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACzC,MAAM,mBAAmB,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACrD,OAAO,mBAAmB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;QAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,mBAAmB,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAC7B,UAA6B,EAC7B,WAA8B;IAE9B,MAAM,KAAK,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CACvD,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CACzF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,SAAiB,EACjB,MAAc,EACd,SAAoB;IAEpB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,wEAAwE;IACxE,uEAAuE;IACvE,qEAAqE;IACrE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC,IAAI,CACxE,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,KAAK,CACZ,CAAC;IACF,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC9B,IAAI,CAAC;QACH,mEAAmE;QACnE,qEAAqE;QACrE,sEAAsE;QACtE,kEAAkE;QAClE,oEAAoE;QACpE,uCAAuC;QACvC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;YACzC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;gBAC9B,IAAI,MAAM,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;oBAAE,SAAS;gBACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC7C,IAAI,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBAC9C,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC3B,kDAAkD;YACpD,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;gBAClE,SAAS;gBACT,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CACvB,YAAoB,EACpB,OAA0B;IAE1B,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAC7D,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,OAAO,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,IAAI,GAAG,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACxE,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAC;IAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,IAAI;YAAE,OAAO,eAAe,CAAC,IAAI,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAoB,EAAE,KAAa;IACpE,gCAAgC;IAChC,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC;IAEnC,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QACtC,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAC9E,MAAM,WAAW,GAAG,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAChE,OAAO,sBAAsB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE;YACnE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/E,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import { opendir } from 'node:fs/promises';\nimport { basename, dirname, isAbsolute, join, parse, resolve, sep } from 'node:path';\n\nimport { isSkippableErrno, rethrowIfAborted } from './errors.ts';\nimport { Logger } from './observability.ts';\nimport { isSamePath, isSlash, normalizePath, toPosixPath } from './path-utils.ts';\nimport type { PathGuard } from './path.ts';\n\n// ─── pure path-completion helpers ───────────────────────────────────────────\n\nfunction hasTrailingSeparator(value: string): boolean {\n  return value.length > 0 && isSlash(value.charCodeAt(value.length - 1));\n}\n\nfunction resolveFromBase(\n  base: string,\n  rawValue: string,\n  trailingSeparator: boolean,\n): { searchDir: string; prefix: string } {\n  const normalizedValue = normalizePath(resolve(base, rawValue));\n  if (trailingSeparator) return { searchDir: normalizedValue, prefix: '' };\n  return {\n    searchDir: dirname(normalizedValue),\n    prefix: basename(normalizedValue),\n  };\n}\n\nfunction parseNamedRootInput(value: string): { rootName: string; remainder: string } | undefined {\n  const normalizedInput = toPosixPath(value);\n  if (!normalizedInput) return undefined;\n  const slashIndex = normalizedInput.indexOf('/');\n  if (slashIndex === -1) return { rootName: normalizedInput, remainder: '' };\n  const rootName = normalizedInput.slice(0, slashIndex);\n  if (!rootName) return undefined;\n  return { rootName, remainder: normalizedInput.slice(slashIndex + 1) };\n}\n\nfunction findAllowedRootByName(rootName: string, allowed: readonly string[]): string | undefined {\n  const normalizedRootName = rootName.toLowerCase();\n  return allowed.find((candidate) => basename(candidate).toLowerCase() === normalizedRootName);\n}\n\nfunction resolveNamedRootContext(\n  currentValue: string,\n  allowed: readonly string[],\n): { searchDir: string; prefix: string } | undefined {\n  const parsed = parseNamedRootInput(currentValue);\n  if (!parsed) return undefined;\n  const root = findAllowedRootByName(parsed.rootName, allowed);\n  if (!root) return undefined;\n  const trailingSeparator = hasTrailingSeparator(currentValue);\n  return resolveFromBase(root, parsed.remainder, trailingSeparator);\n}\n\nfunction withDirectorySeparator(value: string): string {\n  return value.endsWith(sep) ? value : `${value}${sep}`;\n}\n\nfunction collectAllowedRoots(\n  allowed: readonly string[],\n  predicate: (root: string) => boolean,\n): string[] {\n  return allowed.filter(predicate).map(withDirectorySeparator);\n}\n\nfunction findRootPrefixMatches(currentValue: string, allowed: readonly string[]): string[] {\n  const rootPrefix = parseNamedRootInput(currentValue)?.rootName.toLowerCase() ?? '';\n  return collectAllowedRoots(allowed, (root) =>\n    basename(root).toLowerCase().startsWith(rootPrefix),\n  );\n}\n\nfunction findMatchingRoots(\n  searchDir: string,\n  prefix: string,\n  allowed: readonly string[],\n): string[] {\n  const lowerPrefix = prefix.toLowerCase();\n  const normalizedSearchDir = normalizePath(searchDir);\n  return collectAllowedRoots(allowed, (root) => {\n    const rootDir = dirname(root);\n    if (!isSamePath(rootDir, normalizedSearchDir)) return false;\n    return basename(root).toLowerCase().startsWith(lowerPrefix);\n  });\n}\n\nfunction mergeCompletionMatches(\n  dirMatches: readonly string[],\n  rootMatches: readonly string[],\n): string[] {\n  const isDir = (v: string): boolean => v.endsWith(sep);\n  return [...new Set([...dirMatches, ...rootMatches])].sort(\n    (left, right) => Number(isDir(right)) - Number(isDir(left)) || left.localeCompare(right),\n  );\n}\n\nasync function findMatchesInDirectory(\n  searchDir: string,\n  prefix: string,\n  pathGuard: PathGuard,\n): Promise<string[]> {\n  const matches: string[] = [];\n  // The guard owns what a listing may enter: containment through the real\n  // path, device names, the sensitive list, is-a-directory. A refusal is\n  // \"nothing to list\", never an error, so root suggestions survive it.\n  const listable = await pathGuard.validateExistingDirectory(searchDir).then(\n    () => true,\n    () => false,\n  );\n  if (!listable) return matches;\n  try {\n    // Stream via opendir and collect every match. Do not cap here: the\n    // SDK's completion result keeps the first 100 values and reports the\n    // full length as `total` / `hasMore`, so the list must reach it whole\n    // and already sorted (mergeCompletionMatches). Capping here would\n    // keep the opendir-first 100, not the alphabetically-first 100, and\n    // hide the true count from the client.\n    const dir = await opendir(searchDir);\n    try {\n      const lowerPrefix = prefix.toLowerCase();\n      for await (const entry of dir) {\n        if (prefix !== '' && !entry.name.toLowerCase().startsWith(lowerPrefix)) continue;\n        const fullPath = join(searchDir, entry.name);\n        if (pathGuard.isSensitive(fullPath)) continue;\n        matches.push(entry.isDirectory() ? `${fullPath}${sep}` : fullPath);\n      }\n    } finally {\n      await dir.close().catch(() => {\n        /* dir already closed or opendir never resolved */\n      });\n    }\n  } catch (err) {\n    if (!isSkippableErrno(err)) {\n      Logger.warn('PathCompleter.findMatchesInDirectory: readdir failed', {\n        searchDir,\n        error: String(err),\n      });\n    }\n  }\n  return matches;\n}\n\nfunction getSearchContext(\n  currentValue: string,\n  allowed: readonly string[],\n): { searchDir: string; prefix: string } | undefined {\n  const trailingSeparator = hasTrailingSeparator(currentValue);\n  if (isAbsolute(currentValue)) {\n    return resolveFromBase(parse(currentValue).root || sep, currentValue, trailingSeparator);\n  }\n  const namedRootContext = resolveNamedRootContext(currentValue, allowed);\n  if (namedRootContext) return namedRootContext;\n  if (allowed.length === 1) {\n    const base = allowed[0];\n    if (base) return resolveFromBase(base, currentValue, trailingSeparator);\n  }\n  return undefined;\n}\n\n/**\n * Path suggestions for `completion/complete` on the file template. One\n * `opendir` per call; clients debounce, so nothing is cached here. Returns\n * every match, sorted; the SDK truncates to 100 and reports the total.\n */\nexport async function suggestPaths(pathGuard: PathGuard, value: string): Promise<string[]> {\n  // Roots to pick, name and list.\n  const roots = pathGuard.getRoots();\n\n  try {\n    if (!value) {\n      return roots;\n    }\n\n    const context = getSearchContext(value, roots);\n    if (!context) {\n      return findRootPrefixMatches(value, roots);\n    }\n\n    const { searchDir, prefix } = context;\n    const dirMatches = await findMatchesInDirectory(searchDir, prefix, pathGuard);\n    const rootMatches = findMatchingRoots(searchDir, prefix, roots);\n    return mergeCompletionMatches(dirMatches, rootMatches);\n  } catch (error) {\n    rethrowIfAborted(error);\n    Logger.warn('suggestPaths: completion failed, returning empty list', {\n      error: error instanceof Error ? (error.stack ?? error.message) : String(error),\n    });\n    return [];\n  }\n}\n"]}

package/dist/core/path.d.ts

@@ -11,21 +11,17 @@ export interface ServerOptions {
 /** `path.relative` with forward slashes, so displayed paths match across platforms. */
 export declare function toPosixRelative(from: string, to: string): string;
 export declare function normalizeAllowedDirectories(dirs: readonly string[]): string[];
-export declare function resolveRealPath(normalized: string, signal?: AbortSignal): Promise<string | null>;
 export declare function resolveAllowedDirectoriesState(dirs: readonly string[], signal?: AbortSignal): Promise<string[]>;
 /**
- * Accepted risk: validation methods resolve/verify a path (symlinks, boundaries,
- * sensitivity) and then return a plain string; the actual fs operation happens
- * afterward as a separate syscall (classic TOCTOU). A symlink swapped in that
- * exact window could redirect the follow-up operation. This is mitigated by
- * re-validating the resolved real path (not just the requested path) and by
- * walking ancestors to catch escapes before the target exists, but it is not
- * eliminated — doing so would require fd-based operations (open with
- * O_NOFOLLOW / operate on the resolved fd) throughout core/fs.ts. Acceptable
- * tradeoff for a local, single-user filesystem server today.
+ * TOCTOU note: validation returns a plain string and the fs operation is a
+ * later syscall, so a symlink swapped in between could redirect it. Reads and
+ * appends in core/fs.ts and core/read.ts open with O_NOFOLLOW (final component)
+ * and re-check the fd's real path on Linux (ancestor swap). Residual: write
+ * paths that resolve a parent by name (`rename`, `mkdir`, `rm`, `cp`) would
+ * need openat()-relative-to-dirfd, which Node lacks; non-Linux skips the fd
+ * re-check.
  */
 export declare class PathGuard {
-    #private;
     private allowedDirectoriesState;
     /** One entry per configured or granted root, without the realpath aliases. */
     private rootsState;
@@ -54,12 +50,6 @@ export declare class PathGuard {
      */
     initialize(expanded: readonly string[], roots?: readonly string[]): void;
     isInitialized(): boolean;
-    /**
-     * Run `fn` as the next holder of the guard's single mutation lock. Every
-     * change to the allowed set goes through this so concurrent grants cannot
-     * interleave their read-`await`-write and lose a grant (GRANT-1).
-     */
-    private runExclusive;
     getAllowedDirectories(): string[];
     /**
      * The allowed directory that contains `resolvedPath` — the longest match,
@@ -128,7 +118,6 @@ export declare class PathGuard {
      */
     applyGrant(targetDir: string): Promise<boolean>;
     private isWithinBoundary;
-    private validateAccessAndSensitivity;
     private validateAccess;
     private handleRealpathError;
     validateExistingPathDetailed(requestedPath: string): Promise<ValidatedPathDetails>;

package/dist/core/path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../../src/core/path.ts"],"names":[],"mappings":"AAuCA,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAsDD,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAEhE;AAMD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAE7E;AAED,wBAAsB,eAAe,CACnC,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAexB;AAED,wBAAsB,8BAA8B,CAClD,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,EAAE,CAAC,CAWnB;AAMD;;;;;;;;;;GAUG;AACH,qBAAa,SAAS;;IACpB,OAAO,CAAC,uBAAuB,CAAuB;IACtD,8EAA8E;IAC9E,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0B;IACpD;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,kBAAkB,CAAgB;IAC1C,OAAO,CAAC,cAAc,CAAgB;IAOtC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;gBAExC,OAAO,CAAC,EAAE,aAAa;IAInC;;;OAGG;IACH,UAAU,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,GAAE,SAAS,MAAM,EAAa,GAAG,IAAI;IAKlF,aAAa,IAAI,OAAO;IAIxB;;;;OAIG;YACW,YAAY;IAS1B,qBAAqB,IAAI,MAAM,EAAE;IAOjC;;;;;OAKG;IACH,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAc/D;;;;OAIG;IACH,QAAQ,IAAI,MAAM,EAAE;IAIpB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAItC;;;;;;;;;;;;;OAaG;IACG,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgBtD,oBAAoB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKlE;;;;;;;;OAQG;YACW,mBAAmB;IAYjC,8EAA8E;YAChE,qBAAqB;IAgBnC;;;;;;;;;;OAUG;IACG,cAAc,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAiCjE;;;;;;;;;;OAUG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;YAwCvC,gBAAgB;IAa9B,OAAO,CAAC,4BAA4B;IAepC,OAAO,CAAC,cAAc;YAsDR,mBAAmB;IA0C3B,4BAA4B,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAmClF,yBAAyB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAsBvE,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM;IAwBxD,aAAa,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO;IAW9C,OAAO,CAAC,sBAAsB;IAU9B,OAAO,CAAC,iBAAiB;YAOX,8BAA8B;IAwDtC,oBAAoB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAoB5D,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAoE7D,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC;CAwDnD"}
+{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../../src/core/path.ts"],"names":[],"mappings":"AAuCA,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAsDD,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAEhE;AAMD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAE7E;AAmBD,wBAAsB,8BAA8B,CAClD,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,EAAE,CAAC,CAWnB;AAED;;;;;;;;GAQG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,uBAAuB,CAAuB;IACtD,8EAA8E;IAC9E,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0B;IACpD;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,kBAAkB,CAAgB;IAC1C,OAAO,CAAC,cAAc,CAAgB;IAEtC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;gBAExC,OAAO,CAAC,EAAE,aAAa;IAInC;;;OAGG;IACH,UAAU,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,GAAE,SAAS,MAAM,EAAa,GAAG,IAAI;IAKlF,aAAa,IAAI,OAAO;IAIxB,qBAAqB,IAAI,MAAM,EAAE;IAOjC;;;;;OAKG;IACH,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAc/D;;;;OAIG;IACH,QAAQ,IAAI,MAAM,EAAE;IAIpB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAItC;;;;;;;;;;;;;OAaG;IACG,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgBtD,oBAAoB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKlE;;;;;;;;OAQG;YACW,mBAAmB;IAYjC,8EAA8E;YAChE,qBAAqB;IAgBnC;;;;;;;;;;OAUG;IACG,cAAc,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAiCjE;;;;;;;;;;OAUG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;YAwCvC,gBAAgB;IAQ9B,OAAO,CAAC,cAAc;YAwDR,mBAAmB;IA0C3B,4BAA4B,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAmClF,yBAAyB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAsBvE,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM;IAwBxD,aAAa,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO;IAW9C,OAAO,CAAC,sBAAsB;IAU9B,OAAO,CAAC,iBAAiB;YAOX,8BAA8B;IAwDtC,oBAAoB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAoB5D,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAoE7D,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC;CAwDnD"}

package/dist/core/path.js

@@ -1,7 +1,7 @@
 import { lstat, readlink, realpath, stat } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
-import { withAbort } from "./concurrency.js";
+import { runExclusive, withAbort } from "./concurrency.js";
 import { cli } from "./config.js";
 import { classifyCauseChain, ErrorCode, FsError, isFsError, isNotFoundErrno, isSkippableErrno, rethrowIfAborted, SKIPPABLE_FS_CODES, } from "./errors.js";
 import { Logger } from "./observability.js";
@@ -63,7 +63,7 @@ export function toPosixRelative(from, to) {
 export function normalizeAllowedDirectories(dirs) {
     return [...new Set(dirs.map(normalizeAllowedDirectory).filter((entry) => entry.length > 0))];
 }
-export async function resolveRealPath(normalized, signal) {
+async function resolveRealPath(normalized, signal) {
     try {
         signal?.throwIfAborted();
         const realPath = await withAbort(realpath(normalized), signal);
@@ -90,19 +90,14 @@ export async function resolveAllowedDirectoriesState(dirs, signal) {
         })),
     ];
 }
-// ---------------------------------------------------------------------------
-// Windows helpers
-// ---------------------------------------------------------------------------
 /**
- * Accepted risk: validation methods resolve/verify a path (symlinks, boundaries,
- * sensitivity) and then return a plain string; the actual fs operation happens
- * afterward as a separate syscall (classic TOCTOU). A symlink swapped in that
- * exact window could redirect the follow-up operation. This is mitigated by
- * re-validating the resolved real path (not just the requested path) and by
- * walking ancestors to catch escapes before the target exists, but it is not
- * eliminated — doing so would require fd-based operations (open with
- * O_NOFOLLOW / operate on the resolved fd) throughout core/fs.ts. Acceptable
- * tradeoff for a local, single-user filesystem server today.
+ * TOCTOU note: validation returns a plain string and the fs operation is a
+ * later syscall, so a symlink swapped in between could redirect it. Reads and
+ * appends in core/fs.ts and core/read.ts open with O_NOFOLLOW (final component)
+ * and re-check the fd's real path on Linux (ancestor swap). Residual: write
+ * paths that resolve a parent by name (`rename`, `mkdir`, `rm`, `cp`) would
+ * need openat()-relative-to-dirfd, which Node lacks; non-Linux skips the fd
+ * re-check.
  */
 export class PathGuard {
     allowedDirectoriesState;
@@ -125,10 +120,6 @@ export class PathGuard {
      */
     grantedDirectories = [];
     rootBoundaries = [];
-    // ponytail: one mutex per PathGuard. If per-session grant throughput ever
-    // matters, split into per-grant-dir locks; a single lock is correct for the
-    // stdio + InMemoryEventStore single-process model.
-    #mutex = Promise.resolve();
     options;
     constructor(options) {
         this.options = options;
@@ -144,16 +135,6 @@ export class PathGuard {
     isInitialized() {
         return this.allowedDirectoriesState !== undefined;
     }
-    /**
-     * Run `fn` as the next holder of the guard's single mutation lock. Every
-     * change to the allowed set goes through this so concurrent grants cannot
-     * interleave their read-`await`-write and lose a grant (GRANT-1).
-     */
-    async runExclusive(fn) {
-        const result = this.#mutex.then(fn, fn);
-        this.#mutex = result.then(() => undefined, () => undefined);
-        return result;
-    }
     getAllowedDirectories() {
         if (!this.allowedDirectoriesState) {
             return [];
@@ -331,7 +312,7 @@ export class PathGuard {
         // Read + write under the mutation lock so a concurrent grant cannot
         // interleave and lose this grant (GRANT-1). runExclusive is not reentrant:
         // nothing in this body may take the lock again.
-        return this.runExclusive(async () => {
+        return runExclusive(this, async () => {
             const previous = this.grantedDirectories;
             this.grantedDirectories = [...previous, normalizePath(targetDir)];
             try {
@@ -353,33 +334,17 @@ export class PathGuard {
             return false;
         });
     }
-    // The guard already realpath-resolved FS_ROOT_BOUNDARY into rootBoundaries
-    // during recomputeAllowedDirectories. Reuse that single source of truth so
-    // grant paths check the same boundary the rest of the guard enforces,
-    // instead of re-reading the env and re-resolving each entry.
+    // One boundary rule for startup roots and grants: a missing target is
+    // projected through its nearest existing ancestor, an unresolvable one is
+    // refused. No boundary configured means no constraint; partitionRootsWithin
+    // with no bounds would drop everything, so that case returns first.
     async isWithinBoundary(targetDir) {
         if (this.rootBoundaries.length === 0) {
             return true;
         }
-        let resolved;
-        try {
-            resolved = normalizePath(await realpath(targetDir));
-        }
-        catch {
-            resolved = normalizePath(targetDir);
-        }
-        return isPathWithinDirectories(resolved, this.rootBoundaries);
+        const { kept } = await partitionRootsWithin([targetDir], this.rootBoundaries);
+        return kept.length > 0;
     }
-    validateAccessAndSensitivity(requestedPath) {
-        const result = this.validateAccess(requestedPath);
-        this.assertNotSensitiveFile(requestedPath, requestedPath);
-        this.assertNotSensitiveFile(result.normalizedRequested, requestedPath);
-        return result;
-    }
-    // Synchronous since the access-grant round-trip moved to the executor's
-    // pre-check: validateAccess only does lexical containment math and throws,
-    // no async I/O remains. Callers still `await` it for uniform control-flow;
-    // awaiting a non-thenable returns it unchanged.
     validateAccess(requestedPath) {
         if (!this.allowedDirectoriesState) {
             throw new FsError(ErrorCode.UNKNOWN, 'PathGuard not initialized. Call initialize() first.', requestedPath);
@@ -406,6 +371,8 @@ export class PathGuard {
             // never pre-checked — fail closed.
             this.throwAccessDenied(requestedPath, accessDeniedHint);
         }
+        this.assertNotSensitiveFile(requestedPath, requestedPath);
+        this.assertNotSensitiveFile(normalizedRequested, requestedPath);
         return {
             normalizedRequested,
             allowedDirs: this.allowedDirectoriesState,
@@ -437,7 +404,7 @@ export class PathGuard {
         throw new FsError(mapped.code, 'Cannot access path', requestedPath, error instanceof Error ? error : undefined);
     }
     async validateExistingPathDetailed(requestedPath) {
-        const { normalizedRequested, allowedDirs, accessDeniedHint } = this.validateAccessAndSensitivity(requestedPath);
+        const { normalizedRequested, allowedDirs, accessDeniedHint } = this.validateAccess(requestedPath);
         let realPath;
         try {
             realPath = await realpath(normalizedRequested);
@@ -502,7 +469,7 @@ export class PathGuard {
     // resolution must be verified separately (e.g. via validateExistingPath).
     assertNotSensitiveFile(checkPath, requestedPath) {
         if (this.isSensitive(checkPath)) {
-            throw new FsError(ErrorCode.ACCESS_DENIED, 'Sensitive file blocked. Start the server with --allow-sensitive (or FS_ALLOW_SENSITIVE=1) to override.', requestedPath);
+            throw new FsError(ErrorCode.ACCESS_DENIED, 'Sensitive file blocked by the server denylist. To unblock one built-in secret-file pattern, restart the server with --allow <pattern> (or FS_ALLOWLIST); --allow-sensitive (or FS_ALLOW_SENSITIVE=1) turns the whole built-in list off. Paths blocked with --deny or FS_DENYLIST stay blocked.', requestedPath);
         }
     }
     throwAccessDenied(requestedPath, hint) {
@@ -552,7 +519,7 @@ export class PathGuard {
         }
     }
     async validatePathForWrite(requestedPath) {
-        const { normalizedRequested, allowedDirs, accessDeniedHint } = this.validateAccessAndSensitivity(requestedPath);
+        const { normalizedRequested, allowedDirs, accessDeniedHint } = this.validateAccess(requestedPath);
         const { realAncestor, resolvedTarget } = await this.resolveNearestExistingAncestor(requestedPath, normalizedRequested);
         if (!isPathWithinDirectories(realAncestor, allowedDirs) ||
             !isPathWithinDirectories(resolvedTarget, allowedDirs)) {
@@ -564,7 +531,7 @@ export class PathGuard {
         return resolvedTarget;
     }
     async validatePathForDelete(requestedPath) {
-        const { normalizedRequested, allowedDirs, accessDeniedHint } = this.validateAccessAndSensitivity(requestedPath);
+        const { normalizedRequested, allowedDirs, accessDeniedHint } = this.validateAccess(requestedPath);
         // A workspace root is refused here, before the parent-containment check
         // below reaches for a parent that is out-of-root by construction and
         // reports "Outside allowed directories" for the one directory the caller