@jini-ai/mcp 0.6.11 → 0.6.15-rc.1

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # @jini-ai/mcp
 
+## 0.6.13
+
+### Patch Changes
+
+- 7479159: Tighten diagnostic identifier exemptions and ignore ordinary header values shorter than eight characters during exact-secret masking (credential headers are masked at any length; exact secrets still match inside other text but never inside a credential label, URL scheme, secret-named query parameter or existing redaction marker, so they cannot split another credential's label). Keep null tool schemas informational. Preserve safe reader refusals for explicit plugin skill/file requests and use host-formatted plugin tool pointers for relevance, deferred instructions, and supporting files (optional for automatic use; omitted when the host supplies none).
+- 0728914: Engine guard clean-up (`pnpm guard` 106 -> 0): layer, subpath-isolation and module-state findings fixed by moving
+  shared contracts to their owners instead of reaching across domains. Additive public API: `@jini-ai/core/filesystem`
+  (guarded-reader contracts), `useFetchQueryScope` from `@jini-ai/ui` fetch-query (per-provider query scope),
+  `@jini-ai/chat/react` re-exports of the accepted-input, run-state and agent-plugin chat-state helpers. The Claude
+  filesystem probe cache in `@jini-ai/agent-runtime` is instance-owned. No behaviour change intended; host-facing
+  breaks are listed in `owner-store-to-server` and `guard-host-ports`.
+- c14aeb4: Add opt-in byte caps and strict UTF-8 decoding to fetch-backed MCP HTTP exchanges. Guarded exchanges lazily use the optional platform peer (0.6.15 or later); default exchanges still work without platform installed.
+
+  Add opt-in per-frame stdio byte limits, FIFO handler/write scheduling, and EOF draining to the existing MCP tool host, preserving current defaults and factory signatures.
+
+- Updated dependencies [7479159]
+- Updated dependencies [c31264d]
+- Updated dependencies [0728914]
+- Updated dependencies [cbce255]
+- Updated dependencies [6ecbdb2]
+- Updated dependencies [63bacc5]
+  - @jini-ai/core@0.6.13
+  - @jini-ai/protocol@0.6.13
+
+## 0.6.12
+
+### Patch Changes
+
+- @jini-ai/core@0.6.12
+- @jini-ai/protocol@0.6.12
+
 ## 0.6.11
 
 ### Patch Changes

package/README.md

@@ -15,9 +15,8 @@ implementation.
 npm install @jini-ai/mcp
 ```
 
-No peer dependencies. `@modelcontextprotocol/sdk`, `undici`, `@cfworker/json-schema`,
-`@jini-ai/core`, `@jini-ai/cli`, and `@jini-ai/platform`
-are regular dependencies, installed automatically. Nothing here needs a native compile.
+`@modelcontextprotocol/sdk`, `@cfworker/json-schema`, and `@jini-ai/platform` are optional
+peers, needed only for the surfaces that use them. Nothing here needs a native compile.
 
 ## What you get
 
@@ -62,6 +61,15 @@ For an explicit UI check, pass `CHROME_DEVTOOLS_MCP_PRESET` to `planAgentInstall
 
 **Client-side runtime helpers** — `extractRelativeRefs`, `isTextualMime`.
 
+`createFetchMcpHttpExchange({ fetch }, { maxResponseBytes?, strictUtf8? })` from
+`@jini-ai/mcp/federation` optionally caps actual streamed bytes and rejects malformed UTF-8 for
+both JSON and SSE responses. Caps are nonnegative safe integers; overflow throws `RangeError` and
+strict decoding failures throw `TypeError`. Enabling either guard lazily loads the optional
+`@jini-ai/platform` peer, **0.6.15 or later** (the release introducing `readFetchResponseText`); install a
+compatible version before opting in. With neither guard enabled, exchanges still use unlimited
+`response.text()` and work without platform installed. Headers, signals, redirect refusal and the
+separate session-level 4 MiB check retain their behavior.
+
 ## Argument convention (breaking)
 
 Public APIs take a required argument object and, when applicable, an optional settings object.
@@ -129,6 +137,16 @@ const server = createMcpToolServer({
 await server.run({}); // serves over this process's stdio until idle-exit
 ```
 
+Stdio hosting can opt in to `{ maxFrameBytes: 256 * 1024, serial: true, eof: 'drain' }`
+in the existing options object. `maxFrameBytes` must be a positive safe integer and counts each
+inbound/outbound UTF-8 NDJSON frame including LF. Input overflow rejects `run()`; oversized
+responses become bounded JSON-RPC `-32603` errors retaining the request ID. If that error cannot
+fit, the host closes and rejects. `serial` keeps request handlers FIFO through their response
+writes while cancellation, notifications, and replies remain live. Drain finishes complete frames,
+accepted handlers, and writes before closing; an unterminated EOF tail then rejects `run()`.
+Stream errors reject the opted-in host. Omitted options retain SDK limits, concurrent execution,
+and immediate EOF closure; the factory signatures and `run({})` are unchanged.
+
 Read `McpToolDef` in `src/server/` before writing your own tool — the exact `handler` and
 `inputSchema` field shapes are what the index and the SDK bridge consume.
 

package/dist/agent-install/install.d.ts

@@ -78,6 +78,17 @@ export interface ManualInstallPlan {
 }
 /** Discriminated union of all installation plan shapes returned by `planAgentInstall`. */
 export type InstallPlan = CliInstallPlan | JsonInstallPlan | ManualInstallPlan;
+/**
+ * Home-relative path of the MCP registry the `agy` CLI actually reads:
+ * `~/.gemini/config/mcp_config.json` (verified live; see the
+ * `externalMcpInjection` comment in `@jini-ai/agent-runtime`'s
+ * `defs/antigravity.ts`). NOT `~/.gemini/antigravity/mcp_config.json`: that
+ * file only works on machines where the Antigravity IDE happened to symlink it
+ * to this one, and on a machine without that symlink the bridge entry would
+ * never reach `agy`. Planning only this path also means a regular-file
+ * `antigravity/mcp_config.json` (the IDE's own) is never touched.
+ */
+export declare const ANTIGRAVITY_MCP_CONFIG_SEGMENTS: readonly [".gemini", "config", "mcp_config.json"];
 /**
  * Build the registration plan for one agent. Pure — all IO happens in the
  * executor. Throws on an unknown slug so callers surface a clear error.

package/dist/agent-install/install.js

@@ -96,6 +96,17 @@ function withEnv(entry, env, key) {
 function jsonEntry(spec, extra = {}) {
     return withEnv({ command: spec.command, args: spec.args, ...extra }, spec.env, 'env');
 }
+/**
+ * Home-relative path of the MCP registry the `agy` CLI actually reads:
+ * `~/.gemini/config/mcp_config.json` (verified live; see the
+ * `externalMcpInjection` comment in `@jini-ai/agent-runtime`'s
+ * `defs/antigravity.ts`). NOT `~/.gemini/antigravity/mcp_config.json`: that
+ * file only works on machines where the Antigravity IDE happened to symlink it
+ * to this one, and on a machine without that symlink the bridge entry would
+ * never reach `agy`. Planning only this path also means a regular-file
+ * `antigravity/mcp_config.json` (the IDE's own) is never touched.
+ */
+export const ANTIGRAVITY_MCP_CONFIG_SEGMENTS = ['.gemini', 'config', 'mcp_config.json'];
 function cliPlan(slug, bin, argv, serverName) {
     return { kind: 'cli', slug, bin, ...argv, getArgv: ['mcp', 'get', serverName] };
 }
@@ -142,7 +153,7 @@ const AGENT_PLANNERS = {
     // and gates the server with `enabled`.
     opencode: ({ spec, ctx: { home, serverName } }) => jsonPlan('opencode', path.join(home, '.config', 'opencode', 'opencode.json'), ['mcp'], serverName, withEnv({ type: 'local', command: [spec.command, ...spec.args], enabled: true }, spec.env, 'environment')),
     openclaw: ({ spec, ctx: { home, serverName } }) => jsonPlan('openclaw', path.join(home, '.openclaw', 'openclaw.json'), ['mcp', 'servers'], serverName, jsonEntry(spec)),
-    antigravity: ({ spec, ctx: { home, serverName } }) => jsonPlan('antigravity', path.join(home, '.gemini', 'antigravity', 'mcp_config.json'), ['mcpServers'], serverName, jsonEntry(spec)),
+    antigravity: ({ spec, ctx: { home, serverName } }) => jsonPlan('antigravity', path.join(home, ...ANTIGRAVITY_MCP_CONFIG_SEGMENTS), ['mcpServers'], serverName, jsonEntry(spec)),
     trae: ({ spec, ctx: { home, platform, serverName }, appData }) => jsonPlan('trae', traeConfigPath(home, platform, appData), ['mcpServers'], serverName, jsonEntry(spec)),
     // ----- Unverified formats: print-only, never write -----
     vibe: ({ spec, ctx: { home, serverName } }) => ({
@@ -150,7 +161,7 @@ const AGENT_PLANNERS = {
         slug: 'vibe',
         format: 'toml',
         configPath: path.join(home, '.vibe', 'config.toml'),
-        snippet: vibeTomlSnippet(spec, serverName),
+        snippet: vibeTomlSnippet({ spec, name: serverName }),
         reason: 'Vibe uses a TOML array-of-tables ([[mcp_servers]]); ' +
             'its exact schema is unverified, so append this block by hand ' +
             'to avoid corrupting an existing config.',
@@ -304,7 +315,10 @@ function hermesYamlSnippet(spec, name) {
     }
     return lines.join('\n');
 }
-function vibeTomlSnippet(spec, name) {
+/** Render the launch command and environment as a Vibe TOML snippet without I/O.
+ * @complexity O(n) time and space in the serialized launch spec length.
+ */
+function vibeTomlSnippet({ spec, name }, _options = {}) {
     const argsToml = `[${spec.args.map((a) => JSON.stringify(a)).join(', ')}]`;
     const lines = [
         '[[mcp_servers]]',
@@ -313,6 +327,10 @@ function vibeTomlSnippet(spec, name) {
         `command = ${JSON.stringify(spec.command)}`,
         `args = ${argsToml}`,
     ];
+    if (Object.keys(spec.env).length > 0) {
+        const envToml = Object.entries(spec.env).map(([key, value]) => `${JSON.stringify(key)} = ${JSON.stringify(value)}`).join(', ');
+        lines.push(`env = { ${envToml} }`);
+    }
     return lines.join('\n');
 }
 //# sourceMappingURL=install.js.map

package/dist/bin/serve.d.ts

@@ -1,41 +1,4 @@
 #!/usr/bin/env node
-/**
- * @module @jini-ai/mcp/bin/serve
- *
- * The bootable `jini-mcp` binary (`package.json`'s `"bin": { "jini-mcp": "./dist/bin/serve.js" }`)
- * — the real executable entry point gap 3's MCP-callback continuation-transport spike needed and
- * did not have (see `packages/daemon/archived provenance ledger`'s "run/chat orchestration gap 3, part 1"
- * addition, and this package's own dated section in `archived provenance ledger`). `../server/tool-server.js`'s
- * `createMcpToolServer` was always designed to run as *this process's own* stdio — meant to be a
- * script a client (Claude Code) spawns as its own child subprocess and talks to over that child's
- * stdin/stdout — but until this file, nothing in this package actually was that script.
- *
- * Follows the CLI entry point's established shape for a bootable, side-effect-guarded, `#!/usr/bin/env
- * node` entry point: a named, fully-dependency-injected `serve()` export (importable for tests, or
- * for a consumer building its own bin wrapper around it) plus a bottom-of-file guard that only
- * calls it for real when this module is the actual process entrypoint — mirrors that file's own
- * `isMainModule` check (Node's ESM equivalent of the CommonJS `require.main === module` idiom).
- * Deliberately **not** re-exported from `../index.ts`: that barrel is a plain library dependency, and
- * this file's whole purpose is a `process.env`-reading, stdio-serving, potentially `process.exit`-
- * calling side effect — bundling it into the library barrel would mean `import '@jini-ai/mcp'` could
- * start behaving like a spawned MCP server.
- *
- * **Scope: what this process is spawned to do.** One `jini-mcp` process serves exactly one run for
- * its entire lifetime — the spawning daemon injects {@link RUN_ID_ENV_VAR} into the child's own
- * environment before Claude Code (which in turn spawns *this* as its own MCP server child, per its
- * `.mcp.json`) ever starts talking to it. That is what lets `execute_delegated_tool`
- * (`../server/tools/delegated-tool.js`) close over a fixed `runId` at construction time instead of
- * trusting a model-supplied one — see that module's own doc for why that boundary matters. Every
- * other tool this server hosts (`RUN_TOOLS`, `../server/tools/run-tools.js`) is run-agnostic and
- * needed no such scoping.
- *
- * **Daemon-URL resolution** follows the spawning host's environment: no baked-in default, just
- * `resolveDaemonUrl` (the CLI transport) wired to a `--daemon-url`-shaped precedence chain — except this
- * process has no argv to parse (an MCP client launches it with a fixed `command`/`args`/`env`, not
- * interactive flags), so only the env-var step applies: {@link DAEMON_URL_ENV_VAR}. When unset,
- * `resolveDaemonUrl` throws, and this file's own top-level error boundary turns that into a clean
- * stderr message + non-zero exit rather than an unhandled rejection.
- */
 import type { Readable, Writable } from 'node:stream';
 import { createMcpToolServer as createMcpToolServerDefault } from '../server/tool-server.js';
 /** The one run this process is scoped to for its entire lifetime. Set by the spawning daemon, never by the MCP client. */

package/dist/bin/serve.js

@@ -1,4 +1,42 @@
 #!/usr/bin/env node
+/**
+ * @module @jini-ai/mcp/bin/serve
+ *
+ * The bootable `jini-mcp` binary (`package.json`'s `"bin": { "jini-mcp": "./dist/bin/serve.js" }`)
+ * — the real executable entry point gap 3's MCP-callback continuation-transport spike needed and
+ * did not have (see `packages/daemon/archived provenance ledger`'s "run/chat orchestration gap 3, part 1"
+ * addition, and this package's own dated section in `archived provenance ledger`). `../server/tool-server.js`'s
+ * `createMcpToolServer` was always designed to run as *this process's own* stdio — meant to be a
+ * script a client (Claude Code) spawns as its own child subprocess and talks to over that child's
+ * stdin/stdout — but until this file, nothing in this package actually was that script.
+ *
+ * Follows the CLI entry point's established shape for a bootable, side-effect-guarded, `#!/usr/bin/env
+ * node` entry point: a named, fully-dependency-injected `serve()` export (importable for tests, or
+ * for a consumer building its own bin wrapper around it) plus a bottom-of-file guard that only
+ * calls it for real when this module is the actual process entrypoint — mirrors that file's own
+ * `isMainModule` check (Node's ESM equivalent of the CommonJS `require.main === module` idiom).
+ * Deliberately **not** re-exported from `../index.ts`: that barrel is a plain library dependency, and
+ * this file's whole purpose is a `process.env`-reading, stdio-serving, potentially `process.exit`-
+ * calling side effect — bundling it into the library barrel would mean `import '@jini-ai/mcp'` could
+ * start behaving like a spawned MCP server.
+ *
+ * **Scope: what this process is spawned to do.** One `jini-mcp` process serves exactly one run for
+ * its entire lifetime — the spawning daemon injects {@link RUN_ID_ENV_VAR} into the child's own
+ * environment before Claude Code (which in turn spawns *this* as its own MCP server child, per its
+ * `.mcp.json`) ever starts talking to it. That is what lets `execute_delegated_tool`
+ * (`../server/tools/delegated-tool.js`) close over a fixed `runId` at construction time instead of
+ * trusting a model-supplied one — see that module's own doc for why that boundary matters. Every
+ * other tool this server hosts (`RUN_TOOLS`, `../server/tools/run-tools.js`) is run-agnostic and
+ * needed no such scoping.
+ *
+ * **Daemon-URL resolution** follows the spawning host's environment: no baked-in default, just
+ * `resolveDaemonUrl` (the CLI transport) wired to a `--daemon-url`-shaped precedence chain — except this
+ * process has no argv to parse (an MCP client launches it with a fixed `command`/`args`/`env`, not
+ * interactive flags), so only the env-var step applies: {@link DAEMON_URL_ENV_VAR}. When unset,
+ * `resolveDaemonUrl` throws, and this file's own top-level error boundary turns that into a clean
+ * stderr message + non-zero exit rather than an unhandled rejection.
+ */
+import { existsSync, realpathSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { createCheckMessagesTool, messageRelayInstructions } from '../server/message-relay.js';
 import { isLoopbackHostname } from '@jini-ai/platform/net';
@@ -231,7 +269,9 @@ async function resolveStartupTools({ toolIds, resolveBaseUrl, serverOptions }) {
 // Only run for real when this module is the actual process entrypoint (`node dist/bin/serve.js`,
 // or the `jini-mcp` bin shim pnpm/npm links to it) — not merely imported, e.g. by this file's own
 // tests importing the named `serve` export above. Mirrors the CLI entry point's identical guard.
-const isMainModule = process.argv[1] !== undefined && fileURLToPath(import.meta.url) === process.argv[1];
+// Canonical paths recognize npm bin symlinks; a missing argv path is an unrelated import.
+const isMainModule = process.argv[1] !== undefined && existsSync(process.argv[1])
+    && realpathSync(fileURLToPath(import.meta.url)) === realpathSync(process.argv[1]);
 if (isMainModule) {
     await serve({});
 }

package/dist/core/config.js

@@ -342,9 +342,9 @@ export function buildClaudeMcpJson({ servers }, { tokens = {} } = {}) {
 function nonEmptyField({ key, value }) {
     return value && Object.keys(value).length > 0 ? { [key]: value } : {};
 }
-/** `{ headers }` for a remote server (user headers + daemon OAuth bearer when in oauth mode), or `{}` when empty. */
-function remoteHeadersField({ server, tokens }) {
-    const bearer = effectiveMcpAuthMode(server) === 'oauth' ? tokens[server.id] : undefined;
+/** `{ headers }` for a remote server (user headers + its own stored OAuth bearer), or `{}` when empty. */
+function remoteHeadersField({ server, tokens }, _options = {}) {
+    const bearer = effectiveMcpAuthMode(server) === 'oauth' && Object.hasOwn(tokens, server.id) ? tokens[server.id] : undefined;
     return nonEmptyField({ key: 'headers', value: mergeAuthHeader(server.headers, bearer) });
 }
 /** Build a headers object that includes the daemon-issued bearer token when

package/dist/core/tokens.d.ts

@@ -57,8 +57,12 @@ export declare function sanitizeTokensFile({ raw }: {
 /**
  * Read and sanitize the MCP token store from `<dataDir>/mcp-tokens.json`.
  * Returns an empty store when the file does not exist or contains invalid JSON.
+ * Corrupt text is backed up through the owner-only writer before returning empty,
+ * so the next mutation cannot erase the recoverable bytes.
  * @param dataDir The resolved runtime data directory.
- * @returns The sanitized token file, never rejects on missing-file or corrupt-JSON.
+ * @returns The sanitized token file, or an empty store after missing-file or backed-up corrupt JSON.
+ * @throws On unexpected read errors or a failed backup; the damaged file is left untouched.
+ * @complexity O(n) time and space in the token file length, including a backup write on corruption.
  */
 export declare function readTokensFile({ dataDir }: {
     dataDir: string;

package/dist/core/tokens.js

@@ -24,6 +24,7 @@ import { createSystemClock } from "@jini-ai/core/primitives";
 // throwing) if a POSIX platform did not honor that mode; it skips
 // verification on `win32`, which has no POSIX permission-bit model.
 import { readFile } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
 import path from 'node:path';
 import { writeFileAtomicAsync } from '@jini-ai/platform/fs';
 /** Shared atomic secret persistence (CR-006 / SEC-RB-002).
@@ -121,19 +122,31 @@ function sanitizeToken(raw, clock) {
 /**
  * Read and sanitize the MCP token store from `<dataDir>/mcp-tokens.json`.
  * Returns an empty store when the file does not exist or contains invalid JSON.
+ * Corrupt text is backed up through the owner-only writer before returning empty,
+ * so the next mutation cannot erase the recoverable bytes.
  * @param dataDir The resolved runtime data directory.
- * @returns The sanitized token file, never rejects on missing-file or corrupt-JSON.
+ * @returns The sanitized token file, or an empty store after missing-file or backed-up corrupt JSON.
+ * @throws On unexpected read errors or a failed backup; the damaged file is left untouched.
+ * @complexity O(n) time and space in the token file length, including a backup write on corruption.
  */
 export async function readTokensFile({ dataDir }, options = {}) {
+    const filesystem = options.filesystem ?? defaultFilesystem;
+    let raw;
     try {
-        const raw = await (options.filesystem ?? defaultFilesystem).readText({ filePath: tokensFile(dataDir) });
+        raw = await filesystem.readText({ filePath: tokensFile(dataDir) });
         return sanitizeTokensFile({ raw: JSON.parse(raw) }, options);
     }
     catch (err) {
         const e = err;
         if (e.code === 'ENOENT')
             return { ...EMPTY, servers: { ...EMPTY.servers } };
-        if (e.name === 'SyntaxError') {
+        if (e.name === 'SyntaxError' && raw !== undefined) {
+            // Different corrupt contents must not overwrite each other's recovery copy.
+            const digest = createHash('sha256').update(raw).digest('hex');
+            await filesystem.writeSecretText({
+                filePath: `${tokensFile(dataDir)}.corrupt-${digest}`,
+                contents: raw,
+            });
             console.error('[mcp-tokens] Corrupted JSON, returning empty:', e.message);
             return { ...EMPTY, servers: { ...EMPTY.servers } };
         }
@@ -166,7 +179,7 @@ async function writeTokensFile(dataDir, next, options) {
  * (or the persisted entry is malformed). */
 export async function getToken({ dataDir, serverId }, options = {}) {
     const file = await readTokensFile({ dataDir }, options);
-    return file.servers[serverId] ?? null;
+    return Object.hasOwn(file.servers, serverId) ? file.servers[serverId] : null;
 }
 /** Atomically merge a new token for `serverId` into the tokens file. */
 export async function setToken({ dataDir, serverId, token }, options = {}) {

package/dist/federation/adapter.http.d.ts

@@ -1,4 +1,5 @@
 import type { FederationMessages } from "./messages.js";
+import type { TextReadOptions } from "@jini-ai/platform/fetch-with-timeout";
 import type { McpHttpExchange, McpHttpLaunchSpec, McpSessionPort, McpClientInfo } from "./ports.js";
 /**
  * A connected MCP client session against one hosted server.
@@ -50,7 +51,7 @@ export declare function connectMcpHttpSession(deps: Omit<McpHttpSessionDependenc
 /**
  * The production {@link McpHttpExchange}: one `fetch` per exchange.
  *
- * Deliberately logic-free — the same discipline as `spawnMcpStdioChannel`. Everything above it is
+ * Deliberately thin — the same discipline as `spawnMcpStdioChannel`. Everything above it is
  * already under test through the exchange seam, and code that only runs when a real network exists
  * is code that only fails in production.
  *
@@ -59,9 +60,12 @@ export declare function connectMcpHttpSession(deps: Omit<McpHttpSessionDependenc
  * re-send that header to whatever host the server nominated. Refusing to follow means a redirect is
  * a visible failure rather than a silent credential disclosure.
  *
+ * Byte caps and strict UTF-8 are opt-in and require the optional `@jini-ai/platform` >=0.6.15
+ * peer. The default path never loads that peer and retains unlimited `response.text()`.
+ *
  * @complexity O(n) in the response body length.
  */
 export declare function createFetchMcpHttpExchange({ fetch: fetchImpl }: {
     fetch: typeof fetch;
-}): McpHttpExchange;
+}, optional?: TextReadOptions): McpHttpExchange;
 //# sourceMappingURL=adapter.http.d.ts.map

package/dist/federation/adapter.http.js

@@ -1,3 +1,4 @@
+import { parseSseRecord } from "@jini-ai/core/primitives";
 import { buildInitializeParams, CLIENT_PROTOCOL_VERSION, drainToolsList, McpAuthFailedError, McpProtocolError, parseCallToolResult, parseInitializeResult, } from "./mcp-protocol.js";
 /**
  * @file The second real `McpSessionPort` adapter: an MCP client speaking JSON-RPC 2.0 over MCP's
@@ -279,7 +280,7 @@ class McpHttpSession {
         const id = this.nextId++;
         const response = await this.send(JSON.stringify({ jsonrpc: "2.0", id, method, params }), signal);
         assertOkStatus(method, response, this.messages);
-        const frame = extractJsonRpcFrame(method, response);
+        const frame = extractJsonRpcFrame({ method, response, id });
         if (frame.error) {
             throw new McpProtocolError({ message: `mcp-federation: remote returned JSON-RPC error ${frame.error.code ?? "?"}: ${frame.error.message ?? "(no message)"}` });
         }
@@ -312,49 +313,52 @@ function assertOkStatus(method, response, messages) {
     throw new McpProtocolError({ message: `mcp-federation: the server answered '${method}' with HTTP ${response.status}` });
 }
 /**
- * Pulls the JSON-RPC frame out of whichever response mode the server chose.
+ * Pulls the request's JSON-RPC response out of whichever mode the server chose.
  *
  * @throws {McpProtocolError} On an oversized body, a body carrying no frame, or one that does not
  * parse.
  * @complexity O(n) in the body length.
  */
-function extractJsonRpcFrame(method, response) {
+function extractJsonRpcFrame({ method, response, id }, _options = {}) {
     if (Buffer.byteLength(response.text, "utf8") > MAX_RESPONSE_BYTES) {
         throw new McpProtocolError({ message: `mcp-federation: the server's response to '${method}' exceeded ${MAX_RESPONSE_BYTES} bytes` });
     }
-    const payload = response.contentType.startsWith("text/event-stream") ? firstSseData(response.text) : response.text.trim();
-    if (payload === null || payload === "") {
-        throw new McpProtocolError({ message: `mcp-federation: the server's response to '${method}' carried no JSON-RPC message` });
-    }
+    let frame;
     try {
-        return JSON.parse(payload);
+        frame = response.contentType.startsWith("text/event-stream")
+            ? matchingSseResponse({ body: response.text, id })
+            : response.text.trim() === "" ? null : JSON.parse(response.text);
     }
     catch {
         throw new McpProtocolError({ message: `mcp-federation: the server's response to '${method}' was not valid JSON` });
     }
+    if (frame === null) {
+        throw new McpProtocolError({ message: `mcp-federation: the server's response to '${method}' carried no JSON-RPC message` });
+    }
+    return frame;
 }
 /**
- * The first SSE `data:` payload in a stream, or `null`.
+ * The SSE response matching the request id, or `null` when none is present.
  *
- * Only the first is taken, and deliberately: a server may interleave progress notifications before
- * the response, but this client issues one request at a time and wants the frame answering it.
+ * A server may interleave progress notifications before the response, but this client issues one
+ * request at a time and wants the frame answering it.
  * Multi-line `data:` fields are joined with newlines per the SSE spec, since a server is entitled
- * to split a long JSON body across them.
+ * to split a long JSON body across them; the shared record parser owns that framing.
  *
- * @complexity O(n) in the body length.
+ * @throws {SyntaxError} On malformed JSON in a data event; the caller maps it to McpProtocolError.
+ * @complexity O(n) time and space in the bounded body length.
  */
-function firstSseData(body) {
-    const collected = [];
-    for (const rawLine of body.split(/\r\n|\r|\n/)) {
-        if (rawLine.startsWith("data:")) {
-            collected.push(rawLine.slice("data:".length).replace(/^ /, ""));
+function matchingSseResponse({ body, id }, _options = {}) {
+    for (const rawFrame of body.replace(/\r\n|\r/g, "\n").split("\n\n")) {
+        const { data } = parseSseRecord({ rawFrame });
+        if (data === "")
             continue;
+        const frame = JSON.parse(data);
+        if (frame?.id === id && (Object.hasOwn(frame, "result") || Object.hasOwn(frame, "error"))) {
+            return frame;
         }
-        // A blank line ends an event. Anything collected so far is that event's complete payload.
-        if (rawLine.trim() === "" && collected.length > 0)
-            return collected.join("\n");
     }
-    return collected.length > 0 ? collected.join("\n") : null;
+    return null;
 }
 /**
  * Performs the MCP handshake against a hosted server and returns the connected session.
@@ -381,7 +385,7 @@ export async function connectMcpHttpSession(deps, options = {}) {
 /**
  * The production {@link McpHttpExchange}: one `fetch` per exchange.
  *
- * Deliberately logic-free — the same discipline as `spawnMcpStdioChannel`. Everything above it is
+ * Deliberately thin — the same discipline as `spawnMcpStdioChannel`. Everything above it is
  * already under test through the exchange seam, and code that only runs when a real network exists
  * is code that only fails in production.
  *
@@ -390,9 +394,12 @@ export async function connectMcpHttpSession(deps, options = {}) {
  * re-send that header to whatever host the server nominated. Refusing to follow means a redirect is
  * a visible failure rather than a silent credential disclosure.
  *
+ * Byte caps and strict UTF-8 are opt-in and require the optional `@jini-ai/platform` >=0.6.15
+ * peer. The default path never loads that peer and retains unlimited `response.text()`.
+ *
  * @complexity O(n) in the response body length.
  */
-export function createFetchMcpHttpExchange({ fetch: fetchImpl }) {
+export function createFetchMcpHttpExchange({ fetch: fetchImpl }, optional = {}) {
     return {
         async send(request, options = {}) {
             const response = await fetchImpl(request.url, {
@@ -407,7 +414,9 @@ export function createFetchMcpHttpExchange({ fetch: fetchImpl }) {
                 contentType: (response.headers.get("content-type") ?? "").toLowerCase(),
                 sessionId: response.headers.get("mcp-session-id") ?? undefined,
                 wwwAuthenticate: response.headers.get("www-authenticate") ?? undefined,
-                text: await response.text(),
+                text: optional.maxResponseBytes === undefined && !optional.strictUtf8
+                    ? await response.text()
+                    : await (await import("@jini-ai/platform/fetch-with-timeout")).readFetchResponseText({ response }, optional),
             };
         },
     };

package/dist/federation/approvals/revocation-reason.d.ts

@@ -1,9 +1,9 @@
 import type { ToolRefusalReason } from "../trust.js";
 import type { ExternalMcpRevocationReason } from "./revocation.js";
 /** Maps an admitted tool's refusal under the row's current grants to the revocation reason the
- *  gate reports. `refusalForAdmittedToolUnderCurrentGrants` no longer produces
- *  `"remote-declares-not-read-only"` (hints never refuse since G3), but the union still carries it,
- *  so the mapping keeps it rather than collapsing a write refusal into "tool-not-allowed".
+ *  gate reports. `refusalForAdmittedToolUnderCurrentGrants` produces `"remote-declares-not-read-only"`
+ *  for a write tool with no write grant; it maps to "write-not-allowed" rather than collapsing into
+ *  "tool-not-allowed", so the model is told the tool may not make changes.
  *  @complexity O(1). */
 export declare function revocationReasonForToolRefusal(refusal: ToolRefusalReason | null): ExternalMcpRevocationReason | null;
 //# sourceMappingURL=revocation-reason.d.ts.map

package/dist/federation/approvals/revocation-reason.js

@@ -1,7 +1,7 @@
 /** Maps an admitted tool's refusal under the row's current grants to the revocation reason the
- *  gate reports. `refusalForAdmittedToolUnderCurrentGrants` no longer produces
- *  `"remote-declares-not-read-only"` (hints never refuse since G3), but the union still carries it,
- *  so the mapping keeps it rather than collapsing a write refusal into "tool-not-allowed".
+ *  gate reports. `refusalForAdmittedToolUnderCurrentGrants` produces `"remote-declares-not-read-only"`
+ *  for a write tool with no write grant; it maps to "write-not-allowed" rather than collapsing into
+ *  "tool-not-allowed", so the model is told the tool may not make changes.
  *  @complexity O(1). */
 export function revocationReasonForToolRefusal(refusal) {
     if (refusal === null)

package/dist/federation/approvals/revocation.d.ts

@@ -1,4 +1,4 @@
-import type { FederatedCallTarget } from "../ports.js";
+import type { FederatedCallTarget, FederatedGateVerdict } from "../ports.js";
 export type ExternalMcpRevocationReason = "removed" | "turned-off" | "disconnected" | "changed" | "tool-not-allowed" | "write-not-allowed" | "unverifiable";
 /** Host projection of the current row; revision derivation and credential status stay in adapters. */
 export interface ConnectionRosterSnapshot {
@@ -57,5 +57,5 @@ export declare function createFederatedConnectionRevocationGate(required: {
 }): (required: {
     connectionId: string;
     call: FederatedCallTarget;
-}) => Promise<void>;
+}) => Promise<void | FederatedGateVerdict>;
 //# sourceMappingURL=revocation.d.ts.map

package/dist/federation/approvals/revocation.js

@@ -44,7 +44,7 @@ export function createFederatedConnectionRevocationGate(required, optional = {})
             return;
         const { record, reason } = await readRosterRefusal({ roster: required.roster, connectionId, call }, { scope: optional.scope, report });
         if (reason === null)
-            return;
+            return "current-grants-checked";
         const refusal = { serverId: connectionId, label: record?.label ?? null, remoteName: call.remoteName, reason };
         try {
             await optional.webhooks?.connectionRefused(refusal, scopeOption(optional.scope));

package/dist/federation/ports.d.ts

@@ -102,7 +102,11 @@ export interface McpStdioChannel {
  * every later `tools/call`. `external-mcp-revocation.ts`'s per-call gate is the one consumer: a
  * preset gets only the legacy OAuth `needs_reauth` check (it has no roster row to compare against);
  * a roster connection is re-checked against its CURRENT row every call, keyed by
- * `admissionRevision` — see that file's `rosterRefusalFor`.
+ * `admissionRevision` — see that file's `rosterRefusalFor`. A connection whose current grants no gate
+ * re-reads (a preset, or any connection when the host wires no gate) is checked for "may write"
+ * against the grants it was admitted with (`registrations.ts` `assertAdmittedGrants`), so a preset is
+ * never exempt from it; a roster connection whose gate returns {@link FederatedGateVerdict} uses its
+ * current row instead, so a new grant needs no restart.
  */
 export type FederatedConnectionOrigin = {
     readonly kind: "preset";
@@ -122,10 +126,11 @@ export interface FederatedMcpConnectionConfig {
      * Remote readOnlyHint:false or destructiveHint:true vetoes each declaration. */
     readonly readOnlyRemoteNames?: ReadonlySet<string> | undefined;
     /**
-     * SECOND list of REMOTE tool names (pre-namespacing) the operator has separately declared as
-     * writes. Kept for configuration compatibility and admission reports, independently of
-     * {@link allowedToolNames}. The allowlist alone gates admission; this list does not grant or
-     * refuse calls. Descriptor read-only classification and host permissions remain separate gates.
+     * SECOND list of REMOTE tool names (pre-namespacing) the operator has separately allowed to WRITE
+     * ("may write"). The allowlist alone gates admission; this list gates CALLS: a tool `trust.ts`
+     * `federatedToolRequiresWriteGrant` classifies as a write is refused per call unless named here
+     * (`refusalForAdmittedToolUnderCurrentGrants`). Descriptor read-only classification and host
+     * permissions remain separate gates.
      *
      * Same "no safe default at this layer" rule as {@link allowedToolNames}: every connection that has
      * never been told to allow a write must resolve to an empty list here, and a vendor preset that
@@ -165,7 +170,15 @@ export interface FederatedCallTarget {
      *  re-read from the remote on this path. */
     readonly declaredAnnotations: RemoteToolDescriptor["annotations"] | undefined;
     readonly origin: FederatedConnectionOrigin | undefined;
+    /** `trust.ts` `federatedToolRequiresWriteGrant`, decided at registration where the operator's read
+     *  list is known — the per-call write-grant check reads it. Absent means "re-derive", never "read". */
+    readonly requiresWriteGrant?: boolean | undefined;
 }
+/** What `FederationDeps.assertConnectionUsable` returns when it has just checked this call against the
+ *  connection's CURRENT allowlist and write list. Only then is the admitted-grants snapshot skipped
+ *  (so a grant added after boot works without a restart); a liveness-only gate returns nothing and
+ *  the snapshot check still runs, failing closed. */
+export type FederatedGateVerdict = "current-grants-checked";
 /** How a locally-launched federated connection is started.
  *
  * See {@link McpHttpLaunchSpec} for the hosted counterpart, and {@link McpLaunchSpec} for why the