@jini-ai/mcp 0.6.15-rc.1 → 0.6.15

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @jini-ai/mcp
 
+## 0.6.15
+
+### Patch Changes
+
+- Export async WebCrypto `canonicalArgumentDigest` from `@jini-ai/core/records`, reusing
+  `canonicalJson` for identical plugin and host SHA-256 hex digests. Canonical JSON now
+  sorts keys recursively by Unicode code point and throws `CanonicalJsonError` for
+  non-JSON values and cycles; undefined object properties remain omitted.
+
+  MCP approval fingerprints reuse the core serializer. Existing ordinary JSON
+  fingerprints retain their bytes; non-JSON schemas now fail instead of colliding
+  with valid JSON, and astral object keys follow the shared code-point ordering.
+
 ## 0.6.13
 
 ### Patch Changes

package/dist/agent-install/install.d.ts

@@ -121,4 +121,16 @@ export declare function removeJsonInstall({ existingText, plan }: {
     existingText: string | null;
     plan: JsonInstallPlan;
 }): string | null;
+/** Check the installed JSON entry using the installer’s own path and launch contract.
+ * Read failures and stale/disabled entries name the repair without exposing configuration values.
+ * This does not mutate global config or persist a run credential. O(config bytes).
+ */
+export declare function verifyJsonAgentInstall({ agentId, spec, ctx, readFile }: {
+    agentId: string;
+    spec: McpLaunchSpec;
+    ctx: PlanContext;
+    readFile: (required: {
+        path: string;
+    }) => Promise<string>;
+}, _optional?: Record<string, never>): Promise<void>;
 //# sourceMappingURL=install.d.ts.map

package/dist/agent-install/install.js

@@ -299,6 +299,48 @@ function parseJsonObject(text, where) {
     }
     return parsed;
 }
+/** Check the installed JSON entry using the installer’s own path and launch contract.
+ * Read failures and stale/disabled entries name the repair without exposing configuration values.
+ * This does not mutate global config or persist a run credential. O(config bytes).
+ */
+export async function verifyJsonAgentInstall({ agentId, spec, ctx, readFile }, _optional = {}) {
+    const slug = { value: agentId };
+    if (!isAgentSlug(slug))
+        throw new Error('Unknown MCP agent installation');
+    const plan = planAgentInstall({ slug: slug.value, spec, ctx });
+    if (plan.kind !== 'json')
+        throw new Error('MCP installation does not use a JSON registry');
+    try {
+        assertSafeJsonInstallPlan(plan);
+        const root = parseJsonObject(await readFile({ path: plan.configPath }), plan.configPath);
+        const entry = installedJsonEntry({ root, plan });
+        if (!installedLaunchMatches({ entry, expected: plan.entry }))
+            throw new Error('Invalid bridge entry');
+    }
+    catch {
+        throw new Error(`The assistant's tools are not set up in ${agentId}. Run "mcp install ${agentId}" to repair the bridge entry in ${plan.configPath}, then try again.`);
+    }
+}
+function installedJsonEntry({ root, plan }) {
+    let value = root;
+    for (const key of [...plan.keyPath, plan.serverKey]) {
+        if (!value || typeof value !== 'object' || !Object.hasOwn(value, key))
+            return undefined;
+        value = value[key];
+    }
+    return value;
+}
+function installedLaunchMatches({ entry, expected }) {
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry))
+        return false;
+    const actual = entry;
+    const wanted = expected;
+    if (actual.disabled === true || actual.command !== wanted.command)
+        return false;
+    if (JSON.stringify(actual.args ?? []) !== JSON.stringify(wanted.args ?? []))
+        return false;
+    return JSON.stringify(actual.env ?? {}) === JSON.stringify(wanted.env ?? {});
+}
 // --- Snippets for the manual (print-only) strategy ----------------------
 function hermesYamlSnippet(spec, name) {
     const lines = [

package/dist/bin/serve.js

@@ -133,13 +133,15 @@ export async function serve(_requiredArgs, deps = {}) {
     const runId = env[RUN_ID_ENV_VAR];
     if (typeof runId !== 'string' || runId.length === 0) {
         writeErr({ text: `${SERVER_NAME}: missing required ${RUN_ID_ENV_VAR} environment variable (this process must be spawned by a Jini daemon, which sets it)\n` });
-        return exit({ code: 1 });
+        exit({ code: 1 });
+        return;
     }
     let baseUrlResolution;
     const resolveBaseUrl = () => {
         const options = { flagUrl: null, env, envVarName: DAEMON_URL_ENV_VAR, warn: ({ message }) => writeErr({ text: message }) };
         // Startup discovery and subsequent execution must use the same resolved daemon.
-        return baseUrlResolution ??= resolveDaemonUrlFn({}, options);
+        baseUrlResolution ??= resolveDaemonUrlFn({}, options);
+        return baseUrlResolution;
     };
     const delegatedGatewayOptions = buildDelegatedGatewayOptions({ env }, deps);
     const messageRelay = resolveMessageRelay({ env, runId, writeErr, exit });
@@ -165,7 +167,7 @@ export async function serve(_requiredArgs, deps = {}) {
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         writeErr({ text: `${SERVER_NAME}: ${message}\n` });
-        return exit({ code: 1 });
+        exit({ code: 1 });
     }
 }
 /** Enable both relay surfaces only for a trusted spawn flag with its per-run nonce.

package/dist/client/client.js

@@ -1,16 +1,4 @@
-/**
- * @module @jini-ai/mcp/client/client
- * Product-neutral runtime primitives for a stdio MCP server: an idle-exit
- * controller that auto-closes an idle server process, a relative-reference
- * extractor that walks HTML/CSS/JS text to find sibling files to bundle, and a
- * textual-MIME classifier. Dependency-free (node stdlib only); imports no
- * sibling MCP subdirectory.
- */
-// These are the generic, product-agnostic building blocks that back a stdio
-// MCP server's lifecycle and its "pull an entry file plus everything it
-// references" bundling. They hold no state beyond the idle controller's own
-// timer and never touch the network or filesystem, so they unit-test against
-// plain values.
+import { cssUrlRefs } from './css-url-refs.js';
 const defaultTimers = {
     schedule: ({ callback, delayMs }) => setTimeout(callback, delayMs),
     cancel: ({ handle }) => clearTimeout(handle),
@@ -134,13 +122,13 @@ const HTML_REF_PATTERNS = [
     /<iframe\b[^>]*\bsrc=["']([^"']+)["']/gi,
 ];
 const CSS_REF_PATTERNS = [
-    /\burl\(\s*["']?([^"')]+)["']?\s*\)/gi,
-    /@import\s+(?:url\()?\s*["']([^"')]+)["']/gi,
+    cssUrlRefs,
+    /@import\s+(?:url\(\s*)?["']([^"')]+)["']/gi,
 ];
 // JS/TS only - running these on prose creates false positives on words
 // like "imported from 'X'".
 const JS_REF_PATTERNS = [
-    /\bimport\s+[^'"]*?['"]([^'"]+)['"]/g,
+    /\bimport\s[^'"]*['"]([^'"]+)['"]/g,
     /\bfrom\s+['"]([^'"]+)['"]/g,
     /\bimport\(\s*['"]([^'"]+)['"]\s*\)/g,
     /\brequire\(\s*['"]([^'"]+)['"]\s*\)/g,
@@ -178,17 +166,22 @@ function selectRefPatterns(fromMime, fromPath, htmlLike) {
 }
 function collectPatternCandidates(text, patterns) {
     const candidates = [];
-    for (const re of patterns) {
-        for (const m of text.matchAll(re)) {
-            // The capture group is required in every pattern, so `m[1]` is always a
-            // matched string here (the `!` only satisfies noUncheckedIndexedAccess).
-            const ref = m[1].trim();
+    for (const pattern of patterns) {
+        for (const raw of patternRefs(text, pattern)) {
+            const ref = raw.trim();
             if (ref)
                 candidates.push(ref);
         }
     }
     return candidates;
 }
+function patternRefs(text, pattern) {
+    if (typeof pattern === 'function')
+        return pattern(text);
+    // The capture group is required in every pattern, so `m[1]` is always a
+    // matched string here (the `!` only satisfies noUncheckedIndexedAccess).
+    return Array.from(text.matchAll(pattern), (m) => m[1]);
+}
 // Pull every candidate URL out of any srcset attributes in HTML.
 function collectSrcsetCandidates(text) {
     const candidates = [];
@@ -206,26 +199,41 @@ function collectSrcsetCandidates(text) {
 function collapseSegments(segs) {
     const out = [];
     for (const s of segs) {
-        if (s === '' || s === '.')
-            continue;
-        if (s !== '..') {
-            out.push(s);
-            continue;
-        }
-        if (out.length === 0)
+        if (s === '..' && out.length === 0)
             return null;
-        out.pop();
+        if (s === '..')
+            out.pop();
+        // Empty and `.` segments name the current directory and add nothing.
+        if (s !== '..' && s !== '' && s !== '.')
+            out.push(s);
     }
     return out;
 }
 // Resolve one raw ref against the referencing file's directory. Returns null
 // for external refs (`https?:`, `//`, `data:`, `mailto:`, `tel:`, `#`), for
 // refs that escape the root; a ref that collapses to nothing yields ''.
+const LINE_TERMINATORS = '\n\r\u2028\u2029';
+/** `resolved` cut at its first `?` or `#` — the same result as `.replace(/[?#].*$/, '')`, whose
+ *  `.` stops at line terminators: a `?`/`#` with a line break after it is left alone. */
+function withoutQueryOrFragment(resolved) {
+    let tailStart = 0;
+    for (let i = resolved.length - 1; i >= 0; i -= 1) {
+        if (LINE_TERMINATORS.includes(resolved[i])) {
+            tailStart = i + 1;
+            break;
+        }
+    }
+    for (let i = tailStart; i < resolved.length; i += 1) {
+        if (resolved[i] === '?' || resolved[i] === '#')
+            return resolved.slice(0, i);
+    }
+    return resolved;
+}
 function normalizeRef(raw, dir) {
     if (/^(?:https?:|\/\/|data:|mailto:|tel:|#)/i.test(raw))
         return null;
     const resolved = raw.startsWith('/') ? raw.slice(1) : dir + raw;
-    const stripped = resolved.replace(/[?#].*$/, '');
+    const stripped = withoutQueryOrFragment(resolved);
     return collapseSegments(stripped.split('/'))?.join('/') ?? null;
 }
 /**

package/dist/client/css-url-refs.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @file The references `/\burl\(\s*["']?([^"')]+)["']?\s*\)/gi` captures from CSS, found by a
+ * linear scan instead of that pattern's backtracking over whitespace runs and unterminated
+ * references. Each quote is optional on its own, as in the pattern.
+ */
+/** Every `url(...)` reference in `text`, in order, exactly as the pattern's group captured it. */
+export declare function cssUrlRefs(text: string): string[];
+//# sourceMappingURL=css-url-refs.d.ts.map

package/dist/client/css-url-refs.js

@@ -0,0 +1,65 @@
+/**
+ * @file The references `/\burl\(\s*["']?([^"')]+)["']?\s*\)/gi` captures from CSS, found by a
+ * linear scan instead of that pattern's backtracking over whitespace runs and unterminated
+ * references. Each quote is optional on its own, as in the pattern.
+ */
+const isSpace = (ch) => ch !== undefined && /\s/.test(ch);
+const isQuote = (ch) => ch === '"' || ch === "'";
+const isWordChar = (ch) => ch !== undefined && /\w/.test(ch);
+function skipSpaces(text, index) {
+    let i = index;
+    while (isSpace(text[i]))
+        i += 1;
+    return i;
+}
+/** End of the run of characters other than quotes and `)` starting at `index`. */
+function refRunEnd(text, index) {
+    let i = index;
+    while (i < text.length && !`"')`.includes(text[i]))
+        i += 1;
+    return i;
+}
+/** Index just past the reference's `)`: directly after it, or after one quote and whitespace; -1 if neither. */
+function closeOfRef(text, end) {
+    if (text[end] === ')')
+        return end + 1;
+    if (!isQuote(text[end]))
+        return -1;
+    const close = skipSpaces(text, end + 1);
+    return text[close] === ')' ? close + 1 : -1;
+}
+/** After an opening quote. `url( ')` captures the space before the lone quote: the pattern
+ *  backtracks out of its leading `\s*` when nothing follows the quote. */
+function quotedRef(text, start, quoteAt) {
+    const end = refRunEnd(text, quoteAt + 1);
+    if (end === quoteAt + 1)
+        return quoteAt > start && text[end] === ')' ? { ref: text[quoteAt - 1], end: end + 1 } : null;
+    const close = closeOfRef(text, end);
+    return close < 0 ? null : { ref: text.slice(quoteAt + 1, end), end: close };
+}
+/** The reference after `url(` at `start` (the index just past the parenthesis), or null. */
+function refAt(text, start) {
+    const first = skipSpaces(text, start);
+    if (isQuote(text[first]))
+        return quotedRef(text, start, first);
+    if (text[first] === ')')
+        return first > start ? { ref: text[first - 1], end: first + 1 } : null;
+    const end = refRunEnd(text, first);
+    const close = end > first ? closeOfRef(text, end) : -1;
+    return close < 0 ? null : { ref: text.slice(first, end), end: close };
+}
+/** Every `url(...)` reference in `text`, in order, exactly as the pattern's group captured it. */
+export function cssUrlRefs(text) {
+    const refs = [];
+    const opener = /url\(/gi;
+    for (let open = opener.exec(text); open; open = opener.exec(text)) {
+        // `\b` before `url`: the opener may not continue a word.
+        const found = isWordChar(text[open.index - 1]) ? null : refAt(text, open.index + 4);
+        if (found) {
+            refs.push(found.ref);
+            opener.lastIndex = found.end;
+        }
+    }
+    return refs;
+}
+//# sourceMappingURL=css-url-refs.js.map

package/dist/core/config.js

@@ -25,6 +25,7 @@ import { realpathSync } from 'node:fs';
 import path from 'node:path';
 import { pathContains } from '@jini-ai/core/primitives';
 import { writeFileAtomicAsync } from '@jini-ai/platform/fs';
+import { trimCharsEnd } from '@jini-ai/core/text';
 /** Shared atomic secret persistence (CR-006 / SEC-RB-002).
  * The previous pattern in each of those stores wrote the temp file with
  * default permissions and either never restricted it (config, OAuth client
@@ -207,10 +208,8 @@ export function sanitizeMcpConfig({ raw }) {
     const out = [];
     for (const entry of list) {
         const ok = sanitizeMcpServer({ raw: entry });
-        if (!ok)
-            continue;
-        if (seen.has(ok.id))
-            continue; // de-dupe by id
+        if (!ok || seen.has(ok.id))
+            continue; // invalid, or a duplicate id (de-dupe by id)
         seen.add(ok.id);
         out.push(ok);
     }
@@ -448,7 +447,7 @@ function normalizeAllowedDirectory(dir) {
     const root = path.parse(resolved).root;
     if (resolved === root)
         return root;
-    return resolved.replace(/[\\/]+$/, '');
+    return trimCharsEnd({ text: resolved, chars: '\\/' });
 }
 function normalizeAllowedDirectoryVariants(dir, resolvePath) {
     const normalized = normalizeAllowedDirectory(dir);

package/dist/core/tokens.js

@@ -74,12 +74,10 @@ export function sanitizeTokensFile({ raw }, { clock = createSystemClock() } = {}
         return { servers: {} };
     const out = {};
     for (const [id, value] of Object.entries(servers)) {
-        if (id === '__proto__' || id === 'constructor')
-            continue;
-        const tok = sanitizeToken(value, clock);
-        if (!tok)
-            continue;
-        out[id] = tok;
+        // Prototype-polluting keys are never copied; neither is a token that fails sanitizing.
+        const tok = id === '__proto__' || id === 'constructor' ? undefined : sanitizeToken(value, clock);
+        if (tok)
+            out[id] = tok;
     }
     return { servers: out };
 }

package/dist/federation/adapter.http.js

@@ -277,7 +277,8 @@ class McpHttpSession {
      *  @throws {McpProtocolError} On a transport failure, a non-2xx, an unparseable body, or a
      *  JSON-RPC error frame. */
     async request(method, params, signal) {
-        const id = this.nextId++;
+        const id = this.nextId;
+        this.nextId += 1;
         const response = await this.send(JSON.stringify({ jsonrpc: "2.0", id, method, params }), signal);
         assertOkStatus(method, response, this.messages);
         const frame = extractJsonRpcFrame({ method, response, id });
@@ -312,6 +313,10 @@ function assertOkStatus(method, response, messages) {
     }
     throw new McpProtocolError({ message: `mcp-federation: the server answered '${method}' with HTTP ${response.status}` });
 }
+/** A plain JSON-RPC response body; an empty body carries no frame. Throws on invalid JSON. */
+function parseJsonRpcBody(text) {
+    return text.trim() === "" ? null : JSON.parse(text);
+}
 /**
  * Pulls the request's JSON-RPC response out of whichever mode the server chose.
  *
@@ -327,7 +332,7 @@ function extractJsonRpcFrame({ method, response, id }, _options = {}) {
     try {
         frame = response.contentType.startsWith("text/event-stream")
             ? matchingSseResponse({ body: response.text, id })
-            : response.text.trim() === "" ? null : JSON.parse(response.text);
+            : parseJsonRpcBody(response.text);
     }
     catch {
         throw new McpProtocolError({ message: `mcp-federation: the server's response to '${method}' was not valid JSON` });

package/dist/federation/approvals/revocation.js

@@ -41,7 +41,7 @@ export function createFederatedConnectionRevocationGate(required, optional = {})
     };
     return async ({ connectionId, call }) => {
         if (call.origin?.kind === "preset")
-            return;
+            return undefined;
         const { record, reason } = await readRosterRefusal({ roster: required.roster, connectionId, call }, { scope: optional.scope, report });
         if (reason === null)
             return "current-grants-checked";

package/dist/federation/stdio/adapter.stdio.js

@@ -205,7 +205,8 @@ class McpStdioSession {
         if (this.closedReason !== null) {
             return Promise.reject(new McpProtocolError({ message: `mcp-federation: session is closed (${this.closedReason})` }));
         }
-        const id = this.nextId++;
+        const id = this.nextId;
+        this.nextId += 1;
         return new Promise((resolve, reject) => {
             // Deliberately NOT `unref()`ed. An unref'd timer lets the event loop drain while a request is
             // still in flight, which means the request's promise is abandoned unsettled rather than

package/dist/federation/tool-approvals.d.ts

@@ -27,20 +27,6 @@ export interface FederatedToolIdentity {
     /** The input schema, as admitted. */
     readonly inputSchema: Readonly<Record<string, unknown>>;
 }
-/**
- * The fingerprint a remembered approval is saved under and later matched against: the connection,
- * the server it reaches (its origin and admission revision), the remote tool name, its declared
- * hints, the description the model reads and its input schema — so any drift in what the tool says
- * about itself voids the approval. Object keys are sorted first, so key order alone never counts as
- * drift. Hashed, because an admission revision is itself derived from values that can carry
- * credentials and this string is stored and compared, never shown.
- *
- * The host supplies the persisted domain. Changing it invalidates remembered grants.
- * The v2 revision (2026-09-27, "hint drift") added description and input schema: v1 grants
- * no longer matched, asked once and were saved again. A host must keep its chosen bytes stable.
- *
- * @complexity O(h + s) in the size of the hints and the schema.
- */
 export declare function federatedToolApprovalFingerprint({ identity, fingerprintDomain }: {
     identity: FederatedToolIdentity;
     fingerprintDomain: string;

package/dist/federation/tool-approvals.js

@@ -1,18 +1,5 @@
 import { createHash } from "node:crypto";
-/** Stable JSON: object keys sorted at every depth, so the same hints always hash the same. */
-function canonicalJson(value) {
-    if (Array.isArray(value))
-        return `[${value.map(canonicalJson).join(",")}]`;
-    if (value !== null && typeof value === "object") {
-        const entries = Object.entries(value)
-            .filter(([, child]) => child !== undefined)
-            // Object.entries never yields the same key twice, so two keys are never equal and a
-            // two-way comparison is a total order here.
-            .sort(([a], [b]) => (a < b ? -1 : 1));
-        return `{${entries.map(([key, child]) => `${JSON.stringify(key)}:${canonicalJson(child)}`).join(",")}}`;
-    }
-    return JSON.stringify(value) ?? "null";
-}
+import { canonicalJson } from "@jini-ai/core/records";
 /**
  * The fingerprint a remembered approval is saved under and later matched against: the connection,
  * the server it reaches (its origin and admission revision), the remote tool name, its declared
@@ -25,20 +12,24 @@ function canonicalJson(value) {
  * The v2 revision (2026-09-27, "hint drift") added description and input schema: v1 grants
  * no longer matched, asked once and were saved again. A host must keep its chosen bytes stable.
  *
- * @complexity O(h + s) in the size of the hints and the schema.
+ * @complexity Core canonical serialization plus O(h + s) hashing over hints and schema bytes.
  */
+/** The origin's part of an approval fingerprint: a roster admission names its revision. */
+function originFingerprintPart(origin) {
+    return origin.kind === "roster" ? ["roster", origin.admissionRevision] : ["preset"];
+}
 export function federatedToolApprovalFingerprint({ identity, fingerprintDomain }) {
-    const origin = identity.origin === undefined ? null : identity.origin.kind === "roster" ? ["roster", identity.origin.admissionRevision] : ["preset"];
+    const origin = identity.origin === undefined ? null : originFingerprintPart(identity.origin);
     return createHash("sha256")
-        .update(canonicalJson([
-        fingerprintDomain,
-        identity.connectionId,
-        origin,
-        identity.remoteName,
-        identity.declaredAnnotations ?? null,
-        identity.description,
-        identity.inputSchema,
-    ]))
+        .update(canonicalJson({ value: [
+            fingerprintDomain,
+            identity.connectionId,
+            origin,
+            identity.remoteName,
+            identity.declaredAnnotations ?? null,
+            identity.description,
+            identity.inputSchema,
+        ] }))
         .digest("hex");
 }
 //# sourceMappingURL=tool-approvals.js.map

package/dist/federation/trust.js

@@ -280,7 +280,7 @@ const WRITE_SHAPED_MAX_DEPTH = 8;
 function isWriteShapedName(name) {
     const words = name
         .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
-        .replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2")
+        .replace(/([A-Z])(?=[A-Z][a-z])/g, "$1 ")
         .toLowerCase()
         .split(/[^a-z0-9]+/);
     return words.some((word) => WRITE_SHAPED_WORDS.has(word));
@@ -337,7 +337,12 @@ export function writeShapedSchemaInputNames({ schema }) {
 /** R3 action-name rules, applied to the snake_cased remote name (camelCase split, `-` read as `_`). Kept as named module constants
  * (none carries the `g` flag, so `.test` is stateless) so {@link federatedCallConfirmationForAction}
  * reads as the ordered policy it is. */
-const DELIVERY_ACTION = /(?:send|deliver|invite|reply|forward|broadcast).*(?:email|mail|newsletter|message|sms|invitation|broadcast)|(?:email|mail|newsletter|message|sms).*(?:send|deliver|reply|forward)|(?:post|publish).*(?:message|newsletter)/;
+// Delivery verbs and objects in either order; a name is delivery-shaped when any pattern matches.
+const DELIVERY_ACTIONS = [
+    /(?:send|deliver|invite|reply|forward|broadcast).*(?:email|mail|newsletter|message|sms|invitation|broadcast)/,
+    /(?:email|mail|newsletter|message|sms).*(?:send|deliver|reply|forward)/,
+    /(?:post|publish).*(?:message|newsletter)/,
+];
 const SYSTEM_PROMPT_ACTION = /(?:set|update|edit|change).*(?:system_prompt|system_instruction)/;
 const ASSISTANT_PREFIX = /^(?:assistant|agent)_/;
 const READ_ACTION = /^(?:get|list|read|search|describe)_/;
@@ -360,7 +365,7 @@ const PERMANENT_REMOVAL_ACTION = /(?:^|_)(?:delete|purge|drop|destroy|truncate|r
 export function federatedCallConfirmationForAction({ remoteName, annotations, args }) {
     const name = actionName(remoteName);
     const declaredDestructive = annotations?.destructiveHint === true;
-    if (DELIVERY_ACTION.test(name) || SYSTEM_PROMPT_ACTION.test(name))
+    if (DELIVERY_ACTIONS.some((pattern) => pattern.test(name)) || SYSTEM_PROMPT_ACTION.test(name))
         return "confirm";
     if (READ_ACTION.test(name.replace(ASSISTANT_PREFIX, "")) && !declaredDestructive)
         return "none";
@@ -412,6 +417,12 @@ function removalConfirmation(name, declaredDestructive) {
 /** Scan SQL values, including nested batches. Dynamic EXECUTE remains gated because its effect is opaque.
  * With no string value at all there is nothing to classify, so the remote's destructive hint decides.
  * @complexity O(n) in total input characters; O(n) for the collected text. */
+/** The values nested in an array or object (to keep scanning); none for any other value. */
+function nestedValues(value) {
+    if (Array.isArray(value))
+        return value;
+    return value !== null && typeof value === "object" ? Object.values(value) : [];
+}
 function sqlCallDeletesData(args, declaredDestructive) {
     const pending = [args];
     const statements = [];
@@ -419,10 +430,8 @@ function sqlCallDeletesData(args, declaredDestructive) {
         const value = pending.pop();
         if (typeof value === "string")
             statements.push(value);
-        else if (Array.isArray(value))
-            pending.push(...value);
-        else if (value !== null && typeof value === "object")
-            pending.push(...Object.values(value));
+        else
+            pending.push(...nestedValues(value));
     }
     if (statements.length === 0)
         return declaredDestructive;
@@ -688,6 +697,10 @@ export function wrapUntrustedResult(params) {
         .filter((line) => line !== "")
         .join("\n");
 }
+/** Bytes `image` adds to the serialized array: its JSON, plus a separating comma unless first. */
+function imageEntryBytes(image, isFirst) {
+    return Buffer.byteLength(JSON.stringify(image), "utf8") + (isFirst ? 0 : 1);
+}
 /**
  * R7's media carve-out: splits a remote's raw `content` array into well-formed image blocks and
  * everything else, so {@link buildFederatedMcpRegistrations}'s handler can route each half through a
@@ -727,17 +740,17 @@ export function extractFederatedImageBlocks(params) {
     let imageBytes = 2; // The serialized array's opening and closing brackets also consume budget.
     for (const entry of content) {
         const image = asFederatedImageBlock(entry);
+        const addedBytes = image ? imageEntryBytes(image, images.length === 0) : 0;
         if (!image) {
             kept.push(entry);
-            continue;
         }
-        const addedBytes = Buffer.byteLength(JSON.stringify(image), "utf8") + (images.length > 0 ? 1 : 0);
-        if (imageBytes + addedBytes > maxResultBytes) {
+        else if (imageBytes + addedBytes > maxResultBytes) {
             oversizedMimeTypes.push(image.mimeType);
-            continue;
         }
-        images.push(image);
-        imageBytes += addedBytes;
+        else {
+            images.push(image);
+            imageBytes += addedBytes;
+        }
     }
     if (oversizedMimeTypes.length > 0) {
         kept.push({

package/dist/index.d.ts

@@ -20,7 +20,7 @@ export { searchToolsTool, describeToolTool, TOOL_CATALOG_TOOLS } from './server/
 export { searchComponentsTool, describeComponentTool, COMPONENT_CATALOG_TOOLS } from './server/index.js';
 export { createExecuteDelegatedToolTool, createExecuteReadonlyDelegatedToolTool, DEFAULT_DELEGATED_TOOL_TIMEOUT_MS, } from './server/index.js';
 export type { CreateExecuteDelegatedToolToolOptions } from './server/index.js';
-export { CHROME_DEVTOOLS_MCP_PRESET, AGENT_SLUGS, isAgentSlug, planAgentInstall, applyJsonInstall, removeJsonInstall, } from './agent-install/index.js';
+export { CHROME_DEVTOOLS_MCP_PRESET, AGENT_SLUGS, isAgentSlug, planAgentInstall, verifyJsonAgentInstall, applyJsonInstall, removeJsonInstall, } from './agent-install/index.js';
 export type { AgentSlug, McpLaunchSpec, PlanContext, CliInstallPlan, JsonInstallPlan, ManualInstallPlan, InstallPlan, } from './agent-install/index.js';
 export type { McpConfigFilesystemPort } from './core/config.js';
 export type { McpTokenClockOptions, McpTokenStoreOptions } from './core/tokens.js';

package/dist/index.js

@@ -24,6 +24,6 @@ export { searchComponentsTool, describeComponentTool, COMPONENT_CATALOG_TOOLS }
 // ── server: gap 3's MCP-callback delegated-tool-execution def ──────────────
 export { createExecuteDelegatedToolTool, createExecuteReadonlyDelegatedToolTool, DEFAULT_DELEGATED_TOOL_TIMEOUT_MS, } from './server/index.js';
 // ── agent-install: register an MCP server into external agents ──────────────
-export { CHROME_DEVTOOLS_MCP_PRESET, AGENT_SLUGS, isAgentSlug, planAgentInstall, applyJsonInstall, removeJsonInstall, } from './agent-install/index.js';
+export { CHROME_DEVTOOLS_MCP_PRESET, AGENT_SLUGS, isAgentSlug, planAgentInstall, verifyJsonAgentInstall, applyJsonInstall, removeJsonInstall, } from './agent-install/index.js';
 export { DaemonHttpError } from './server/daemon-client.js';
 //# sourceMappingURL=index.js.map

package/dist/server/adapters/stdio-codec.d.ts

@@ -0,0 +1,10 @@
+import { type JSONRPCMessage } from '@modelcontextprotocol/sdk/types.js';
+export type { JSONRPCMessage as StdioMessage } from '@modelcontextprotocol/sdk/types.js';
+/** Measure the SDK's actual serialization; an oversized response becomes a bounded error.
+ * @throws RangeError when a request/notification or the minimal replacement exceeds the cap.
+ */
+export declare function boundedMessage({ message, maxFrameBytes }: {
+    message: JSONRPCMessage;
+    maxFrameBytes: number;
+}, _options?: {}): JSONRPCMessage;
+//# sourceMappingURL=stdio-codec.d.ts.map

package/dist/server/adapters/stdio-codec.js

@@ -0,0 +1,19 @@
+/** SDK serialization and response classification stay behind the stdio adapter. */
+import { serializeMessage } from '@modelcontextprotocol/sdk/shared/stdio.js';
+import { isJSONRPCErrorResponse, isJSONRPCResultResponse } from '@modelcontextprotocol/sdk/types.js';
+/** Measure the SDK's actual serialization; an oversized response becomes a bounded error.
+ * @throws RangeError when a request/notification or the minimal replacement exceeds the cap.
+ */
+export function boundedMessage({ message, maxFrameBytes }, _options = {}) {
+    if (Buffer.byteLength(serializeMessage(message)) <= maxFrameBytes)
+        return message;
+    if (!isJSONRPCResultResponse(message) && !isJSONRPCErrorResponse(message)) {
+        throw new RangeError('MCP outgoing frame exceeds maxFrameBytes');
+    }
+    const replacement = { jsonrpc: '2.0', id: message.id, error: { code: -32603, message: 'Response exceeds maxFrameBytes' } };
+    if (Buffer.byteLength(serializeMessage(replacement)) > maxFrameBytes) {
+        throw new RangeError('MCP error response exceeds maxFrameBytes');
+    }
+    return replacement;
+}
+//# sourceMappingURL=stdio-codec.js.map

package/dist/server/resources/site-guide-resource.js

@@ -15,7 +15,8 @@ export function createSiteGuideResource(input, options = {}) {
         description: 'Permission-filtered building blocks and live facts for the site hosting this run. Consult before planning or building; use site_guide explain through the delegated gateway for details.',
         read: async ({ ctx }) => {
             const result = await gateway.handler({ args: { toolId: 'site_guide', input: { operation: 'overview' } }, ctx });
-            if (typeof result !== 'object' || result === null || !('status' in result) || result.status !== 'completed' || !('output' in result)) {
+            const completed = typeof result === 'object' && result !== null && 'status' in result && result.status === 'completed';
+            if (!completed || !('output' in result)) {
                 throw new Error('site_guide resource read did not complete. Use the delegated tool result to inspect authorization or availability.');
             }
             return { text: JSON.stringify(result.output, null, 2) };

package/dist/server/stdio-hosting.js

@@ -6,8 +6,7 @@
 import { once } from 'node:events';
 import { Transform, Writable } from 'node:stream';
 import { setImmediate } from 'node:timers/promises';
-import { serializeMessage } from '@modelcontextprotocol/sdk/shared/stdio.js';
-import { isJSONRPCErrorResponse, isJSONRPCResultResponse } from '@modelcontextprotocol/sdk/types.js';
+import { boundedMessage } from './adapters/stdio-codec.js';
 import { resolveSdkTransport } from './sdk-transport.js';
 /** Validate the opt-in limit before construction performs any I/O. */
 export function validateFrameLimit({ maxFrameBytes }) {
@@ -21,21 +20,6 @@ export function validateFrameLimit({ maxFrameBytes }) {
 export function wantsStdioHosting({ maxFrameBytes, serial, eof }) {
     return maxFrameBytes !== undefined || serial === true || eof === 'drain';
 }
-/** Measure the SDK's actual serialization; an oversized response becomes a bounded error.
- * @throws RangeError when a request/notification or the minimal replacement exceeds the cap.
- */
-function boundedMessage({ message, maxFrameBytes }) {
-    if (Buffer.byteLength(serializeMessage(message)) <= maxFrameBytes)
-        return message;
-    if (!isJSONRPCResultResponse(message) && !isJSONRPCErrorResponse(message)) {
-        throw new RangeError('MCP outgoing frame exceeds maxFrameBytes');
-    }
-    const replacement = { jsonrpc: '2.0', id: message.id, error: { code: -32603, message: 'Response exceeds maxFrameBytes' } };
-    if (Buffer.byteLength(serializeMessage(replacement)) > maxFrameBytes) {
-        throw new RangeError('MCP error response exceeds maxFrameBytes');
-    }
-    return replacement;
-}
 /** Count bytes per LF-terminated frame before the SDK's unbounded read buffer sees them.
  * Chunks pass through unchanged; the SDK still owns CRLF handling and malformed-JSON policy.
  */

package/dist/server/tool-protocol.js

@@ -117,8 +117,8 @@ function isMcpContentEnvelope(payload) {
  */
 export function okResult({ payload }) {
     const outcome = batchOutcomeFor({ output: payload });
-    const isError = (typeof payload === 'object' && payload !== null && 'isError' in payload && payload.isError === true)
-        || outcome === 'partial_failure' || outcome === 'error';
+    const flaggedError = typeof payload === 'object' && payload !== null && 'isError' in payload && payload.isError === true;
+    const isError = flaggedError || outcome === 'partial_failure' || outcome === 'error';
     if (isMcpContentEnvelope(payload)) {
         return { content: payload.content, ...(isError ? { isError: true } : {}) };
     }

package/dist/server/tool-server.js

@@ -43,7 +43,52 @@ function stdioOptions(options) {
         ...(options.stdout === undefined ? {} : { stdout: options.stdout }),
     };
 }
-/** Opt-in stdio guards for this run, or undefined to keep the legacy lifecycle. */
+/** Wraps request handlers so idle exit counts them as activity: from acceptance through the
+ *  response write under stdio hosting, else for the handler's own duration. */
+function createActivityTracker({ idleExit, hosting }) {
+    return (handler) => (...args) => {
+        if (!hosting)
+            return idleExit.trackRequest({ fn: () => handler(...args) });
+        const result = hosting.track({ task: async () => handler(...args), signal: args[1]?.extra?.signal });
+        // Active from acceptance through the response write, not just the handler: a serial
+        // request queued behind a slow write must not let idle exit close the transport.
+        void idleExit.trackRequest({ fn: () => hosting.responseWritten({ result }) });
+        return result;
+    };
+}
+/** Resolves once the connected transport closes (rejecting if hosting fails to dispose). Holds
+ *  the process open until the client disconnects (stdin EOF) — `connect()` only starts the
+ *  transport, it doesn't wait for the stream to close. */
+function waitForTransportClose({ transport, idleExit, hosting, stdin }) {
+    return new Promise((resolve, reject) => {
+        const sdkOnClose = transport.onclose;
+        let finished = false;
+        const done = () => {
+            if (finished)
+                return;
+            finished = true;
+            idleExit.dispose({});
+            if (!hosting) {
+                resolve();
+                return;
+            }
+            void hosting.dispose().then(failure => (failure ? reject(failure.error) : resolve()));
+        };
+        transport.onclose = () => {
+            sdkOnClose?.();
+            done();
+        };
+        const closeTransportForStdin = () => {
+            void transport.close({}).catch(() => done());
+        };
+        if (hosting) {
+            hosting.watch({ close: closeTransportForStdin });
+            return;
+        }
+        stdin.once('end', closeTransportForStdin);
+        stdin.once('close', closeTransportForStdin);
+    });
+}
 function hostingForOptions(options) {
     if (!wantsStdioHosting(options))
         return undefined;
@@ -144,15 +189,7 @@ export function createMcpToolServer(requiredArgs, options = {}) {
                 onIdle: () => closeTransportForIdle?.(),
             });
             const hosting = hostingForOptions(options);
-            const withActivity = (handler) => (...args) => {
-                if (!hosting)
-                    return idleExit.trackRequest({ fn: () => handler(...args) });
-                const result = hosting.track({ task: async () => handler(...args), signal: args[1]?.extra?.signal });
-                // Active from acceptance through the response write, not just the handler: a serial
-                // request queued behind a slow write must not let idle exit close the transport.
-                void idleExit.trackRequest({ fn: () => hosting.responseWritten({ result }) });
-                return result;
-            };
+            const withActivity = createActivityTracker({ idleExit, hosting });
             server.setRequestHandler({
                 schema: ListToolsRequestSchema,
                 handler: withActivity(async () => ({ tools: toolsToList({ tools: [...toolIndex.values()] }) })),
@@ -191,37 +228,7 @@ export function createMcpToolServer(requiredArgs, options = {}) {
                     idleExit.noteActivity({});
                     sdkOnMessage?.({ message });
                 };
-                const stdin = options.stdin ?? process.stdin;
-                await new Promise((resolve, reject) => {
-                    const sdkOnClose = transport.onclose;
-                    let finished = false;
-                    const done = () => {
-                        if (finished)
-                            return;
-                        finished = true;
-                        idleExit.dispose({});
-                        if (!hosting) {
-                            resolve();
-                            return;
-                        }
-                        void hosting.dispose().then(failure => (failure ? reject(failure.error) : resolve()));
-                    };
-                    transport.onclose = () => {
-                        sdkOnClose?.();
-                        done();
-                    };
-                    const closeTransportForStdin = () => {
-                        void transport.close({}).catch(() => done());
-                    };
-                    // Hold the process open until the client disconnects (stdin EOF) — `connect()` only
-                    // starts the transport, it doesn't wait for the stream to close.
-                    if (hosting) {
-                        hosting.watch({ close: closeTransportForStdin });
-                        return;
-                    }
-                    stdin.once('end', closeTransportForStdin);
-                    stdin.once('close', closeTransportForStdin);
-                });
+                await waitForTransportClose({ transport, idleExit, hosting, stdin: options.stdin ?? process.stdin });
             }
             finally {
                 idleExit.dispose({});

package/dist/server/tools/delegated-tool.js

@@ -39,6 +39,8 @@ import { parseMcpToolInputSchema } from '../adapters/protocol.js';
 import { randomUUID } from 'node:crypto';
 import { postDaemonJson } from '../daemon-client.js';
 import { daemonCallOptions, requireString } from '../tool-protocol.js';
+/** Shared by legacy gateways and concrete definitions for every MCP-capable agent CLI. */
+const APPROVAL_GUIDANCE = 'Never say an action has started until its tool result explicitly says it started. An approval-gated action waiting for Confirm has not started. While approval is pending, other writes are refused with awaiting_approval and started:false; reads may continue. Wait for the final result before reporting an outcome.';
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
@@ -118,7 +120,7 @@ function createDelegatedGateway(variant, { runId }, options) {
         : DEFAULT_DELEGATED_TOOL_TIMEOUT_MS;
     return {
         name: variant.name,
-        description: `${variant.description} Put the tool's own arguments inside input; non-conflicting top-level tool arguments are moved there automatically.`,
+        description: `${variant.description} ${APPROVAL_GUIDANCE} Put the tool's own arguments inside input; non-conflicting top-level tool arguments are moved there automatically.`,
         argumentNormalization: { foldIntoInput: true },
         inputSchema: {
             type: 'object',
@@ -255,7 +257,7 @@ export function createTypedDelegatedToolTool({ runId, tool }, options = {}) {
         : createExecuteDelegatedToolTool({ runId }, options);
     return {
         name: wireName,
-        description: descriptor.description ?? descriptor.id,
+        description: `${descriptor.description ?? descriptor.id} ${APPROVAL_GUIDANCE}`,
         // Parse to check the MCP boundary, but publish the original schema, including extensions.
         inputSchema: descriptor.inputSchema,
         annotations: { ...gateway.annotations, title: descriptor.id },

package/dist/tools/ask-choice/question.js

@@ -77,11 +77,11 @@ export function parseQuestion({ input, toolId }, _options = {}) {
 }
 export function matchesOptions({ question, params }) {
     const choice = params['choice'];
-    if (question.singleSelect) {
-        if (!question.singleSelect.options.some(option => option.value === choice))
-            return false;
-    }
-    else if (choice !== undefined)
+    // A single-select question needs one of its options; any other question takes no `choice`.
+    const choiceAccepted = question.singleSelect
+        ? question.singleSelect.options.some(option => option.value === choice)
+        : choice === undefined;
+    if (!choiceAccepted)
         return false;
     const selections = params['selections'];
     if (selections === undefined)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/mcp",
-  "version": "0.6.15-rc.1",
+  "version": "0.6.15",
   "description": "Model Context Protocol adapters: server config schema and IO, an MCP client, and agent-side MCP server installation.",
   "license": "Apache-2.0",
   "repository": {
@@ -83,12 +83,12 @@
     "registry": "https://registry.npmjs.org"
   },
   "dependencies": {
-    "@jini-ai/core": "^0.6.15-rc.1",
-    "@jini-ai/protocol": "^0.6.15-rc.1"
+    "@jini-ai/core": "^0.6.15",
+    "@jini-ai/protocol": "^0.6.15"
   },
   "peerDependencies": {
     "@cfworker/json-schema": "^4.1.1",
-    "@jini-ai/platform": "^0.6.15-rc.1",
+    "@jini-ai/platform": "^0.6.10",
     "@modelcontextprotocol/sdk": "^1.29.0"
   },
   "peerDependenciesMeta": {
@@ -105,9 +105,9 @@
   "devDependencies": {
     "@cfworker/json-schema": "^4.1.1",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@jini-ai/daemon": "^0.6.15-rc.1",
-    "@jini-ai/core": "^0.6.15-rc.1",
-    "@jini-ai/platform": "^0.6.15-rc.1"
+    "@jini-ai/platform": "^0.6.15",
+    "@jini-ai/core": "^0.6.15",
+    "@jini-ai/daemon": "^0.6.15"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json && chmod +x dist/bin/serve.js",