@lyric_dev/data-loom 0.3.0 → 0.4.1

package/README.md

@@ -58,25 +58,39 @@ npm start            # serves the current directory's project
 
 ## Plan dependencies with your Claude (MCP server)
 
-DataLoom can also run as an **MCP server**, so your own Claude session determines and applies the order of interdependent proposals — DataLoom holds no API key and the reasoning runs under your authenticated Claude.
+The running daemon also **hosts an MCP server** over HTTP, so your own Claude session determines and applies the order of interdependent proposals — DataLoom holds no API key and the reasoning runs under your authenticated Claude. One registration serves **every** project; the target project is resolved per call (an explicit `project` argument, falling back to whatever the dashboard has selected).
 
-1. Register it in Claude Code (stdio server):
+1. Register it once, globally — no per-project setup:
 
    ```
-   claude mcp add data-loom -- npx @lyric_dev/data-loom mcp "C:\path\to\your\project"
+   claude mcp add --transport http --scope user data-loom http://127.0.0.1:4317/mcp
    ```
 
-   (From source: `node dist/index.js mcp "C:\path\to\project"`.)
+   The MCP server lives in the daemon, so **DataLoom must be running** for the tools to be reachable (start it with `npx @lyric_dev/data-loom "C:\path\to\your\project"`). It binds to loopback only.
 
-2. In that project, ask Claude something like *"review DataLoom's open proposals and set the dependencies."* On connect, the server asks Claude to surface any proposal that hasn't been reviewed for dependencies yet, propose the edges, and **confirm with you before writing**. It exposes three tools:
-   - `list_open_proposals` — the open changes with their proposal text, current phase/readiness, and dependency-review state (read-only; proposal text only, no secrets).
-   - `set_dependency(from, to)` — writes a `## Depends On` entry into a proposal.
-   - `mark_independent(change)` — records that a proposal genuinely depends on nothing, by writing an empty `## Depends On` block.
+2. In any project, ask Claude something like *"review DataLoom's open proposals and set the dependencies."* On connect, the server asks Claude to surface any proposal that hasn't been reviewed for dependencies yet, propose the edges, and **confirm with you before writing**. It exposes these tools:
+   - `list_projects` — the selectable OpenSpec workspaces plus the current selection (read-only), to discover/confirm a `project` path.
+   - `list_open_proposals(project?)` — the open changes with their proposal text, current phase/readiness, and dependency-review state (read-only; proposal text only, no secrets).
+   - `set_dependency(from, to, project?)` — writes a `## Depends On` entry into a proposal.
+   - `mark_independent(change, project?)` — records that a proposal genuinely depends on nothing, by writing an empty `## Depends On` block.
    - `install_weave_skill` — installs the `/loom:weave` shortcut command (one-time setup, see below).
 
    Each write is an explicit, reviewable `## Depends On` edit; the roadmap then recomputes deterministically. Proposals that still need a dependency decision are flagged in the roadmap with a **"needs review"** badge, and DataLoom appears as a server in its own MCP Topology tab once registered.
 
-3. **One command for it all: `/loom:weave`.** Ask Claude to *"install the weave skill"* (it calls `install_weave_skill`). That writes a `/loom:weave` slash command into your global Claude config (`~/.claude/commands/loom/weave.md`); reload Claude Code, and from then on `/loom:weave` runs the whole review — list, propose, confirm, apply — in any project where DataLoom is registered.
+3. **One command for it all: `/loom:weave`.** Ask Claude to *"install the weave skill"* (it calls `install_weave_skill`). That writes a `/loom:weave` slash command into your global Claude config (`~/.claude/commands/loom/weave.md`); reload Claude Code, and from then on `/loom:weave` runs the whole review — list, propose, confirm, apply — in any project, passing that project explicitly. (It needs the daemon running; if the tools aren't reachable it tells you to start DataLoom.)
+
+> **Upgrading from an earlier version?** The MCP server used to be a per-project stdio registration (`claude mcp add data-loom -- npx … mcp "<path>"`). That mode is gone. Remove any old per-project `data-loom` registrations and add the single user-scope HTTP one above.
+
+## Security
+
+DataLoom runs entirely on `127.0.0.1` and is built for a single local user.
+
+- **Loopback only** — the daemon (dashboard, WebSocket, and MCP endpoint) binds to the loopback interface and is never exposed to the network.
+- **Host + Origin validated** — every HTTP request and WebSocket upgrade is checked: requests with a non-loopback `Host` (DNS-rebinding) or a non-loopback `Origin` (cross-site requests from a web page) are rejected. Native MCP clients (which send no `Origin`) are allowed. This is what keeps a random website you visit from driving the daemon.
+- **No secrets** — the MCP tools carry only proposal text and change names; the topology view redacts server commands/args and shows scheme+host only. No API keys or config are read or returned, and the daemon holds no credential.
+- **Bounded** — request bodies are capped (4 MB) and MCP sessions are capped and idle-evicted, so a local client can't exhaust memory.
+
+The MCP tools can read and write any OpenSpec workspace path you point them at (this is intentional, so the tool can stay LLM-provider-independent). That means: treat the daemon as you would any local dev server — fine for your own machine, not something to run on a shared/multi-user host.
 
 ## Design principles
 

package/dist/index.js

@@ -12,7 +12,6 @@ import { discover } from "./mcp/discovery.js";
 import { checkServer } from "./mcp/availability.js";
 import { discoverProjects, isViewableProject } from "./projects.js";
 import { resolvePublicDir } from "./assets.js";
-import { runMcpServer } from "./mcpServer.js";
 const host = "127.0.0.1";
 const port = Number(process.env.PORT ?? 4317);
 // Initial project: CLI argument, then DATA_LOOM_ROOT, then cwd.
@@ -52,6 +51,7 @@ async function main() {
         checkMcp,
         getProjects,
         selectProject,
+        getCurrentProject: () => session?.project ?? null,
     });
     console.log(`[data-loom] dashboard ready at http://${host}:${server.port}`);
     if (session)
@@ -141,17 +141,7 @@ function openBrowser(url) {
         /* non-fatal — the URL is already logged */
     }
 }
-if (process.argv[2] === "mcp") {
-    // MCP stdio server mode: `data-loom mcp [project]`
-    const project = resolve(process.argv[3] ?? process.env.DATA_LOOM_ROOT ?? process.cwd());
-    runMcpServer(project).catch((err) => {
-        console.error(err);
-        process.exit(1);
-    });
-}
-else {
-    main().catch((err) => {
-        console.error(err);
-        process.exit(1);
-    });
-}
+main().catch((err) => {
+    console.error(err);
+    process.exit(1);
+});

package/dist/mcpServer.js

@@ -1,27 +1,42 @@
-// data_loom as an MCP server: exposes the open proposals (read) and a
+// data_loom as an MCP server: exposes a project's open proposals (read) and a
 // dependency-writing action (write `## Depends On`) so an MCP client — the
 // user's own authenticated Claude — can determine and apply the order.
 // Holds no credentials; tools carry only proposal text and change names.
+//
+// Hosted by the dashboard daemon over Streamable-HTTP (see server.ts). A single
+// server serves every project: the target project is resolved per call from an
+// explicit `project` argument, falling back to the daemon's current dashboard
+// selection. The server holds no single project frozen for its lifetime.
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
 import { OpenSpecClient } from "./openspecClient.js";
 import { deriveModel } from "./derive.js";
+import { discoverProjects, isViewableProject } from "./projects.js";
+/**
+ * A validation error whose message is safe to return to the client because it
+ * only references caller-supplied input (a change name, a path the caller named).
+ * Anything that is NOT a ToolError is treated as an unexpected internal failure
+ * and reported generically, so host filesystem detail never leaks.
+ */
+class ToolError extends Error {
+}
 // Advertised to the client on connect. The "confirm before writing" gate lives
 // here, in the agent's behavior — the server cannot verify a human approved.
 const INSTRUCTIONS = `This server exposes a project's open OpenSpec proposals and lets you record the dependency order between them. It holds no model and cannot infer anything on its own — the judgment is yours and the decision is the user's.
 
-When you connect, call list_open_proposals and look at each proposal's "dependencyReview" field. For every proposal whose state is "pending" (it has no \`## Depends On\` declaration yet):
+It is hosted by the running DataLoom dashboard daemon and serves every project from one registration. Each tool takes an optional \`project\` (an absolute path); when omitted it acts on the project currently selected in the dashboard. Call list_projects to see the available OpenSpec workspaces. For automated/repeatable use, always pass \`project\` explicitly.
+
+When you connect, call list_open_proposals (passing the project you are working in) and look at each proposal's "dependencyReview" field. For every proposal whose state is "pending" (it has no \`## Depends On\` declaration yet):
   1. Read its proposal text alongside the others and reason about which changes it should be implemented after.
   2. PROPOSE the dependencies — or that it is independent — to the user in plain language, with your reasoning.
   3. Only AFTER the user confirms, record the result: call set_dependency(from, to) for each confirmed edge, or mark_independent(change) for a change that genuinely depends on nothing.
 
 Never write a dependency the user has not confirmed. Proposals already marked "declared" need no action.
 
-Tip: call install_weave_skill once to add a \`/loom:weave\` command (written to the user's global Claude config) that runs this whole review in one step; the user reloads Claude Code to pick it up.`;
+Tip: call install_weave_skill once to add a \`/loom:weave\` command (written to the user's global Claude config) that runs this whole review in one step; the user reloads Claude Code to pick it up. Register this server once, globally, with: claude mcp add --transport http --scope user data-loom http://127.0.0.1:4317/mcp`;
 // The `/loom:weave` slash command this server installs into the user's global
 // Claude commands dir. Static content that only orchestrates this server's tools.
 const WEAVE_COMMAND = `---
@@ -33,33 +48,64 @@ tags: [loom, dependencies, mcp, review]
 
 Weave the dependency order of this project's open OpenSpec proposals, using the **data-loom** MCP server.
 
-**Prerequisite:** the data-loom MCP server must be registered in this session — its tools are \`list_open_proposals\`, \`set_dependency\`, and \`mark_independent\`. If those tools are not available, tell the user to register it (\`claude mcp add data-loom -- npx @lyric_dev/data-loom mcp "<project path>"\`) and stop.
+**Prerequisite:** the DataLoom dashboard daemon must be running and the data-loom MCP server registered in this session — its tools are \`list_open_proposals\`, \`set_dependency\`, \`mark_independent\`, and \`list_projects\`. If those tools are not available, the daemon is almost certainly not running: tell the user to **start DataLoom** (\`npx @lyric_dev/data-loom "<project path>"\`) and, if they have not already, register it once with \`claude mcp add --transport http --scope user data-loom http://127.0.0.1:4317/mcp\`, then stop.
 
 Steps:
 
-1. Call \`list_open_proposals\` and note each proposal's \`dependencyReview\` state.
-2. Focus on the proposals whose state is \`pending\` (no \`## Depends On\` declaration yet). Proposals already \`declared\` need no action — leave them alone.
-3. Read the pending proposals alongside the others. Reason about which change should be implemented **after** which, from their capabilities and content: a change that extends or modifies what another change introduces depends on it; changes that touch disjoint areas are independent.
-4. **Propose** your conclusion to the user in plain language — for each pending proposal, the dependencies you would record (or that it is independent), each with a one-line reason. Do not write anything yet.
-5. **Wait for the user to confirm.** Never write a dependency the user has not approved.
-6. After the user confirms, record it:
-   - \`set_dependency(from, to)\` for each confirmed edge (the dependent is \`from\`).
-   - \`mark_independent(change)\` for a proposal the user confirms depends on nothing.
-7. Call \`list_open_proposals\` again and report the resulting phases — what moved, and what is now ready versus blocked.
+1. Determine this session's project — the absolute path of the current working directory — and pass it as the \`project\` argument to **every** tool call below, so the review is deterministic and acts on the project you are in (never on whatever the dashboard happens to be showing).
+2. Call \`list_open_proposals\` with that \`project\` and note each proposal's \`dependencyReview\` state.
+3. Focus on the proposals whose state is \`pending\` (no \`## Depends On\` declaration yet). Proposals already \`declared\` need no action — leave them alone.
+4. Read the pending proposals alongside the others. Reason about which change should be implemented **after** which, from their capabilities and content: a change that extends or modifies what another change introduces depends on it; changes that touch disjoint areas are independent.
+5. **Propose** your conclusion to the user in plain language — for each pending proposal, the dependencies you would record (or that it is independent), each with a one-line reason. Do not write anything yet.
+6. **Wait for the user to confirm.** Never write a dependency the user has not approved.
+7. After the user confirms, record it (passing the same \`project\` to each):
+   - \`set_dependency(from, to, project)\` for each confirmed edge (the dependent is \`from\`).
+   - \`mark_independent(change, project)\` for a proposal the user confirms depends on nothing.
+8. Call \`list_open_proposals\` again and report the resulting phases — what moved, and what is now ready versus blocked.
 
 The reasoning stays the user's to approve: you surface and apply, the user decides.
 `;
-export async function runMcpServer(project) {
-    const client = new OpenSpecClient(project);
-    const changesDir = join(project, "openspec", "changes");
-    const server = new Server({ name: "data-loom", version: "0.2.4" }, { capabilities: { tools: {} }, instructions: INSTRUCTIONS });
+const PROJECT_ARG = {
+    type: "string",
+    description: "Absolute path to the target OpenSpec project. Optional — defaults to the project currently selected in the DataLoom dashboard. Call list_projects to discover valid workspaces.",
+};
+/**
+ * Build a project-agnostic MCP server. A fresh instance is created per client
+ * session (see server.ts); all instances share the injected daemon state, so
+ * the dashboard selection is the single fallback source of project truth.
+ */
+export function createMcpServer(deps) {
+    const server = new Server({ name: "data-loom", version: "0.4.1" }, { capabilities: { tools: {} }, instructions: INSTRUCTIONS });
+    // Resolve the target project for a call: explicit arg, then dashboard
+    // selection, then an instructive error. Validated as a real workspace before
+    // any read or write.
+    const resolveProject = (explicit) => {
+        const raw = typeof explicit === "string" && explicit.trim() ? explicit : deps.getCurrentProject();
+        if (!raw) {
+            throw new ToolError("No `project` given and no project is selected in the DataLoom dashboard. Call list_projects to see the available OpenSpec workspaces, then pass one as the `project` argument.");
+        }
+        const abs = resolve(raw);
+        if (!isViewableProject(abs)) {
+            throw new ToolError(`${abs} is not an OpenSpec workspace (no openspec/ directory). Call list_projects to see the available workspaces.`);
+        }
+        return abs;
+    };
     server.setRequestHandler(ListToolsRequestSchema, async () => ({
         tools: [
             {
-                name: "list_open_proposals",
-                description: "List the open (non-archived) OpenSpec proposals for this project, each with its proposal text (Why / What Changes / Capabilities) and currently derived dependencies, phase, and readiness. Use this to reason about which proposals should be implemented after which.",
+                name: "list_projects",
+                description: "List the selectable projects — the OpenSpec workspaces discoverable from Claude Code's known projects, plus the dashboard's current selection. Read-only. Use it to discover and confirm a valid `project` path before calling a project-scoped tool.",
                 inputSchema: { type: "object", properties: {}, additionalProperties: false },
             },
+            {
+                name: "list_open_proposals",
+                description: "List the open (non-archived) OpenSpec proposals for the target project, each with its proposal text (Why / What Changes / Capabilities) and currently derived dependencies, phase, and readiness. Use this to reason about which proposals should be implemented after which.",
+                inputSchema: {
+                    type: "object",
+                    properties: { project: PROJECT_ARG },
+                    additionalProperties: false,
+                },
+            },
             {
                 name: "set_dependency",
                 description: "Declare that one open proposal depends on (should be implemented after) another by writing a `## Depends On` entry into the dependent's proposal. The roadmap then recomputes deterministically from that file.",
@@ -68,6 +114,7 @@ export async function runMcpServer(project) {
                     properties: {
                         from: { type: "string", description: "The dependent change (gets the `## Depends On` entry)" },
                         to: { type: "string", description: "The change it depends on" },
+                        project: PROJECT_ARG,
                     },
                     required: ["from", "to"],
                     additionalProperties: false,
@@ -80,6 +127,7 @@ export async function runMcpServer(project) {
                     type: "object",
                     properties: {
                         change: { type: "string", description: "The open change to mark as having no dependencies" },
+                        project: PROJECT_ARG,
                     },
                     required: ["change"],
                     additionalProperties: false,
@@ -87,38 +135,49 @@ export async function runMcpServer(project) {
             },
             {
                 name: "install_weave_skill",
-                description: "Install the `/loom:weave` slash command into the user's global Claude commands directory (~/.claude/commands/loom/weave.md), so this dependency review can be run as a single command from any project where this server is registered. Writes a static command file only (no project data or secrets) and overwrites any existing copy. Run once, then the user reloads Claude Code.",
+                description: "Install the `/loom:weave` slash command into the user's global Claude commands directory (~/.claude/commands/loom/weave.md), so this dependency review can be run as a single command from any project. Writes a static command file only (no project data or secrets) and overwrites any existing copy. Run once, then the user reloads Claude Code.",
                 inputSchema: { type: "object", properties: {}, additionalProperties: false },
             },
         ],
     }));
     server.setRequestHandler(CallToolRequestSchema, async (req) => {
         const { name, arguments: args } = req.params;
+        const a = (args ?? {});
         try {
+            if (name === "list_projects") {
+                return ok(await discoverProjects(deps.getCurrentProject() ?? ""));
+            }
+            if (name === "install_weave_skill") {
+                return ok(await installWeaveSkill());
+            }
+            // Project-scoped tools: resolve + validate the target, then act on it.
+            const project = resolveProject(a.project);
+            const client = new OpenSpecClient(project);
+            const changesDir = join(project, "openspec", "changes");
             if (name === "list_open_proposals") {
-                return ok(await listOpenProposals(client, changesDir));
+                return ok(await listOpenProposals(client, changesDir, project));
             }
             if (name === "set_dependency") {
-                const from = String(args?.from ?? "");
-                const to = String(args?.to ?? "");
-                return ok(await setDependency(client, changesDir, from, to));
+                const from = String(a.from ?? "");
+                const to = String(a.to ?? "");
+                return ok(await setDependency(client, changesDir, project, from, to));
             }
             if (name === "mark_independent") {
-                const change = String(args?.change ?? "");
-                return ok(await markIndependent(client, changesDir, change));
-            }
-            if (name === "install_weave_skill") {
-                return ok(await installWeaveSkill());
+                const change = String(a.change ?? "");
+                return ok(await markIndependent(client, changesDir, project, change));
             }
             return err(`unknown tool: ${name}`);
         }
         catch (e) {
-            return err(e instanceof Error ? e.message : String(e));
+            // Validation errors (caller-supplied input) are safe to surface; anything
+            // else is an unexpected internal failure → generic message, detail to log.
+            if (e instanceof ToolError)
+                return err(e.message);
+            console.error("[data-loom mcp] tool error:", e);
+            return err("internal error");
         }
     });
-    await server.connect(new StdioServerTransport());
-    // Logs go to stderr so they don't corrupt the stdio JSON-RPC channel.
-    console.error(`[data-loom mcp] serving project ${project}`);
+    return server;
 }
 function ok(data) {
     return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
@@ -130,7 +189,7 @@ async function openChanges(client) {
     const model = await deriveModel(client);
     return model.changes.filter((c) => !c.archived);
 }
-async function listOpenProposals(client, changesDir) {
+async function listOpenProposals(client, changesDir, project) {
     const changes = await openChanges(client);
     const proposals = [];
     for (const c of changes) {
@@ -152,44 +211,44 @@ async function listOpenProposals(client, changesDir) {
             proposal, // proposal text only — never config, env, or secrets
         });
     }
-    return { proposals };
+    return { project, proposals };
 }
-async function setDependency(client, changesDir, from, to) {
+async function setDependency(client, changesDir, project, from, to) {
     if (!from || !to)
-        throw new Error("both 'from' and 'to' are required");
+        throw new ToolError("both 'from' and 'to' are required");
     if (from === to)
-        throw new Error("a change cannot depend on itself");
+        throw new ToolError("a change cannot depend on itself");
     const names = new Set((await openChanges(client)).map((c) => c.name));
     if (!names.has(from))
-        throw new Error(`unknown open change: ${from}`);
+        throw new ToolError(`unknown open change: ${from}`);
     if (!names.has(to))
-        throw new Error(`unknown open change: ${to}`);
+        throw new ToolError(`unknown open change: ${to}`);
     const path = join(changesDir, from, "proposal.md");
     const text = await readFile(path, "utf8");
     const updated = addDependsOn(text, to);
     const written = updated !== text;
     if (written)
         await writeFile(path, updated);
-    return { from, to, written, dependsOn: await client.readProposalDependsOn(from) };
+    return { project, from, to, written, dependsOn: await client.readProposalDependsOn(from) };
 }
-async function markIndependent(client, changesDir, change) {
+async function markIndependent(client, changesDir, project, change) {
     if (!change)
-        throw new Error("'change' is required");
+        throw new ToolError("'change' is required");
     const names = new Set((await openChanges(client)).map((c) => c.name));
     if (!names.has(change))
-        throw new Error(`unknown open change: ${change}`);
+        throw new ToolError(`unknown open change: ${change}`);
     const path = join(changesDir, change, "proposal.md");
     const text = await readFile(path, "utf8");
     const updated = ensureDependsOnSection(text);
     const written = updated !== text; // already declared -> idempotent no-op
     if (written)
         await writeFile(path, updated);
-    return { change, written, dependencyReview: "declared" };
+    return { project, change, written, dependencyReview: "declared" };
 }
 /**
  * Provision the `/loom:weave` command into the user's GLOBAL Claude commands
- * dir, so the review runs as one command from any project where this server is
- * registered. Writes only the static command file; overwrites in place.
+ * dir, so the review runs as one command from any project. Writes only the
+ * static command file; overwrites in place.
  */
 async function installWeaveSkill() {
     const dir = join(homedir(), ".claude", "commands", "loom");

package/dist/server.js

@@ -1,8 +1,12 @@
 // Serve the SPA on loopback and push roadmap + MCP + project state over a websocket.
 import { createServer } from "node:http";
-import { extname } from "node:path";
+import { randomUUID } from "node:crypto";
+import { extname, resolve, sep } from "node:path";
 import { WebSocketServer, WebSocket } from "ws";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 import { loadAsset } from "./assets.js";
+import { createMcpServer } from "./mcpServer.js";
 const MIME = {
     ".html": "text/html; charset=utf-8",
     ".js": "text/javascript; charset=utf-8",
@@ -11,7 +15,7 @@ const MIME = {
     ".svg": "image/svg+xml",
 };
 export async function startServer(opts) {
-    const { publicDir, host, port, getRoadmap, getMcp, checkMcp, getProjects, selectProject } = opts;
+    const { publicDir, host, port, getRoadmap, getMcp, checkMcp, getProjects, selectProject, getCurrentProject } = opts;
     let wss;
     const broadcast = (msg) => {
         const data = JSON.stringify(msg);
@@ -20,9 +24,113 @@ export async function startServer(opts) {
                 ws.send(data);
         }
     };
+    // Loopback origin/host allowlist — the DNS-rebinding + CSRF guard. Built from
+    // the actually-bound port after listen; seeded from the requested port so the
+    // guard is active from the first request.
+    const loopbackHosts = ["127.0.0.1", "localhost", "[::1]"];
+    let allowedAuthorities = new Set();
+    const setAllowed = (p) => {
+        allowedAuthorities = new Set(loopbackHosts.map((h) => `${h}:${p}`));
+    };
+    setAllowed(port);
+    // Reject what a hostile web page or a rebound DNS name could mount: a Host
+    // that is not our loopback authority (DNS rebinding), or any *present* Origin
+    // that is not a loopback origin (CSRF). An absent Origin = a native, non-
+    // browser client (e.g. Claude Code), which is allowed.
+    const isAllowed = (req) => {
+        const host = req.headers.host;
+        if (!host || !allowedAuthorities.has(host))
+            return false;
+        const origin = req.headers.origin;
+        if (origin) {
+            try {
+                if (!allowedAuthorities.has(new URL(origin).host))
+                    return false;
+            }
+            catch {
+                return false;
+            }
+        }
+        return true;
+    };
+    // One MCP server + transport per client session (stateful Streamable-HTTP),
+    // keyed by session id. Sessions are capped and idle-evicted so churn cannot
+    // grow memory without bound. Tools resolve their target project per call from
+    // getCurrentProject (see mcpServer.ts), so one daemon serves every project.
+    const MAX_SESSIONS = 32;
+    const SESSION_IDLE_TTL_MS = 30 * 60 * 1000;
+    const mcpSessions = new Map();
+    const idleSweep = setInterval(() => {
+        const now = Date.now();
+        for (const [sid, s] of mcpSessions) {
+            if (now - s.lastSeen > SESSION_IDLE_TTL_MS) {
+                mcpSessions.delete(sid);
+                void s.transport.close();
+            }
+        }
+    }, 60 * 1000);
+    idleSweep.unref();
+    const handleMcp = async (req, res) => {
+        const sessionId = req.headers["mcp-session-id"];
+        try {
+            if (req.method === "POST") {
+                const body = await readJsonBody(req);
+                const existing = sessionId ? mcpSessions.get(sessionId) : undefined;
+                if (existing) {
+                    existing.lastSeen = Date.now();
+                    await existing.transport.handleRequest(req, res, body);
+                    return;
+                }
+                if (!isInitializeRequest(body)) {
+                    return sendError(res, 400, "missing or invalid mcp-session-id");
+                }
+                if (mcpSessions.size >= MAX_SESSIONS) {
+                    return sendError(res, 503, "too many sessions");
+                }
+                const transport = new StreamableHTTPServerTransport({
+                    sessionIdGenerator: () => randomUUID(),
+                    onsessioninitialized: (sid) => {
+                        mcpSessions.set(sid, { transport, lastSeen: Date.now() });
+                    },
+                });
+                transport.onclose = () => {
+                    if (transport.sessionId)
+                        mcpSessions.delete(transport.sessionId);
+                };
+                await createMcpServer({ getCurrentProject }).connect(transport);
+                await transport.handleRequest(req, res, body);
+                return;
+            }
+            if (req.method === "GET" || req.method === "DELETE") {
+                const s = sessionId ? mcpSessions.get(sessionId) : undefined;
+                if (!s)
+                    return sendError(res, 400, "missing or invalid mcp-session-id");
+                s.lastSeen = Date.now();
+                await s.transport.handleRequest(req, res);
+                return;
+            }
+            return sendError(res, 405, "method not allowed");
+        }
+        catch (e) {
+            if (e instanceof PayloadTooLargeError) {
+                if (!res.headersSent)
+                    sendError(res, 413, "request body too large");
+                return;
+            }
+            // Unexpected failures stay in the server log; the client gets nothing
+            // about the host (no paths, no stack).
+            console.error("[data-loom] mcp request error:", e);
+            if (!res.headersSent)
+                sendError(res, 500, "internal error");
+        }
+    };
     const http = createServer(async (req, res) => {
         try {
+            if (!isAllowed(req))
+                return sendError(res, 403, "forbidden");
             const url = new URL(req.url ?? "/", `http://${host}`);
+            if (url.pathname === "/mcp")
+                return handleMcp(req, res);
             if (url.pathname === "/api/model")
                 return sendJson(res, getRoadmap());
             if (url.pathname === "/api/mcp")
@@ -45,9 +153,12 @@ export async function startServer(opts) {
                     return sendError(res, 400, err instanceof Error ? err.message : "invalid project");
                 }
             }
-            // static assets (served from public/ on the filesystem)
+            // static assets (served from public/ on the filesystem) — resolve and
+            // assert the path stays within publicDir before reading.
             const rel = url.pathname === "/" ? "index.html" : url.pathname.replace(/^\/+/, "");
-            if (rel.includes(".."))
+            const root = resolve(publicDir);
+            const full = resolve(root, rel);
+            if (full !== root && !full.startsWith(root + sep))
                 return sendError(res, 403, "forbidden");
             const file = await loadAsset(rel, publicDir);
             if (!file)
@@ -59,7 +170,10 @@ export async function startServer(opts) {
             sendError(res, 500, "error");
         }
     });
-    wss = new WebSocketServer({ server: http });
+    wss = new WebSocketServer({
+        server: http,
+        verifyClient: (info) => isAllowed(info.req),
+    });
     wss.on("connection", async (ws) => {
         const roadmap = getRoadmap();
         if (roadmap)
@@ -72,11 +186,14 @@ export async function startServer(opts) {
             /* project list optional */
         }
     });
-    await new Promise((resolve) => http.listen(port, host, resolve));
+    await new Promise((ready) => http.listen(port, host, ready));
+    const actualPort = http.address()?.port ?? port;
+    setAllowed(actualPort);
     return {
-        port,
+        port: actualPort,
         broadcast,
         close: () => {
+            clearInterval(idleSweep);
             wss.close();
             http.close();
         },
@@ -90,3 +207,41 @@ function sendError(res, code, message) {
     res.writeHead(code, { "content-type": MIME[".json"] });
     res.end(JSON.stringify({ error: message }));
 }
+/** Raised when a request body exceeds the cap; mapped to HTTP 413. */
+class PayloadTooLargeError extends Error {
+}
+/** Largest request body we will buffer (JSON-RPC tool calls are tiny). */
+const MAX_BODY_BYTES = 4 * 1024 * 1024;
+/** Read and JSON-parse a request body; returns undefined for an empty body. */
+function readJsonBody(req) {
+    return new Promise((resolve, reject) => {
+        let data = "";
+        let size = 0;
+        let aborted = false;
+        req.on("data", (chunk) => {
+            if (aborted)
+                return;
+            size += chunk.length;
+            if (size > MAX_BODY_BYTES) {
+                aborted = true;
+                reject(new PayloadTooLargeError("request body too large"));
+                req.destroy();
+                return;
+            }
+            data += chunk;
+        });
+        req.on("end", () => {
+            if (aborted)
+                return;
+            if (!data)
+                return resolve(undefined);
+            try {
+                resolve(JSON.parse(data));
+            }
+            catch (e) {
+                reject(e instanceof Error ? e : new Error("invalid JSON body"));
+            }
+        });
+        req.on("error", reject);
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lyric_dev/data-loom",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "Local dashboard for spec-driven development: a phased OpenSpec roadmap (WHAT) and an MCP topology (HOW).",
   "type": "module",
   "license": "MIT",