@needmoretruth/nmts-cli 0.17.2

package/dist/mcp-tools/context.js

@@ -0,0 +1,50 @@
+// What every tool in the agent surface is handed, and the two helpers they all use.
+//
+// ⛔ THE PLACE IS THE PERSON'S, THE NAMES ARE THE MODEL'S. `outDir` was resolved once, from what
+//    the person typed when they started the server, and no tool takes a destination argument. A
+//    model chooses which file, never where it lands. That is the one rule that makes the rest of
+//    this surface safe to widen: adding a tool cannot add a way out of that directory, because
+//    there is nowhere in a tool declaration to put one.
+/** The server and network every command takes, in the shape they take it. */
+export function common(ctx) {
+    return { server: ctx.server, network: ctx.network };
+}
+/**
+ * Collect what a command would have printed, so it can be handed to a model instead.
+ *
+ * ⛔ EVERY TOOL USES THIS AND NONE OF THEM PRINT. On this server stdout is the protocol wire; a
+ *    stray line there is a parse error at the client and the whole tool list disappears with no
+ *    explanation. Commands write through an injected sink precisely so that this can be true.
+ */
+export function collector() {
+    const lines = [];
+    return { lines, write: (line) => lines.push(line) };
+}
+/**
+ * Run one command with its output collected, and hand back what it wrote.
+ *
+ * ⚠ A non-zero exit code is NOT turned into a throw. A command that returns 4 has already written
+ *   the explanation the model needs, and replacing it with a generic failure would throw that
+ *   away. The commands that genuinely cannot proceed throw, and the transport reports those.
+ */
+export async function say(run) {
+    const out = collector();
+    await run(out.write);
+    return out.lines.join("\n");
+}
+/** A required string argument, with the same refusal every tool gives for it. */
+export function needString(args, name) {
+    const value = args[name];
+    // The transport already checked the declared schema, so this only catches an empty string —
+    // which is a legal string and never a legal path, id or address.
+    if (typeof value !== "string" || value === "")
+        throw new Error(`\`${name}\` is required.`);
+    return value;
+}
+/** Several paths at once, as the multi-path commands take them. */
+export function needPaths(args) {
+    const value = args["paths"];
+    if (!Array.isArray(value) || value.length === 0)
+        throw new Error("`paths` must hold at least one path.");
+    return value.filter((p) => typeof p === "string" && p !== "");
+}

package/dist/mcp-tools/files.js

@@ -0,0 +1,133 @@
+// Fetching files out of the account, and putting files into it.
+//
+// ⛔ TWO OF THESE SPEND AND THEIR DESCRIPTIONS SAY SO FIRST. A model reads the description before
+//    it decides; burying the cost after the parameters is how a tool gets called to "see what
+//    happens". Both take a dry_run that prices without spending, and the transport now refuses a
+//    dry_run that is not a real boolean — before that check, `"true"` read as false and the paid
+//    branch ran.
+//
+// ⛔ EVERY DESTINATION IS DERIVED FROM THE DIRECTORY THE PERSON CHOSE. No tool here takes a path on
+//    this disk. `nmts_get` keeps only the last segment of the account path; `nmts_pull` builds its
+//    tree under that directory and refuses a stored name that would climb out; `nmts_receive` uses
+//    the sender's name the same way. The only path a model may choose is one INSIDE the account.
+import { get } from "../commands/get.js";
+import { pull } from "../commands/pull.js";
+import { push } from "../commands/push.js";
+import { put } from "../commands/put.js";
+import { receive } from "../commands/receive.js";
+import { destinationFor } from "../safe-path.js";
+import { common, needString, say } from "./context.js";
+const SPENDS = "⛔ THIS SPENDS THE ACCOUNT'S CREDITS — one credit per started mebibyte, per lease period, and " +
+    "credits are not refundable. Pass dry_run to be told the price without spending it. The first " +
+    "upload on a machine stops and asks the person to agree; show them what it says rather than " +
+    "agreeing for them.";
+export function fileTools(ctx) {
+    return [
+        {
+            name: "nmts_get",
+            description: `Fetch one file from the NMTS account, decrypt it, and write it into ${ctx.outDir}. Takes ` +
+                `a path exactly as nmts_list prints it. It leaves nothing at that name rather than ` +
+                `writing a wrong or partial file, and it will not replace a file that is already there. ` +
+                `The reply says where it went.`,
+            inputSchema: {
+                type: "object",
+                properties: { path: { type: "string", description: "The file's path inside the account." } },
+                required: ["path"],
+                additionalProperties: false,
+            },
+            run: (args) => {
+                const wanted = needString(args, "path");
+                return say((write) => get(wanted, { ...common(ctx), out: destinationFor(ctx.outDir, wanted), json: true, write }));
+            },
+        },
+        {
+            name: "nmts_pull",
+            description: `Fetch a whole folder — or the whole account, if no folder is named — and rebuild its ` +
+                `shape under ${ctx.outDir}. Unlike fetching one file it carries on past a file that will ` +
+                `not come back, because getting nineteen of twenty is better than getting none; the reply ` +
+                `lists what was written, what was skipped as already there, and what failed and why.`,
+            inputSchema: {
+                type: "object",
+                properties: {
+                    folder: {
+                        type: "string",
+                        description: "A folder path inside the account. Omit for everything.",
+                    },
+                },
+                additionalProperties: false,
+            },
+            run: (args) => say((write) => pull(typeof args["folder"] === "string" ? args["folder"] : undefined, {
+                ...common(ctx),
+                out: ctx.outDir,
+                json: true,
+                write,
+            })),
+        },
+        {
+            name: "nmts_receive",
+            description: `Fetch a file another account shared with this one, using an id from nmts_shares, and ` +
+                `write it into ${ctx.outDir} under the name the sender gave it. The sender's identity is ` +
+                `checked before anything is opened.`,
+            inputSchema: {
+                type: "object",
+                properties: { id: { type: "string", description: "The share id, from nmts_shares." } },
+                required: ["id"],
+                additionalProperties: false,
+            },
+            run: (args) => say((write) => receive(needString(args, "id"), { ...common(ctx), intoDir: ctx.outDir, json: true, write })),
+        },
+        {
+            name: "nmts_put",
+            description: `Encrypt one file from this machine and upload it to the NMTS account. ${SPENDS} A name ` +
+                `already taken in the destination is numbered rather than replacing what is there.`,
+            inputSchema: {
+                type: "object",
+                properties: {
+                    file: { type: "string", description: "Path to a file ON THIS MACHINE to upload." },
+                    name: { type: "string", description: "The name it gets in the account. Defaults to the file's own." },
+                    to: { type: "string", description: "An existing folder in the account, as nmts_list prints it." },
+                    dry_run: { type: "boolean", description: "Say what it would cost and stop. Nothing is sent or charged." },
+                },
+                required: ["file"],
+                additionalProperties: false,
+            },
+            run: (args) => say((write) => put(needString(args, "file"), {
+                ...common(ctx),
+                json: true,
+                ...(typeof args["name"] === "string" ? { name: args["name"] } : {}),
+                ...(typeof args["to"] === "string" ? { to: args["to"] } : {}),
+                ...(args["dry_run"] === true ? { dryRun: true } : {}),
+                write,
+            })),
+        },
+        {
+            name: "nmts_push",
+            description: `Upload a whole directory from this machine, rebuilding its shape in the account. ` +
+                `${SPENDS} ⛔ It stops at the FIRST failure rather than carrying on — the opposite of ` +
+                `nmts_pull, and on purpose: a failure that really means the account cannot pay any more ` +
+                `would, if carried past, ask to pay for every remaining file. Files already in the ` +
+                `destination are skipped, so running it again is safe and sends only what is missing. ` +
+                `Names beginning with a dot are left alone unless include_hidden is true — a directory of ` +
+                `source code keeps its credentials in exactly those files.`,
+            inputSchema: {
+                type: "object",
+                properties: {
+                    directory: { type: "string", description: "Path to a directory ON THIS MACHINE." },
+                    to: { type: "string", description: "An existing folder in the account to put it under." },
+                    include_hidden: { type: "boolean", description: "Also send names beginning with a dot." },
+                    dry_run: { type: "boolean", description: "Price the whole tree and stop. Nothing is sent or charged." },
+                },
+                required: ["directory"],
+                additionalProperties: false,
+            },
+            run: (args) => say((write) => push(needString(args, "directory"), {
+                ...common(ctx),
+                json: true,
+                ...(typeof args["to"] === "string" ? { to: args["to"] } : {}),
+                ...(args["include_hidden"] === true ? { hidden: true } : {}),
+                ...(args["dry_run"] === true ? { dryRun: true } : {}),
+                write,
+            })),
+        },
+    ];
+}

package/dist/mcp-tools/organise.js

@@ -0,0 +1,128 @@
+// Rearranging what the account holds, without moving a byte or spending anything.
+//
+// ⛔ EVERYTHING HERE IS AN EDIT TO THE SEALED LIST AND NOTHING HERE IS PERMANENT. Names, folders
+//    and marks live only inside the list the account code opens; the server never sees them and no
+//    stored bytes move. That is why these are the tools a model may use freely: the worst outcome
+//    is a tidy-up somebody has to undo, and every one of them has an undo.
+//
+// ⛔ WHAT IS DELIBERATELY ABSENT: permanent erase, and sweeping the trash. Putting something in the
+//    trash is reversible and is here; taking it out for good is not, and a machine does not get to
+//    make that call on somebody's files. The command line still has both for a person.
+//
+// ⛔ SIX MARK VERBS ARE ONE TOOL, NOT SIX. A model choosing between `nmts_star` and `nmts_unstar`
+//    is choosing between two spellings of the same decision, and the pair that gets forgotten is
+//    the "un" one. One tool with the mark named and a switch says what is actually being decided.
+import { label, pin, star, unlabel, unpin, unstar } from "../commands/marks.js";
+import { mkdir, mv, rename } from "../commands/organise.js";
+import { restore, rm } from "../commands/trash.js";
+import { common, needPaths, needString, say } from "./context.js";
+export function organiseTools(ctx) {
+    return [
+        {
+            name: "nmts_mkdir",
+            description: "Make a folder in the NMTS account, including any parent folders that are missing. " +
+                "Folders exist only inside the account's sealed list; making one costs nothing.",
+            inputSchema: {
+                type: "object",
+                properties: { path: { type: "string", description: "The folder path to make." } },
+                required: ["path"],
+                additionalProperties: false,
+            },
+            run: (args) => say((write) => mkdir(needString(args, "path"), { ...common(ctx), json: true, write })),
+        },
+        {
+            name: "nmts_move",
+            description: "Move one or more entries into a folder in the NMTS account. Nothing is re-uploaded and " +
+                "nothing is charged — only the sealed list changes. A name already taken in the " +
+                "destination is numbered rather than replacing what is there.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    paths: {
+                        type: "array",
+                        items: { type: "string" },
+                        description: "The entries to move, as nmts_list prints them.",
+                    },
+                    to: { type: "string", description: "The destination folder." },
+                },
+                required: ["paths", "to"],
+                additionalProperties: false,
+            },
+            run: (args) => say((write) => mv([...needPaths(args), needString(args, "to")], { ...common(ctx), json: true, write })),
+        },
+        {
+            name: "nmts_rename",
+            description: "Rename one entry in the NMTS account. The name lives inside the sealed list, so this " +
+                "moves no bytes and costs nothing.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    path: { type: "string", description: "The entry to rename." },
+                    name: { type: "string", description: "Its new name. A name, not a path." },
+                },
+                required: ["path", "name"],
+                additionalProperties: false,
+            },
+            run: (args) => say((write) => rename(needString(args, "path"), needString(args, "name"), { ...common(ctx), json: true, write })),
+        },
+        {
+            name: "nmts_mark",
+            description: "Put a mark on files, or take one off. `star` is the account's favourites, `pin` keeps a " +
+                "file at the top of its folder, and `label` attaches a word you choose (give it in " +
+                "`name`). Marks live inside the sealed list and are refused on folders.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    paths: { type: "array", items: { type: "string" }, description: "The files to mark." },
+                    mark: { type: "string", enum: ["star", "pin", "label"], description: "Which mark." },
+                    on: { type: "boolean", description: "true puts the mark on, false takes it off. Required." },
+                    name: { type: "string", description: "The label's word. Required when mark is label." },
+                },
+                required: ["paths", "mark", "on"],
+                additionalProperties: false,
+            },
+            run: (args) => {
+                const paths = needPaths(args);
+                const mark = needString(args, "mark");
+                const on = args["on"];
+                if (typeof on !== "boolean")
+                    throw new Error("`on` is required: true to mark, false to unmark.");
+                const options = { ...common(ctx), json: true };
+                return say((write) => {
+                    const opts = { ...options, write };
+                    if (mark === "star")
+                        return on ? star(paths, opts) : unstar(paths, opts);
+                    if (mark === "pin")
+                        return on ? pin(paths, opts) : unpin(paths, opts);
+                    const name = needString(args, "name");
+                    return on ? label(name, paths, opts) : unlabel(name, paths, opts);
+                });
+            },
+        },
+        {
+            name: "nmts_trash",
+            description: "Put files in the NMTS account's trash. Nothing is destroyed and nothing is refunded: the " +
+                "storage stays bought and the file can be brought back with nmts_restore. Emptying the " +
+                "trash for good is not something this surface can do — that is a person's decision at the " +
+                "command line.",
+            inputSchema: {
+                type: "object",
+                properties: { paths: { type: "array", items: { type: "string" }, description: "The files to trash." } },
+                required: ["paths"],
+                additionalProperties: false,
+            },
+            run: (args) => say((write) => rm(needPaths(args), { ...common(ctx), json: true, write })),
+        },
+        {
+            name: "nmts_restore",
+            description: "Take files back out of the NMTS account's trash, into the folder they came from.",
+            inputSchema: {
+                type: "object",
+                properties: { paths: { type: "array", items: { type: "string" }, description: "The files to restore." } },
+                required: ["paths"],
+                additionalProperties: false,
+            },
+            run: (args) => say((write) => restore(needPaths(args), { ...common(ctx), json: true, write })),
+        },
+    ];
+}

package/dist/mcp-tools/reads.js

@@ -0,0 +1,89 @@
+// The tools that only look: what the account holds, what it is spending, what is about to expire.
+//
+// ⛔ NONE OF THESE COST ANYTHING AND NONE OF THEM WRITE. That is worth stating rather than
+//    assuming, because it is what makes them safe to call in a loop — an agent working out what to
+//    do next will call them repeatedly, and a surface where "just checking" costs money teaches
+//    the opposite of the habit this tool wants.
+import { publicCode } from "../commands/public-code.js";
+import { balance } from "../commands/balance.js";
+import { expiring } from "../commands/expiring.js";
+import { ls } from "../commands/ls.js";
+import { shares } from "../commands/share.js";
+import { usage } from "../commands/usage.js";
+import { common, say } from "./context.js";
+const NO_ARGS = { type: "object", properties: {}, additionalProperties: false };
+export function readTools(ctx) {
+    return [
+        {
+            name: "nmts_list",
+            description: "List the files stored in the NMTS account, as JSON. Paths are what nmts_get takes. " +
+                "Entries in the trash are left out unless include_trashed is true, and the reply says " +
+                "how many were left out. Optionally narrow with a search word and choose an order.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    include_trashed: { type: "boolean", description: "Include what is in the trash." },
+                    find: { type: "string", description: "Keep only entries whose name contains this." },
+                    sort: {
+                        type: "string",
+                        enum: ["name", "size", "date"],
+                        description: "Order the listing. Absent means the path order this tool has always printed.",
+                    },
+                    descending: { type: "boolean", description: "Reverse the order." },
+                },
+                additionalProperties: false,
+            },
+            run: (args) => say((write) => ls({
+                ...common(ctx),
+                json: true,
+                all: args["include_trashed"] === true,
+                ...(typeof args["find"] === "string" ? { find: args["find"] } : {}),
+                ...(typeof args["sort"] === "string" ? { sort: args["sort"] } : {}),
+                ...(args["descending"] === true ? { desc: true } : {}),
+                write,
+            })),
+        },
+        {
+            name: "nmts_usage",
+            description: "How much this account holds: how many files and folders, how many bytes, how much is in " +
+                "the trash, and the largest few. Reads the account's own sealed list — it costs nothing " +
+                "and says nothing about credits.",
+            inputSchema: NO_ARGS,
+            run: () => say((write) => usage({ ...common(ctx), json: true, write })),
+        },
+        {
+            name: "nmts_expiring",
+            description: "Files whose bought storage runs out soon, with how long each has left. Storage on NMTS " +
+                "is a lease, not a purchase: a file whose lease ends is gone. Reads the storage " +
+                "network's own clock, so it refuses rather than guessing when it cannot reach it.",
+            inputSchema: NO_ARGS,
+            run: () => say((write) => expiring({ ...common(ctx), json: true, write })),
+        },
+        {
+            name: "nmts_balance",
+            description: "How many credits this account has left, what that buys, and the ceilings on spending. " +
+                "Read this before uploading anything large: the price of an upload is printed, but only " +
+                "this says whether the account can pay it.",
+            inputSchema: NO_ARGS,
+            run: () => say((write) => balance({ ...common(ctx), json: true, write })),
+        },
+        {
+            name: "nmts_public_code",
+            description: "The account's PUBLIC CODE — the value other accounts send files to — and whether it has " +
+                "been published yet. Until it is published nobody can send to this account. ⛔ It only " +
+                "reads. Publishing is permanent and is a person's decision at the command line: if the " +
+                "reply says it is not published, say so rather than working around it. ⚠ Not the account " +
+                "code, which opens every file and is never given away.",
+            inputSchema: NO_ARGS,
+            run: () => say((write) => publicCode({ ...common(ctx), json: true, write })),
+        },
+        {
+            name: "nmts_shares",
+            description: "Files this account has shared with somebody, and files somebody has shared with it. The " +
+                "ids in the received list are what nmts_receive takes; the ids in the sent list are what " +
+                "nmts_unshare takes.",
+            inputSchema: NO_ARGS,
+            run: () => say((write) => shares({ ...common(ctx), json: true, write })),
+        },
+    ];
+}

package/dist/mcp-tools/share.js

@@ -0,0 +1,61 @@
+// Handing a file to another account, and taking it back.
+//
+// ⛔ THE UNDO DOES NOT UNDO IT, AND THE DESCRIPTION SAYS SO. Withdrawing a share stops further
+//    downloads and reaches nothing already fetched. That is not a flaw waiting to be fixed — it is
+//    what handing somebody a file means — so it is stated before the first share rather than after.
+//
+// ⛔ A PERSON HAS TO HAVE AGREED, AND THIS SURFACE CANNOT AGREE FOR THEM. Sharing is behind a
+//    once-per-machine agreement in this tool's own record. If it has not been given, the first
+//    call here stops and returns what the agreement says. ⚠ Show that to the person; do not run
+//    the command that grants it on their behalf. Nothing in a command-line tool can tell whether a
+//    person or a program typed a grant, so this is a rule rather than a mechanism, and saying
+//    otherwise would be claiming a protection that is not there.
+//
+// ⛔ THE RECIPIENT'S PUBLIC CODE IS NOT CHECKED AGAINST A PERSON. A share sent to a well-formed
+//    code that belongs to somebody else is sent, and is not recallable. Confirm it with whoever
+//    gave it to you, out of band, before calling this.
+import { share, unshare } from "../commands/share.js";
+import { common, needString, say } from "./context.js";
+export function shareTools(ctx) {
+    return [
+        {
+            name: "nmts_share",
+            description: "Give another NMTS account the key to one file in this account. ⛔ IT CANNOT BE TAKEN " +
+                "BACK: withdrawing the share stops further downloads and cannot reach a copy the " +
+                "recipient already fetched, and a public code typed wrongly is a share sent to whoever " +
+                "holds that code. The first share on a machine stops and asks the person to agree — show " +
+                "them what it says rather than agreeing for them. Nothing is uploaded and nothing is " +
+                "charged; the recipient pays nothing either.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    path: { type: "string", description: "The file to share, as nmts_list prints it." },
+                    public_code: {
+                        type: "string",
+                        description: "The recipient's PUBLIC CODE, given to you by them. Not their account code.",
+                    },
+                },
+                required: ["path", "public_code"],
+                additionalProperties: false,
+            },
+            run: (args) => say((write) => share(needString(args, "path"), needString(args, "public_code"), {
+                ...common(ctx),
+                json: true,
+                write,
+            })),
+        },
+        {
+            name: "nmts_unshare",
+            description: "Withdraw a share this account made, using an id from nmts_shares. It stops any further " +
+                "download and does NOT reach a copy already fetched. Safe to call: taking something back " +
+                "is the direction this door is meant to fail in.",
+            inputSchema: {
+                type: "object",
+                properties: { id: { type: "string", description: "The share id, from nmts_shares." } },
+                required: ["id"],
+                additionalProperties: false,
+            },
+            run: (args) => say((write) => unshare(needString(args, "id"), { ...common(ctx), json: true, write })),
+        },
+    ];
+}

package/dist/mcp.js

@@ -0,0 +1,142 @@
+// The Model Context Protocol, spoken over stdin/stdout, with no library.
+//
+// ⛔ WHY NO SDK. This package promises that a separate licence can be arranged, and that promise is
+//    only true while every line of it is ours to license. Each dependency is a copy of somebody
+//    else's copyright riding along — a check enforces that they are all permissive, but the surface
+//    here is small enough that not adding one is simply better. MCP over stdio is JSON-RPC 2.0 in
+//    newline-delimited JSON; that is the whole transport.
+//
+// ⛔ STDOUT IS THE WIRE. Anything printed there that is not a protocol message corrupts the session
+//    — the client sees a parse error and the tools vanish. So nothing in this file writes to stdout
+//    except `send`, and everything a person should read goes to stderr. A test holds that line.
+//
+// ⚠ WHAT THIS IS NOT: it is not a sandbox. A tool call here can read the account's file list and
+//   write a file into the directory the person chose when they started the server. It cannot reach
+//   anywhere else on disk, and it cannot make or revoke a key — those need a person at a browser.
+import { createInterface } from "node:readline";
+import { checkArgs } from "./mcp-args.js";
+import { renderError } from "./errors.js";
+/**
+ * Protocol versions this server knows how to speak.
+ *
+ * ⛔ Ordered newest first. If the client asks for one of these it gets that one back; if it asks
+ *    for anything else it gets the newest we know, which is what the specification says to do —
+ *    guessing that an unknown version is compatible is how a session half-works.
+ */
+export const PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26", "2024-11-05"];
+const PARSE_ERROR = -32700;
+const INVALID_REQUEST = -32600;
+const METHOD_NOT_FOUND = -32601;
+const INTERNAL_ERROR = -32603;
+function isRequest(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const v = value;
+    return v["jsonrpc"] === "2.0" && typeof v["method"] === "string";
+}
+/**
+ * Answer one request. Returns the response object, or `null` for a notification.
+ *
+ * Pure apart from the tools it is handed, so the whole protocol is testable without pipes.
+ */
+export async function handle(request, tools, info) {
+    if (!isRequest(request)) {
+        return { jsonrpc: "2.0", id: null, error: { code: INVALID_REQUEST, message: "not a JSON-RPC 2.0 request" } };
+    }
+    const id = request.id;
+    const reply = (result) => ({ jsonrpc: "2.0", id, result });
+    const fail = (code, message) => ({ jsonrpc: "2.0", id, error: { code, message } });
+    switch (request.method) {
+        case "initialize": {
+            const asked = request.params?.["protocolVersion"];
+            const version = typeof asked === "string" && PROTOCOL_VERSIONS.includes(asked)
+                ? asked
+                : PROTOCOL_VERSIONS[0];
+            return reply({ protocolVersion: version, capabilities: { tools: {} }, serverInfo: info });
+        }
+        // Notifications carry no id and get no answer. Returning one would be a protocol error.
+        case "notifications/initialized":
+        case "notifications/cancelled":
+            return null;
+        case "ping":
+            return reply({});
+        case "tools/list":
+            return reply({
+                tools: tools.map((t) => ({ name: t.name, description: t.description, inputSchema: t.inputSchema })),
+            });
+        case "tools/call": {
+            const name = request.params?.["name"];
+            const tool = tools.find((t) => t.name === name);
+            if (tool === undefined)
+                return fail(METHOD_NOT_FOUND, `no tool named ${String(name)}`);
+            // ⛔ THE SCHEMA IS CHECKED HERE, ONCE, FOR EVERY TOOL. It used to be advertised and never
+            //    enforced: anything that was not an object became `{}` and everything else went straight
+            //    through, so a tool declaring `dry_run: boolean` was handed the STRING "true" and its
+            //    `=== true` test read it as false — a request for a price became a paid upload. Checking
+            //    in each tool would be the same four checks written twenty times, and the twentieth would
+            //    forget. ⛔ A wrong argument is REFUSED, never repaired: guessing what `"true"` meant is
+            //    deciding on the caller's behalf which branch spends money.
+            const raw = request.params?.["arguments"];
+            const args = raw === undefined ? {} : raw;
+            const problems = checkArgs(tool.inputSchema, args);
+            if (problems.length > 0) {
+                return reply({
+                    content: [{ type: "text", text: `${tool.name}: ${problems.join("; ")}` }],
+                    isError: true,
+                });
+            }
+            try {
+                // Narrowed by the check above: `checkArgs` refuses anything that is not an object.
+                const checked = typeof args === "object" && args !== null && !Array.isArray(args) ? { ...args } : {};
+                return reply({ content: [{ type: "text", text: await tool.run(checked) }] });
+            }
+            catch (error) {
+                // ⛔ A failed TOOL is not a failed SESSION. The model is told what went wrong and can try
+                //    something else; a JSON-RPC error would look to some clients like the server broke.
+                //
+                // ⛔ AND IT IS TOLD WHAT TO DO NEXT. This used to send `error.message` alone, which threw
+                //    away the one line the refusal carries for exactly this reader — the model here has no
+                //    terminal to look at and no other source. Forty of the server's fifty-six refusals
+                //    carry that line, and none of them reached this path until 2026-08-30. `renderError`
+                //    is the same shaping the terminal gets, so the two cannot drift apart.
+                return reply({
+                    content: [{ type: "text", text: renderError(error, "nmts") }],
+                    isError: true,
+                });
+            }
+        }
+        default:
+            // ⛔ An unknown NOTIFICATION is silence, not an error: a client is allowed to send ones we
+            //    have never heard of, and answering would put an unasked-for message on the wire.
+            if (id === undefined)
+                return null;
+            return fail(METHOD_NOT_FOUND, `unknown method ${request.method}`);
+    }
+}
+/** Read newline-delimited JSON-RPC from `input` until it ends, answering on `output`. */
+export async function serve(options) {
+    const lines = createInterface({ input: options.input, crlfDelay: Infinity });
+    for await (const line of lines) {
+        if (line.trim() === "")
+            continue;
+        let parsed;
+        try {
+            parsed = JSON.parse(line);
+        }
+        catch {
+            options.output(JSON.stringify({ jsonrpc: "2.0", id: null, error: { code: PARSE_ERROR, message: "invalid JSON" } }));
+            continue;
+        }
+        let response;
+        try {
+            response = await handle(parsed, options.tools, options.info);
+        }
+        catch (error) {
+            // The handler itself falling over must not end the session either.
+            const message = error instanceof Error ? error.message : "the server failed";
+            response = { jsonrpc: "2.0", id: null, error: { code: INTERNAL_ERROR, message } };
+        }
+        if (response !== null)
+            options.output(JSON.stringify(response));
+    }
+}