@nxuss/lemma 1.8.0 → 1.9.0

package/README.md

@@ -1,11 +1,11 @@
-# 🧠 Lemma v1.8.0
+# 🧠 Lemma v1.9.0
 
 [![npm version](https://img.shields.io/npm/v/@nxuss/lemma.svg?color=orange&style=flat-square)](https://www.npmjs.com/package/@nxuss/lemma)
 [![License](https://img.shields.io/npm/l/@nxuss/lemma.svg?color=blue&style=flat-square)](https://github.com/Nxusbets/lemma/blob/main/LICENSE)
 [![MCP Tools](https://img.shields.io/badge/MCP%20tools-95-ff69b4?style=flat-square)](https://github.com/Nxusbets/lemma)
 [![Security](https://img.shields.io/badge/privacy-firewall%20active-blueviolet?style=flat-square)](https://github.com/Nxusbets/lemma)
 [![Caching](https://img.shields.io/badge/semantic%20memory-enabled-success?style=flat-square)](https://github.com/Nxusbets/lemma)
-[![Tests](https://img.shields.io/badge/tests-293%20passing-00c853?style=flat-square)](https://github.com/Nxusbets/lemma)
+[![Tests](https://img.shields.io/badge/tests-333%20passing-00c853?style=flat-square)](https://github.com/Nxusbets/lemma)
 
 ```text
     __                                
@@ -27,6 +27,57 @@ are advertised to the model each turn. The rest stay one `lemma_toolbox` call aw
 
 ## 📋 Changelog
 
+### v1.9.0 — The tools stop fighting the agent using them *(NEW)*
+
+Lemma's savings only count if the agent actually uses the tools. Five defects were pushing it back
+to its native tools instead — which means the file gets read twice, and Lemma's overhead is charged
+for nothing. Each one below was found by driving the tools as a consumer, not by reading the code.
+
+| Change | What it does | Why it matters |
+| :--- | :--- | :--- |
+| **Real line numbers in `read_workspace_file`** | Every line carries its true line number in the original file, mapped through compression rather than renumbered. Squeezer markers get a blank gutter instead of borrowing a neighbour's number. | A compressed read could not be cited (`file.ts:120`) or edited from, so the agent re-read the file with a native tool — paying for it twice and cancelling the squeeze. |
+| **`offset` / `limit`** | Read a line range of a large file, numbered from the range start. | Whole-file reads were the only option, on files where a 30-line window was the actual need. |
+| **Imports are named, not just counted** | `// [Lemma Squeezer: Squeezed 2 import/dependency lines: fs, path]` | "Squeezed 3 import lines" made *"is this module already imported?"* unanswerable without a full re-read. |
+| **`run_workspace_command` timeout: 15s → 120s, configurable to 600s** | `timeoutMs` parameter. | 15s is below the runtime of a real `npm test` or `tsc --noEmit` — the exact commands the output distiller exists for. The tool always timed out, so it was never used. |
+| **Timed-out commands keep their output** | Partial stdout/stderr is distilled and returned with a truncation notice. | The old path discarded everything on timeout, and the partial output is normally where the failure is. |
+| **Allowlist covers real toolchains** | `python`, `pytest`, `cargo`, `go`, `make`, `rg`, `sed`, `awk`, `docker`, `kubectl`, `gh` and more. Still deny-by-default. | A blocked command is not a command prevented — it is a refused round-trip followed by the same command run through an unrestricted shell, outside Lemma's view. |
+| **The read cache stops withholding unsent content** | The dedup key now includes the view (range, numbering, compact mode), not just the path. | Reading lines 1-50 then 51-100 returned `UNCHANGED` for content that had **never been sent**. This was data loss, not just friction. |
+| **`UNCHANGED` carries a symbol outline** | Instead of a bare hash, the marker lists the file's symbols and their lines. | *"Reuse your existing copy"* assumes the agent still has it — but its context gets compacted as a session grows, and the server has no way to know. |
+| **Free sessions stop paying for tools they can't run** | `resolveToolSurface` takes an entitlement check; Pro-gated tools are no longer advertised without a license. They stay registered and discoverable via `lemma_toolbox`. | A free session advertised the full core surface — read, search, patch, run, AST — and refused 14 of those 20 at call time, charging ~3k tokens per turn for the privilege. |
+| **TURBOMODE prompt: ~1,700 → ~894 tokens** | Rule 3 no longer contradicts rule 0. Rationale written for human readers moved into source comments. | *"NEVER read files blindly, always call get_ast_hologram first"* told the model to spend a round-trip to save a read that was often cheaper than the round-trip. |
+
+**Safety net for the new gutter:** `apply_workspace_patch` strips a line-number prefix from a search
+block, but only when *every* non-empty line carries one. A lone `1| ` inside real content (a markdown
+table) is left alone. Both cases are covered by tests.
+
+Line numbers are exact rather than approximate because of what compression actually does: it only
+*drops* whole lines and normalizes whitespace *within* a line — it never reorders, merges or splits
+them. A line that cannot be located reports no number rather than a wrong one, and does not
+desynchronise the lines after it.
+
+**333 tests passing** (up from 309), including a guard that fails the build if a prompt trim removes
+one of the correctness disclosures. It caught a real regression during this work.
+
+### v1.8.1 — Two correctness fixes: secret scrubbing and patch data loss
+
+An audit of the tools with no test coverage turned up two bugs where the tool looked done but
+silently produced wrong output.
+
+- **`apply_workspace_patch` could corrupt a line.** The exact-match strategy computed
+  `startLine`/`endLine` from a raw substring `indexOf`, but the handler always spliced by whole
+  line. A search block that was a *fragment* of a line (not the entire line) collapsed
+  `startLine === endLine`, and the splice replaced the entire line with just the replacement —
+  discarding everything else on it. Exact matches now splice by character offset;
+  whitespace-normalized/indent-anchored/fuzzy matches (already full-line windows) are unaffected.
+- **The privacy scrubber only recognized 3 generic patterns.** Default patterns covered
+  `API_KEY`/`EMAIL`/`Bearer ...` shapes only — vendor-specific secrets (Stripe, AWS, GitHub,
+  Google, Slack, JWTs, PEM private-key blocks) and custom-named secrets (e.g. a project's own
+  `_SALT` or `_WEBHOOK_SECRET` env var) passed through unmasked. Also, a project's custom
+  `lemma.config.json` patterns silently *replaced* the defaults instead of adding to them, so
+  defining one narrow pattern dropped coverage for everything else. Added vendor-specific
+  patterns plus a generic `ENV_SECRET` catch-all keyed on variable-name conventions, and custom
+  patterns now augment the defaults by default (`replaceDefaults: true` opts into full override).
+
 ### v1.8.0 — The Brain learns from project history, not just what it's told *(NEW)*
 
 Every memory in The Brain used to depend on the assistant remembering to call `store_memory`. If
@@ -411,12 +462,34 @@ chmod +x .git/hooks/post-commit
 
 ## 💎 Free vs Pro
 
-### 🆓 Free (34 Tools)
+Of the 95 registered tools, 46 work with no license and 49 require Pro. This split is enforced by
+one allowlist in code (`FREE_TOOLS` in `src/mcp/tools.ts`), not by narrative — if a tool isn't in
+that list, it's Pro, regardless of what a description elsewhere implies.
+
+Since v1.9.0, a session without a license does not *advertise* the Pro tools either. Sending their
+schemas every turn only to refuse the call charged roughly 3k tokens per turn for capabilities the
+session could not use. They remain registered and discoverable through `lemma_toolbox`, which is
+where you find out a capability exists and what unlocks it.
+
+### 🆓 Free (46 Tools)
 
 These tools work **without a Pro license**. Activate them with just `lemma init`:
 
 | Tool | What It Does |
 | :--- | :--- |
+| `smarter_cache` | Semantic cache lookup before reasoning from scratch |
+| `state_hash_cache` | Reasoning cache keyed to file content hashes — exact invalidation |
+| `token_receipt` | Auditable per-session ledger of how each answer was produced |
+| `search_memory` | Semantic search across The Brain, all projects |
+| `store_memory` | Persist verified solutions/fixes/decisions into The Brain |
+| `get_project_history` | Git log + checkpoints + Brain memories in one call |
+| `token_budget` | Session token/cost dashboard, including Lemma's own overhead |
+| `squeeze_prompt` | Compress code blocks before they enter your own context |
+| `turbosqueeze` | Extreme internal-context compression (never shown to the user) |
+| `read_workspace_file` | Read a file (or a line range) with auto-compression, privacy scrubbing, and real line numbers |
+| `scrub_privacy` | Mask PII, API keys, and secrets from any text block |
+| `summarize_long_text` | Summarize via local Ollama, falls back to truncation |
+| `lemma_toolbox` | List, inspect, and call tools whose schemas were withheld |
 | `file_fingerprint` | File hash cache — avoid re-reads |
 | `git_blame_heat` | Git blame + risk scoring |
 | `type_coverage_report` | TypeScript type safety score |
@@ -426,7 +499,6 @@ These tools work **without a Pro license**. Activate them with just `lemma init`
 | `auto_context_bundle` | Full context bundle per file |
 | `repeat_guard` | Duplicate output detector |
 | `conversation_checkpoint` | Session state save/load |
-| `get_project_history` | Git log + checkpoints + Brain memories in one call |
 | `test_autofix_interceptor` | Test failure → Brain auto-fix |
 | `prompt_pattern_cache` | Reusable prompt templates |
 | `infra_discover` | Auto-detect Jenkins, OKD, Terraform |
@@ -452,25 +524,27 @@ These tools work **without a Pro license**. Activate them with just `lemma init`
 | `terraform_state_list` | List Terraform state resources |
 | `terraform_drift` | Detect Terraform drift |
 
-### 💎 Pro (51 Tools)
+### 💎 Pro (49 Tools)
 
 All remaining tools require a Pro license. Activate with `lemma activate <key>` → [Get Pro](https://lemma.nxus.studio/upgrade)
 
 | Category | Tools |
 | :--- | :--- |
-| **AI Proxy** | OpenAI/Anthropic/Gemini proxy, exact-match cache, context squeezer, complexity router |
-| **Privacy** | Privacy firewall (semantic scrubber), PII masking |
-| **The Brain** | Semantic memory, telepathic hints, hybrid consensus, smarter cache, dedup guard |
-| **Zero-Token Static** | entropy_score, coupling_radar, pattern_fossil, git_heatmap_risk, precrime_static, dead_export_necromancer |
-| **Architecture** | depgraph, refactor, ast_flow_visualizer, imports_skeleton_resolver |
-| **Code Intelligence** | get_ast_hologram, validate_patch_sandbox, surgical_ast_insert, get_symbol_surgical_context |
-| **Workspace** | read/write/create files, apply patches, search, list dirs, run commands |
-| **Optimization** | turbosqueeze, squeeze_prompt, wormhole_squeeze, compress_context, token_budget |
-| **PR Review** | review_diff, review_pr, pr_status, generate_pr_workflow |
-| **Session** | test_oracle, schema_extract, changelog_auto, env_snapshot, migration_tracer |
-| **Automation** | AutoPilot, Auto-Heal, Silent Patch Watcher |
-
-> **The MCP server is Pro.** All 51 Pro tools — The Brain, PreCrime, AST Hologram, `depgraph`, `refactor`, and every optimization tool — require a Pro license. The 33 Free tools listed above (including all 22 Infrastructure tools) are accessible without activation.
+| **AI Proxy** | OpenAI/Anthropic/Gemini proxy, exact-match cache, complexity router |
+| **The Brain (advanced)** | `get_telepathic_hints`, `query_hybrid_consensus`, `semantic_dedup_guard`, `local_semantic_autofix` — basic search/store/smarter_cache are Free |
+| **Zero-Token Static** | `entropy_score`, `coupling_radar`, `pattern_fossil`, `git_heatmap_risk`, `precrime_static`, `dead_export_necromancer` |
+| **Architecture** | `depgraph`, `refactor`, `ast_flow_visualizer`, `imports_skeleton_resolver`, `cognitive_map`, `file_intent_index` |
+| **Code Intelligence** | `get_ast_hologram`, `validate_patch_sandbox`, `surgical_ast_insert`, `get_symbol_surgical_context`, `smart_file_slice`, `diff_only` |
+| **Workspace writes** | `write_workspace_file`, `create_workspace_file`, `apply_workspace_patch`, `multi_file_patch`, `search_workspace`, `list_workspace_dir`, `run_workspace_command`, `output_region` |
+| **Optimization (advanced)** | `wormhole_squeeze`, `compress_context`, `prune_conversation_history` — `turbosqueeze`, `squeeze_prompt`, `token_budget` are Free |
+| **PR Review** | `review_diff`, `review_pr`, `pr_status`, `generate_pr_workflow` |
+| **Session & Automation** | `test_oracle`, `schema_extract`, `changelog_auto`, `env_snapshot`, `migration_tracer`, `spec_to_stub`, `batch_tool_calls`, `get_routing_advice`, `get_project_onboarding`, `auto_heal`, `semantic_grep` |
+| **Automation (background)** | AutoPilot, Auto-Heal, Silent Patch Watcher |
+
+> **The MCP server itself is Pro.** All 49 Pro tools — the advanced Brain layer, PreCrime, AST
+> Hologram, `depgraph`, `refactor`, every workspace-write tool, and every PR review tool — require a
+> Pro license. The 46 Free tools above (including all 22 Infrastructure tools and `read_workspace_file`
+> with its automatic privacy scrubbing) are accessible without activation.
 
 ---
 
@@ -687,6 +761,8 @@ lemma start
 | `lemma apply <id>` | Apply a pending fix patch. |
 | `lemma discard <id>` | Discard a pending fix patch. |
 | `lemma activate <key>` | Activate Pro license for full MCP access. |
+| `lemma-checkpoint [projectRoot]` | Standalone bin: derive a session checkpoint from repo state (branch, changed files, recent commits) without an assistant call. See [Session checkpoints](#-session-checkpoints). |
+| `lemma-brain-ingest [projectRoot]` | Standalone bin: feed The Brain from git commits and `CHANGELOG.md`, incrementally. See [Feeding The Brain from project history](#-feeding-the-brain-from-project-history). |
 
 ### Customizing via `lemma.config.json`
 
@@ -726,157 +802,32 @@ Just run `lemma init`. Lemma automatically registers its MCP server in your `~/.
 }
 ```
 
-Once connected, your IDE gains access to **62 MCP tools** — 11 free + 51 Pro. Lemma auto-injects the TurboMode system prompt on handshake.
-
----
-
-## 🛠️ MCP Tools Reference (v1.1.0 — 62 Tools)
-
-### 🆓 Free Tools (11)
-
-> These tools work without a Pro license. All are zero-dependency and run locally.
-
-| Tool | Category | Description |
-| :--- | :--- | :--- |
-| `file_fingerprint` | Smart Read | SHA256 hash cache. Returns 'unchanged' when hash matches, avoiding re-reads. |
-| `git_blame_heat` | Analysis | Git blame + risk scoring per line. Identifies hotspots and high-risk authors. |
-| `type_coverage_report` | Analysis | TypeScript type safety score via AST. Reports typed vs untyped, `any` count. |
-| `import_tree_context` | Architecture | Bidirectional import graph with reverse dependencies. |
-| `read_token_budgeted` | Smart Read | Read file with hard token limit. Returns only relevant sections. |
-| `bulk_file_digest` | Smart Read | Read N files in one call. Returns compressed digest. |
-| `auto_context_bundle` | Smart Read | One-call bundle: content + imports + types + Brain hints. |
-| `repeat_guard` | Optimization | Detects duplicate outputs using Jaccard similarity. |
-| `conversation_checkpoint` | Session | Save/load session state to prevent re-explaining context. |
-| `test_autofix_interceptor` | Automation | Run tests + Brain search for matching fixes. |
-| `prompt_pattern_cache` | Optimization | Find/store optimized prompt templates. |
-
-### 🗂️ Workspace Tools
-
-| Tool | Description |
-| :--- | :--- |
-| `read_workspace_file` | Read a file with automatic token compression and privacy scrubbing. |
-| `write_workspace_file` | Write content to a file, creating parent directories as needed. |
-| `create_workspace_file` | Create a new file (fails if exists). Returns minimal ACK. |
-| `apply_workspace_patch` | Smart search-and-replace patch — safe against duplicate matches. |
-| `multi_file_patch` | Apply patches to multiple files in a single call. |
-| `list_workspace_dir` | Recursively list the project structure up to a configurable depth. |
-| `search_workspace` | Fast text search (grep) across all project files. |
-| `semantic_grep` | Natural language concept search using BM25. |
-| `run_workspace_command` | Execute bash commands in the workspace root. Secured by allowlist. Distills long jest/vitest/tsc/eslint output down to the failures and their locations; full output kept retrievable. |
-| `output_region` | Retrieve any part of a stored command output verbatim (whole thing, one failing test, or a line range). |
-| `file_intent_index` | Group files by domain intent (auth, routing, config). |
-
-### 🔬 Code Intelligence Tools
-
-| Tool | Description |
-| :--- | :--- |
-| `get_ast_hologram` | Holographic AST Map of all exported symbols. 90% token savings. |
-| `validate_patch_sandbox` | Pre-flight validator: runs tsc + syntax check before applying. |
-| `diff_only` | Compact line-by-line diff between known states. Session-scoped. |
-| `surgical_ast_insert` | Insert code at AST anchor point. 95% output token savings. |
-| `get_symbol_surgical_context` | Extract symbol + dependency signatures only. 90% savings. |
-| `smart_file_slice` | Read only relevant lines around a query. 85% savings. |
-| `schema_extract` | Extract interfaces/types/schemas via AST. 80% savings. |
-| `spec_to_stub` | Generate mock stubs from TypeScript interfaces. |
-| `ast_flow_visualizer` | Mermaid flowchart from function control flow. |
-| `imports_skeleton_resolver` | Import signature mapper for quick reference. |
-
-### 🧠 Brain & Memory Tools
-
-| Tool | Description |
-| :--- | :--- |
-| `search_memory` | Semantic search across The Brain from all projects globally. |
-| `store_memory` | Persist solutions, fixes, decisions into The Brain. |
-| `query_hybrid_consensus` | Hybrid cache: 80% threshold → instant answer, 0 cloud tokens. |
-| `get_telepathic_hints` | Proactive hints from The Brain based on active file. |
-| `smarter_cache` | Predictive cache at 75% threshold before any reasoning. |
-| `semantic_dedup_guard` | Brain dedup firewall. Rejects ≥92% similar entries. |
-| `local_semantic_autofix` | Offline self-healing from Brain error index. |
-
-### ⚙️ Optimization & Privacy Tools
-
-| Tool | Description |
-| :--- | :--- |
-| `scrub_privacy` | Mask PII, API keys, secrets from any text block. |
-| `squeeze_prompt` | Compress code blocks. Up to 80% token reduction. |
-| `turbosqueeze` | Extreme compression: strips comments, imports, whitespace. |
-| `wormhole_squeeze` | Reversible unicode compression. 60-70% reduction. |
-| `compress_context` | Summarize old conversation turns. Keeps last N intact. |
-| `prune_conversation_history` | Intelligently decimate history preserving critical context. |
-| `summarize_long_text` | Summarize via Ollama. Falls back to truncation. |
-| `token_budget` | Dashboard: multiplier, savings, strategies, recommendations. |
-| `get_routing_advice` | Optimal model recommendation from Complexity Router. |
-| `get_project_onboarding` | One-shot architectural mental model. |
-| `auto_heal` | Auto-diagnose and repair crashes from live context. |
-| `batch_tool_calls` | Execute multiple tools in parallel via Promise.all. |
-
-### 🔮 Zero-Token Static Intelligence Tools
-
-> All tools in this section use **zero LLM tokens**. Pure local computation.
-
-| Tool | Description |
-| :--- | :--- |
-| `entropy_score` | Mathematical chaos score (0-100) per file. |
-| `coupling_radar` | Dependency graph: circular imports, god modules, dead islands. |
-| `pattern_fossil` | Zombie code detector: var vs const, callbacks vs async/await. |
-| `git_heatmap_risk` | Git churn analysis + co-edit pairs. |
-| `precrime_static` | Composite risk predictor combining entropy + coupling + git. |
-| `dead_export_necromancer` | Dead code auditor: exported but never imported. |
-| `git_blame_heat` | Git blame + per-line risk scoring. |
-| `type_coverage_report` | TypeScript type safety score. |
-| `import_tree_context` | Bidirectional import graph. |
-
-### 🏗️ Architecture & Refactoring Tools
-
-| Tool | Description |
-| :--- | :--- |
-| `depgraph` | Real-time dependency graph with depth, format, circular detection. |
-| `refactor` | Declarative codemod: rename symbols or move files. |
-| `cognitive_map` | Auto-updating knowledge graph of domains and patterns. |
-
-### 🔍 PR Review Agent Tools
-
-| Tool | Description |
-| :--- | :--- |
-| `review_diff` | Analyze raw diff for bugs, security, best practices. |
-| `review_pr` | Full PR review against GitHub, Azure DevOps, GitLab. |
-| `pr_status` | Query last review status for a PR. |
-| `generate_pr_workflow` | Generate CI/CD workflow YAML for PR reviews. |
-
-### 🧪 Testing & Quality Tools
-
-| Tool | Description |
-| :--- | :--- |
-| `test_oracle` | Run tests, return only failures with compressed traces. |
-| `test_autofix_interceptor` | Run tests + Brain search for matching fixes. |
-| `changelog_auto` | Conventional commit changelog from git history. |
-| `env_snapshot` | Node/npm versions, deps, .env keys (values hidden). |
-| `migration_tracer` | Prisma migration schema diff analysis. |
-
-### 📋 Session & Automation Tools
-
-| Tool | Description |
-| :--- | :--- |
-| `conversation_checkpoint` | Save/load session state to `.lemma/session/`. |
-| `prompt_pattern_cache` | Find/store optimized prompt templates. |
-| `review_pr` | Full PR review with auto-approve option. |
+Once connected, your IDE gains access to all **95 MCP tools** (46 Free + 49 Pro — see
+[Free vs Pro](#-free-vs-pro) for the full, current split) and Lemma auto-injects the TurboMode
+system prompt on handshake. By default only the tools your project shows evidence of needing are
+*advertised* each turn — see [Tool profiles](#-tool-profiles) — but every tool is registered and
+reachable via `lemma_toolbox` regardless of profile.
 
 ### ⚡ TurboMode Auto-Injection
 
-When connected via `lemma mcp`, Lemma auto-injects 12 rules into the agent's system prompt on handshake:
-
-1. `turbosqueeze` before writing large code blocks
-2. `smarter_cache` before any reasoning
-3. `store_memory` after every resolved solution
-4. `get_ast_hologram` before reading files
-5. `batch_tool_calls` for parallel operations
-6. `semantic_dedup_guard` before every `store_memory`
-7. No fluff, no chit-chat — maximum density
-8. `auto_context_bundle` or `bulk_file_digest` for multi-file ops
-9. `repeat_guard` before long outputs
-10. `conversation_checkpoint` to restore session context
-11. `test_autofix_interceptor` when tests fail
-12. `prompt_pattern_cache` for repetitive prompts
+When connected via `lemma mcp`, Lemma auto-injects its system prompt on handshake. The real,
+current prompt (`LEMMA_TURBOMODE_PROMPT` in `src/mcp/prompts.ts`) states the goal — reduce what
+enters context without ever costing a correct answer — and enforces it with rules including:
+
+- A tool call costs tokens too: expect a call to save more than its own round-trip, or skip it.
+- `lemma_toolbox` reaches every tool whose schema was withheld from this session — check it
+  before saying a capability is missing.
+- Compression (`turbosqueeze`, `wormhole_squeeze`, `squeeze_prompt`) is for the model's own
+  context only; the user always gets the real, uncompressed file.
+- `smarter_cache` hits must be disclosed as cached, never presented as freshly reasoned, and
+  re-verified before acting on them.
+- `state_hash_cache` (exact file-hash invalidation) is preferred over `smarter_cache` (semantic
+  similarity) whenever the answer depends on specific files.
+- `store_memory` only after a solution is actually verified — an unverified fix stored here
+  becomes a false cache hit later.
+- `get_routing_advice` before assuming a mechanical task needs the biggest available model.
+- `surgical_ast_insert` by default for adding to an existing file, instead of rewriting it whole.
+- `token_receipt` for "how much did we save," never an invented estimate.
 
 ---
 
@@ -904,7 +855,15 @@ AUTH_ALLOWED_ORIGINS=https://yourdomain.com
 ```
 
 ### MCP Command Allowlist
-`run_workspace_command` only executes commands from an allowlist. Default safe prefixes: `npm`, `npx`, `git`, `tsc`, `node`, `jest`, `eslint`, `ls`, `grep`, and more.
+`run_workspace_command` only executes commands from an allowlist. It is deny-by-default, but the
+defaults cover the toolchains a normal repo builds and tests with — JS/TS (`npm`, `npx`, `pnpm`,
+`tsc`, `jest`, `vitest`, `eslint`), Python (`python`, `pytest`, `ruff`), Go, Rust, Ruby, JVM,
+`make`, version control (`git`, `gh`), read-only shell utilities (`ls`, `grep`, `rg`, `sed`, `awk`,
+`find`), and container/infra CLIs (`docker`, `kubectl`, `terraform`).
+
+A command missing from this list is not a command prevented: the agent gets a refusal, then runs the
+same thing through an unrestricted shell where Lemma can neither distil the output nor account for
+it. The list is scoped to keep that from happening for ordinary development work.
 
 Extend for your project in `lemma.config.json`:
 ```json
@@ -921,15 +880,6 @@ See [`.env.security.example`](.env.security.example) for all security-related en
 
 ## 🦜 SDK Integrations
 
-### LangChain
-```typescript
-import { LemmaLangChainProvider } from '@nxuss/lemma/langchain';
-
-const model = new LemmaLangChainProvider({
-  apiKey: process.env.OPENAI_API_KEY,
-});
-```
-
 ### CrewAI
 ```typescript
 import { LemmaCrewAIProvider } from '@nxuss/lemma/crewai';

package/dist/cjs/mcp/prompts.d.ts

@@ -1,4 +1,13 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-export declare const LEMMA_TURBOMODE_PROMPT = "You are operating in LEMMA TURBOMODE. Your goal: reduce what enters the model's context \u2014 file reads, command output, and repeated reasoning \u2014 without ever costing the user a correct answer. Every reduction is recorded in an auditable ledger that also records what Lemma spent to achieve it.\n\nThere is no fixed multiplier to hit. Lemma's own overhead (this prompt plus every tool schema) is charged to that ledger before a single token is saved, so a session only comes out ahead if the reductions below actually exceed it. Optimize for real net savings, not for a number.\n\n## MANDATORY TURBOMODE RULES \u2014 VIOLATE THESE AND YOU WASTE THE USER'S MONEY\n\n### 0. Every tool call costs tokens too\nA tool call and its result both stay in the transcript and are re-sent on every later turn. Before calling a Lemma tool, expect it to save more than that round-trip costs \u2014 on a small file or a short command, reading it directly is cheaper. Never call a reporting tool on a schedule: a report is not work. Call one only when the user asks how the session is going.\n\n### 0b. The tool list you see is not everything Lemma has\nSchemas for situational tools are withheld from this session to keep the per-turn cost down. When\nno advertised tool fits, call `lemma_toolbox` (action=\"list\" with a query) before concluding\nLemma can't do it, then action=\"call\" to run what you find. Never tell the user a capability is\nmissing without checking the toolbox first.\n\n### 1. Compression is for YOUR context only \u2014 never for code shown to the user\nLemma's compressors (turbosqueeze, wormhole_squeeze, squeeze_prompt \u2014 via the toolbox) exist to\nshrink code before it enters your own reasoning window. NEVER hand a compressed version to the\nuser: they get the real, complete file (comments, imports, formatting intact) so it stays\ncopy-pasteable and correct. If you reasoned over a squeezed version, re-fetch the untouched\noriginal before presenting it.\n\n### 2. smarter_cache (threshold 0.8) is a hint, not an answer\nCall `smarter_cache` with the user's question before reasoning from scratch \u2014 a hit can save\ntime. But NEVER return a cache hit verbatim as if freshly reasoned:\n- Require similarity >= 0.8 (raised from 0.75 \u2014 0.75 was matching questions that weren't\n  actually the same question).\n- Always tell the user the answer came from cache (e.g. \"from a cached earlier answer:\").\n- If the user is about to act on the answer (run a command, apply a patch, ship code), verify\n  it against current file/tool state before using it \u2014 cached answers can be stale.\n- On a MISS, or on any doubt, reason normally.\n\n### 3. Before reading files \u2192 call get_ast_hologram\nNEVER read files blindly. Always call `get_ast_hologram` first to locate the exact symbols you need. Then read only those specific files. Each unnecessary file read wastes 1000+ tokens.\n\n### 4. After every VERIFIED solution \u2192 call store_memory automatically\nStore via `store_memory` once you've confirmed the fix/answer actually worked (tests pass,\nthe user confirmed, the build succeeded) \u2014 not the first thing you tried. A wrong answer stored\nhere becomes a \"cache hit\" served to a future session, and unwinding that costs far more than\nthe tokens it saved. Verified answers are still free to cache aggressively.\n\n### 5. Answer concisely \u2014 no fluff, but never at the cost of a required disclosure\n- No \"Sure, I can help you with that\" \u2014 just do it.\n- No unnecessary explanation of what you did \u2014 unless asked.\n- No repeating the user's question back to them.\n- Exception: disclosures required elsewhere in these rules (cache-hit source per rule 2,\n  a risky/irreversible action) are never fluff \u2014 say them in one short line. Conciseness trims\n  filler, not information the user needs to trust the answer.\n\n### 6. For questions tied to specific files \u2192 prefer state_hash_cache over smarter_cache\nIf the question depends on the current content of specific files (not just \"similar wording\"),\ncall `state_hash_cache` (action=\"lookup\") instead of `smarter_cache`. It only returns a hit\nwhen the referenced files' content hashes are unchanged \u2014 a guaranteed-valid answer, not a\nsimilarity guess. After answering, call it again with action=\"store\" to cache it. Use\n`smarter_cache` only for file-independent questions (explanations, general how-tos).\n\n### 7. Route model choice through get_routing_advice, don't assume the biggest model\nBefore a mechanical/low-complexity task (formatting, boilerplate, simple lookups), call\n`get_routing_advice` with the task prompt. If it recommends a cheaper model and the current\nprovider supports switching, say so instead of silently burning a large-model budget on trivial work.\n\n### 8. Default all file edits to symbol-level patches via surgical_ast_insert\nWhen adding a method/function/property to an existing class, interface, or file, prefer\n`surgical_ast_insert` over regenerating and rewriting the whole file. Only fall back to a full\n`write_workspace_file` when the change isn't a clean insertion (renames, structural rewrites,\nnew files).\n\n### 9. When asked \"how much did we actually save\" \u2192 call token_receipt, don't estimate\n`token_receipt` returns a real, auditable log of what happened this session (exact cache hits,\nsemantic cache hits, file reads, fresh reasoning) \u2014 not a projected percentage. Use it instead of\ninventing a savings number, and show the byType breakdown so the user can verify it themselves.\n\n### 10. Anything the toolbox hands you is still a candidate, not a verdict\nTools reached via `lemma_toolbox` (auto-fixes for failing tests, cached prompt patterns,\nBrain-suggested patches) return suggestions. Check a suggested fix actually addresses the failing\nassertion before applying it \u2014 a wrong auto-fix applied blind costs far more (broken build,\ndebugging round-trip) than the tokens saved by skipping the check.\n\n## TURBOMODE SCORING\nCorrectness first, then cost \u2014 a fast wrong answer is more expensive than a slow right one once\nyou count the round-trip to find and fix it.\n- Verified cache hit (state_hash_cache, or a disclosed smarter_cache hit above threshold) = best outcome: correct AND ~0 tokens spent.\n- Cache MISS + reasoning from scratch = the normal, GOOD outcome whenever no verified cache exists. Reasoning is not a failure mode \u2014 it's what you do when you don't already have a trustworthy answer.\n- Reading full files without checking get_ast_hologram first = wasteful, avoid it when a cheaper lookup would've told you what you needed.\n- Any answer delivered without required disclosure (rule 6's exception), or a cached/auto-fixed result used without verification = FAIL, regardless of tokens saved \u2014 it can cost the user far more than tokens once it's wrong.\n\nRemember: the goal is spending fewer tokens on the SAME quality of answer, not a lower-quality answer for fewer tokens.";
+/**
+ * This text is injected into the system prompt and re-sent on every turn of the session, so
+ * its length is a recurring charge against the very savings it asks for. It is kept to the
+ * rules that change behaviour or protect correctness; anything that only restates good default
+ * behaviour (be concise, don't pad) was removed rather than paid for on every request.
+ *
+ * The full rationale and scoring model live in the `lemma-turbomode` prompt resource, which
+ * the client can fetch on demand instead of carrying permanently.
+ */
+export declare const LEMMA_TURBOMODE_PROMPT = "You are operating in LEMMA TURBOMODE. Reduce what enters the model's context \u2014 file reads, command output, repeated reasoning \u2014 without ever costing the user a correct answer. Lemma's own overhead (this prompt + every tool schema) is charged to the ledger before a single token is saved, so optimize for real net savings, not for a multiplier.\n\n## RULES\n\n**0. Tool calls cost tokens too.** A call and its result stay in the transcript and are re-sent every later turn. Expect a Lemma tool to save more than that round-trip costs \u2014 on a small file or short command, reading it directly is cheaper. Never call a reporting tool on a schedule.\n\n**0b. The advertised list is not everything Lemma has.** Situational schemas are withheld to keep per-turn cost down. Before concluding Lemma can't do something, call `lemma_toolbox` (action=\"list\" with a query), then action=\"call\".\n\n**1. Compression is for YOUR context only.** NEVER hand a compressed version to the user \u2014 they get the real, complete file, comments and imports intact. If you reasoned over a squeezed version, re-fetch the original before presenting it.\n\n**2. A cache hit is a hint, not an answer.** `smarter_cache` requires similarity >= 0.8. Always tell the user the answer came from cache. If they're about to act on it (run a command, apply a patch, ship code), verify against current state first \u2014 cached answers go stale. On a MISS or any doubt, reason normally.\n\n**3. Locate before reading only when locating is cheaper.** Don't know which file? `get_ast_hologram` / `search_workspace` beats reading candidates one by one. Already know the file? Read it \u2014 a lookup round-trip on a small file costs more than the file. `read_workspace_file` carries real line numbers and takes offset/limit, so prefer a targeted range on large files.\n\n**4. store_memory only after verification.** Store once the fix actually worked (tests pass, build succeeded, user confirmed) \u2014 not your first attempt. A wrong answer stored here becomes a false cache hit for a future session, and unwinding that costs far more than it saved.\n\n**5. Never trade a required disclosure for brevity.** A cache-hit source or a risky/irreversible action is not filler. One short line.\n\n**6. File-dependent questions \u2192 state_hash_cache, not smarter_cache.** It only hits when the referenced files' hashes are unchanged: a guaranteed-valid answer instead of a similarity guess. Look up before, store after. Use `smarter_cache` only for file-independent questions.\n\n**7. Edit in place.** `apply_workspace_patch` or `surgical_ast_insert` over rewriting a file with `write_workspace_file`; reserve the full write for renames, structural rewrites and new files. For mechanical work, `get_routing_advice` says whether a cheaper model suffices.\n\n**8. \"How much did we save\" \u2192 token_receipt, don't estimate.** It returns a real auditable log. Show the byType breakdown so the user can verify it.\n\n**9. What the toolbox hands you is a candidate, not a verdict.** Auto-fixes, cached patterns and Brain-suggested patches are suggestions. Check a fix addresses the actual failing assertion before applying it.\n\n## SCORING\nCorrectness first, then cost \u2014 a fast wrong answer costs more than a slow right one once you count the round-trip to fix it. A verified cache hit is best; a MISS followed by reasoning from scratch is the normal GOOD outcome, not a failure. A cached or auto-fixed result delivered without disclosure or verification is a FAIL regardless of tokens saved.\n\nFewer tokens for the SAME quality of answer \u2014 never a worse answer for fewer tokens.";
 export declare function setupPromptsHandlers(server: Server): void;
 //# sourceMappingURL=prompts.d.ts.map

package/dist/cjs/mcp/prompts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../../../src/mcp/prompts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAGnE,eAAO,MAAM,sBAAsB,23NAsFqF,CAAC;AAEzH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CA8BzD"}
+{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../../../src/mcp/prompts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAGnE;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,slHA6BkD,CAAC;AAEtF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CA8BzD"}

package/dist/cjs/mcp/prompts.js

@@ -3,93 +3,45 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.LEMMA_TURBOMODE_PROMPT = void 0;
 exports.setupPromptsHandlers = setupPromptsHandlers;
 const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
-exports.LEMMA_TURBOMODE_PROMPT = `You are operating in LEMMA TURBOMODE. Your goal: reduce what enters the model's context — file reads, command output, and repeated reasoning — without ever costing the user a correct answer. Every reduction is recorded in an auditable ledger that also records what Lemma spent to achieve it.
+/**
+ * This text is injected into the system prompt and re-sent on every turn of the session, so
+ * its length is a recurring charge against the very savings it asks for. It is kept to the
+ * rules that change behaviour or protect correctness; anything that only restates good default
+ * behaviour (be concise, don't pad) was removed rather than paid for on every request.
+ *
+ * The full rationale and scoring model live in the `lemma-turbomode` prompt resource, which
+ * the client can fetch on demand instead of carrying permanently.
+ */
+exports.LEMMA_TURBOMODE_PROMPT = `You are operating in LEMMA TURBOMODE. Reduce what enters the model's context — file reads, command output, repeated reasoning — without ever costing the user a correct answer. Lemma's own overhead (this prompt + every tool schema) is charged to the ledger before a single token is saved, so optimize for real net savings, not for a multiplier.
 
-There is no fixed multiplier to hit. Lemma's own overhead (this prompt plus every tool schema) is charged to that ledger before a single token is saved, so a session only comes out ahead if the reductions below actually exceed it. Optimize for real net savings, not for a number.
+## RULES
 
-## MANDATORY TURBOMODE RULES — VIOLATE THESE AND YOU WASTE THE USER'S MONEY
+**0. Tool calls cost tokens too.** A call and its result stay in the transcript and are re-sent every later turn. Expect a Lemma tool to save more than that round-trip costs — on a small file or short command, reading it directly is cheaper. Never call a reporting tool on a schedule.
 
-### 0. Every tool call costs tokens too
-A tool call and its result both stay in the transcript and are re-sent on every later turn. Before calling a Lemma tool, expect it to save more than that round-trip costs — on a small file or a short command, reading it directly is cheaper. Never call a reporting tool on a schedule: a report is not work. Call one only when the user asks how the session is going.
+**0b. The advertised list is not everything Lemma has.** Situational schemas are withheld to keep per-turn cost down. Before concluding Lemma can't do something, call \`lemma_toolbox\` (action="list" with a query), then action="call".
 
-### 0b. The tool list you see is not everything Lemma has
-Schemas for situational tools are withheld from this session to keep the per-turn cost down. When
-no advertised tool fits, call \`lemma_toolbox\` (action="list" with a query) before concluding
-Lemma can't do it, then action="call" to run what you find. Never tell the user a capability is
-missing without checking the toolbox first.
+**1. Compression is for YOUR context only.** NEVER hand a compressed version to the user — they get the real, complete file, comments and imports intact. If you reasoned over a squeezed version, re-fetch the original before presenting it.
 
-### 1. Compression is for YOUR context only — never for code shown to the user
-Lemma's compressors (turbosqueeze, wormhole_squeeze, squeeze_prompt — via the toolbox) exist to
-shrink code before it enters your own reasoning window. NEVER hand a compressed version to the
-user: they get the real, complete file (comments, imports, formatting intact) so it stays
-copy-pasteable and correct. If you reasoned over a squeezed version, re-fetch the untouched
-original before presenting it.
+**2. A cache hit is a hint, not an answer.** \`smarter_cache\` requires similarity >= 0.8. Always tell the user the answer came from cache. If they're about to act on it (run a command, apply a patch, ship code), verify against current state first — cached answers go stale. On a MISS or any doubt, reason normally.
 
-### 2. smarter_cache (threshold 0.8) is a hint, not an answer
-Call \`smarter_cache\` with the user's question before reasoning from scratch — a hit can save
-time. But NEVER return a cache hit verbatim as if freshly reasoned:
-- Require similarity >= 0.8 (raised from 0.75 — 0.75 was matching questions that weren't
-  actually the same question).
-- Always tell the user the answer came from cache (e.g. "from a cached earlier answer:").
-- If the user is about to act on the answer (run a command, apply a patch, ship code), verify
-  it against current file/tool state before using it — cached answers can be stale.
-- On a MISS, or on any doubt, reason normally.
+**3. Locate before reading only when locating is cheaper.** Don't know which file? \`get_ast_hologram\` / \`search_workspace\` beats reading candidates one by one. Already know the file? Read it — a lookup round-trip on a small file costs more than the file. \`read_workspace_file\` carries real line numbers and takes offset/limit, so prefer a targeted range on large files.
 
-### 3. Before reading files → call get_ast_hologram
-NEVER read files blindly. Always call \`get_ast_hologram\` first to locate the exact symbols you need. Then read only those specific files. Each unnecessary file read wastes 1000+ tokens.
+**4. store_memory only after verification.** Store once the fix actually worked (tests pass, build succeeded, user confirmed) — not your first attempt. A wrong answer stored here becomes a false cache hit for a future session, and unwinding that costs far more than it saved.
 
-### 4. After every VERIFIED solution → call store_memory automatically
-Store via \`store_memory\` once you've confirmed the fix/answer actually worked (tests pass,
-the user confirmed, the build succeeded) — not the first thing you tried. A wrong answer stored
-here becomes a "cache hit" served to a future session, and unwinding that costs far more than
-the tokens it saved. Verified answers are still free to cache aggressively.
+**5. Never trade a required disclosure for brevity.** A cache-hit source or a risky/irreversible action is not filler. One short line.
 
-### 5. Answer concisely — no fluff, but never at the cost of a required disclosure
-- No "Sure, I can help you with that" — just do it.
-- No unnecessary explanation of what you did — unless asked.
-- No repeating the user's question back to them.
-- Exception: disclosures required elsewhere in these rules (cache-hit source per rule 2,
-  a risky/irreversible action) are never fluff — say them in one short line. Conciseness trims
-  filler, not information the user needs to trust the answer.
+**6. File-dependent questions → state_hash_cache, not smarter_cache.** It only hits when the referenced files' hashes are unchanged: a guaranteed-valid answer instead of a similarity guess. Look up before, store after. Use \`smarter_cache\` only for file-independent questions.
 
-### 6. For questions tied to specific files → prefer state_hash_cache over smarter_cache
-If the question depends on the current content of specific files (not just "similar wording"),
-call \`state_hash_cache\` (action="lookup") instead of \`smarter_cache\`. It only returns a hit
-when the referenced files' content hashes are unchanged — a guaranteed-valid answer, not a
-similarity guess. After answering, call it again with action="store" to cache it. Use
-\`smarter_cache\` only for file-independent questions (explanations, general how-tos).
+**7. Edit in place.** \`apply_workspace_patch\` or \`surgical_ast_insert\` over rewriting a file with \`write_workspace_file\`; reserve the full write for renames, structural rewrites and new files. For mechanical work, \`get_routing_advice\` says whether a cheaper model suffices.
 
-### 7. Route model choice through get_routing_advice, don't assume the biggest model
-Before a mechanical/low-complexity task (formatting, boilerplate, simple lookups), call
-\`get_routing_advice\` with the task prompt. If it recommends a cheaper model and the current
-provider supports switching, say so instead of silently burning a large-model budget on trivial work.
+**8. "How much did we save" → token_receipt, don't estimate.** It returns a real auditable log. Show the byType breakdown so the user can verify it.
 
-### 8. Default all file edits to symbol-level patches via surgical_ast_insert
-When adding a method/function/property to an existing class, interface, or file, prefer
-\`surgical_ast_insert\` over regenerating and rewriting the whole file. Only fall back to a full
-\`write_workspace_file\` when the change isn't a clean insertion (renames, structural rewrites,
-new files).
+**9. What the toolbox hands you is a candidate, not a verdict.** Auto-fixes, cached patterns and Brain-suggested patches are suggestions. Check a fix addresses the actual failing assertion before applying it.
 
-### 9. When asked "how much did we actually save" → call token_receipt, don't estimate
-\`token_receipt\` returns a real, auditable log of what happened this session (exact cache hits,
-semantic cache hits, file reads, fresh reasoning) — not a projected percentage. Use it instead of
-inventing a savings number, and show the byType breakdown so the user can verify it themselves.
+## SCORING
+Correctness first, then cost — a fast wrong answer costs more than a slow right one once you count the round-trip to fix it. A verified cache hit is best; a MISS followed by reasoning from scratch is the normal GOOD outcome, not a failure. A cached or auto-fixed result delivered without disclosure or verification is a FAIL regardless of tokens saved.
 
-### 10. Anything the toolbox hands you is still a candidate, not a verdict
-Tools reached via \`lemma_toolbox\` (auto-fixes for failing tests, cached prompt patterns,
-Brain-suggested patches) return suggestions. Check a suggested fix actually addresses the failing
-assertion before applying it — a wrong auto-fix applied blind costs far more (broken build,
-debugging round-trip) than the tokens saved by skipping the check.
-
-## TURBOMODE SCORING
-Correctness first, then cost — a fast wrong answer is more expensive than a slow right one once
-you count the round-trip to find and fix it.
-- Verified cache hit (state_hash_cache, or a disclosed smarter_cache hit above threshold) = best outcome: correct AND ~0 tokens spent.
-- Cache MISS + reasoning from scratch = the normal, GOOD outcome whenever no verified cache exists. Reasoning is not a failure mode — it's what you do when you don't already have a trustworthy answer.
-- Reading full files without checking get_ast_hologram first = wasteful, avoid it when a cheaper lookup would've told you what you needed.
-- Any answer delivered without required disclosure (rule 6's exception), or a cached/auto-fixed result used without verification = FAIL, regardless of tokens saved — it can cost the user far more than tokens once it's wrong.
-
-Remember: the goal is spending fewer tokens on the SAME quality of answer, not a lower-quality answer for fewer tokens.`;
+Fewer tokens for the SAME quality of answer — never a worse answer for fewer tokens.`;
 function setupPromptsHandlers(server) {
     server.setRequestHandler(types_js_1.ListPromptsRequestSchema, async () => {
         return {

package/dist/cjs/mcp/prompts.js.map

@@ -1 +1 @@
-{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../../../src/mcp/prompts.ts"],"names":[],"mappings":";;;AA2FA,oDA8BC;AAxHD,iEAAsG;AAEzF,QAAA,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wHAsFkF,CAAC;AAEzH,SAAgB,oBAAoB,CAAC,MAAc;IACjD,MAAM,CAAC,iBAAiB,CAAC,mCAAwB,EAAE,KAAK,IAAI,EAAE;QAC5D,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,iBAAiB;oBACvB,WAAW,EAAE,+MAA+M;oBAC5N,SAAS,EAAE,EAAE;iBACd;aACF;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,iBAAiB,CAAC,iCAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACjE,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,OAAO;gBACL,WAAW,EAAE,8CAA8C;gBAC3D,QAAQ,EAAE;oBACR;wBACE,IAAI,EAAE,MAAM;wBACZ,OAAO,EAAE;4BACP,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,8BAAsB;yBAC7B;qBACF;iBACF;aACF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../../../src/mcp/prompts.ts"],"names":[],"mappings":";;;AA2CA,oDA8BC;AAxED,iEAAsG;AAEtG;;;;;;;;GAQG;AACU,QAAA,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qFA6B+C,CAAC;AAEtF,SAAgB,oBAAoB,CAAC,MAAc;IACjD,MAAM,CAAC,iBAAiB,CAAC,mCAAwB,EAAE,KAAK,IAAI,EAAE;QAC5D,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,iBAAiB;oBACvB,WAAW,EAAE,+MAA+M;oBAC5N,SAAS,EAAE,EAAE;iBACd;aACF;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,iBAAiB,CAAC,iCAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACjE,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,OAAO;gBACL,WAAW,EAAE,8CAA8C;gBAC3D,QAAQ,EAAE;oBACR;wBACE,IAAI,EAAE,MAAM;wBACZ,OAAO,EAAE;4BACP,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,8BAAsB;yBAC7B;qBACF;iBACF;aACF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cjs/mcp/tool-profiles.d.ts

@@ -40,10 +40,19 @@ export interface ResolvedToolSurface<T extends {
     /** Situational groups that matched this project. */
     activeGroups: string[];
 }
+export interface ResolveOptions {
+    /**
+     * Returns false for a tool this session is not licensed to run. Such a tool must not be
+     * advertised: its schema would be re-sent every turn purely to be refused at call time.
+     * It stays registered and discoverable through `lemma_toolbox`, which is where a user
+     * finds out the capability exists and what it takes to unlock it.
+     */
+    isEntitled?: (name: string) => boolean;
+}
 export declare function resolveToolSurface<T extends {
     name: string;
     description?: string;
-}>(allDefinitions: T[], cwd?: string): ResolvedToolSurface<T>;
+}>(allDefinitions: T[], cwd?: string, options?: ResolveOptions): ResolvedToolSurface<T>;
 /**
  * One-line-per-tool catalog of everything not advertised, so the model can find and
  * invoke a hidden tool without its schema having been resident all session.

package/dist/cjs/mcp/tool-profiles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-profiles.d.ts","sourceRoot":"","sources":["../../../src/mcp/tool-profiles.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnD;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,EA0BnC,CAAC;AA4DF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,UAAoE,CAAC;AAkBnG,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE;IAC7D,OAAO,EAAE,WAAW,CAAC;IACrB,wCAAwC;IACxC,UAAU,EAAE,CAAC,EAAE,CAAC;IAChB,uFAAuF;IACvF,MAAM,EAAE,CAAC,EAAE,CAAC;IACZ,oDAAoD;IACpD,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,wBAAgB,kBAAkB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,EACjF,cAAc,EAAE,CAAC,EAAE,EACnB,GAAG,GAAE,MAAsB,GAC1B,mBAAmB,CAAC,CAAC,CAAC,CAmCxB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EACrD,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAuDR"}
+{"version":3,"file":"tool-profiles.d.ts","sourceRoot":"","sources":["../../../src/mcp/tool-profiles.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnD;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,EA0BnC,CAAC;AA4DF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,UAAoE,CAAC;AAkBnG,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE;IAC7D,OAAO,EAAE,WAAW,CAAC;IACrB,wCAAwC;IACxC,UAAU,EAAE,CAAC,EAAE,CAAC;IAChB,uFAAuF;IACvF,MAAM,EAAE,CAAC,EAAE,CAAC;IACZ,oDAAoD;IACpD,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACxC;AAED,wBAAgB,kBAAkB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,EACjF,cAAc,EAAE,CAAC,EAAE,EACnB,GAAG,GAAE,MAAsB,EAC3B,OAAO,GAAE,cAAmB,GAC3B,mBAAmB,CAAC,CAAC,CAAC,CA4CxB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EACrD,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAuDR"}

package/dist/cjs/mcp/tool-profiles.js

@@ -113,10 +113,19 @@ function readConfiguredProfile(cwd) {
         return env;
     return "auto";
 }
-function resolveToolSurface(allDefinitions, cwd = process.cwd()) {
+function resolveToolSurface(allDefinitions, cwd = process.cwd(), options = {}) {
     const profile = readConfiguredProfile(cwd);
+    // `lemma_toolbox` is the only route back to a withheld schema, so no entitlement check may
+    // ever remove it — doing so would turn every deferred tool into an unreachable one.
+    const entitlementCheck = options.isEntitled ?? (() => true);
+    const isEntitled = (name) => name === "lemma_toolbox" || entitlementCheck(name);
     if (profile === "full") {
-        return { profile, advertised: allDefinitions, hidden: [], activeGroups: ["*"] };
+        const advertised = [];
+        const hidden = [];
+        for (const def of allDefinitions) {
+            (isEntitled(def.name) ? advertised : hidden).push(def);
+        }
+        return { profile, advertised, hidden, activeGroups: ["*"] };
     }
     // Always advertised: it is the only route back to a withheld schema, so hiding it
     // would turn a deferred tool into a lost one.
@@ -141,7 +150,7 @@ function resolveToolSurface(allDefinitions, cwd = process.cwd()) {
     const advertised = [];
     const hidden = [];
     for (const def of allDefinitions) {
-        (allowed.has(def.name) ? advertised : hidden).push(def);
+        (allowed.has(def.name) && isEntitled(def.name) ? advertised : hidden).push(def);
     }
     return { profile, advertised, hidden, activeGroups };
 }