@rikaidev/yomi 0.3.1 → 0.4.1

package/dist/mcp/server.js

@@ -1,81 +1,23 @@
 /**
- * Yomi MCP server — LINE query + reply surface over stdio.
+ * Yomi MCP server.
  *
- * On startup resumes any persisted LINE session. Exposes forty-one tools:
- * login, login_complete, list_conversations, get_chat_messages,
- * get_message_image, get_message_media, get_unread_digest, get_insight,
- * mark_read,
- * send_message, send_image, send_file, send_audio, send_video,
- * send_location, send_contact, send_sticker, list_stickers, search_stickers,
- * preview_sticker, find_contact, list_contacts, get_group_members,
- * rename_group, invite_member, kick_member, leave_group, create_group,
- * react_message, cancel_reaction, unsend_message, add_friend, block_contact,
- * unblock_contact, accept_invitation, collect_messages, search_messages,
- * exclude_chats, include_chats, list_excluded_chats, get_scope_policy.
- *
- * find_contact/list_contacts/get_group_members expose LINE's raw
- * people/membership data only — no affinity scoring, no interaction-
- * frequency ranking, no relationship-graph computation. That
- * intelligence layer belongs to the host app, not this server.
- *
- * collect_messages/search_messages add cross-conversation search (LINE has
- * no such primitive): collect_messages explicitly fetches and indexes
- * recent messages locally (see ../search/), embedding them for semantic
- * search along the way; search_messages ranks by cosine similarity when
- * vectors exist, falling back to FTS5 keyword search otherwise. No
- * relationship graph, no affinity scoring either way.
- *
- * exclude_chats/include_chats/list_excluded_chats manage a scoping
- * DENYLIST (see ../search/scope.ts): excluded chats are skipped by
- * collect_messages and have their already-indexed data purged, not just
- * filtered at query time. These are local-index operations too, so they
- * work without a live LINE session (list_excluded_chats degrades its name
- * resolution gracefully when there is none).
- *
- * Hard rules:
- *   - `login`/`login_complete` are the only tools callable without a live
- *     session; together they drive the passwordless flow and persist the
- *     result. Two calls are needed only on MCP clients that don't support
- *     elicitation (confirmed empirically for Claude Desktop) — `login`
- *     starts the flow and returns the PIN as a visible tool result instead
- *     of blocking, then `login_complete` finishes it once the human has
- *     acted on their phone; clients with elicitation get the original
- *     single-call flow via `login` alone. `search_messages` also runs
- *     without a live session, reading the local index as-is (with a live
- *     session it also auto-collects a first-time empty index).
- *     `exclude_chats`/`include_chats`/`list_excluded_chats` are local-index
- *     operations and likewise run without a live session.
- *     Every other tool returns a clear error until a session exists.
- *   - Runs a background capture loop (see ../search/capture.ts): on startup
- *     it starts LINE's poll loop and indexes new incoming messages into the
- *     local search index. This is SILENT — SYNC4 sync never sends read
- *     receipts — and denylist-gated. It never sends messages and never
- *     marks anything read. The only read-receipt path is the explicit
- *     mark_read tool and the auto-read that follows a successful
- *     send_message/send_image/send_file (replying implies reading).
- *   - `send_message`/`send_image`/`send_file` perform exactly one real,
- *     E2EE-encrypted send per call — no auto-send, no retry loop, no
- *     background send. Each also best-effort sends a read receipt for that
- *     chat after a successful send (see the `read` field in the response).
- *
- * Tool handler bodies live in the handlers/ folder (one single-responsibility
- * module per domain, re-exported through handlers/index.ts) and the tool
- * schema list lives in tools.ts, to keep this file, the wiring/dispatch
- * surface, under the project's 200-scc-line cap for MCP server files.
+ * `serveStdio` negotiates both the stateless MCP 2026-07-28 era and legacy
+ * initialize-based clients. One factory instance is pinned to the selected
+ * era for the lifetime of the stdio connection.
  */
-import { Server } from '@modelcontextprotocol/sdk/server/index.js';
-import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { CallToolRequestSchema, ListResourcesRequestSchema, ListToolsRequestSchema, ReadResourceRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
+import { ResourceNotFoundError, Server, } from '@modelcontextprotocol/server';
+import { serveStdio } from '@modelcontextprotocol/server/stdio';
 import { isLineAuthInvalidatedError } from '../line/client/index.js';
 import { LineProtocolService } from '../line/core/service.js';
 import { startCapture } from '../search/capture.js';
 import { getDefaultEmbedder } from '../search/default-embedder.js';
 import { createCliLogger } from '../util/log.js';
+import { checkForUpdate } from '../util/update-check.js';
 import { YOMI_VERSION } from '../version.js';
+import { clientCapabilitiesOf } from './client-capabilities.js';
 import { handleAcceptInvitation, handleAddFriend, handleBlockContact, handleCancelReaction, handleCollectMessages, handleCreateGroup, handleExcludeChats, handleFindContact, handleGetChatMessages, handleGetGroupMembers, handleGetInsight, handleGetMessageImage, handleGetMessageMedia, handleGetScopePolicy, handleGetUnreadDigest, handleIncludeChats, handleInviteMember, handleKickMember, handleLeaveGroup, handleListContacts, handleListConversations, handleListExcludedChats, handleListStickers, handleLogin, handleLoginComplete, handleMarkRead, handlePreviewSticker, handleReactMessage, handleRenameGroup, handleSearchMessages, handleSearchStickers, handleSendAudio, handleSendContact, handleSendFile, handleSendImage, handleSendLocation, handleSendMessage, handleSendSticker, handleSendVideo, handleUnblockContact, handleUnsendMessage, NO_CREDENTIALS_MESSAGE, sessionExpiredError, sessionRequiredError, sessionRevokedError, toolError, } from './handlers/index.js';
 import { getPrivacyPolicyText } from './policy.js';
 import { TOOLS } from './tools.js';
-import { supportsMcpApps } from './ui/capability.js';
 import { LOGIN_UI_RESOURCE_CONTENTS, LOGIN_UI_RESOURCE_LISTING, LOGIN_UI_RESOURCE_URI, } from './ui/resource.js';
 import { toolsForClient } from './ui/tools-with-ui.js';
 const log = createCliLogger('Yomi');
@@ -102,12 +44,21 @@ async function main() {
             });
         });
     }
+    // Asked once per process, bounded, best-effort: a hand-installed .mcpb
+    // bundle never auto-updates, so this notice is the only way a GUI-only user
+    // learns a newer Yomi exists (see ../util/update-check.ts). Awaited here
+    // because `instructions` is built once, before any client connects.
+    const updateNotice = await checkForUpdate();
+    if (updateNotice) {
+        log.info('update.available', { current: YOMI_VERSION });
+    }
     // `instructions` is surfaced by the MCP SDK to the client/model on
     // initialize — a "TOS on connect" privacy disclosure. It is a consent
     // notice, not decoration. A short model directive precedes the canonical
     // policy prose, which lives ONLY in PRIVACY.md (see ./policy.ts) so the
     // disclosure is single-sourced and never drifts from get_scope_policy.
-    const instructions = 'SESSION ERRORS — if a tool fails with a login-required or signed-out ' +
+    const instructions = (updateNotice ? `${updateNotice}\n\n` : '') +
+        'SESSION ERRORS — if a tool fails with a login-required or signed-out ' +
         'error, the MCP server and its connection are healthy: LINE revoked this ' +
         "device's session (usually because the same account logged in somewhere " +
         'else). Tell the user that plainly and offer the `login` tool. Never ' +
@@ -132,174 +83,185 @@ async function main() {
         'policy; call get_scope_policy only when the user asks to see the policy again or ' +
         'wants the current exclusion list. Policy follows:\n\n' +
         getPrivacyPolicyText();
-    const server = new Server({ name: 'yomi', version: YOMI_VERSION }, { capabilities: { tools: {}, resources: {} }, instructions });
-    // Ground truth for whether a connected client actually supports
-    // elicitation (needed by the `login` tool) — observe it, don't assume it.
-    server.oninitialized = () => {
-        const capabilities = server.getClientCapabilities();
-        log.info('client.capabilities', {
-            capabilities: JSON.stringify(capabilities ?? null),
+    const buildServer = ({ era }) => {
+        const server = new Server({ name: 'yomi', version: YOMI_VERSION }, {
+            capabilities: { tools: {}, resources: {} },
+            instructions,
         });
-    };
-    // MCP Apps UI resource (the `login` view) is only advertised to clients
-    // that negotiated support for it (see ./ui/capability.ts) — a client
-    // without it must see `resources/list` return empty and `login`'s schema
-    // stay byte-for-byte what it always was.
-    server.setRequestHandler(ListResourcesRequestSchema, async () => {
-        const supportsUi = supportsMcpApps(server.getClientCapabilities());
-        const count = supportsUi ? 1 : 0;
-        log.info('resources.list', { supportsUi, count });
-        return { resources: supportsUi ? [LOGIN_UI_RESOURCE_LISTING] : [] };
-    });
-    server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
-        log.info('resources.read', { uri: request.params.uri });
-        if (request.params.uri !== LOGIN_UI_RESOURCE_URI) {
-            throw new Error(`Unknown resource: ${request.params.uri}`);
-        }
-        return { contents: [LOGIN_UI_RESOURCE_CONTENTS] };
-    });
-    server.setRequestHandler(ListToolsRequestSchema, async () => {
-        const supportsUi = supportsMcpApps(server.getClientCapabilities());
-        return { tools: toolsForClient(TOOLS, supportsUi) };
-    });
-    server.setRequestHandler(CallToolRequestSchema, async (request) => {
-        const { name, arguments: args } = request.params;
-        // `login` is the one tool allowed without an existing session — it is
-        // how a session gets created. `search_messages` also runs without a
-        // live session: it reads the local search index (and, when a session
-        // does exist, auto-collects a first-time empty index). exclude_chats/
-        // include_chats/list_excluded_chats are local-index scoping operations
-        // over ../search/scope.ts and likewise need no live client (list's name
-        // resolution just degrades to null without one). Everything else needs
-        // a live client.
-        const noSessionExempt = name === 'login' ||
-            name === 'login_complete' ||
-            name === 'search_messages' ||
-            name === 'exclude_chats' ||
-            name === 'include_chats' ||
-            name === 'list_excluded_chats' ||
-            name === 'get_scope_policy';
-        if (!noSessionExempt) {
-            // Three distinct "no session" stories, and the user gets sent looking in
-            // the wrong place if we conflate them: LINE revoked this device's token
-            // (someone logged in elsewhere), the token merely aged out and the silent
-            // refresh failed (nobody logged in anywhere), or we never logged in at
-            // all. All three recover via `login`; only the explanation differs.
-            if (service.loginRequired) {
-                return service.loginReason === 'expired'
-                    ? sessionExpiredError()
-                    : sessionRevokedError();
+        // Ground truth for whether a connected client actually supports
+        // elicitation (needed by the `login` tool) — observe it, don't assume it.
+        server.oninitialized = () => {
+            const capabilities = server.getClientCapabilities();
+            log.info('client.capabilities', {
+                capabilities: JSON.stringify(capabilities ?? null),
+            });
+        };
+        // MCP 2026-07-28 requires list endpoints to be connection-independent.
+        // Older hosts safely ignore the MCP Apps MIME type and `_meta.ui`.
+        server.setRequestHandler('resources/list', async () => {
+            log.info('resources.list', { count: 1 });
+            return { resources: [LOGIN_UI_RESOURCE_LISTING] };
+        });
+        server.setRequestHandler('resources/read', async (request) => {
+            log.info('resources.read', { uri: request.params.uri });
+            if (request.params.uri !== LOGIN_UI_RESOURCE_URI) {
+                throw new ResourceNotFoundError(request.params.uri);
             }
-            if (!service.client) {
-                return sessionRequiredError();
+            return { contents: [LOGIN_UI_RESOURCE_CONTENTS] };
+        });
+        server.setRequestHandler('tools/list', async () => {
+            return { tools: toolsForClient(TOOLS, true) };
+        });
+        server.setRequestHandler('tools/call', async (request, ctx) => {
+            const { name, arguments: args } = request.params;
+            // `login` is the one tool allowed without an existing session — it is
+            // how a session gets created. `search_messages` also runs without a
+            // live session: it reads the local search index (and, when a session
+            // does exist, auto-collects a first-time empty index). exclude_chats/
+            // include_chats/list_excluded_chats are local-index scoping operations
+            // over ../search/scope.ts and likewise need no live client (list's name
+            // resolution just degrades to null without one). Everything else needs
+            // a live client.
+            const noSessionExempt = name === 'login' ||
+                name === 'login_complete' ||
+                name === 'search_messages' ||
+                name === 'exclude_chats' ||
+                name === 'include_chats' ||
+                name === 'list_excluded_chats' ||
+                name === 'get_scope_policy';
+            if (!noSessionExempt) {
+                // Three distinct "no session" stories, and the user gets sent looking in
+                // the wrong place if we conflate them: LINE revoked this device's token
+                // (someone logged in elsewhere), the token merely aged out and the silent
+                // refresh failed (nobody logged in anywhere), or we never logged in at
+                // all. All three recover via `login`; only the explanation differs.
+                if (service.loginRequired) {
+                    return service.loginReason === 'expired'
+                        ? sessionExpiredError()
+                        : sessionRevokedError();
+                }
+                if (!service.client) {
+                    return sessionRequiredError();
+                }
             }
-        }
-        try {
-            switch (name) {
-                case 'login':
-                    return await handleLogin(server, service, (args ?? {}));
-                case 'login_complete':
-                    return await handleLoginComplete();
-                case 'list_conversations':
-                    return await handleListConversations(service, (args ?? {}));
-                case 'get_chat_messages':
-                    return await handleGetChatMessages(service, (args ?? {}));
-                case 'get_message_image':
-                    return await handleGetMessageImage(service, (args ?? {}));
-                case 'get_message_media':
-                    return await handleGetMessageMedia(service, (args ?? {}));
-                case 'get_unread_digest':
-                    return await handleGetUnreadDigest(service, (args ?? {}));
-                case 'get_insight':
-                    return await handleGetInsight(service, (args ?? {}));
-                case 'mark_read':
-                    return await handleMarkRead(service, (args ?? {}));
-                case 'send_message':
-                    return await handleSendMessage(service, (args ?? {}));
-                case 'send_image':
-                    return await handleSendImage(service, (args ?? {}));
-                case 'send_file':
-                    return await handleSendFile(service, (args ?? {}));
-                case 'send_audio':
-                    return await handleSendAudio(service, (args ?? {}));
-                case 'send_video':
-                    return await handleSendVideo(service, (args ?? {}));
-                case 'send_location':
-                    return await handleSendLocation(service, (args ?? {}));
-                case 'send_contact':
-                    return await handleSendContact(service, (args ?? {}));
-                case 'send_sticker':
-                    return await handleSendSticker(service, (args ?? {}));
-                case 'list_stickers':
-                    return await handleListStickers(service, (args ?? {}));
-                case 'search_stickers':
-                    return await handleSearchStickers(service, (args ?? {}));
-                case 'preview_sticker':
-                    return await handlePreviewSticker(service, (args ?? {}));
-                case 'find_contact':
-                    return await handleFindContact(service, (args ?? {}));
-                case 'list_contacts':
-                    return await handleListContacts(service);
-                case 'get_group_members':
-                    return await handleGetGroupMembers(service, (args ?? {}));
-                case 'rename_group':
-                    return await handleRenameGroup(service, (args ?? {}));
-                case 'invite_member':
-                    return await handleInviteMember(service, (args ?? {}));
-                case 'kick_member':
-                    return await handleKickMember(service, (args ?? {}));
-                case 'leave_group':
-                    return await handleLeaveGroup(service, (args ?? {}));
-                case 'create_group':
-                    return await handleCreateGroup(service, (args ?? {}));
-                case 'react_message':
-                    return await handleReactMessage(service, (args ?? {}));
-                case 'cancel_reaction':
-                    return await handleCancelReaction(service, (args ?? {}));
-                case 'unsend_message':
-                    return await handleUnsendMessage(service, (args ?? {}));
-                case 'add_friend':
-                    return await handleAddFriend(service, (args ?? {}));
-                case 'block_contact':
-                    return await handleBlockContact(service, (args ?? {}));
-                case 'unblock_contact':
-                    return await handleUnblockContact(service, (args ?? {}));
-                case 'accept_invitation':
-                    return await handleAcceptInvitation(service, (args ?? {}));
-                case 'collect_messages':
-                    return await handleCollectMessages(service, (args ?? {}));
-                case 'search_messages':
-                    return await handleSearchMessages(service, (args ?? {}));
-                case 'exclude_chats':
-                    return await handleExcludeChats((args ?? {}));
-                case 'include_chats':
-                    return await handleIncludeChats((args ?? {}));
-                case 'list_excluded_chats':
-                    return await handleListExcludedChats(service);
-                case 'get_scope_policy':
-                    return await handleGetScopePolicy(service);
-                default:
-                    return toolError(`Unknown tool: ${name}`);
+            try {
+                switch (name) {
+                    case 'login':
+                        // `era` selects HOW the login talks to the human: the legacy era
+                        // can push `elicitation/create`, the modern one answers with
+                        // multi-round-trip `input_required` results the client fulfils
+                        // and retries (`ctx.mcpReq.inputResponses` carries the answers).
+                        return await handleLogin(server, service, (args ?? {}), {
+                            era,
+                            capabilities: clientCapabilitiesOf(server, ctx),
+                            inputResponses: ctx.mcpReq.inputResponses,
+                        });
+                    case 'login_complete':
+                        return await handleLoginComplete();
+                    case 'list_conversations':
+                        return await handleListConversations(service, (args ?? {}));
+                    case 'get_chat_messages':
+                        return await handleGetChatMessages(service, (args ?? {}));
+                    case 'get_message_image':
+                        return await handleGetMessageImage(service, (args ?? {}));
+                    case 'get_message_media':
+                        return await handleGetMessageMedia(service, (args ?? {}));
+                    case 'get_unread_digest':
+                        return await handleGetUnreadDigest(service, (args ?? {}));
+                    case 'get_insight':
+                        return await handleGetInsight(service, (args ?? {}));
+                    case 'mark_read':
+                        return await handleMarkRead(service, (args ?? {}));
+                    case 'send_message':
+                        return await handleSendMessage(service, (args ?? {}));
+                    case 'send_image':
+                        return await handleSendImage(service, (args ?? {}));
+                    case 'send_file':
+                        return await handleSendFile(service, (args ?? {}));
+                    case 'send_audio':
+                        return await handleSendAudio(service, (args ?? {}));
+                    case 'send_video':
+                        return await handleSendVideo(service, (args ?? {}));
+                    case 'send_location':
+                        return await handleSendLocation(service, (args ?? {}));
+                    case 'send_contact':
+                        return await handleSendContact(service, (args ?? {}));
+                    case 'send_sticker':
+                        return await handleSendSticker(service, (args ?? {}));
+                    case 'list_stickers':
+                        return await handleListStickers(service, (args ?? {}));
+                    case 'search_stickers':
+                        return await handleSearchStickers(service, (args ?? {}));
+                    case 'preview_sticker':
+                        return await handlePreviewSticker(service, (args ?? {}));
+                    case 'find_contact':
+                        return await handleFindContact(service, (args ?? {}));
+                    case 'list_contacts':
+                        return await handleListContacts(service);
+                    case 'get_group_members':
+                        return await handleGetGroupMembers(service, (args ?? {}));
+                    case 'rename_group':
+                        return await handleRenameGroup(service, (args ?? {}));
+                    case 'invite_member':
+                        return await handleInviteMember(service, (args ?? {}));
+                    case 'kick_member':
+                        return await handleKickMember(service, (args ?? {}));
+                    case 'leave_group':
+                        return await handleLeaveGroup(service, (args ?? {}));
+                    case 'create_group':
+                        return await handleCreateGroup(service, (args ?? {}));
+                    case 'react_message':
+                        return await handleReactMessage(service, (args ?? {}));
+                    case 'cancel_reaction':
+                        return await handleCancelReaction(service, (args ?? {}));
+                    case 'unsend_message':
+                        return await handleUnsendMessage(service, (args ?? {}));
+                    case 'add_friend':
+                        return await handleAddFriend(service, (args ?? {}));
+                    case 'block_contact':
+                        return await handleBlockContact(service, (args ?? {}));
+                    case 'unblock_contact':
+                        return await handleUnblockContact(service, (args ?? {}));
+                    case 'accept_invitation':
+                        return await handleAcceptInvitation(service, (args ?? {}));
+                    case 'collect_messages':
+                        return await handleCollectMessages(service, (args ?? {}));
+                    case 'search_messages':
+                        return await handleSearchMessages(service, (args ?? {}));
+                    case 'exclude_chats':
+                        return await handleExcludeChats((args ?? {}));
+                    case 'include_chats':
+                        return await handleIncludeChats((args ?? {}));
+                    case 'list_excluded_chats':
+                        return await handleListExcludedChats(service);
+                    case 'get_scope_policy':
+                        return await handleGetScopePolicy(service);
+                    default:
+                        return toolError(`Unknown tool: ${name}`);
+                }
             }
-        }
-        catch (error) {
-            const message = error?.message ?? String(error);
-            // A mid-session LINE token invalidation (e.g. V3_TOKEN_CLIENT_LOGGED_OUT
-            // after a competing login) is not a tool bug — flag the service so
-            // subsequent calls short-circuit at the gate above, and translate the
-            // raw protocol error into an actionable re-login message.
-            if (isLineAuthInvalidatedError(error)) {
-                service.loginRequired = true;
-                service.loginReason = 'revoked';
-                log.warn('tool.session_revoked', { error: message, tool: name });
-                return sessionRevokedError(message);
+            catch (error) {
+                const message = error?.message ?? String(error);
+                // A mid-session LINE token invalidation (e.g. V3_TOKEN_CLIENT_LOGGED_OUT
+                // after a competing login) is not a tool bug — flag the service so
+                // subsequent calls short-circuit at the gate above, and translate the
+                // raw protocol error into an actionable re-login message.
+                if (isLineAuthInvalidatedError(error)) {
+                    service.loginRequired = true;
+                    service.loginReason = 'revoked';
+                    log.warn('tool.session_revoked', { error: message, tool: name });
+                    return sessionRevokedError(message);
+                }
+                log.error('tool.failed', { error: message, tool: name });
+                return toolError(message);
             }
-            log.error('tool.failed', { error: message, tool: name });
-            return toolError(message);
-        }
+        });
+        return server;
+    };
+    serveStdio(buildServer, {
+        legacy: 'serve',
+        onerror: (error) => log.error('server.protocol_error', { error: error.message }),
     });
-    const transport = new StdioServerTransport();
-    await server.connect(transport);
     log.info('server.started', { tools: TOOLS.length });
 }
 main().catch((error) => {

package/dist/mcp/tools.js

@@ -1,18 +1,7 @@
-/**
- * Yomi MCP tool schemas — the full TOOLS list served by ListToolsRequest
- * and dispatched by CallToolRequest in server.ts.
- *
- * Split out from server.ts purely to keep server.ts (the wiring/dispatch
- * file) under the project's 200-scc-line cap; behavior owned here is
- * unchanged from what previously lived inline in server.ts.
- *
- * Descriptions are deliberately terse: the tool list renders at prompt
- * position 0 on every request, so trimming boilerplate here directly lowers
- * the fixed per-request token cost every connected client pays.
- */
+import { PRIMARY_DEVICE_SETTING_PATH } from './handlers/login-copy.js';
 export const TOOLS = [
     {
-        description: 'Log in to LINE via the passwordless secondary-device flow. Requires 允許自其他裝置登入 enabled on the primary phone. On MCP clients with elicitation, this call prompts for phone/region and PIN and completes login by itself. On clients without it (e.g. Claude Desktop), phone/region come from the arguments or a persisted login, and this returns as soon as LINE issues the PIN (or reports none needed) — then call login_complete IMMEDIATELY (do not wait for the human). LINE gives ~3 minutes from PIN display to confirm on the phone; login_complete blocks past that, so calling it late only wastes that window.',
+        description: `Log in to LINE via the passwordless secondary-device flow. Requires ${PRIMARY_DEVICE_SETTING_PATH} enabled on the primary phone — with it off LINE never prompts that phone and NO login can succeed, so raise this with the human up front rather than after a failure. On MCP clients with form elicitation, this call first confirms that setting, then prompts for phone/region and PIN and completes login by itself; if the human says the setting is off, it returns the enabling steps without starting a login (relay them verbatim, then call \`login\` again). On clients without it (e.g. Claude Desktop), phone/region come from the arguments or a persisted login, and this returns as soon as LINE issues the PIN (or reports none needed) — then call login_complete IMMEDIATELY (do not wait for the human). LINE gives ~3 minutes from PIN display to confirm on the phone; login_complete blocks past that, so calling it late only wastes that window.`,
         inputSchema: {
             type: 'object',
             properties: {
@@ -29,7 +18,7 @@ export const TOOLS = [
         name: 'login',
     },
     {
-        description: "Finish a passwordless login that `login` started on a client without elicitation (not needed on elicitation-capable clients). No arguments. Call immediately after `login` returns — do not wait for the human. Blocks while they enter the PIN (skipped if a stored certificate is valid) and approve the device, then returns the profile. LINE's real deadline is ~3 minutes from PIN display. Errors if no login is pending.",
+        description: "Finish a passwordless login that `login` started on a client without form elicitation (not needed on form-elicitation-capable clients). No arguments. Call immediately after `login` returns — do not wait for the human. Blocks while they enter the PIN (skipped if a stored certificate is valid) and approve the device, then returns the profile. LINE's real deadline is ~3 minutes from PIN display. Errors if no login is pending.",
         inputSchema: {
             type: 'object',
             properties: {},

package/dist/mcp/ui/resource.js

@@ -1,9 +1,9 @@
 /**
  * The single MCP Apps UI resource this server exposes: the login view.
  * Registered by ../server.ts's `resources/list` and `resources/read`
- * handlers, gated on client capability (see ./capability.ts) so a client
- * without MCP Apps support sees an empty resource list, unchanged from
- * before this feature existed.
+ * handlers. MCP 2026-07-28 requires list results to be independent of a
+ * connection, so this resource is always advertised; hosts without MCP Apps
+ * support safely ignore the MIME type and `_meta.ui`.
  *
  * The `csp` key within `_meta.ui` is deliberately omitted: the login view
  * makes no outbound connections and loads nothing external, so the host's

package/dist/mcp/ui/tools-with-ui.js

@@ -1,9 +1,8 @@
 /**
  * Attaches the MCP Apps `_meta.ui` linkage to the `login` tool definition,
- * but only for clients that negotiated MCP Apps support (see
- * ./capability.ts) — on a client without it, the tool list served must stay
- * byte-for-byte what it always was. Kept separate from ../tools.ts (a flat,
- * static schema registry) because this step is per-connection, not static.
+ * when requested by the caller. The MCP 2026-07-28 server always requests it
+ * because list results may not vary by connection; the conditional remains
+ * useful to callers that serialize the legacy plain registry directly.
  */
 import { LOGIN_UI_RESOURCE_URI } from './resource.js';
 /**