@softov/ahpc 0.2.0 → 0.4.0

package/dist/src/control.js

@@ -3,12 +3,13 @@ import { spawn } from 'node:child_process';
 import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { confirm } from '@textui/widgets';
-import { findBlocks, toBlocks } from './blocks.js';
+import { confirm, pick } from '@textui/widgets';
+import { findBlocks, valueIcon } from '@textui/chat';
+import { toBlocks } from './blocks.js';
+import { chatMatches, linksIn, parseSessionLink, sessionOfLink } from './links.js';
 import { operate } from './ahp/operate.js';
 import { createTerminals } from './terminal.js';
 import { SessionFlag } from './ahp/types.js';
-import { valueIcon } from './view/icons.js';
 import { ARCHIVED, BOOD_FLOAT, CAN_ADD_CHAT, CAN_FORK, CAN_SIDE_CHAT, CHAT_URI, CHATS, CUSTOMIZATIONS, CURSOR, DRAFT, EXPANDED, FILTER, FIND, FINDING, FIND_AT, HAS_CHATS, HOST, HOST_ERROR, INPUT, MODEL, MODEL_CONFIG, OPEN_TERMINAL, AUTOMATIONS, AUTOMATION_ROW, CHANGES as CHANGES_AT_PATH, CHANGE_AT, CHANGE_ROW, CHANGE_SCOPES, FILES_AT, FILES_OPEN, OPEN, OPEN_FILE, PROVIDER, MARKDOWN, QUEUE, RUNNING, SCREEN, SELECTED, SETTINGS, SIDEBAR, SPLIT_AT, SPLIT_DEFAULT, TURNS, WORKSPACE, applyEvent, inputRefused, pendingInput, queue, reportHostError, sendingInput, sessions, turns, writeSessions, writeStatus, } from './state.js';
 export const CONTROLLER = serviceKey('chat.controller');
 /** The command that asks about one config key. Registered when a host offers it. */
@@ -427,6 +428,50 @@ export function createController(app, host, bindings) {
             if (next)
                 controller.openChat(next);
         },
+        async openLink(link) {
+            const parsed = parseSessionLink(link);
+            if (parsed === undefined) {
+                failed(new Error(`${link} is not an agent-host-session:// link`));
+                return false;
+            }
+            // The catalogue as held, then as the host has it now: a session the
+            // agent made a moment ago may not have reached the list yet.
+            let row = sessionOfLink(parsed, sessions(app.store));
+            if (row === undefined) {
+                await controller.refresh();
+                row = sessionOfLink(parsed, sessions(app.store));
+            }
+            if (row === undefined) {
+                failed(new Error(`No session on this host matches ${link}`));
+                return false;
+            }
+            controller.open(row.resource);
+            if (parsed.chatId === undefined)
+                return true;
+            /*
+             * The chat, once the session has said which chats it has.
+             *
+             * The list arrives with the snapshot, a moment after `open`, and a chat
+             * URI is not something to build here - the host names them. Waited for,
+             * briefly; a chat the session no longer has is the session itself,
+             * which is the reference window's answer too.
+             */
+            const wanted = parsed.chatId;
+            for (let i = 0; i < 40; i++) {
+                if (app.store.get(OPEN) !== row.resource)
+                    return true;
+                // Not before the default chat is known: `open` sets it when the
+                // detail lands, and a switch made earlier is a switch it undoes.
+                const settled = app.store.get(CHAT_URI) !== null;
+                const chat = (app.store.get(CHATS) ?? []).find((entry) => chatMatches(entry.resource, wanted));
+                if (settled && chat !== undefined) {
+                    controller.openChat(chat.resource);
+                    return true;
+                }
+                await new Promise((resolve) => { setTimeout(resolve, 50); });
+            }
+            return true;
+        },
         open(uri) {
             // Closing drops this consumer only. Unsubscribing the channel to shed a
             // duplicate is what silently kills the stream everything else reads.
@@ -805,6 +850,29 @@ connection) {
      */
     const provider = () => app.store.get(PROVIDER) ?? 'claude';
     const agent = () => known.agents.find((found) => found.provider === provider());
+    /**
+     * The keys of a session's config that are about its directory.
+     *
+     * The host's own, named in the reference client's `sessionConfigKeys.ts`:
+     * whether to work in a worktree, from which branch, and how that worktree
+     * is made. An answer to any of them is an answer about one repository.
+     */
+    const ABOUT_WHERE = ['isolation', 'branch', 'worktreeBranchPrefix', 'worktreeBranchTrack', 'worktreeCreateNewBranch', 'worktreeIncludeFiles'];
+    /**
+     * Point the next session somewhere else.
+     *
+     * What was answered about the old directory goes with it: `branch: main`
+     * chosen in one repository would be sent back to the host as the answer
+     * for the next, and the host echoes what it is told - so the composer
+     * would show a branch the new repository may not have, and start from it.
+     * The rest of the answers are about the harness, not the directory, and
+     * stay.
+     */
+    const workspace = (path) => {
+        app.store.set(WORKSPACE, path);
+        const held = app.store.get(SETTINGS) ?? {};
+        app.store.set(SETTINGS, Object.fromEntries(Object.entries(held).filter(([key]) => !ABOUT_WHERE.includes(key))));
+    };
     const listAgents = async () => {
         try {
             known.agents = await controller.agents();
@@ -1078,6 +1146,39 @@ connection) {
             slots: ['palette'],
             run: () => { app.screens.reset('new'); app.focus.focus('chat.composer'); },
         },
+        {
+            /*
+             * A link in the transcript, followed.
+             *
+             * The reference host's session tools answer with an
+             * `agent-host-session://` link, and its window makes one a click. A
+             * terminal has no click, so the links in the open transcript are the
+             * choices, and one chosen opens the session or the chat it names. One
+             * typed is followed the same way, which is how a link from somewhere
+             * else gets opened.
+             */
+            id: 'chat.openLink',
+            title: 'Open a session link',
+            category: 'Session',
+            description: 'Follow an agent-host-session:// link in this transcript',
+            slots: ['palette'],
+            when: `${OPEN}`,
+            args: [{
+                    name: 'link',
+                    type: 'string',
+                    required: true,
+                    description: 'The link to follow',
+                    choices: () => linksIn(app.store.get(TURNS) ?? []).map((found) => ({
+                        value: found.link,
+                        label: found.link.replace(/^agent-host-session:\/\//, ''),
+                        ...(found.context ? { description: found.context } : {}),
+                    })),
+                }],
+            run: (args) => {
+                void controller.openLink(String(args.link ?? '')).then((opened) => { if (opened)
+                    app.screens.push('chat'); });
+            },
+        },
         {
             id: 'go.changes',
             title: 'What this session changed',
@@ -1610,7 +1711,7 @@ connection) {
             id: 'terminal.new',
             title: 'Open a terminal',
             category: 'Terminal',
-            description: 'Start a shell on the host, in a directory it serves',
+            description: 'Start a shell on the host, in the workspace directory',
             slots: ['palette'],
             run: () => {
                 const where = app.store.get(WORKSPACE);
@@ -1684,13 +1785,41 @@ connection) {
             id: 'compose.workspace',
             title: 'Workspace',
             category: 'Compose',
-            description: 'Select the workspace',
+            description: 'Choose the directory the session works in, from the host\'s own',
+            slots: ['palette'],
+            when: `!${OPEN}`,
+            /*
+             * Picked by looking, the way the reference client picks a folder: it
+             * lists the host's directories over `resourceList`, and so does this,
+             * through the `file:` provider `registerChat` mounts. The dialog is
+             * textui's, which walks the resource registry and never the disk this
+             * client is on - a path typed blind was the only way before, and it
+             * had to be a path on a machine you could not see.
+             *
+             * Started where the chip already points, when the host will list it;
+             * a directory off the catalogue otherwise, which is somewhere on the
+             * host's machine that is known to exist.
+             */
+            run: async () => {
+                const held = app.store.get(WORKSPACE) ?? '';
+                const at = `file://${held}`;
+                const served = sessions(app.store).flatMap((one) => one.workingDirectories)[0];
+                const listable = held !== '' && await controller.files(at).then(() => true, () => false);
+                const start = listable ? at : served ?? at;
+                const picked = await pick(app, { start, wants: 'directory', title: 'Workspace', placeholder: 'Filter this directory…' });
+                if (picked !== null)
+                    workspace(decodeURIComponent(picked.replace(/^file:\/\//, '')));
+            },
+        },
+        {
+            id: 'compose.workspace.path',
+            title: 'Workspace path',
+            category: 'Compose',
+            description: 'Type the directory the session works in',
             slots: ['palette'],
             when: `!${OPEN}`,
-            // No `choices`, so the palette asks for it as text - the same overlay,
-            // with its field as the answer rather than as a filter. Give it a
-            // `choices` function later and the same chip becomes a list of
-            // workspaces without anything else changing.
+            // For a host that lists nothing - one without the `resource*` family -
+            // and for a path already known, which is quicker typed than walked to.
             args: [{
                     name: 'path',
                     type: 'string',
@@ -1700,7 +1829,7 @@ connection) {
             run: (args) => {
                 const path = String(args.path ?? '').trim();
                 if (path)
-                    app.store.set(WORKSPACE, path);
+                    workspace(path);
             },
         },
         {
@@ -2195,6 +2324,7 @@ function shipped() {
         // out of it is escape - the pair that makes every other letter reachable.
         { keys: 'c', commandId: 'go.changes', scopeId: CHAT_SCOPE },
         { keys: 'f', commandId: 'go.files', scopeId: CHAT_SCOPE },
+        { keys: 'l', commandId: 'chat.openLink', scopeId: CHAT_SCOPE },
         /*
          * On the changes screen, and nowhere else.
          *

package/dist/src/flags.js

@@ -27,7 +27,7 @@ export const COMMANDS = new Set([
     'agents', 'models', 'commands', 'customizations', 'completions', 'changes', 'content',
     'prompt', 'exec', 'cancel', 'queue', 'unqueue',
     'watch', 'confirm', 'answer', 'dispatch',
-    'mcp', 'serve',
+    'mcp', 'serve', 'wire',
 ]);
 /**
  * Every flag that takes no value, in either front end.
@@ -41,6 +41,9 @@ export const COMMANDS = new Set([
 export const SWITCHES = new Set([
     // The screen's own.
     '--static', '-s', '--settled', '--approve', '--answer', '--bood', '--help', '-h',
+    // Answered by the entry point before either front end is loaded, and here
+    // so that neither swallows the word after it.
+    '--version', '-v',
     // Shape and scope, on both sides.
     '--json', '--full', '--all', '--archived', '--unread', '--undo',
     '--off', '--deny', '--reject', '--claude', '--chat',

package/dist/src/links.d.ts

@@ -0,0 +1,54 @@
+/**
+ * `agent-host-session://` links, which are how one session names another.
+ *
+ * The reference host's session tools answer with one - `create_session`,
+ * `list_sessions` and `send_message` each put an `openLink` in their result -
+ * and its window turns the link into a click that opens the session or the
+ * chat. A terminal has no click, so here the same link is something to pick:
+ * the links in the open transcript are offered as a list, and one chosen
+ * opens what it names. The shape is the reference host's
+ * (`common/openSessionLink.ts`): `agent-host-session://<provider>/<id>`, with
+ * `?chat=<chatId>` for one chat of it and `&turn=<turnId>` for one turn.
+ */
+import type { SessionSummary, Turn } from './ahp/types.js';
+export interface SessionLink {
+    provider: string;
+    id: string;
+    chatId?: string;
+    turnId?: string;
+}
+/** The link read, or undefined for text that is not one. */
+export declare function parseSessionLink(text: string): SessionLink | undefined;
+/** The id inside a session URI, whatever scheme it is under: `ahp-session:/x` and `claude:/x` are both `x`. */
+export declare const idOf: (uri: string) => string;
+/**
+ * The row a link names.
+ *
+ * Matched on the id and the provider, whichever scheme the row is under: a
+ * session this client started is `ahp-session:/` and one read off the host's
+ * catalogue is `<provider>:/`, and the link says neither.
+ */
+export declare const sessionOfLink: (link: SessionLink, rows: SessionSummary[]) => SessionSummary | undefined;
+/** One link found in a transcript, and where. */
+export interface FoundLink {
+    link: string;
+    /** What was around it, for the row that offers it. */
+    context: string;
+    turnId: string;
+}
+/**
+ * Every link in the transcript, once each, in the order they appear.
+ *
+ * Read from what a person can see: the prose, the tool calls' outcomes and
+ * outputs, and the host's notices. A tool answering `create_session` puts the
+ * link in its output, which is where somebody reading the transcript finds it.
+ */
+export declare function linksIn(turns: Turn[]): FoundLink[];
+/**
+ * Whether a chat URI is the chat a link names.
+ *
+ * The id is the URI's authority where it has one - `ahp-chat://<chatId>/<session>`,
+ * which is how the reference host and ahpd spell a chat - and the path
+ * otherwise, `ahp-chat:/<id>`, which is the protocol's own shape.
+ */
+export declare const chatMatches: (chatUri: string, chatId: string) => boolean;

package/dist/src/links.js

@@ -0,0 +1,120 @@
+/**
+ * `agent-host-session://` links, which are how one session names another.
+ *
+ * The reference host's session tools answer with one - `create_session`,
+ * `list_sessions` and `send_message` each put an `openLink` in their result -
+ * and its window turns the link into a click that opens the session or the
+ * chat. A terminal has no click, so here the same link is something to pick:
+ * the links in the open transcript are offered as a list, and one chosen
+ * opens what it names. The shape is the reference host's
+ * (`common/openSessionLink.ts`): `agent-host-session://<provider>/<id>`, with
+ * `?chat=<chatId>` for one chat of it and `&turn=<turnId>` for one turn.
+ */
+const LINK = /^agent-host-session:\/\/([^/?#]+)\/([^?#]+)(?:\?([^#]*))?(?:#.*)?$/i;
+/** A link wherever it sits in prose: up to the whitespace or the bracket that ends it. */
+const IN_TEXT = /agent-host-session:\/\/[^\s<>()\[\]"'`]+/gi;
+const param = (query, name) => {
+    const found = new RegExp(`(?:^|&)${name}=([^&]*)`).exec(query)?.[1];
+    if (found === undefined)
+        return undefined;
+    try {
+        return decodeURIComponent(found);
+    }
+    catch {
+        return found;
+    }
+};
+/** The link read, or undefined for text that is not one. */
+export function parseSessionLink(text) {
+    const found = LINK.exec(text.trim());
+    if (found === null)
+        return undefined;
+    let id;
+    try {
+        id = decodeURIComponent(found[2] ?? '');
+    }
+    catch {
+        id = found[2] ?? '';
+    }
+    if (id === '')
+        return undefined;
+    const query = found[3] ?? '';
+    const chatId = param(query, 'chat');
+    const turnId = param(query, 'turn');
+    return {
+        provider: found[1] ?? '',
+        id,
+        // The default chat is the session itself, which is how the reference
+        // host builds the link: it leaves the query off for it.
+        ...(chatId !== undefined && chatId !== '' && chatId !== 'default' ? { chatId } : {}),
+        ...(turnId !== undefined && turnId !== '' ? { turnId } : {}),
+    };
+}
+/** The id inside a session URI, whatever scheme it is under: `ahp-session:/x` and `claude:/x` are both `x`. */
+export const idOf = (uri) => {
+    const colon = uri.indexOf(':');
+    return (colon < 0 ? uri : uri.slice(colon + 1)).replace(/^\/+/, '');
+};
+/**
+ * The row a link names.
+ *
+ * Matched on the id and the provider, whichever scheme the row is under: a
+ * session this client started is `ahp-session:/` and one read off the host's
+ * catalogue is `<provider>:/`, and the link says neither.
+ */
+export const sessionOfLink = (link, rows) => rows.find((row) => idOf(row.resource) === link.id && row.provider === link.provider)
+    ?? rows.find((row) => idOf(row.resource) === link.id);
+/**
+ * Every link in the transcript, once each, in the order they appear.
+ *
+ * Read from what a person can see: the prose, the tool calls' outcomes and
+ * outputs, and the host's notices. A tool answering `create_session` puts the
+ * link in its output, which is where somebody reading the transcript finds it.
+ */
+export function linksIn(turns) {
+    const found = [];
+    const seen = new Set();
+    const take = (text, turnId) => {
+        if (!text)
+            return;
+        for (const match of text.matchAll(IN_TEXT)) {
+            const link = match[0].replace(/[.,;:!?]+$/, '');
+            if (seen.has(link) || parseSessionLink(link) === undefined)
+                continue;
+            seen.add(link);
+            const from = Math.max(0, (match.index ?? 0) - 40);
+            const context = text.slice(from, match.index ?? 0).replace(/\s+/g, ' ').trim();
+            found.push({ link, context, turnId });
+        }
+    };
+    for (const turn of turns) {
+        take(turn.message, turn.id);
+        for (const part of turn.parts) {
+            if (part.kind === 'markdown' || part.kind === 'systemNotification')
+                take(part.content, turn.id);
+            else if (part.kind === 'toolCall') {
+                take(part.call.outcome, turn.id);
+                take(part.call.output, turn.id);
+            }
+        }
+    }
+    return found;
+}
+/**
+ * Whether a chat URI is the chat a link names.
+ *
+ * The id is the URI's authority where it has one - `ahp-chat://<chatId>/<session>`,
+ * which is how the reference host and ahpd spell a chat - and the path
+ * otherwise, `ahp-chat:/<id>`, which is the protocol's own shape.
+ */
+export const chatMatches = (chatUri, chatId) => {
+    const found = /^[^:]+:\/\/([^/]+)\//.exec(chatUri)?.[1] ?? idOf(chatUri);
+    if (found === '')
+        return false;
+    try {
+        return decodeURIComponent(found) === chatId;
+    }
+    catch {
+        return found === chatId;
+    }
+};

package/dist/src/main.js

@@ -12,8 +12,20 @@
 // does not load a front end, which is the reason they were copied here.
 import { commandIn } from './flags.js';
 const argv = process.argv.slice(2);
-const first = commandIn(argv);
-if (first !== undefined) {
+/*
+ * Answered before anything is loaded.
+ *
+ * `--version` with no command would otherwise open the screen, which is a
+ * question answered by a whole renderer starting up and then being read off a
+ * status bar. Neither front end is imported to answer it.
+ */
+const asked = argv.includes('--version') || argv.includes('-v');
+const first = asked ? undefined : commandIn(argv);
+if (asked) {
+    const { version } = await import('./version.js');
+    process.stdout.write(`${version()}\n`);
+}
+else if (first !== undefined) {
     /*
      * A closed pipe is not an error.
      *

package/dist/src/mcp/http.d.ts

@@ -12,6 +12,16 @@ export interface ServeOptions {
      * token is what makes binding anywhere else defensible.
      */
     token?: string;
+    /**
+     * Browser origins allowed to reach this, beyond its own.
+     *
+     * Empty is the safe default and the usual answer: a shell script, a webhook
+     * and an MCP client send no `Origin` at all, so nothing legitimate is turned
+     * away by allowing none. This is for a page somebody serves themselves.
+     */
+    origins?: readonly string[];
+    /** The opt-in tool groups to serve, beyond the core table. */
+    groups?: readonly string[];
     onProblem?(said: string): void;
 }
 /** What this is listening on, and how to stop it. */

package/dist/src/mcp/http.js

@@ -12,7 +12,7 @@
  * client that launched it, this is shared and outlives any of them.
  */
 import { createServer } from 'node:http';
-import { answer, call, listing } from './serve.js';
+import { SPOKEN, answer, call, listing } from './serve.js';
 /** How much of a request body is read before it is refused, in bytes. */
 const LIMIT = 1_000_000;
 const body = async (request) => {
@@ -24,6 +24,39 @@ const body = async (request) => {
     }
     return read;
 };
+/**
+ * Answer a request with a stream rather than one object.
+ *
+ * The transport allows either, and this is the branch that lets anything be
+ * said before the result: notifications go out as they happen and the response
+ * is the last event, after which the stream closes. Only opened where the
+ * caller asked for progress, because a stream is worse for everybody else -
+ * more to parse, and a connection held open for a request that answers at once.
+ */
+const stream = (response) => {
+    response.writeHead(200, {
+        'content-type': 'text/event-stream',
+        'cache-control': 'no-cache, no-transform',
+        connection: 'keep-alive',
+    });
+    const event = (value) => { response.write(`data: ${JSON.stringify(value)}\n\n`); };
+    return {
+        event,
+        end: (value) => { event(value); response.end(); },
+    };
+};
+/**
+ * Whether this request asked to be told what is happening while it waits.
+ *
+ * A `progressToken` in `_meta`, which is the only way a caller asks. Read here
+ * rather than inside `answer`, because the decision it drives - a stream or an
+ * object - has to be made before a single byte of the response is written.
+ */
+const wantsProgress = (message) => {
+    const params = message.params;
+    const token = params?._meta?.progressToken;
+    return typeof token === 'string' || typeof token === 'number';
+};
 const send = (response, code, value) => {
     const text = JSON.stringify(value);
     response.writeHead(code, {
@@ -44,6 +77,52 @@ const allowed = (request, token) => {
     const said = request.headers.authorization;
     return typeof said === 'string' && said.trim() === `Bearer ${token}`;
 };
+/**
+ * Whether a browser may talk to this.
+ *
+ * The transport says a server **MUST** validate `Origin` to stop DNS
+ * rebinding, and the reason it says so is that binding to loopback is not the
+ * protection it looks like: a page on any website can POST to
+ * `http://127.0.0.1:7431` from inside the browser of the person running this,
+ * and the request arrives from their own machine looking exactly like theirs.
+ * Without this, opening a tab would be enough to drive every session on the
+ * host.
+ *
+ * No header at all is allowed. A browser always sends one on a request like
+ * these; a program does not, and refusing those would refuse every real
+ * caller to guard against a thing that cannot happen.
+ */
+const sameOrigin = (request, url, extra) => {
+    const said = request.headers.origin;
+    if (typeof said !== 'string' || said === '')
+        return true;
+    if (extra.includes(said))
+        return true;
+    try {
+        const from = new URL(said);
+        // The host and port this request came in on, whatever name was used to
+        // reach it - `localhost` and `127.0.0.1` are the same server and a person
+        // typing either should not be told no.
+        return from.host === url.host;
+    }
+    catch {
+        return false;
+    }
+};
+/**
+ * Whether this can speak the version the client says it is using.
+ *
+ * The transport says an invalid or unsupported `MCP-Protocol-Version` **MUST**
+ * be a 400. Absent is not unsupported: the same paragraph says to assume
+ * `2025-03-26` where there is no header, which is a client from before it
+ * existed.
+ */
+const speakable = (request) => {
+    const said = request.headers['mcp-protocol-version'];
+    if (said === undefined)
+        return true;
+    return typeof said === 'string' && SPOKEN.includes(said);
+};
 /** Start listening. Answers once the socket is up. */
 export async function serve(host, options) {
     const server = createServer((request, response) => {
@@ -51,6 +130,18 @@ export async function serve(host, options) {
             try {
                 const url = new URL(request.url ?? '/', `http://${request.headers.host ?? 'localhost'}`);
                 const path = url.pathname.replace(/\/+$/, '') || '/';
+                if (!sameOrigin(request, url, options.origins ?? [])) {
+                    // 403 rather than 401: a token would not make this request
+                    // acceptable, so inviting one would be the wrong thing to say.
+                    send(response, 403, { error: `This server does not serve requests from ${String(request.headers.origin)}.` });
+                    return;
+                }
+                if (!speakable(request)) {
+                    send(response, 400, {
+                        error: `This server does not speak MCP ${String(request.headers['mcp-protocol-version'])}. It speaks ${SPOKEN.join(', ')}.`,
+                    });
+                    return;
+                }
                 if (!allowed(request, options.token)) {
                     send(response, 401, { error: 'This server needs a bearer token.' });
                     return;
@@ -59,7 +150,7 @@ export async function serve(host, options) {
                 // what to call. Every tool with its schema, which is also what an MCP
                 // client gets from `tools/list`.
                 if (request.method === 'GET' && (path === '/api' || path === '/')) {
-                    send(response, 200, listing());
+                    send(response, 200, listing(options.groups));
                     return;
                 }
                 if (path === '/mcp') {
@@ -77,6 +168,22 @@ export async function serve(host, options) {
                         send(response, 400, { jsonrpc: '2.0', id: null, error: { code: -32700, message: 'That is not JSON.' } });
                         return;
                     }
+                    if (wantsProgress(message)) {
+                        const open = stream(response);
+                        const reply = await answer(host, message, {
+                            ...options,
+                            notify: (notification) => open.event({ jsonrpc: '2.0', ...notification }),
+                        });
+                        // A notification that also carried a progress token has nothing to
+                        // end the stream with, so it is closed rather than left open on a
+                        // response that is never coming.
+                        if (reply === undefined) {
+                            response.end();
+                            return;
+                        }
+                        open.end(reply);
+                        return;
+                    }
                     const reply = await answer(host, message, options);
                     // A notification is answered with 202 and no body, which is what the
                     // transport says and what a client waiting on one would hang over.
@@ -105,7 +212,7 @@ export async function serve(host, options) {
                             return;
                         }
                     }
-                    const result = await call(host, name, input);
+                    const result = await call(host, name, input, undefined, options.groups);
                     // Shaped for a program rather than for a model: the answer itself,
                     // or the refusal as an error, without MCP's content envelope around
                     // it. A caller that wants the envelope has `/mcp`.