@theronap/agnoclast-mcp 0.9.210 → 0.9.212

package/lib/diagnose.mjs

@@ -414,7 +414,9 @@ async function fetchCortexOnce(url, opts = {}, policy = {}) {
     sleep: sleepFn = sleep, random = Math.random, now = Date.now,
   } = policy
   const { timeoutMs: optTimeout, signal: callerSignal, ...rest } = opts
-  const baseHeaders = { ...(rest.headers ?? {}), 'x-cortex-client': CLIENT_ID }
+  // x-cortex-tool: the tool this request is for (the running one, else the path map) — the server
+  // counts calls per tool for staff usage stats (api_requests). A name only; arguments never travel.
+  const baseHeaders = { ...(rest.headers ?? {}), 'x-cortex-client': CLIENT_ID, 'x-cortex-tool': toolForUrl(url) }
   const fetchOpts = SESSION_KEY
     ? { ...rest, headers: { ...baseHeaders, 'x-cortex-session-key': SESSION_KEY } }
     : { ...rest, headers: baseHeaders }

package/lib/folder_decisions.mjs

@@ -0,0 +1,80 @@
+// THE FORCED FOLDER QUESTION AND THE DECLINE LIST — pure renderers (ADR-0077, 2026-10-05).
+//
+// The server refuses to file a GitHub unit until every changed path has an answer. The refusal is only
+// useful if the judge can answer it in ONE more call, so this prints every open question with what it
+// accepts, the candidate pages (and their tiers), any earlier decision being re-asked, and a
+// ready-to-edit `folderDecisions` value. Pure so CI can execute exactly what each refusal prints.
+
+const q = (s) => `"${s}"`
+
+/** The refusal text for a 409/400/403 from intake_materialize carrying ADR-0077 questions. */
+export function renderFolderQuestions(body) {
+  const lines = []
+  const questions = Array.isArray(body?.questions) ? body.questions : []
+  const pages = Array.isArray(body?.candidatePages) ? body.candidatePages : []
+  const head = {
+    folder_decisions_required: 'Not filed yet — these paths have no page and no decision. Answer each, then call again with folderDecisions.',
+    claim_tier_unconfirmed: 'Not filed yet — that page is narrower than accessible.',
+    folder_defer_not_allowed: 'Not filed yet — only a cold judge may defer.',
+    decline_never_needs_working_session: 'Not filed yet — a cold judge may not decline "never".',
+    folder_decision_unmatched: 'Not filed yet — an answer matched no open question.',
+    folder_claim_on_mother_page: 'Not filed yet — that is the repo\'s mother page.',
+    folder_claim_not_a_project_page: 'Not filed yet — code belongs on a project page.',
+    folder_claim_page_unresolved: 'Not filed yet — that page could not be resolved.',
+  }[body?.error] ?? `Not filed yet — ${body?.error ?? 'folder decision refused'}.`
+  lines.push(head)
+  if (typeof body?.detail === 'string') lines.push(body.detail)
+  if (body?.page?.tier) lines.push(`Page: ${q(body.page.title)} (${body.page.tier}) — ref ${body.page.ref}`)
+  const open = questions.filter((x) => !x.answered)
+  if (open.length) {
+    lines.push('', `Open (${open.length}):`)
+    for (const x of open) {
+      const what = x.kind === 'file' ? `file in grab-bag \`${x.grabBag ?? '?'}\`` : `folder (${x.files?.length ?? 0} changed file${x.files?.length === 1 ? '' : 's'})`
+      lines.push(`- \`${x.identifier}\` — ${what}`)
+      if (Array.isArray(x.answerWith) && x.answerWith.length > 1) {
+        lines.push(`    may also be answered at: ${x.answerWith.slice(1).map((a) => `\`${a}\``).join(', ')}`)
+      }
+      if (x.earlier) {
+        lines.push(`    asked before: declined ${x.earlier.kind} on \`${x.earlier.identifier}\`${x.earlier.decidedBy ? ` by ${x.earlier.decidedBy}` : ''} ${String(x.earlier.decidedAt).slice(0, 10)} — "${x.earlier.reason ?? ''}". That decision has lapsed.`)
+      }
+    }
+  }
+  if (pages.length) {
+    lines.push('', 'Pages this unit is being filed onto (candidates — only if a page is ABOUT the folder):')
+    for (const p of pages) lines.push(`- ${q(p.title)} (${p.tier}) — ref ${p.ref}${p.tier !== 'accessible' ? ' — needs confirmTier: true' : ''}`)
+  }
+  if (open.length) {
+    const example = open.slice(0, 3).map((x) => (pages[0]
+      ? { identifier: x.identifier, claim: pages[0].ref }
+      : { identifier: x.identifier, decline: 'not_yet', reason: 'why it belongs to no page' }))
+    lines.push('', `Answer shape: folderDecisions: ${JSON.stringify(example)}`)
+    lines.push('No page fits? Author a small area page about the folder (`author`), then claim onto its ref. Generated/vendored/lockfiles/fixtures: decline "never".')
+    if (body?.cold) lines.push('You are a cold judge here: {identifier, defer: true} hands a question to the next session that touches it.')
+  }
+  return lines.join('\n')
+}
+
+/** intake_materialize success: what the answers did. [] when nothing was asked. */
+export function renderFolderDecisionsApplied(fd) {
+  const applied = Array.isArray(fd?.applied) ? fd.applied : []
+  if (!applied.length) return []
+  const lines = [`Folder decisions applied (${applied.length}):`]
+  for (const op of applied) {
+    if (op.action === 'claim') lines.push(`  - claimed \`${op.identifier}\` onto ${q(op.page)} (${op.tier})`)
+    else if (op.action === 'decline') lines.push(`  - declined ${op.kind} \`${op.identifier}\` — "${op.reason}"`)
+    else lines.push(`  - deferred \`${op.identifier}\` to the next session that touches it`)
+  }
+  return lines
+}
+
+/** my_routing_claims / read_page: the declines, as lines. [] when there are none (or the server is older). */
+export function renderDeclines(declines, { heading = 'Declines' } = {}) {
+  const list = Array.isArray(declines) ? declines : []
+  if (!list.length) return []
+  const lines = [`${heading} (${list.length}) — a decline covers the identifier and everything under it:`]
+  for (const d of list) {
+    const state = d.active ? (d.kind === 'never' ? 'never' : d.kind === 'not_yet' ? 'not yet' : 'snoozed') : `${d.kind}, lapsed — will be asked again`
+    lines.push(`  ${d.active ? '⊘' : '·'} \`${d.identifier}\`${d.brain ? ` · ${d.brain}` : ''} — ${state}${d.reason ? ` — "${d.reason}"` : ''}${d.decidedBy ? ` · ${d.decidedBy}` : ''}${d.cold ? ' (cold judge)' : ''} · ${String(d.decidedAt).slice(0, 10)}`)
+  }
+  return lines
+}

package/lib/identifier_routes.mjs

@@ -10,6 +10,8 @@
 //
 // Pure so CI can execute what each state prints.
 
+import { renderDeclines } from './folder_decisions.mjs'
+
 const q = (s) => `"${s}"`
 const pageLabel = (h) => `${q(h.title)} (${h.kind}, ${h.tier})`
 
@@ -56,6 +58,8 @@ export function renderIdentifierResolution(out, { expand = false } = {}) {
   if (mentions.length) {
     lines.push(`Mentioned on (does not route): ${mentions.map((h) => q(h.title)).join(', ')}`)
   }
+  // ADR-0077: a decline on it or a folder above it decides whether a commit is ASKED about it.
+  lines.push(...renderDeclines(out.declines, { heading: 'Declined' }))
   const ev = out.events ?? { visibleCount: 0, recent: [] }
   lines.push(`· ${ev.visibleCount} tagged timeline event${ev.visibleCount === 1 ? '' : 's'} visible to you${ev.recent?.length ? ':' : expand ? '.' : ' — pass expand: true to list recent ones.'}`)
   for (const e of ev.recent ?? []) lines.push(`  - ${String(e.occurredAt).slice(0, 10)} · ${e.source} · ${e.summary}`)

package/lib/imessage_send.mjs

@@ -1,88 +1,78 @@
-// send_imessage — outbound iMessage via Messages.app. This is a personal automation, NOT org
-// intelligence: it writes nothing to Agnoclast. Three layers of safety (eng-review D3/D6/D10):
-//   D6  argv-safe: recipient + body are passed as osascript `on run argv` arguments, NEVER
-//       interpolated into the script source → no AppleScript injection, no quote/newline breakage.
-//   D3  draft-by-default: nothing sends unless the caller explicitly passes send:true.
-//   D10 recipient gating: an MCP send tool is reachable by any agent context (prompt-injection
-//       surface), so a boolean alone is not enough. Allowlisted recipients send on send:true;
-//       OFF-list recipients additionally require an out-of-band confirm secret the agent context
-//       doesn't have (CORTEX_IMESSAGE_SEND_CONFIRM), else the send is BLOCKED.
-import { spawn } from 'child_process'
+// send_imessage — ask to send a text from the user's own Mac, the same way request_send_email asks to
+// send an email (ADR-0076).
+//
+// WHAT CHANGED, AND WHY. This tool used to text directly: osascript → Messages.app on whatever machine
+// the MCP ran on, gated by CORTEX_IMESSAGE_SEND_ALLOWLIST and an out-of-band confirm secret. No
+// approval screen, no history, no "did it go out?", and nothing written to Agnoclast — while email had
+// all of it. Theron, 2026-10-05: "my texts are not being handled in the same way that emails are
+// handled, and that seems like a failure."
+//
+// Now it creates a request on agnoclast.com (POST /api/texts/send-requests). The request waits on
+// /email → Waiting for the user's OK, unless their send rule — the SAME rule email uses, set only on
+// the web — lets it through. Once approved, the user's Mac (the Agnoclast desktop app) sends it through
+// Messages and reports back. So:
+//   * this process never runs osascript and never sends anything itself;
+//   * the env allowlist and the confirm secret are gone — the web send rule replaced both, and an agent
+//     cannot loosen it;
+//   * without send:true it is still a draft preview, exactly as before, so existing callers that rely on
+//     draft-by-default see no change in that path.
+//
+// ⚠ THE POST IS NOT IDEMPOTENT. Never retried: a 5xx may mean the request was created.
 
-// AppleScript reads its inputs from argv — the message text is DATA, never code.
-const SEND_SCRIPT = `on run argv
-  set targetId to item 1 of argv
-  set targetMessage to item 2 of argv
-  tell application "Messages"
-    set targetService to 1st account whose service type = iMessage
-    set targetBuddy to participant targetId of targetService
-    send targetMessage to targetBuddy
-  end tell
-end run`
-
-export function phoneKey(raw) {
-  const d = String(raw).replace(/[^0-9]/g, '')
-  return d.length < 7 ? null : d.slice(-10)
-}
-function handleKey(h) {
-  return h.includes('@') ? h.trim().toLowerCase() : phoneKey(h)
-}
-export function loadSendAllowlist(raw = process.env.CORTEX_IMESSAGE_SEND_ALLOWLIST ?? '') {
-  const set = new Set()
-  for (const item of raw.split(',').map((s) => s.trim()).filter(Boolean)) {
-    set.add(item.includes('@') ? item.toLowerCase() : (phoneKey(item) ?? item))
-  }
-  return set
+/** PURE. The draft preview — unchanged in spirit from the old tool. */
+export function draftText({ recipient, message }) {
+  return `📝 DRAFT (not sent) — to ${recipient}:\n${message}\n\n(Call send_imessage again with send:true to ask the user to approve it.)`
 }
 
-// Pure decision: what should happen, given inputs + config. Testable without Messages.app.
-//   → { action: 'draft' | 'send' | 'blocked', reason }
-export function decideSend({ recipient, message, send, confirm, allowlist, confirmSecret }) {
-  if (!recipient || !String(recipient).trim()) return { action: 'blocked', reason: 'no recipient' }
-  if (!message || !String(message).trim()) return { action: 'blocked', reason: 'empty message' }
-  if (!send) return { action: 'draft', reason: 'draft-by-default — re-call with send:true to actually send' }
-  const key = handleKey(String(recipient))
-  if (key && allowlist.has(key)) return { action: 'send', reason: 'allowlisted recipient' }
-  // off-list: require the out-of-band confirm secret
-  if (confirmSecret && confirm && confirm === confirmSecret) return { action: 'send', reason: 'off-list send authorized by confirm secret' }
-  return {
-    action: 'blocked',
-    reason: confirmSecret
-      ? 'recipient not allowlisted — pass the out-of-band confirm secret to send, or add them to CORTEX_IMESSAGE_SEND_ALLOWLIST'
-      : 'recipient not allowlisted — add them to CORTEX_IMESSAGE_SEND_ALLOWLIST (or set CORTEX_IMESSAGE_SEND_CONFIRM for an out-of-band override)',
-  }
-}
-
-export function sendViaOsascript(recipient, message) {
-  return new Promise((resolve) => {
-    let err = ''
-    let proc
-    try {
-      proc = spawn('osascript', ['-', String(recipient), String(message)], { stdio: ['pipe', 'ignore', 'pipe'] })
-    } catch (e) {
-      resolve({ ok: false, error: String(e) }); return
+/**
+ * PURE. The server's answer → what the agent is told. Mirrors request_send_email's contract exactly:
+ * `reviewUrl` PRESENT means pending, and the hand-off sentence is relayed verbatim; ABSENT means the
+ * user's send rule already approved it, and there is nothing to approve.
+ *
+ * Returns { text, isError }.
+ */
+export function textRequestReply(status, body, recipient) {
+  const msg = typeof body?.error === 'string' ? body.error : null
+  if (status === 201 || (status >= 200 && status < 300)) {
+    const reviewUrl = body?.reviewUrl
+    if (reviewUrl) {
+      return { isError: false, text:
+        `Text request created to ${recipient}. It is NOT sent yet. ` +
+        `Tell the user, in these words: It's waiting for your OK: ${reviewUrl}` }
     }
-    proc.stderr.on('data', (d) => { err += d })
-    proc.on('error', (e) => resolve({ ok: false, error: String(e) }))
-    proc.on('close', (code) => resolve({ ok: code === 0, error: err.trim() }))
-    proc.stdin.write(SEND_SCRIPT)
-    proc.stdin.end()
-  })
+    const state = body?.request?.state ?? 'approved'
+    return { isError: false, text:
+      `Approved by the user's send rule — nothing to approve (state: ${state}). Their Mac sends it through ` +
+      `Messages the next time it checks in, usually within a minute. Do not offer an approval link, and do ` +
+      `not send it again; the user can see how it went on Email → History in Agnoclast.` }
+  }
+  if (body?.code === 'no_text_sender') {
+    return { isError: true, text: `${msg} Nothing was stored, so nothing will be sent.` }
+  }
+  if (status >= 500) {
+    return { isError: true, text:
+      `${msg ?? `Agnoclast could not finish that (${status}).`} ⚠ The request MAY have been created anyway. ` +
+      `Do NOT call send_imessage again — ask the user to check Email in Agnoclast.` }
+  }
+  return { isError: true, text: msg ?? `send_imessage failed (${status}).` }
 }
 
-// Tool entry: decide, then act. Returns MCP content text.
-export async function runSendImessage({ recipient, message, send, confirm }) {
-  const decision = decideSend({
-    recipient, message, send, confirm,
-    allowlist: loadSendAllowlist(),
-    confirmSecret: process.env.CORTEX_IMESSAGE_SEND_CONFIRM ?? null,
-  })
-  if (decision.action === 'draft') {
-    return `📝 DRAFT (not sent) — to ${recipient}:\n${message}\n\n(${decision.reason})`
-  }
-  if (decision.action === 'blocked') {
-    return `🚫 Not sent: ${decision.reason}`
+/**
+ * Tool entry. `request` is the injected POST (fetchCortex with retries off, in server.mjs), so this
+ * stays testable without a network.
+ */
+export async function runSendImessage({ recipient, message, send }, request) {
+  if (!recipient || !String(recipient).trim()) return { isError: true, text: 'Name who to text: a phone number or an iMessage email address.' }
+  if (!message || !String(message).trim()) return { isError: true, text: 'The text is empty.' }
+  if (send !== true) return { isError: false, text: draftText({ recipient, message }) }
+  let res
+  try {
+    res = await request({ to: String(recipient).trim(), text: String(message) })
+  } catch (e) {
+    return { isError: true, text:
+      `Could not confirm the text request: ${e?.message ?? e} ⚠ It may have been created anyway. ` +
+      `Do NOT call send_imessage again — ask the user to check Email in Agnoclast.` }
   }
-  const r = await sendViaOsascript(recipient, message)
-  return r.ok ? `✅ Sent to ${recipient}.` : `❌ Send failed: ${r.error || 'Messages.app returned an error (is it signed in to iMessage? is Automation permission granted?)'}`
+  const body = await res.json().catch(() => null)
+  return textRequestReply(res.status, body, recipient)
 }

package/lib/server.mjs

@@ -10,6 +10,7 @@ import { fetchCortex, classify, resolveBase, resolveEnvToken, setSessionKey, set
 import { REPORT_KINDS, REPORT_ISSUE_DESCRIPTION, fileIssue } from './report_issue.mjs'
 import { folderClaimLine } from './folder_claims.mjs'
 import { renderFolderClaimOffers, renderIdentifierResolution, renderUnroutedPathStamps } from './identifier_routes.mjs'
+import { renderDeclines, renderFolderDecisionsApplied, renderFolderQuestions } from './folder_decisions.mjs'
 import { resolveSessionKey, resolveLogSessionId } from './session_key.mjs'
 import { runSendImessage } from './imessage_send.mjs'
 import { formatGrepHits } from './grep_cli.mjs'
@@ -1225,7 +1226,8 @@ function renderNudge(payload) {
         'Atomically publish a claimed intake item into one brain — the disclosure moment (ADR-0062). Deterministic identifier homes in that brain are always attached; documentIds may add further pages. The record is born at the strictest of its source baseline, what the producer asked for, and every attached page; a source floor (iMessage, claude-code) pins it. ' +
         'Name the governing page with governingPage (one of documentIds, never a person page) — otherwise the ranking picks it. ' +
         'Pass mode "preview" first when your choice differs from the claim\'s proposal: it returns the pages, the governing page and the tier this exact call would produce, and writes nothing. Never writes private intake into search/history before this call. ' +
-        '⚠ ADR-0051: a unit does not finish until you looked for its OTHER homes. A call whose documentIds add nothing beyond the deterministic homes it gets anyway is REFUSED once — name the pages this unit is about (the design it implements, the project, the person), or go look, or say you looked with searchedForOtherHomes.',
+        '⚠ ADR-0051: a unit does not finish until you looked for its OTHER homes. A call whose documentIds add nothing beyond the deterministic homes it gets anyway is REFUSED once — name the pages this unit is about (the design it implements, the project, the person), or go look, or say you looked with searchedForOtherHomes. ' +
+        '⚠ ADR-0077: a GitHub commit or PR does not finish until every changed path has an answer. If a changed file\'s deepest folder (or, in a grab-bag folder like web/lib/engine/ or db/supabase/, the file itself) has no claim and no decline, the call is REFUSED with the open questions; answer each in folderDecisions and call again.',
       inputSchema: {
         intakeItemId: z.string().describe('intake item uuid'),
         orgId: z.string().describe('destination brain org uuid'),
@@ -1250,6 +1252,17 @@ function renderNudge(payload) {
           'looking, not a way past the question. Measured 2026-09-25: 30 records filed through this verb in one afternoon with no ' +
           'judged page on any of them.',
         ),
+        folderDecisions: z.array(z.object({
+          identifier: z.string().describe('the open question\'s identifier, or a folder above it that its answerWith lists'),
+          claim: z.string().optional().describe('page `ref:` (or document id) of a project page ABOUT this path — never the repo\'s mother page, a person or a user page'),
+          decline: z.enum(['never', 'not_yet']).optional().describe('never = generated/build output, lockfiles, fixtures, vendored code; not_yet = asked again after 10 more commits or 90 days'),
+          reason: z.string().optional().describe('required with decline: why it belongs to no page — the next session asked will read it'),
+          defer: z.boolean().optional().describe('cold judges only (a cleanup lease): hand the question to the next session that touches it'),
+          confirmTier: z.boolean().optional().describe('required to claim onto a page narrower than accessible — its tier will govern every future commit there'),
+        })).optional().describe(
+          'ADR-0077: one answer per open folder question from a refused call — exactly one of claim, decline or defer each. ' +
+          'Send only after the server has listed the questions; claims and declines are written when the unit is filed.',
+        ),
       },
     },
     async (args) => {
@@ -1273,10 +1286,18 @@ function renderNudge(payload) {
           attachmentMeta: (args.documentIds ?? []).map(() => ({ origin: args.origin ?? 'llm' })),
           ...(args.governingPage ? { governingDocumentId: args.governingPage } : {}),
           ...(args.searchedForOtherHomes ? { searchedForOtherHomes: true } : {}),
+          ...(args.folderDecisions?.length ? { folderDecisions: args.folderDecisions } : {}),
         }),
       })
       if (!res.ok) {
         const body = await res.text()
+        // ADR-0077: the forced folder question. Every refusal from it carries the open questions, so
+        // print them in a form the judge can answer in ONE more call.
+        {
+          let parsed = null
+          try { parsed = JSON.parse(body) } catch { /* not JSON */ }
+          if (parsed && Array.isArray(parsed.questions)) return toolError(renderFolderQuestions(parsed))
+        }
         if (res.status === 409) {
           let err = null
           try { err = JSON.parse(body)?.error } catch { /* not JSON: fall through to the raw text */ }
@@ -1346,6 +1367,7 @@ function renderNudge(payload) {
       // did not happen, which is exactly the silence this whole path exists to remove.
       // ADR-0075 — the deepest unclaimed folder this unit sits in, offered for the feature page it was
       // filed onto. Never claimed by the server; the session decides.
+      lines.push(...renderFolderDecisionsApplied(body?.folderDecisions))
       lines.push(...renderFolderClaimOffers(body?.folderClaimOffers))
       if (body?.containerSkipped) {
         lines.push(`⚠ CONTAINER NOT APPLIED — ${body.containerSkipped}. The record exists but is not inside the event you named; place it with contain_record or leave it out.`)
@@ -2427,22 +2449,27 @@ function renderNudge(payload) {
   server.registerTool(
     'snooze_routing_claim',
     {
-      title: 'Stop surfacing one unclaimed source',
+      title: 'Decline an unclaimed source or path (never / not yet), or stop surfacing it',
       description: "Silence one identifier in the `Sources nothing has claimed` block at session start. Use it when a recurring source genuinely belongs nowhere — a scratch repo, a bot channel, someone else's project that happens to cc you. NOT for something you simply have not got to yet: that is what leaving it alone does. A snooze silences the NOTICE and routes nothing; the events keep landing exactly where they land today. The block already has a volume floor that keeps one-off identifiers out, so anything you see there is recurring by construction — which is precisely why no threshold can tell 'not yet decided' from 'decided: nowhere', and why this exists. Bounded to at most a year and defaulting to 90 days, because a repo that was noise in August may be the centre of the work by November. Identity namespaces (`email:`, `thread:`) are refused: they are never surfaced as claimable in the first place, so there is nothing to snooze.",
       inputSchema: {
         identifier: z.string().describe('the identifier exactly as the context block prints it, e.g. `repo:owner/name`'),
         brain: z.string().optional().describe('which brain to stop surfacing it in. Required when you belong to more than one — the call refuses rather than picking.'),
         days: z.number().optional().describe('how long to stay quiet (1-365, default 90).'),
-        reason: z.string().optional().describe('why it belongs nowhere, in one phrase — the next person to see it resurface will want this.'),
+        reason: z.string().optional().describe('why it belongs nowhere, in one phrase — the next person to see it resurface will want this. REQUIRED with kind.'),
+        kind: z.enum(['never', 'not_yet']).optional().describe('ADR-0077: record a DECLINE instead of silencing the notice. never = generated/build output, lockfiles, fixtures, vendored code (a cold judge — a session holding cleanup leases — may not write it); not_yet = asked again after 10 more commits touch it or 90 days. A decline covers the identifier and everything under it, and claiming the identifier clears it.'),
+        remove: z.boolean().optional().describe('ADR-0077: UN-decline — delete the decline (or snooze) on this identifier, so the next commit that touches it is asked again.'),
       },
     },
-    async ({ identifier, brain, days, reason }) => {
+    async ({ identifier, brain, days, reason, kind, remove }) => {
       let res
       try {
         res = await fetchCortex(`${BASE}/api/brain/snooze-routing-claim`, {
           method: 'POST',
           headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
-          body: JSON.stringify({ identifier, ...(brain ? { brain } : {}), ...(days ? { days } : {}), ...(reason ? { reason } : {}) }),
+          body: JSON.stringify({
+            identifier, ...(brain ? { brain } : {}), ...(days ? { days } : {}), ...(reason ? { reason } : {}),
+            ...(kind ? { kind } : {}), ...(remove ? { remove: true } : {}),
+          }),
         })
       } catch (e) {
         return toolError(`Could not snooze ${identifier}: ${e.message}`)
@@ -2453,7 +2480,10 @@ function renderNudge(payload) {
         const hint = out?.hint ? `\n${out.hint}` : ''
         return toolError(`Could not snooze ${identifier}: ${out?.error ?? res.status}${extra}${hint}`)
       }
-      return { content: [{ type: 'text', text: `${out.note}\nIf it should route somewhere after all, \`set_routing_identifier\` on the owning page overrides this — a claim always beats a snooze.` }] }
+      if (kind && !out?.kind) {
+        return toolError(`This server cannot record a ${kind} decline yet (it stored a plain snooze instead). Re-run after the server updates.`)
+      }
+      return { content: [{ type: 'text', text: `${out.note}\nIf it should route somewhere after all, \`set_routing_identifier\` on the owning page overrides this — a claim always beats a decline, and clears it.` }] }
     },
   )
 
@@ -3844,7 +3874,7 @@ function renderNudge(payload) {
       if (!res.ok) return toolError(`Could not read routing claims: ${out?.error ?? res.status}${out?.hint ? `\n${out.hint}` : ''}`)
 
       const groups = Array.isArray(out?.identifiers) ? out.identifiers : []
-      if (groups.length === 0) {
+      if (groups.length === 0 && !(Array.isArray(out?.declines) && out.declines.length)) {
         return { content: [{ type: 'text', text: 'No routing claims you can see. Nothing you own decides a brain for any identifier, so inbound mail resolves by nothing and stages.' }] }
       }
       const lines = []
@@ -3858,6 +3888,9 @@ function renderNudge(payload) {
           lines.push(`    ${c.brain} · ${page}${c.mine ? '' : ' · claimed by someone else'} · ${c.source} · ${String(c.createdAt).slice(0, 10)}`)
         }
       }
+      // ADR-0077: declines beside claims.
+      const declineLines = renderDeclines(out?.declines)
+      if (declineLines.length) lines.push('', ...declineLines)
       lines.push('')
       lines.push('— Exactly one brain routes. Zero or several STAGE, and a real message carries several identifiers, so one clean sender can still stage on another key it carries.')
       lines.push('— Before adding a claim: a second brain on the same identifier converts routing into staging. Claim the NARROWEST key the message carries (a repo or package), not the account it came from.')
@@ -5869,23 +5902,32 @@ function renderNudge(payload) {
     },
   )
 
-  // send_imessage — local outbound texting (NOT org intelligence; writes nothing to Agnoclast). Runs on
-  // this machine via Messages.app. Draft-by-default + recipient allowlist + OOB confirm (D3/D6/D10).
+  // send_imessage — ask to send a text from the user's own Mac (ADR-0076). It no longer texts from this
+  // machine: it creates a request on Agnoclast that waits on /email → Waiting for the user's OK (or their
+  // web send rule approves it), and the user's Mac — the desktop app, through Messages — sends it and
+  // reports back. The same contract as request_send_email: reviewUrl PRESENT = pending, relayed verbatim.
+  //
+  // ⚠ NOT IDEMPOTENT: `idempotent: false, retries: 0`, exactly as request_send_email, so a widened
+  // fetchCortex default can never make sending a text retriable.
   server.registerTool(
     'send_imessage',
     {
-      title: 'Send an iMessage (draft-by-default)',
-      description: 'Compose/send an iMessage via the local Messages app. SAFE BY DEFAULT: without send:true it only returns a draft preview. Sending requires the recipient to be on CORTEX_IMESSAGE_SEND_ALLOWLIST (or an out-of-band confirm). Use this to text someone on the user\'s behalf — always show the draft and get the user\'s OK before sending.',
+      title: 'Ask to send a text (iMessage) from the user\'s Mac',
+      description: 'Text someone from the USER\'S OWN Mac, through Messages. Without send:true this only returns a draft preview. With send:true it creates a request that WAITS for the user to approve it in Agnoclast (Email → Waiting), unless their own send rule allows it; once approved, their Mac sends it within about a minute. The text is frozen when the request is made, so write the final wording, and show the user what you are about to send first. Returns an approval link to relay, or confirmation that their rule approved it. ⚠ NEVER call it twice with send:true for the same text — it is not idempotent.',
       inputSchema: {
-        recipient: z.string().describe('phone number (e.g. +18015551234) or iMessage email'),
-        message: z.string().describe('the message body to send'),
-        send: z.boolean().optional().describe('must be true to actually send; omit/false returns a draft preview only'),
-        confirm: z.string().optional().describe('out-of-band confirm secret, required to send to a recipient not on the allowlist'),
+        recipient: z.string().describe('one phone number (e.g. +18015551234, or (801) 555-1234 for a US number) or iMessage email address'),
+        message: z.string().describe('the text to send'),
+        send: z.boolean().optional().describe('true to ask the user to approve sending it; omit or false for a draft preview only'),
+        confirm: z.string().optional().describe('NO LONGER USED — approval happens in Agnoclast now. Ignored.'),
       },
     },
-    async ({ recipient, message, send, confirm }) => {
-      const text = await runSendImessage({ recipient, message, send, confirm })
-      return { content: [{ type: 'text', text }] }
+    async ({ recipient, message, send }) => {
+      const r = await runSendImessage({ recipient, message, send }, (body) => fetchCortex(`${BASE}/api/texts/send-requests`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+      }, { idempotent: false, retries: 0 }))
+      return r.isError ? toolError(r.text) : { content: [{ type: 'text', text: r.text }] }
     },
   )
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theronap/agnoclast-mcp",
-  "version": "0.9.210",
+  "version": "0.9.212",
   "description": "Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.",
   "type": "module",
   "bin": {