@ultimat3/mcp 19.1.3 → 19.3.1

package/CLAUDE.md

@@ -51,6 +51,13 @@ import. The CLI wires it.
   `exposureOf` to the projected tool — outcome 1's only declaration surface for a projected
   primitive. Dropping it there silently disables outcome 1 for every projected tool: nothing
   fails, every caller simply sees every tool.
+- **A thrown value is a framework error only when its `code` matches core's `FRAMEWORK_CODE`,
+  never `code.startsWith('X_')`** (`As of 2026-09`). `asFrameworkError` substitutes
+  `x errors explain ${code}` when a coded throw carries no `fix:`, so the code lands in a COMMAND
+  an agent is told to run — and a prefix test admits `X_$(id)`. A value that is not a code spelled
+  the one way takes the `-32603` branch, which leaks nothing of the throw. One pattern, core's,
+  because `@ultimat3/core`'s `client-wire.ts` already had to answer the same question for a
+  problem document off the wire.
 - Resolve order is visibility → scope → args → policy. Validating first leaks a schema;
   running the policy first decides a refusal from attacker-supplied input.
 - **A key's membership of a declared schema is `Object.hasOwn(properties, key)`, never
@@ -282,6 +289,18 @@ import. The CLI wires it.
   answered `400 parse error` for a malformed payload and `401` for a well-formed one under the
   SAME rejected token, which is precisely the oracle the pre-parse 401 exists to remove. The parse
   error still exists — it is what an authenticated agent gets.
+- **`transport-stdio.ts`'s default `write` is AWAITED, and it has to be** (`As of 2026-09`). It was
+  `Bun.stdout.write(chunk)` returning `void`, so every `await write(...)` in `serveStdio` awaited
+  nothing: fd 1 is a pipe for every real peer (a local agent LAUNCHED this process), the runtime
+  queues past the buffer, and the CLI's exit threw the queue away — measured, a 4,000,236-byte
+  frame arrived as 1,388,672 bytes. The same failure `scripts/stdout-truncation.test.ts` pins for
+  `--json`, and it needs a CHILD PROCESS to see: in-process it does not exist. Awaiting it is also
+  the loop's only back-pressure.
+- **A schema property lands through `Object.defineProperty` too** — `input-schema.ts`'s
+  `narrowProperties`, the twin of `validate-args.ts`'s `put` on the schema side. `out[key] = …` for
+  a property named `__proto__` runs `Object.prototype`'s setter and re-prototypes the published
+  `properties` record instead of adding a key, so a field the tool author declared vanishes from
+  `tools/list` and from what the arg validator reads back.
 - `transport-stdio.ts` never writes stdout except the wire. Diagnostics → stderr. It also **caps one
   message** at `DEFAULT_STDIO_LINE_LIMIT` (1 MiB, the same figure `transport-http.ts` enforces with
   `readWithinLimit`) — the peer launched this process and is trusted, a bug in it is not, and a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/mcp",
-  "version": "19.1.3",
+  "version": "19.3.1",
   "description": "MCP server, dev tools, and the action-to-tool projection \u2014 one authz system, two surfaces",
   "license": "MIT",
   "type": "module",
@@ -31,13 +31,13 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/action": "19.1.3",
-    "@ultimat3/core": "19.1.3",
-    "@ultimat3/entity": "19.1.3",
-    "@ultimat3/http": "19.1.3",
-    "@ultimat3/jobs": "19.1.3",
-    "@ultimat3/policy": "19.1.3",
-    "@ultimat3/query": "19.1.3",
-    "@ultimat3/schema": "19.1.3"
+    "@ultimat3/action": "19.3.1",
+    "@ultimat3/core": "19.3.1",
+    "@ultimat3/entity": "19.3.1",
+    "@ultimat3/http": "19.3.1",
+    "@ultimat3/jobs": "19.3.1",
+    "@ultimat3/policy": "19.3.1",
+    "@ultimat3/query": "19.3.1",
+    "@ultimat3/schema": "19.3.1"
   }
 }

package/src/input-schema.ts

@@ -49,7 +49,18 @@ function narrowProperties(
   properties: Readonly<Record<string, RichJsonSchema>>,
 ): Readonly<Record<string, JsonSchema>> {
   const out: Record<string, JsonSchema> = {};
-  for (const [key, child] of Object.entries(properties)) out[key] = narrow(child);
+  for (const [key, child] of Object.entries(properties)) {
+    // `out[key] = …` is not an assignment for exactly one name — `__proto__` runs
+    // `Object.prototype`'s setter and RE-PROTOTYPES this record instead of adding a key, so a
+    // field an author declared disappears from `tools/list` and from what `validate-args.ts`
+    // reads back. The twin of `validate-args.ts`'s `put`, on the schema side.
+    Object.defineProperty(out, key, {
+      value: narrow(child),
+      writable: true,
+      enumerable: true,
+      configurable: true,
+    });
+  }
   return out;
 }
 

package/src/server.ts

@@ -3,7 +3,7 @@
 // and an already-resolved caller, and returns a response or `null` for a notification.
 // Both transports (http, stdio) and every test drive this one function.
 
-import { singleLine, stringField } from '@ultimat3/core';
+import { FRAMEWORK_CODE, singleLine, stringField } from '@ultimat3/core';
 import { formatIssues } from '@ultimat3/schema';
 import { auditResourceRead, auditToolCall, outcomeForCode, outcomeForResult } from './audit';
 import { McpScopeDeniedError } from './errors';
@@ -322,7 +322,11 @@ function asFrameworkError(error: unknown): FrameworkError | undefined {
   // raises here leaves the JSON-RPC request with no response at all — not even the `-32603` the
   // header promises for a genuine bug.
   const code = stringField(error, 'code');
-  if (code === undefined || !code.startsWith('X_')) return undefined;
+  // `FRAMEWORK_CODE`, never `startsWith('X_')`: the substituted `fix:` below interpolates this
+  // value into a COMMAND an agent is told to run, and `X_$(id)` passes a prefix test. A code is
+  // `X_SCREAMING_SNAKE` and nothing else, so a value that is not one is not a framework error —
+  // it takes the `-32603` branch, which leaks nothing of the throw.
+  if (code === undefined || !FRAMEWORK_CODE.test(code)) return undefined;
   return {
     code,
     title: stringField(error, 'title') ?? '',

package/src/transport-stdio.ts

@@ -128,6 +128,13 @@ async function handleLine(
   await write(`${JSON.stringify(response)}\n`);
 }
 
-function defaultWrite(chunk: string): void {
-  Bun.stdout.write(chunk);
+/**
+ * `Bun.stdout.write` is ASYNCHRONOUS when fd 1 is a pipe — which it always is here, because the
+ * peer LAUNCHED this process — and it answers the count it accepted, never the count it wrote.
+ * Dropping that promise made every `await write(...)` above await nothing: the CLI's exit ran with
+ * the tail still queued and the peer lost it. Measured: a 4,000,236-byte frame arrived as 1,388,672
+ * bytes. Awaiting it is also the back-pressure this loop otherwise has none of.
+ */
+async function defaultWrite(chunk: string): Promise<void> {
+  await Bun.stdout.write(chunk);
 }