@ultimat3/mcp 25.0.0 → 25.2.0

package/CLAUDE.md

@@ -228,7 +228,8 @@ import. The CLI wires it.
 - Banned SQL functions are matched as a **prefix of a CALLED function name** — add a family, never
   a name (`pg_sleep_for` passed an exact `pg_sleep` ban); the call unit and the three named bans: README.
 - `db.query` is defended four ways: a SELECT-only role and `BEGIN READ ONLY` in `@ultimat3/db`
-  (the CLI wires them — this package must never import `db`), the parse here, and the caps here.
+  (the CLI wires them — this package never opens a `db` connection; it imports one lexer rule,
+  `endOfBlockComment`, so a nested comment ends where Postgres ends it), the parse here, the caps here.
   `limit` is a request, never a permission: `resolveQueryLimits` clamps it into a hard 1000.
 - The caps run in the **tool**, not the host. A host that forgets them answers a million rows
   into a model's context. `guards` names the layers that engaged; a layer that could not engage

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/mcp",
-  "version": "25.0.0",
+  "version": "25.2.0",
   "description": "MCP server, dev tools, and the action-to-tool projection \u2014 one authz system, two surfaces",
   "license": "MIT",
   "type": "module",
@@ -33,13 +33,14 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/action": "25.0.0",
-    "@ultimat3/core": "25.0.0",
-    "@ultimat3/entity": "25.0.0",
-    "@ultimat3/http": "25.0.0",
-    "@ultimat3/jobs": "25.0.0",
-    "@ultimat3/policy": "25.0.0",
-    "@ultimat3/query": "25.0.0",
-    "@ultimat3/schema": "25.0.0"
+    "@ultimat3/action": "25.2.0",
+    "@ultimat3/core": "25.2.0",
+    "@ultimat3/db": "25.2.0",
+    "@ultimat3/entity": "25.2.0",
+    "@ultimat3/http": "25.2.0",
+    "@ultimat3/jobs": "25.2.0",
+    "@ultimat3/policy": "25.2.0",
+    "@ultimat3/query": "25.2.0",
+    "@ultimat3/schema": "25.2.0"
   }
 }

package/src/dev-server.ts

@@ -188,7 +188,7 @@ export function devTools(host: DevHost): readonly AnyMcpTool[] {
   return [
     read(
       'routes.list',
-      'Route table: url, render mode, offline strategy, hydrate, budget.',
+      'Route table as `x routes --json` prints it: pages, then every action, query and runtime.ts route.',
       NO_ARGS,
       () => jsonResult(host.routes()),
     ),

package/src/dev-ui-interact.ts

@@ -4,10 +4,11 @@
 // navigation. Its own file for the reason `dev-ui-tools.ts` has one: that file stands near the
 // 500-line ceiling, and this tool's step schema alone is a screen. `dev-server.ts` spreads both.
 //
-// Every bound lives in the HANDLER's contract, not the schema: `validate-args.ts` enforces no
-// `maxItems`, and a step list the schema cannot bound is one the CLI refuses whole — never trims,
-// because dropping a step changes what the picture is of. The schema's job is the SHAPE of a step
-// (`anyOf` over five one-key objects); the CLI's is the count, the lengths and the policies.
+// Every bound lives in the HANDLER's contract, not the schema — a placement, no longer a limit:
+// `validate-args.ts` enforces `maxItems` now, so the count COULD move into the schema; it has not.
+// The CLI refuses an over-long step list whole — never trims, because dropping a step changes what
+// the picture is of. The schema's job is the SHAPE of a step (`anyOf` over five one-key objects);
+// the CLI's is the count, the lengths and the policies.
 
 import type {
   UiColorScheme,

package/src/dev-ui-tools.ts

@@ -230,9 +230,9 @@ export interface InspectSpecRead {
 }
 
 /**
- * The four `ui.inspect` fields, bounded HERE and not in the schema: `validate-args.ts` enforces
- * no `maxItems`, and a bound the catalog cannot state is one the handler must apply and then
- * confess to. Shared with `ui.interact`, whose `inspect` block is these same four fields.
+ * The four `ui.inspect` fields, bounded HERE and not in the schema: the handler TRIMS and confesses
+ * (`trimmed`, `droppedStyles`), where a schema `maxItems` — which `validate-args.ts` enforces —
+ * would refuse the whole call. Shared with `ui.interact`, whose `inspect` block is these four.
  */
 export function inspectSpecOf(args: ToolArgs): InspectSpecRead {
   const wanted = strings(args['selectors']);

package/src/readonly-sql.ts

@@ -6,6 +6,7 @@
 // anywhere at statement level (which also catches a data-modifying CTE — `WITH x AS
 // (INSERT ...) SELECT`, which reads like a SELECT and is not one).
 
+import { dollarTagAt, endOfBlockComment } from '@ultimat3/db';
 import { McpNotBranchDbError, McpQueryRejectedError } from './errors';
 import { calledFunctions, forbiddenFamily } from './readonly-sql-calls';
 
@@ -216,8 +217,9 @@ function notBranch(cause: string, fix: string): McpNotBranchDbError {
 /**
  * Replace string/identifier literals and comments with spaces so keyword scanning cannot be
  * fooled by `SELECT 'delete'` (a harmless literal that looks like a write) and cannot be
- * evaded by hiding a second statement behind a block comment. Only word boundaries matter
- * downstream, so collapsing each run to one space is enough.
+ * evaded by hiding a second statement behind a block comment — ended where Postgres ends it,
+ * nesting counted (`@ultimat3/db`'s `endOfBlockComment`), or a comment closed early hides one
+ * instead. Only word boundaries matter downstream, so collapsing each run to one space is enough.
  *
  * `identifiers: 'keep'` unwraps a double-quoted identifier to its content instead — the call
  * scan needs it, because `"pg_advisory_lock"(1)` calls the function the blanked form hides.
@@ -234,11 +236,13 @@ function stripLiteralsAndComments(sql: string, identifiers: 'blank' | 'keep' = '
       continue;
     }
     if (two === '/*') {
-      const end = sql.indexOf('*/', i + 2);
-      if (end === -1) {
+      // Nested, as Postgres reads it: ending at the FIRST `*/` let `/* /* */ ' */` open a literal
+      // here that swallowed the real statement after the comment.
+      const end = endOfBlockComment(sql, i);
+      if (end === null) {
         throw unterminated('a /* block comment', 'close it with */, or use -- to the end of line');
       }
-      i = end + 2;
+      i = end;
       out += ' ';
       continue;
     }
@@ -260,26 +264,21 @@ function stripLiteralsAndComments(sql: string, identifiers: 'blank' | 'keep' = '
       i = end;
       continue;
     }
-    // Glued to an identifier, `$` is part of the NAME (`a$b$` is one identifier to Postgres), so
-    // it opens nothing — `@ultimat3/db`'s `dollarTagAt` makes the same check.
-    if (char === '$' && !IDENTIFIER_CHAR.test(sql[i - 1] ?? '')) {
-      // Postgres's own tag grammar: an identifier that does not start with a digit — letters,
-      // `_`, digits after the first, and any non-ASCII character. `[a-z_]*` read `$a1$` as text,
-      // and the `'` it then saw hid a `pg_sleep` Postgres runs outside every quote.
-      const tag = DOLLAR_TAG.exec(sql.slice(i));
-      if (tag !== null) {
-        const marker = tag[0];
-        const end = sql.indexOf(marker, i + marker.length);
-        if (end === -1) {
-          throw unterminated(
-            `a ${marker} dollar-quoted body`,
-            `close it with the same tag: ${marker} … ${marker}`,
-          );
-        }
-        i = end + marker.length;
-        out += ' ';
-        continue;
+    // `@ultimat3/db`'s lexer rule, the one copy: Postgres's tag grammar (non-ASCII included, never
+    // a leading digit — `[a-z_]*` read `$a1$` as text and hid a `pg_sleep` behind the `'` after
+    // it), and a `$` that continues an identifier (`é$x$` is one name) opens nothing.
+    const marker = char === '$' ? dollarTagAt(sql, i) : null;
+    if (marker !== null) {
+      const end = sql.indexOf(marker, i + marker.length);
+      if (end === -1) {
+        throw unterminated(
+          `a ${marker} dollar-quoted body`,
+          `close it with the same tag: ${marker} … ${marker}`,
+        );
       }
+      i = end + marker.length;
+      out += ' ';
+      continue;
     }
     out += char;
     i += 1;
@@ -289,7 +288,6 @@ function stripLiteralsAndComments(sql: string, identifiers: 'blank' | 'keep' = '
 
 const IDENTIFIER_CHAR = /[A-Za-z0-9_$\u0080-\uffff]/;
 const WORD = /[a-z_\u0080-\uffff][a-z0-9_$\u0080-\uffff]*/g;
-const DOLLAR_TAG = /^\$(?:[A-Za-z_\u0080-\uffff][A-Za-z0-9_\u0080-\uffff]*)?\$/;
 
 /**
  * `U&"` opening at a token boundary — the lexer's `xuistart`, with no space inside. `menu&"m"` is

package/src/validate-args.ts

@@ -121,6 +121,15 @@ function array(schema: JsonSchema, input: unknown, path: string, issues: ArgIssu
     issues.push({ path, message: 'must be an array' });
     return input;
   }
+  // `@ultimat3/schema` publishes `t.array(items, { min, max })` as these two; a bound on the wire
+  // that nothing here checks is an agent obeying a rule a hand-written tool never enforced.
+  const count = (n: number): string => `${n} item${n === 1 ? '' : 's'}`;
+  if (schema.minItems !== undefined && input.length < schema.minItems) {
+    issues.push({ path, message: `must have at least ${count(schema.minItems)}` });
+  }
+  if (schema.maxItems !== undefined && input.length > schema.maxItems) {
+    issues.push({ path, message: `must have at most ${count(schema.maxItems)}` });
+  }
   const items = schema.items;
   if (items === undefined) return input;
   return input.map((item, index) => walk(items, item, `${path}[${index}]`, issues));