@worca/app 1.0.0 → 1.2.0-rc.1

package/src/core/ask/git-allowlist.mjs

@@ -0,0 +1,226 @@
+// src/core/ask/git-allowlist.mjs
+// The single gate between the Ask Worca `git` tool and a spawned git argv
+// (ask-worca-worktrees-design.md §8). Pure, no imports: worktree-deps.mjs
+// spawns ONLY what this returns. Allowlist-shaped throughout — unknown
+// subcommands, creation/mutation forms and the known exec/config/write/
+// transport vectors are rejected with a hint the model can act on.
+
+// `cat-file` is DELIBERATELY absent: it is a pure raw-content read (`cat-file -p
+// HEAD:.env` / `cat-file -p <blob-sha>`) with no diff structure for the §8
+// protected-path filter to act on, and it completes the `ls-tree -> blob-sha ->
+// cat-file -p <sha>` leak that no path inspection can catch (a sha carries no
+// path). Files are read by checking out the ref and inspecting them with the
+// other read subcommands — the git tool serves diffs/logs/history, not raw dumps.
+const READ_SUBCOMMANDS = new Set([
+  'diff', 'log', 'show', 'status', 'blame', 'rev-parse', 'merge-base',
+  'grep', 'shortlog', 'describe', 'ls-files', 'ls-tree',
+]);
+const LIST_ONLY = new Set(['branch', 'tag']);
+const NAV = new Set(['checkout', 'switch']);
+
+// ANY position, exact token or `=`-form prefix. Closes config injection
+// (`-c`/`--config-env` → hooks/pager/textconv = arbitrary exec), repo
+// redirection (`--git-dir`/`--work-tree`/`-C`), exec paths (`--exec-path`/
+// `--ext-diff`/`--textconv`), file writes (`--output`/`-o`) and transport
+// command overrides (`--upload-pack`/`--receive-pack`).
+//
+// The second row are worktree-scope ESCAPES demonstrated during planning (spec
+// D3 — the model reads ONLY inside its checkout): `diff --no-index <a> <b>` and
+// `blame --contents <file>` read ARBITRARY filesystem paths and print them,
+// bypassing every §7 deny; `grep -f/--file <path>` reads a pattern file from
+// anywhere; `--filters` runs a repo-configured smudge filter (arbitrary exec —
+// cat-file is already removed from the read tier, but blocking the flag is
+// defence-in-depth); `--color`/`--color=*` injects SGR escapes that make the
+// `diff --git ` header undetectable, defeating the protected-path section filter
+// (verified: `git diff --color=always` leaked a whole `.env`). `-f`/`--file` are
+// already in BRANCH_TAG_MUTATING/NAV_BLOCKED, so promoting them here changes no
+// existing behaviour. The short `-O` form of `--open-files-in-pager` (arbitrary
+// exec) needs a PREFIX guard, not a Set entry — `key('-Ocurl…')` returns the
+// whole token, so no exact match can catch it (handled in validateGitArgs below).
+const BLOCKED_ANYWHERE = new Set([
+  '-c', '--config-env', '--exec-path', '--git-dir', '--work-tree', '-C',
+  '--ext-diff', '--textconv', '--output', '-o', '--upload-pack', '--receive-pack',
+  '--open-files-in-pager',
+  '--no-index', '--contents', '-f', '--file', '--filters', '--color',
+]);
+
+// Output-SHAPE flags. Each one was verified (code review of PR #376) to defeat
+// the protected-path filter in tools.mjs against a real repo with a committed
+// `.env`: the SECTION filter engages only on a `diff --git ` header at column 0,
+// and the LINE filter only sees a path when git prints it as its own token.
+//   --graph / --line-prefix   prefix EVERY line → no header at column 0 → the
+//                             fallback line filter kept `| +DB_PASSWORD=…` verbatim
+//   --src-prefix/--dst-prefix relabel `a/.env` as `x.env` → no pattern matches
+//   --no-prefix/--default-prefix  change the header shape the parser is pinned to
+//   --relative[=<dir>]        strips the directory a slash-anchored pattern needs
+//   --submodule[=diff]        inlines a nested repo's patch under its own headers
+//   --color-words/--color-moved(-ws)  colour switches `--color` does not spell
+// Keyed by `key()` form (exact token or `=`-prefix), like the rest of the set;
+// the value is the hint the model gets back.
+const SHAPE_BLOCKED = {
+  '--graph': 'it prefixes every output line, which defeats the protected-path filter — use --oneline without --graph',
+  '--line-prefix': 'it prefixes every output line, which defeats the protected-path filter',
+  '--src-prefix': 'it relabels file paths, which defeats the protected-path filter',
+  '--dst-prefix': 'it relabels file paths, which defeats the protected-path filter',
+  '--no-prefix': 'it changes the diff header shape the protected-path filter reads',
+  '--default-prefix': 'it changes the diff header shape the protected-path filter reads',
+  '--relative': 'it strips directories from paths, which defeats slash-anchored protected-path patterns',
+  '--submodule': 'submodule patches are not filtered here — open the submodule as its own worktree',
+  '--color-words': 'colour output defeats the protected-path filter',
+  '--color-moved': 'colour output defeats the protected-path filter',
+  '--color-moved-ws': 'colour output defeats the protected-path filter',
+};
+// `--format`/`--pretty` on the PATH-LIST subcommands can glue the object name to
+// the path (`%(objectname)%(path)`) so the line filter's token split never sees a
+// protected basename. `log --format` is commit metadata and stays allowed.
+const LIST_FORMAT_FLAGS = new Set(['--format', '--pretty']);
+const LIST_FORMAT_SUBS = new Set(['ls-tree', 'ls-files']);
+// Short options whose value may be ATTACHED on the patch/log subcommands
+// (`-Sfoo`, `-Gconfig`, `-L1,5:file`): everything after them in a cluster is data,
+// so the `-f`/`-o`/`-O` letter scan stops there. Only letters that take a value on
+// EVERY allowed subcommand belong here — a letter that is boolean somewhere would
+// let `-<letter>f` smuggle `--file` past the scan on that subcommand.
+const PATCH_VALUE_SHORTS = new Set(['S', 'G', 'L']);
+
+const BRANCH_TAG_MUTATING = new Set([
+  '-d', '-D', '--delete', '-m', '-M', '--move', '-c', '-C', '--copy', '-f', '--force',
+  '--edit-description', '--set-upstream-to', '-u', '--unset-upstream', '--create-reflog',
+  '-s', '--sign', '-F', '--file', '-e', '--edit', '-a', // tag -a creates; branch -a lists — resolved below
+]);
+const LISTY_FLAGS = new Set(['--list', '-l', '--contains', '--no-contains', '--merged', '--no-merged', '--points-at']);
+// `-c`/`-C`/`--guess` create a branch on `switch`; without them a `git switch -c
+// evil` is blocked only by git's own `--detach`+`-c` mutual-exclusion error — a
+// version-dependent accident, not the validator. Blocking them keeps D4 ("no
+// branch ever created") enforced by us, not by git's argument parser.
+const NAV_BLOCKED = new Set(['-b', '-B', '-c', '-C', '--guess', '--orphan', '--track', '-t', '-f', '--force',
+  '--ours', '--theirs', '-p', '--patch', '--pathspec-from-file', '--merge', '-m']);
+const FETCH_FLAGS = new Set(['--all', '--prune', '-p']);
+
+// `grep` is the one read subcommand whose output the §8 protected-path filter reads
+// LINE by LINE (a path list, not a patch), and it drops a line only when a delimited
+// token on that line is a protected basename. These forms take the path OFF the
+// line — `-h`/`--no-filename` and `--heading` print bare match lines, `-z`/`--null`
+// glues the path to the content with a NUL — so a protected file's CONTENTS come
+// back verbatim (verified against real git: `git grep -h <pat>` dumped a whole
+// .env). Forcing `-H` downstream is not enough: the last flag wins, and `--heading`
+// overrides `-H` outright, so they are refused here.
+const GREP_PATH_SUPPRESSING = new Set(['-h', '--no-filename', '--heading', '-z', '--null']);
+// Short options whose value may be ATTACHED (`-ehunter`, `-C3`, `-m5`): everything
+// after them inside a cluster is data, so the cluster scan stops there.
+const GREP_VALUE_SHORTS = new Set(['e', 'f', 'm', 'A', 'B', 'C', 'O']);
+
+const key = (a) => (a.includes('=') ? a.slice(0, a.indexOf('=')) : a);
+
+const pathSuppressingError = (tok, flag) =>
+  `git grep ${flag} (in ${JSON.stringify(tok)}) hides the filename from the output and is not allowed — the protected-path filter needs the path on every line`;
+
+function validateGrep(args) {
+  for (const a of args.slice(1)) {
+    if (GREP_PATH_SUPPRESSING.has(key(a))) return { ok: false, error: pathSuppressingError(a, key(a)) };
+    if (a.startsWith('--') || !a.startsWith('-')) continue;
+    for (const ch of a.slice(1)) {                       // bundles: `git grep -nh` == `-n -h`
+      if (GREP_VALUE_SHORTS.has(ch)) break;              // the rest of the token is this option's value
+      if (ch === 'h' || ch === 'z') return { ok: false, error: pathSuppressingError(a, `-${ch}`) };
+    }
+  }
+  return { ok: true, args, nav: false, fetch: false };
+}
+
+function validateListOnly(sub, args) {
+  const rest = args.slice(1);
+  for (const a of rest) {
+    const k = key(a);
+    if (k === '-a' && sub === 'branch') continue;              // branch -a = list all; tag -a = create
+    if (BRANCH_TAG_MUTATING.has(k)) return { ok: false, error: `git ${sub} ${a} mutates branches/tags and is not allowed` };
+  }
+  const positionals = rest.filter((a) => !a.startsWith('-'));
+  const listy = rest.some((a) => LISTY_FLAGS.has(key(a)));
+  if (positionals.length && !listy) {
+    return { ok: false, error: `git ${sub} with a positional name creates a ${sub}; use --list <pattern> to filter` };
+  }
+  return { ok: true, args, nav: false, fetch: false };
+}
+
+function validateNav(sub, args) {
+  const rest = args.slice(1);
+  if (rest.includes('--')) return { ok: false, error: `git ${sub} -- <paths> (file restore) is not allowed` };
+  for (const a of rest) {
+    if (NAV_BLOCKED.has(key(a))) return { ok: false, error: `git ${sub} ${a} is not allowed (worktrees stay detached, files stay pristine)` };
+  }
+  const positionals = rest.filter((a) => !a.startsWith('-'));
+  if (positionals.length !== 1) return { ok: false, error: `git ${sub} needs exactly one ref` };
+  const out = rest.includes('--detach') ? args : [sub, '--detach', ...rest];
+  return { ok: true, args: out, nav: true, fetch: false };
+}
+
+function validateFetch(args) {
+  const rest = args.slice(1);
+  for (const a of rest.filter((x) => x.startsWith('-'))) {
+    if (!FETCH_FLAGS.has(a)) return { ok: false, error: `git fetch ${a} is not allowed` };
+  }
+  const positionals = rest.filter((a) => !a.startsWith('-'));
+  if (positionals.length > 1) return { ok: false, error: 'git fetch takes at most a remote name — refspecs are not allowed (they can rewrite local branches)' };
+  if (positionals.length === 1) {
+    const p = positionals[0];
+    // Remote NAME only. Reject URLs/refspecs (`:`), path traversal (`.`/`..` or a
+    // leading `.`), and a leading `-` (option-shaped). The runtime `git remote`
+    // membership check in the tool handler is the second gate, but shape-reject here.
+    if (!/^[A-Za-z0-9._-]+$/.test(p) || p.includes(':') || p === '.' || p === '..' || /^[.-]/.test(p)) {
+      return { ok: false, error: 'git fetch accepts a configured remote NAME only, never a URL, refspec or path' };
+    }
+  }
+  return { ok: true, args, nav: false, fetch: true };
+}
+
+/**
+ * @param {unknown} rawArgs  the model-supplied argv (without the leading "git")
+ * @returns {{ok:true, args:string[], nav:boolean, fetch:boolean} | {ok:false, error:string}}
+ */
+export function validateGitArgs(rawArgs) {
+  if (!Array.isArray(rawArgs) || !rawArgs.length || !rawArgs.every((a) => typeof a === 'string')) {
+    return { ok: false, error: 'args must be a non-empty array of strings' };
+  }
+  const args = rawArgs.map((a) => a.trim()).filter((a) => a.length);
+  if (!args.length) return { ok: false, error: 'args must be a non-empty array of strings' };
+  const sub = args[0];
+  // Which short letters swallow the rest of a cluster as their VALUE depends on the
+  // subcommand: grep's `-e<pat>`/`-C<n>`…, the patch/log family's `-S<str>`/`-G<re>`/
+  // `-L<range>`. Anywhere else no letter is trusted to take a value.
+  const valueShorts = sub === 'grep' ? GREP_VALUE_SHORTS : (READ_SUBCOMMANDS.has(sub) ? PATCH_VALUE_SHORTS : new Set());
+  for (const a of args) {
+    // Cluster guard for ATTACHED short-option values, which key() cannot normalise
+    // (it strips `=value`, never `-f<value>` — git's standard attached short form):
+    // `-O<cmd>` (open-files-in-pager = arbitrary exec, `diff -O<orderfile>` = read),
+    // `-f<path>` (grep's pattern FILE = arbitrary absolute-path read OUTSIDE the
+    // worktree, breaking the D3 confinement invariant) and `-o<path>` (--output =
+    // file write). All three also hide inside a bundle — `git grep -nf/etc/passwd`
+    // is `-n -f /etc/passwd`, verified against real git — so the scan walks the
+    // cluster letter by letter and stops only at a letter known to take a value
+    // (`-Sfoo` is the pickaxe string "foo", not `-S -f oo`). The bare `-f`/`-o`/`-O`
+    // tokens were already refused by BLOCKED_ANYWHERE, so this only widens to the
+    // forms that carry a value.
+    if (/^-[A-Za-z]/.test(a)) {
+      for (const ch of a.slice(1)) {
+        if (ch === 'O' || ch === 'f' || ch === 'o') return { ok: false, error: `argument ${JSON.stringify(a)} is not allowed` };
+        if (valueShorts.has(ch)) break;                  // the rest of the token is this option's value
+        if (!/[A-Za-z]/.test(ch)) break;                 // a digit/punctuation ends the flag cluster
+      }
+    }
+    const k = key(a);
+    if (BLOCKED_ANYWHERE.has(k)) return { ok: false, error: `argument ${JSON.stringify(a)} is not allowed` };
+    if (Object.prototype.hasOwnProperty.call(SHAPE_BLOCKED, k)) {
+      return { ok: false, error: `argument ${JSON.stringify(a)} is not allowed: ${SHAPE_BLOCKED[k]}` };
+    }
+    if (LIST_FORMAT_SUBS.has(sub) && LIST_FORMAT_FLAGS.has(k)) {
+      return { ok: false, error: `git ${sub} ${k} is not allowed — a custom format can hide the path from the protected-path filter; use the default listing` };
+    }
+  }
+  if (sub === 'pull') return { ok: false, error: 'pull is not available (detached worktrees have nothing to merge into) — fetch, then diff/checkout origin/<branch>' };
+  if (sub === 'push' || sub === 'remote') return { ok: false, error: `${sub} is not available: the chat cannot publish anything — propose a pipeline instead` };
+  if (sub === 'grep') return validateGrep(args);   // read tier, but the path must stay on every line
+  if (READ_SUBCOMMANDS.has(sub)) return { ok: true, args, nav: false, fetch: false };
+  if (LIST_ONLY.has(sub)) return validateListOnly(sub, args);
+  if (NAV.has(sub)) return validateNav(sub, args);
+  if (sub === 'fetch') return validateFetch(args);
+  return { ok: false, error: `git ${sub} is not in the allowlist` };
+}

package/src/core/ask/limits.mjs

@@ -0,0 +1,57 @@
+// src/core/ask/limits.mjs
+// Fixed limits of the Ask Worca chat (ask-worca-design.md §6.9) plus the two
+// operator-configurable per-turn guards, read fresh on every turn (D12). Pure
+// apart from the settings readers, which are injectable for tests.
+import { askMaxTurns as readAskMaxTurns, askMaxBudgetUsd as readAskMaxBudgetUsd } from '../settings.mjs';
+import { TEXT_EXTENSIONS, BINARY_EXTENSIONS } from './attachment-kind.mjs';
+
+export const ASK_LIMITS = Object.freeze({
+  turnsPerThread: 1,                       // one running turn per thread (409)
+  turnsGlobal: 3,                          // running turns across all threads (429)
+  turnTimeoutMs: 30 * 60 * 1000,           // wall clock per turn (the runner has none)
+  jobGraceMs: 30_000,                      // finished job kept for WS replay
+  emptyThreadSweepMs: 24 * 60 * 60 * 1000, // empty threads older than this are swept at boot
+  attachment: Object.freeze({
+    maxFiles: 8,                           // per message
+    maxBytesPerFile: 512 * 1024,           // text kinds — they are inlined/paged into prompts
+    maxBytesPerBinaryFile: 5 * 1024 * 1024, // image/pdf kinds — read from disk, never inlined (#398)
+    maxBytesPerThread: 25 * 1024 * 1024,   // enforced ACROSS kinds (was 4 MB text-only pre-#398)
+    extensions: TEXT_EXTENSIONS,           // attachment-kind.mjs owns both tables
+    binaryExtensions: BINARY_EXTENSIONS,
+  }),
+  contextHeaderMaxChars: 1024,             // [worca context] block
+  inlineAttachmentsMaxBytes: 24 * 1024,    // inlined into the turn prompt
+  restoredMaxChars: 30_000,                // DB-replay fallback prompt
+  blockIoMaxChars: 2048,                   // persisted tool input / error per block
+  agentLogMaxLines: 50,
+  listRunsDefaultLimit: 20,
+  listRunsMaxLimit: 100,
+  runsScanLimit: 200,                      // listAllPipelines({limit}) before JS filtering
+  diffDefaultBytes: 60_000,
+  diffMaxBytes: 200_000,
+  gitOutputMaxBytes: 200_000,              // per `git` tool call (P4 §8), sliceBytes window
+  gitCaptureMaxBytes: 8_000_000,           // stdout CAPTURE cap per spawn — past it the child is killed and the output marked capped
+  worktreesPerThread: 5,                   // P4 D9
+  worktreesGlobal: 15,                     // P4 D9
+  attachmentReadDefaultBytes: 32_000,
+  attachmentReadMaxBytes: 200_000,
+  briefMaxChars: 8000,
+  commentBodyMaxChars: 4000,               // diff_comments.body cap (pinned equal to COMMENT_BODY_MAX)
+  titleMaxChars: 120,
+  headerRuns: 5,
+  headerCards: 5,
+  headerAttachments: 5,
+  deltaBatchMs: 50,
+  deltaBatchChars: 256,
+  defaultModel: 'claude-opus-5',           // D8
+  defaultEffort: 'high',
+});
+
+/**
+ * The two configurable per-turn guards. Read fresh every call — a Settings change
+ * applies to the next turn without a restart.
+ * @returns {{maxTurns:number, maxBudgetUsd:number|null}}
+ */
+export function askLimits({ readMaxTurns = readAskMaxTurns, readMaxBudgetUsd = readAskMaxBudgetUsd } = {}) {
+  return { maxTurns: readMaxTurns(), maxBudgetUsd: readMaxBudgetUsd() };
+}

package/src/core/ask/mcp-stdio.mjs

@@ -0,0 +1,135 @@
+#!/usr/bin/env node
+// src/core/ask/mcp-stdio.mjs
+// The worca MCP server of the Ask Worca sandbox (ask-worca-design.md §6.4, D11):
+// a hand-rolled JSON-RPC 2.0 server over stdio — newline-delimited JSON, one
+// message per line (the MCP stdio transport rule), stdout carrying ONLY protocol
+// messages, diagnostics on stderr. claude spawns it once per process through the
+// per-turn --mcp-config and closes its stdin on shutdown; the server then exits 0.
+//
+// Probed on claude 2.1.239: request ids start at 0 (so a notification is
+// id === undefined || id === null); the client sends initialize (protocolVersion
+// '2025-11-25') → notifications/initialized → tools/list → tools/call{name,
+// arguments, _meta}; with only capabilities.tools advertised it never sends
+// resources/prompts/roots/ping. Tool-execution failures are returned INSIDE the
+// result as isError:true text so the model can self-correct; unknown tools and
+// non-object arguments are -32602; unknown methods -32601; parse errors -32700.
+//
+// WORCA_HOME / WORCA_ASK_THREAD_ID come from the env (mcpServers.env) or from
+// `--home <base> --thread <id>` (argv wins). The DB opens lazily on the first
+// tool call through db.mjs (WAL, busy_timeout, open-retry — second-process
+// access is designed for).
+import { createInterface } from 'node:readline';
+import { createRequire } from 'node:module';
+import { pathToFileURL } from 'node:url';
+import { createAskTools, AskToolError } from './tools.mjs';
+import { defaultToolDeps } from './tool-deps.mjs';
+import { defaultWorktreeDeps } from './worktree-deps.mjs';
+import { defaultCommentDeps } from './comment-deps.mjs';
+
+const SUPPORTED_PROTOCOLS = Object.freeze(['2024-11-05', '2025-03-26', '2025-06-18', '2025-11-25']);
+const DEFAULT_PROTOCOL = '2025-06-18';
+const PKG_VERSION = createRequire(import.meta.url)('../../../package.json').version;
+
+/** `--home <base> --thread <id>`; a flag without a value is ignored. */
+export function parseArgv(argv) {
+  const out = { home: null, thread: null };
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] === '--home' && argv[i + 1] !== undefined) out.home = argv[++i];
+    else if (argv[i] === '--thread' && argv[i + 1] !== undefined) out.thread = argv[++i];
+  }
+  return out;
+}
+
+/**
+ * @param {{tools:{list:Function, call:Function}, write:(s:string)=>void, log?:(s:string)=>void, serverVersion?:string}} opts
+ * @returns {{feed:(line:string)=>Promise<void>, idle:()=>Promise<void>}}
+ */
+export function createRpcServer({ tools, write, log = (s) => process.stderr.write(`${s}\n`), serverVersion = PKG_VERSION }) {
+  const send = (msg) => write(`${JSON.stringify(msg)}\n`);
+  const result = (id, res) => send({ jsonrpc: '2.0', id, result: res });
+  const error = (id, code, message) => send({ jsonrpc: '2.0', id, error: { code, message } });
+  const toolNames = () => new Set(tools.list().map((t) => t.name));
+
+  async function handle(msg) {
+    if (!msg || typeof msg !== 'object' || Array.isArray(msg)) return error(null, -32600, 'Invalid Request');
+    const { id, method, params } = msg;
+    const isNotification = id === undefined || id === null;
+    if (typeof method !== 'string') return isNotification ? undefined : error(id, -32600, 'Invalid Request');
+    if (isNotification) return undefined;                       // notifications/* — never answered
+    switch (method) {
+      case 'initialize': {
+        const requested = params && typeof params.protocolVersion === 'string' ? params.protocolVersion : '';
+        return result(id, {
+          protocolVersion: SUPPORTED_PROTOCOLS.includes(requested) ? requested : DEFAULT_PROTOCOL,
+          capabilities: { tools: {} },
+          serverInfo: { name: 'worca', version: serverVersion },
+        });
+      }
+      case 'ping':
+        return result(id, {});
+      case 'tools/list':
+        return result(id, { tools: tools.list() });
+      case 'tools/call': {
+        const name = params && typeof params.name === 'string' ? params.name : '';
+        const args = params && params.arguments !== undefined ? params.arguments : {};
+        if (!name || !toolNames().has(name)) return error(id, -32602, `Invalid params: unknown tool ${JSON.stringify(name)}`);
+        if (args === null || typeof args !== 'object' || Array.isArray(args)) return error(id, -32602, 'Invalid params: arguments must be an object');
+        try {
+          const out = await tools.call(name, args);
+          return result(id, { content: [{ type: 'text', text: JSON.stringify(out ?? null) }] });   // never `undefined` → invalid JSON text
+        } catch (err) {
+          const message = err && err.message ? err.message : String(err);
+          if (!(err instanceof AskToolError)) log(`[ask-mcp] ${name} failed: ${err && err.stack ? err.stack : message}`);
+          return result(id, { content: [{ type: 'text', text: `error: ${message}` }], isError: true });
+        }
+      }
+      default:
+        return error(id, -32601, `Method not found: ${method}`);
+    }
+  }
+
+  // One sequential chain: responses leave in request order, a slow tool never reorders them.
+  let chain = Promise.resolve();
+  return {
+    feed(line) {
+      const trimmed = String(line).trim();
+      if (!trimmed) return chain;
+      let msg;
+      try { msg = JSON.parse(trimmed); } catch {
+        chain = chain.then(() => error(null, -32700, 'Parse error'));   // through the chain: order preserved
+        return chain;
+      }
+      for (const m of Array.isArray(msg) ? msg : [msg]) {
+        chain = chain.then(() => handle(m)).catch((e) => log(`[ask-mcp] handler crashed: ${e && e.stack ? e.stack : e}`));
+      }
+      return chain;
+    },
+    idle: () => chain,
+  };
+}
+
+export async function main({ argv = process.argv.slice(2), env = process.env, stdin = process.stdin, stdout = process.stdout } = {}) {
+  const { home, thread } = parseArgv(argv);
+  if (home) env.WORCA_HOME = home;                               // argv wins; worcaHome() reads the env at call time
+  const threadId = thread || env.WORCA_ASK_THREAD_ID || null;
+  const server = createRpcServer({
+    tools: createAskTools({
+      ...defaultToolDeps({ threadId }),
+      ...defaultWorktreeDeps({ threadId }),
+      ...defaultCommentDeps(),
+    }),
+    write: (s) => stdout.write(s),
+  });
+  const rl = createInterface({ input: stdin });
+  rl.on('line', (line) => { server.feed(line); });
+  await new Promise((resolve) => rl.on('close', resolve));
+  await server.idle();
+  await new Promise((resolve) => stdout.write('', resolve));      // macOS pipes are async: drain before exit
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  main().then(
+    () => process.exit(0),
+    (err) => { process.stderr.write(`[ask-mcp] fatal: ${err && err.stack ? err.stack : err}\n`); process.exit(1); },
+  );
+}

package/src/core/ask/models.mjs

@@ -0,0 +1,125 @@
+// src/core/ask/models.mjs
+// The Ask Worca model picker catalog (D8, ask-worca-design.md §6.9): the COMPOSED
+// catalog from config.mjs — built-ins ⊕ plugin models ⊕ the user's GLOBAL models,
+// with composeCatalog's precedence (global > plugin > built-in) already applied and
+// one entry per id. The only thing dropped here is `custom:'project'`.
+import { listModels as realListModels, EFFORTS } from '../config.mjs';
+import { listPluginModels as realPluginModels, pluginModelSecretStatus as realSecretStatus } from '../plugin-models.mjs';
+import { ASK_LIMITS } from './limits.mjs';
+
+/**
+ * @param {{
+ *   listModels?: (projectDir:string)=>Promise<Array<object>>,
+ *   pluginModels?: ()=>Array<{plugin:string,id:string,secrets?:string[]}>,
+ *   secretStatus?: (plugin:string)=>Array<{key:string,set:boolean}>,
+ *   defaults?: {defaultModel:string, defaultEffort:string},
+ * }} [deps]
+ */
+export function createAskModels({
+  listModels = realListModels,
+  pluginModels = realPluginModels,
+  secretStatus = realSecretStatus,
+  defaults = ASK_LIMITS,
+} = {}) {
+  /**
+   * lc id -> the modelSecrets keys that model needs but that are NOT set.
+   * Mirrors pluginModelsPayload() in ui/server.mjs (which ships the full
+   * [{key,label,set}] for the editor); the chat only needs the missing keys.
+   * Keying by id alone is safe because listPluginModels() already dedupes to one
+   * entry per id (plugin-models.mjs:64-77). Like the server, this only sees keys
+   * the manifest DECLARES in modelSecrets — an env {secret:…} naming an
+   * undeclared key is invisible here exactly as it is in the Models view.
+   * Built lazily: an install with no plugin models does no extra disk reads.
+   */
+  function missingSecretsByIdLc() {
+    const byPlugin = new Map();   // pluginModelSecretStatus hits disk per call — memoize
+    const out = new Map();
+    for (const m of pluginModels()) {
+      const needed = Array.isArray(m.secrets) ? m.secrets : [];
+      if (!needed.length) continue;
+      if (!byPlugin.has(m.plugin)) byPlugin.set(m.plugin, secretStatus(m.plugin) || []);
+      const missing = byPlugin.get(m.plugin).filter((s) => needed.includes(s.key) && !s.set).map((s) => s.key);
+      if (missing.length) out.set(m.id.toLowerCase(), missing);
+    }
+    return out;
+  }
+
+  /** The D8 initial pick, validated against the live catalog (D5). */
+  function pickDefault(models) {
+    const want = String(defaults.defaultModel || '').toLowerCase();
+    const hit = models.find((m) => m.id.toLowerCase() === want) || models[0] || null;
+    if (!hit) return null;
+    const efforts = hit.efforts.length ? hit.efforts : [...EFFORTS];
+    const effort = efforts.includes(defaults.defaultEffort)
+      ? defaults.defaultEffort
+      : (efforts.includes('high') ? 'high' : efforts[0]);
+    return { model: hit.id, effort };
+  }
+
+  /**
+   * @param {{withSecrets?:boolean}} [opts] `withSecrets:false` skips the per-model
+   *   secret probe — the extra listPluginModels() + one manifest/config read per
+   *   plugin, all synchronous. Only validateModelEffort passes it: that path keeps
+   *   id/efforts and throws the rest away, and it runs on every message POST.
+   * @returns {Promise<{models:Array<object>, efforts:string[], default:{model:string,effort:string}|null}>}
+   */
+  async function askCatalog({ withSecrets = true } = {}) {
+    const all = await listModels('');
+    const models = [];
+    let missing = null; // lazily built on the first plugin entry
+    for (const m of all) {
+      if (!m || typeof m.id !== 'string') continue;
+      // Legacy per-project models stay out: the chat is project-less (listModels('')
+      // never composes them anyway — config.mjs:296), and offering them needs a
+      // project-selection design first. Everything else — built-in, global,
+      // plugin — is offered.
+      if (m.custom === 'project') continue;
+      const custom = m.custom === 'global' || m.custom === 'plugin' ? m.custom : false;
+      const entry = {
+        id: m.id,
+        label: typeof m.label === 'string' && m.label ? m.label : m.id,
+        efforts: Array.isArray(m.efforts) ? [...m.efforts] : [...EFFORTS],
+        custom,
+        hasEnv: m.hasEnv === true,
+      };
+      if (custom === 'plugin' && typeof m.plugin === 'string' && m.plugin) entry.plugin = m.plugin;
+      // Only globals and plugin entries can arrive flagged: composeCatalog emits an
+      // UNSHADOWED built-in as {...m, custom:false, hasEnv:false} with no
+      // ...unreliable(lc) (src/core/config.mjs:200), so a built-in in model_cost_flags
+      // shows no ⚠cost here. Pre-existing gap, shared with the pipeline dropdown and
+      // /api/config; fixing it means editing composeCatalog and its three other consumers.
+      if (m.costUnreliable === true) entry.costUnreliable = true;
+      if (custom === 'plugin' && withSecrets) {
+        if (!missing) missing = missingSecretsByIdLc();
+        const keys = missing.get(m.id.toLowerCase());
+        if (keys && keys.length) entry.secretsMissing = [...keys];
+      }
+      models.push(entry);
+    }
+    return { models, efforts: [...EFFORTS], default: pickDefault(models) };
+  }
+
+  /**
+   * @param {unknown} model
+   * @param {unknown} effort
+   * @returns {Promise<{ok:true, model:string, effort:string}|{ok:false, error:string}>}
+   */
+  async function validateModelEffort(model, effort) {
+    if (typeof model !== 'string' || !model.trim()) return { ok: false, error: 'model is required' };
+    if (typeof effort !== 'string' || !effort.trim()) return { ok: false, error: 'effort is required' };
+    const id = model.trim();
+    const { models } = await askCatalog({ withSecrets: false });   // id/efforts only — a missing secret never blocks (D9)
+    const entry = models.find((m) => m.id.toLowerCase() === id.toLowerCase());
+    if (!entry) return { ok: false, error: `unknown model "${id}"` };
+    const e = effort.trim();
+    if (!entry.efforts.includes(e)) return { ok: false, error: `effort "${e}" is not available for model "${entry.id}"` };
+    return { ok: true, model: entry.id, effort: e };
+  }
+
+  return { askCatalog, validateModelEffort };
+}
+
+const bound = createAskModels();
+/** Bound to the real catalog — what ui/server.mjs uses for GET /api/ask/models and the message POST. */
+export const askCatalog = bound.askCatalog;
+export const validateModelEffort = bound.validateModelEffort;