@ybotok/loam 0.2.0-alpha.6 → 0.2.0-alpha.9

package/dist/commands/list/views.js

@@ -12,10 +12,9 @@ import { serviceResolver } from "../../core/c4/resolve/service.js";
 import { maturityGaps, serviceMaturity, } from "../../core/vocabulary/maturity.js";
 import {} from "../../core/repo/entries.js";
 import { landscapePath, servicePathsAt } from "../../core/repo/paths.js";
-import { featureChecklist } from "../../core/verify/checklist.js";
-import { readVerification } from "../../core/verify/file.js";
+import { verificationState } from "../../core/status/verification.js";
 import {} from "../../core/verify/answers.js";
-import { confirmedProvenance, tallyRecord, verificationVerdict, } from "../../core/verify/record.js";
+import {} from "../../core/verify/record.js";
 /**
  * Read the living landscape ONCE and decide, per service, whether an API is
  * expected of it. `serviceResolver` is handed the real service ids so an edge
@@ -70,40 +69,36 @@ export async function serviceViews(docsDir, services, boundService, preloaded) {
     });
 }
 /**
- * The verification column. `readVerification` is one file read; the checklist
- * is derived only when there is a record to judge — on a fleet-sized repo most
- * features have none, and deriving N checklists to print N dashes is the cost
- * that would get this column dropped.
+ * The verification column: `status`'s own record state (`verificationState`),
+ * projected onto the cell — the record read, the files added up against the
+ * checklist just derived, the archived record read as frozen history — so
+ * `list`, `status` and `gate` compute one cell, for the reasons that function
+ * records. Reading the record is cheap but no longer one file read — a
+ * directory listing and one small read per attesting service, plus the
+ * one-file `verification.yaml` — and the checklist is derived only when there
+ * is a record to judge: on a fleet-sized repo most features have none, and
+ * deriving N checklists to print N dashes is the cost that would get this
+ * column dropped. `fleet` is the invocation's read index, so each derivation's
+ * enumerations and delta parse are memo hits rather than a walk per feature.
  *
- * An archived feature's record is frozen history (see `core/verify/record.ts`): archive
- * merged the feature's operations into the living openapi, so a re-derived
- * checklist can only mismatch — the record is reported as recorded, never
- * judged stale.
+ * A record that cannot be read is one dash like an absent one: this column
+ * shows one glyph either way. That includes a record whose summary
+ * contradicts its own claims (`verify.record-miscounted`), so no count from it
+ * is printed as fact — reading it as absent is the safe half of the truth, and
+ * `status` and `verify`, which can say why, report it as unreadable instead.
  */
-export async function featureVerification(docsDir, f) {
-    const v = await readVerification(f.dir);
-    if (v === null)
+export async function featureVerification(docsDir, f, fleet) {
+    const { state: s } = await verificationState(docsDir, f, { fleet });
+    if (s.state === "absent" || s.state === "unreadable" || s.recorded === null)
         return null;
-    const stale = f.archived
-        ? false
-        : (await featureChecklist(docsDir, f.dir, f.id)).digest !== v.checklist;
-    const tally = tallyRecord(v);
     return {
-        state: stale ? "stale" : "recorded",
-        recorded: v.recorded,
-        verdict: verificationVerdict(tally, stale),
-        confirmed: tally.confirmed,
-        claims: tally.claims,
-        attested: tally.attested,
-        answered: confirmedProvenance(v.claims),
+        state: s.state,
+        recorded: s.recorded,
+        verdict: s.verdict,
+        confirmed: s.confirmed,
+        claims: s.claims,
+        attested: s.attested,
+        answered: s.answered,
     };
 }
-/* ------------------------------------------------------------------ */
-/* Text                                                                */
-/* ------------------------------------------------------------------ */
-/**
- * Fixed-width presence flags. `a` and `A` are deliberately the same letter in
- * two cases: the arch spec and the API are the two things a reader most often
- * mistakes for each other, and one is lowercase because it is optional.
- */
 //# sourceMappingURL=views.js.map

package/dist/commands/list/views.js.map

@@ -1 +1 @@
-{"version":3,"file":"views.js","sourceRoot":"","sources":["../../../src/commands/list/views.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAkB,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EACL,YAAY,EACZ,eAAe,GAGhB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAwC,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAmB,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EACL,mBAAmB,EACnB,WAAW,EAEX,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AAWrC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,QAAwB,EACxB,YAAgC,EAChC,SAA4B;IAE5B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAClC,0EAA0E;IAC1E,+DAA+D;IAC/D,0EAA0E;IAC1E,yEAAyE;IACzE,uEAAuE;IACvE,yEAAyE;IACzE,yDAAyD;IACzD,MAAM,IAAI,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9F,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,oEAAoE;IACpE,mDAAmD;IACnD,MAAM,MAAM,GAAG,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IACzD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACnC,wEAAwE;YACxE,0EAA0E;YAC1E,wEAAwE;YACxE,wEAAwE;YACxE,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC5B,MAAM,QAAQ,GAAG,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QAChE,MAAM,WAAW,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG;YACX,KAAK;YACL,QAAQ;YACR,WAAW;YACX,oBAAoB,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,IAAI,YAAY,KAAK,KAAK,CAAC,EAAE;SAC1E,CAAC;QACF,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC;AAgCD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgB,EAChB,CAAe;IAEf,MAAM,CAAC,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ;QACtB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,SAAS,CAAC;IAC1E,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU;QACnC,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC;QAC1C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE;;;;GAIG","sourcesContent":["/**\n * What the list actually reads: one row per service, one verification cell per\n * feature.\n *\n * Both are gathered before anything is printed or serialized, because the same\n * numbers appear in `--json` and in the worklist footer — a footer computed\n * from a second read is a footer that can contradict the rows above it.\n */\nimport { existsSync } from \"node:fs\";\nimport { loadFile, type LoadedDoc } from \"../../core/c4/likec4.js\";\nimport { serviceResolver } from \"../../core/c4/resolve/service.js\";\nimport {\n  maturityGaps,\n  serviceMaturity,\n  type Maturity,\n  type MaturityInput,\n} from \"../../core/vocabulary/maturity.js\";\nimport { type FeatureEntry, type ServiceEntry } from \"../../core/repo/entries.js\";\nimport { landscapePath, servicePathsAt } from \"../../core/repo/paths.js\";\nimport { featureChecklist } from \"../../core/verify/checklist.js\";\nimport { readVerification } from \"../../core/verify/file.js\";\nimport { type AnsweredBy } from \"../../core/verify/answers.js\";\nimport {\n  confirmedProvenance,\n  tallyRecord,\n  type VerificationVerdict,\n  verificationVerdict,\n} from \"../../core/verify/record.js\";\nimport type { DocsDir } from \"../../core/kernel/ids/dirs.js\";\n\nexport interface ServiceView extends MaturityInput {\n  /** True when this service's `sources` can only be resolved from its own repo. */\n  unverifiableFromHere: boolean;\n  maturity: Maturity;\n  /** What stands between this service and the next rung, in fix order. */\n  missing: string[];\n}\n\n/**\n * Read the living landscape ONCE and decide, per service, whether an API is\n * expected of it. `serviceResolver` is handed the real service ids so an edge\n * drawn into a modelled container (`paymentService.api`) counts for the service\n * that owns it — the same resolution `validate` uses, so the two commands\n * cannot disagree about who is called.\n */\nexport async function serviceViews(\n  docsDir: DocsDir,\n  services: ServiceEntry[],\n  boundService: string | undefined,\n  preloaded?: LoadedDoc | null,\n): Promise<ServiceView[]> {\n  const known = new Set(services.map((s) => s.id));\n  const lp = landscapePath(docsDir);\n  // `preloaded` is the landscape a caller already holds — `undefined` means\n  // \"load it if it exists\", null \"there is none\", the convention\n  // validateService's own `preloaded` follows. The fleet scorecard hands in\n  // the batch-parsed doc because a healthy `validate --all` must spin ZERO\n  // per-document workspaces (test/validate-batch-fallback.test.ts counts\n  // them), and a second parse of a document that run already holds was the\n  // exact per-path cost the batch loader exists to retire.\n  const land = preloaded !== undefined ? preloaded : existsSync(lp) ? await loadFile(lp) : null;\n  const called = new Set<string>();\n  // Positive evidence only: with no landscape, or one that does not parse, we\n  // know nothing about who is called and every service is assumed to have an\n  // API — the conservative direction, because claiming a service needs no\n  // contract is how a real one goes undocumented. This is the SAME rule\n  // `landscapeEvidence` (core/vocabulary/maturity.ts) spells per service for\n  // explore and the context pack — derived fleet-wide here in one pass (one\n  // `called` set for every service) because calling the per-service partition\n  // from this loop would re-walk the whole relationship list once per\n  // service. If the rule moves, both spellings move.\n  const proven = land !== null && land.errors.length === 0;\n  if (proven) {\n    const svcOf = serviceResolver(land.elements, known);\n    for (const r of land.relationships) {\n      // …including its self-edge rule: an edge whose two endpoints resolve to\n      // one service is that service's own internal wiring, and counting it made\n      // a service nobody calls owe an OpenAPI contract — `partial` here while\n      // `loam context` (which reads the shared derivation) said `documented`.\n      if (r.op !== undefined && svcOf(r.source) !== svcOf(r.target)) called.add(svcOf(r.target));\n    }\n  }\n\n  return services.map((entry) => {\n    const archSpec = existsSync(servicePathsAt(entry.dir).archSpec);\n    const apiExpected = !proven || called.has(entry.id);\n    const view = {\n      entry,\n      archSpec,\n      apiExpected,\n      unverifiableFromHere: entry.sources.declared && boundService !== entry.id,\n    };\n    const missing = maturityGaps(view);\n    return { ...view, maturity: serviceMaturity(view), missing };\n  });\n}\n\n/* ------------------------------------------------------------------ */\n/* JSON                                                                */\n/* ------------------------------------------------------------------ */\n\nexport interface VerificationCell {\n  state: \"recorded\" | \"stale\";\n  /** The day the record was written. */\n  recorded: string;\n  /**\n   * `verify --json`'s own three-valued verdict, through `verificationVerdict` —\n   * not a fourth opinion computed here. `attested` is the one this column got\n   * wrong: a scenario confirmed on an agent's word printed as `11/11` under a\n   * heading that said `verified`, and `list --json` is how the fleet is graded.\n   */\n  verdict: VerificationVerdict;\n  /** Both counts are `tallyRecord`'s — the record's `claims[]`, never its `summary:` block. */\n  confirmed: number;\n  claims: number;\n  /** Of the confirmed, the scenario claims on an agent's word (`attestedClaims`). */\n  attested: number;\n  /**\n   * Of the confirmed, one count per `answered_by` value (`confirmedProvenance`), every key\n   * present. A different question from `attested` above, which is why both are here: `attested`\n   * asks only about `scenario.tested` because that is what the verdict turns on, while this asks\n   * who answered EVERY kind — and reading the first as if it were the second is how the fleet\n   * scorecard credited agent-answered permission and operation claims to a test runner.\n   */\n  answered: Record<AnsweredBy, number>;\n}\n\n/**\n * The verification column. `readVerification` is one file read; the checklist\n * is derived only when there is a record to judge — on a fleet-sized repo most\n * features have none, and deriving N checklists to print N dashes is the cost\n * that would get this column dropped.\n *\n * An archived feature's record is frozen history (see `core/verify/record.ts`): archive\n * merged the feature's operations into the living openapi, so a re-derived\n * checklist can only mismatch — the record is reported as recorded, never\n * judged stale.\n */\nexport async function featureVerification(\n  docsDir: DocsDir,\n  f: FeatureEntry,\n): Promise<VerificationCell | null> {\n  const v = await readVerification(f.dir);\n  if (v === null) return null;\n  const stale = f.archived\n    ? false\n    : (await featureChecklist(docsDir, f.dir, f.id)).digest !== v.checklist;\n  const tally = tallyRecord(v);\n  return {\n    state: stale ? \"stale\" : \"recorded\",\n    recorded: v.recorded,\n    verdict: verificationVerdict(tally, stale),\n    confirmed: tally.confirmed,\n    claims: tally.claims,\n    attested: tally.attested,\n    answered: confirmedProvenance(v.claims),\n  };\n}\n\n/* ------------------------------------------------------------------ */\n/* Text                                                                */\n/* ------------------------------------------------------------------ */\n\n/**\n * Fixed-width presence flags. `a` and `A` are deliberately the same letter in\n * two cases: the arch spec and the API are the two things a reader most often\n * mistakes for each other, and one is lowercase because it is optional.\n */\n"]}
+{"version":3,"file":"views.js","sourceRoot":"","sources":["../../../src/commands/list/views.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAkB,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EACL,YAAY,EACZ,eAAe,GAGhB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAwC,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAEzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAmB,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAA4B,MAAM,6BAA6B,CAAC;AAgBvE;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,QAAwB,EACxB,YAAgC,EAChC,SAA4B;IAE5B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAClC,0EAA0E;IAC1E,+DAA+D;IAC/D,0EAA0E;IAC1E,yEAAyE;IACzE,uEAAuE;IACvE,yEAAyE;IACzE,yDAAyD;IACzD,MAAM,IAAI,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9F,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,oEAAoE;IACpE,mDAAmD;IACnD,MAAM,MAAM,GAAG,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IACzD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACnC,wEAAwE;YACxE,0EAA0E;YAC1E,wEAAwE;YACxE,wEAAwE;YACxE,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC5B,MAAM,QAAQ,GAAG,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QAChE,MAAM,WAAW,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG;YACX,KAAK;YACL,QAAQ;YACR,WAAW;YACX,oBAAoB,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,IAAI,YAAY,KAAK,KAAK,CAAC,EAAE;SAC1E,CAAC;QACF,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC;AA6BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgB,EAChB,CAAe,EACf,KAAmB;IAEnB,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,YAAY,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzF,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;KACrB,CAAC;AACJ,CAAC","sourcesContent":["/**\n * What the list actually reads: one row per service, one verification cell per\n * feature.\n *\n * Both are gathered before anything is printed or serialized, because the same\n * numbers appear in `--json` and in the worklist footer — a footer computed\n * from a second read is a footer that can contradict the rows above it.\n */\nimport { existsSync } from \"node:fs\";\nimport { loadFile, type LoadedDoc } from \"../../core/c4/likec4.js\";\nimport { serviceResolver } from \"../../core/c4/resolve/service.js\";\nimport {\n  maturityGaps,\n  serviceMaturity,\n  type Maturity,\n  type MaturityInput,\n} from \"../../core/vocabulary/maturity.js\";\nimport { type FeatureEntry, type ServiceEntry } from \"../../core/repo/entries.js\";\nimport { landscapePath, servicePathsAt } from \"../../core/repo/paths.js\";\nimport type { FleetContext } from \"../../core/fleet-context.js\";\nimport { verificationState } from \"../../core/status/verification.js\";\nimport { type AnsweredBy } from \"../../core/verify/answers.js\";\nimport { type VerificationVerdict } from \"../../core/verify/record.js\";\nimport type { DocsDir } from \"../../core/kernel/ids/dirs.js\";\n\nexport interface ServiceView extends MaturityInput {\n  /** True when this service's `sources` can only be resolved from its own repo. */\n  unverifiableFromHere: boolean;\n  maturity: Maturity;\n  /**\n   * What stands between this service and the next rung, in fix order — and at\n   * `vouched`, the re-vouch a document that moved under its stamp owes\n   * (`maturityGaps`). Empty exactly when nothing is owed, which is the\n   * worklist's membership test.\n   */\n  missing: string[];\n}\n\n/**\n * Read the living landscape ONCE and decide, per service, whether an API is\n * expected of it. `serviceResolver` is handed the real service ids so an edge\n * drawn into a modelled container (`paymentService.api`) counts for the service\n * that owns it — the same resolution `validate` uses, so the two commands\n * cannot disagree about who is called.\n */\nexport async function serviceViews(\n  docsDir: DocsDir,\n  services: ServiceEntry[],\n  boundService: string | undefined,\n  preloaded?: LoadedDoc | null,\n): Promise<ServiceView[]> {\n  const known = new Set(services.map((s) => s.id));\n  const lp = landscapePath(docsDir);\n  // `preloaded` is the landscape a caller already holds — `undefined` means\n  // \"load it if it exists\", null \"there is none\", the convention\n  // validateService's own `preloaded` follows. The fleet scorecard hands in\n  // the batch-parsed doc because a healthy `validate --all` must spin ZERO\n  // per-document workspaces (test/validate-batch-fallback.test.ts counts\n  // them), and a second parse of a document that run already holds was the\n  // exact per-path cost the batch loader exists to retire.\n  const land = preloaded !== undefined ? preloaded : existsSync(lp) ? await loadFile(lp) : null;\n  const called = new Set<string>();\n  // Positive evidence only: with no landscape, or one that does not parse, we\n  // know nothing about who is called and every service is assumed to have an\n  // API — the conservative direction, because claiming a service needs no\n  // contract is how a real one goes undocumented. This is the SAME rule\n  // `landscapeEvidence` (core/vocabulary/maturity.ts) spells per service for\n  // explore and the context pack — derived fleet-wide here in one pass (one\n  // `called` set for every service) because calling the per-service partition\n  // from this loop would re-walk the whole relationship list once per\n  // service. If the rule moves, both spellings move.\n  const proven = land !== null && land.errors.length === 0;\n  if (proven) {\n    const svcOf = serviceResolver(land.elements, known);\n    for (const r of land.relationships) {\n      // …including its self-edge rule: an edge whose two endpoints resolve to\n      // one service is that service's own internal wiring, and counting it made\n      // a service nobody calls owe an OpenAPI contract — `partial` here while\n      // `loam context` (which reads the shared derivation) said `documented`.\n      if (r.op !== undefined && svcOf(r.source) !== svcOf(r.target)) called.add(svcOf(r.target));\n    }\n  }\n\n  return services.map((entry) => {\n    const archSpec = existsSync(servicePathsAt(entry.dir).archSpec);\n    const apiExpected = !proven || called.has(entry.id);\n    const view = {\n      entry,\n      archSpec,\n      apiExpected,\n      unverifiableFromHere: entry.sources.declared && boundService !== entry.id,\n    };\n    const missing = maturityGaps(view);\n    return { ...view, maturity: serviceMaturity(view), missing };\n  });\n}\n\n/** What the features table says about verification without N `loam verify` runs. */\nexport interface VerificationCell {\n  state: \"recorded\" | \"stale\";\n  /** The day the record was written. */\n  recorded: string;\n  /**\n   * `verify --json`'s own three-valued verdict, through `verificationVerdict` —\n   * not a fourth opinion computed here. `attested` is the one this column got\n   * wrong: a scenario confirmed on an agent's word printed as `11/11` under a\n   * heading that said `verified`, and `list --json` is how the fleet is graded.\n   */\n  verdict: VerificationVerdict;\n  /** Both counts are `tallyRecord`'s — the record's `claims[]`, never its `summary:` block. */\n  confirmed: number;\n  claims: number;\n  /** Of the confirmed, the scenario claims on an agent's word (`attestedClaims`). */\n  attested: number;\n  /**\n   * Of the confirmed, one count per `answered_by` value (`confirmedProvenance`), every key\n   * present. A different question from `attested` above, which is why both are here: `attested`\n   * asks only about `scenario.tested` because that is what the verdict turns on, while this asks\n   * who answered EVERY kind — and reading the first as if it were the second is how the fleet\n   * scorecard credited agent-answered permission and operation claims to a test runner.\n   */\n  answered: Record<AnsweredBy, number>;\n}\n\n/**\n * The verification column: `status`'s own record state (`verificationState`),\n * projected onto the cell — the record read, the files added up against the\n * checklist just derived, the archived record read as frozen history — so\n * `list`, `status` and `gate` compute one cell, for the reasons that function\n * records. Reading the record is cheap but no longer one file read — a\n * directory listing and one small read per attesting service, plus the\n * one-file `verification.yaml` — and the checklist is derived only when there\n * is a record to judge: on a fleet-sized repo most features have none, and\n * deriving N checklists to print N dashes is the cost that would get this\n * column dropped. `fleet` is the invocation's read index, so each derivation's\n * enumerations and delta parse are memo hits rather than a walk per feature.\n *\n * A record that cannot be read is one dash like an absent one: this column\n * shows one glyph either way. That includes a record whose summary\n * contradicts its own claims (`verify.record-miscounted`), so no count from it\n * is printed as fact — reading it as absent is the safe half of the truth, and\n * `status` and `verify`, which can say why, report it as unreadable instead.\n */\nexport async function featureVerification(\n  docsDir: DocsDir,\n  f: FeatureEntry,\n  fleet: FleetContext,\n): Promise<VerificationCell | null> {\n  const { state: s } = await verificationState(docsDir, f, { fleet });\n  if (s.state === \"absent\" || s.state === \"unreadable\" || s.recorded === null) return null;\n  return {\n    state: s.state,\n    recorded: s.recorded,\n    verdict: s.verdict,\n    confirmed: s.confirmed,\n    claims: s.claims,\n    attested: s.attested,\n    answered: s.answered,\n  };\n}\n"]}

package/dist/commands/mcp/dispatch.js

@@ -31,11 +31,13 @@ import { registerStatus } from "../status/status.js";
 import { registerList } from "../list/list.js";
 import { registerShow } from "../show/show.js";
 import { registerDelta } from "../delta/delta.js";
+import { registerTasks } from "../tasks/tasks.js";
 import { registerDiff } from "../diff/diff.js";
 import { registerExplore } from "../explore.js";
 import { registerDependencies } from "../dependencies.js";
 import { registerDoctor } from "../doctor.js";
 import { registerContext } from "../context/context.js";
+import { registerAdopt } from "../adopt/adopt.js";
 import { registerGate } from "../gate/gate.js";
 import { registerExplain } from "../explain/explain.js";
 import { registerInstructions } from "../instructions.js";
@@ -44,6 +46,7 @@ import { registerNew } from "../new/new.js";
 import { registerRebase } from "../rebase/rebase.js";
 import { registerGherkin } from "../gherkin/gherkin.js";
 import { registerArchive } from "../archive/archive.js";
+import { MCP_TOOLS } from "../../core/mcp/tools.js";
 /**
  * Every console method Node's Console writes to STDOUT — the protocol stream,
  * where one stray line corrupts the transport. Hooking only `log` was the
@@ -93,13 +96,80 @@ export function captureConsole(sinks) {
 /** Commander output codes whose printed output is the point, not a usage failure. */
 const PASS_THROUGH = new Set(["commander.help", "commander.helpDisplayed", "commander.version"]);
 /**
- * The scoped program, output routed into `sinks`. configureOutput and
- * exitOverride are set BEFORE the register calls on purpose: commander copies
- * inherited settings onto a subcommand when it is created, so settings applied
- * after registration would leave every subcommand writing to the real stdout —
- * which for an MCP server is the protocol stream.
+ * Every command a tool table may name, keyed by the `command` its tool carries.
+ * A LOOKUP, not a roster: which of these a call's program registers is decided
+ * by the active tool table alone (`toolRunner`), so the authoring writers —
+ * new, rebase, gherkin, archive — exist in it only when `--author` put their
+ * tools in the table, and the table the read-only hints describe is the one
+ * place that gate is written.
+ *
+ * `instructions` and `steps` read no config at all, and are in MCP_TOOLS
+ * because an agent meets them BEFORE the repository is wired: every generated
+ * skill's first line points at `loam instructions <workflow>`. They are why
+ * registration follows the table. This list and MCP_TOOLS used to be two
+ * copies of one roster, and nothing counted them against each other until a
+ * tool advertised in `tools/list` and absent here answered a `tools/call` with
+ * `unknown command 'instructions'` — an envelope that reads as the caller's
+ * mistake. `test/mcp-serve.test.ts` calls every advertised tool, and checks
+ * this lookup against both tables directly.
+ */
+const REGISTRARS = new Map([
+    ["validate", registerValidate],
+    ["status", registerStatus],
+    ["list", registerList],
+    ["show", registerShow],
+    ["delta", registerDelta],
+    ["tasks", registerTasks],
+    ["diff", registerDiff],
+    ["explore", registerExplore],
+    ["dependencies", registerDependencies],
+    ["doctor", registerDoctor],
+    ["context", registerContext],
+    ["adopt", registerAdopt],
+    ["gate", registerGate],
+    ["explain", registerExplain],
+    ["instructions", registerInstructions],
+    ["steps", registerSteps],
+    ["new", registerNew],
+    ["rebase", registerRebase],
+    ["gherkin", registerGherkin],
+    ["archive", registerArchive],
+]);
+/**
+ * Resolve every command `tools` name to its registrar, or throw naming each
+ * one that has none. This is the server's STARTUP check, and it runs once per
+ * table: `toolRunner` calls it before the first frame is read, so a tool
+ * advertised with no registrar — the roster drift above, arriving again —
+ * stops `loam mcp` at launch, through cli.ts's catch like any other throw,
+ * before a client has been promised anything. It used to run inside every call's program build, where one
+ * missing entry turned EVERY `tools/call` into an `internal` envelope naming
+ * it, the tools that were wired correctly included: a call's outcome
+ * depended on a tool it never named.
+ */
+export function resolveRegistrars(tools) {
+    const resolved = [];
+    const missing = [];
+    for (const command of new Set(tools.map((tool) => tool.command))) {
+        const register = REGISTRARS.get(command);
+        if (register === undefined)
+            missing.push(`'${command}'`);
+        else
+            resolved.push(register);
+    }
+    if (missing.length > 0) {
+        throw new Error(`loam mcp: no command registered for MCP tool command ${missing.join(", ")} — add it to REGISTRARS in src/commands/mcp/dispatch.ts`);
+    }
+    return resolved;
+}
+/**
+ * The scoped program, output routed into `sinks`, holding exactly the commands
+ * the resolved table names. configureOutput and exitOverride are set BEFORE the
+ * register calls on purpose: commander copies inherited settings onto a
+ * subcommand when it is created, so settings applied after registration would
+ * leave every subcommand writing to the real stdout — which for an MCP server
+ * is the protocol stream.
  */
-function readProgram(sinks, authoring = false) {
+function readProgram(sinks, registrars) {
     const program = new Command();
     program.name("loam");
     program.exitOverride();
@@ -107,49 +177,34 @@ function readProgram(sinks, authoring = false) {
         writeOut: (text) => sinks.stdout.push(text),
         writeErr: (text) => sinks.stderr.push(text),
     });
-    registerValidate(program);
-    registerStatus(program);
-    registerList(program);
-    registerShow(program);
-    registerDelta(program);
-    registerDiff(program);
-    registerExplore(program);
-    registerDependencies(program);
-    registerDoctor(program);
-    registerContext(program);
-    registerGate(program);
-    registerExplain(program);
-    // The two that read no config at all. They are here for the same reason they
-    // are in MCP_TOOLS: an agent meets `instructions` and `steps` BEFORE the
-    // repository is wired, and every generated skill's first line points at
-    // `loam instructions <workflow>`. This list and MCP_TOOLS are two copies of
-    // one roster, and nothing counted them against each other until a tool
-    // advertised in `tools/list` and absent here answered a `tools/call` with
-    // `unknown command 'instructions'` — an envelope that reads as the caller's
-    // mistake. `test/mcp-serve.test.ts` now calls every advertised tool.
-    registerInstructions(program);
-    registerSteps(program);
-    if (authoring) {
-        registerNew(program);
-        registerRebase(program);
-        registerGherkin(program);
-        registerArchive(program);
-    }
+    for (const register of registrars)
+        register(program);
     return program;
 }
+/**
+ * The runner `loam mcp` serves `tools` with. Throws HERE, at construction, when
+ * the table names a command with no registrar (`resolveRegistrars`); the
+ * runner it returns never throws, and builds each call's program from the
+ * registrars resolved once — so no call can fail for the sake of a tool it
+ * did not name.
+ */
+export function toolRunner(tools = MCP_TOOLS) {
+    const registrars = resolveRegistrars(tools);
+    return (argv) => runToolArgv(argv, registrars);
+}
 /**
  * Run one tool argv. Never throws: whatever goes wrong becomes an envelope in
  * `stdout` with `code` 1, so the serve loop's answer to THIS call is the only
  * thing affected — one bad call must never take the server down, and a
  * memoised rejection cannot exist because nothing here outlives the call.
  */
-export async function runToolArgv(argv, authoring = false) {
+async function runToolArgv(argv, registrars) {
     const sinks = { stdout: [], stderr: [] };
     const previousExitCode = process.exitCode;
     const restoreConsole = captureConsole(sinks);
     process.exitCode = undefined;
     try {
-        await readProgram(sinks, authoring).parseAsync(["node", "loam", ...argv]);
+        await readProgram(sinks, registrars).parseAsync(["node", "loam", ...argv]);
     }
     catch (err) {
         if (err instanceof CommanderError) {

package/dist/commands/mcp/dispatch.js.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../../../src/commands/mcp/dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAcxD;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG;IACrB,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO;IAChD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS;CAC1E,CAAC;AACX,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,OAAO,CAAU,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,KAAY;IACzC,MAAM,MAAM,GAAG,OAA6C,CAAC;IAC7D,MAAM,MAAM,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,CAAC,GAAG,KAAgB,EAAQ,EAAE;QAC/D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;IAC9B,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC5C,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI;QACjC,CAAC,cAAc,EAAE,QAAQ,CAAC;QAC1B,CAAC,cAAc,EAAE,QAAQ,CAAC;KAClB,EAAE,CAAC;QACX,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,kEAAkE;YAClE,2DAA2D;YAC3D,IAAI,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,UAAU;gBAAE,SAAS;YACjD,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,EAAE;QACV,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;IAC/D,CAAC,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,yBAAyB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAEjG;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,KAAY,EAAE,SAAS,GAAG,KAAK;IAClD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,OAAO,CAAC,YAAY,EAAE,CAAC;IACvB,OAAO,CAAC,eAAe,CAAC;QACtB,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3C,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;KAC5C,CAAC,CAAC;IACH,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1B,cAAc,CAAC,OAAO,CAAC,CAAC;IACxB,YAAY,CAAC,OAAO,CAAC,CAAC;IACtB,YAAY,CAAC,OAAO,CAAC,CAAC;IACtB,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,YAAY,CAAC,OAAO,CAAC,CAAC;IACtB,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,cAAc,CAAC,OAAO,CAAC,CAAC;IACxB,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,YAAY,CAAC,OAAO,CAAC,CAAC;IACtB,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,6EAA6E;IAC7E,yEAAyE;IACzE,wEAAwE;IACxE,4EAA4E;IAC5E,uEAAuE;IACvE,0EAA0E;IAC1E,4EAA4E;IAC5E,qEAAqE;IACrE,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,IAAI,SAAS,EAAE,CAAC;QACd,WAAW,CAAC,OAAO,CAAC,CAAC;QACrB,cAAc,CAAC,OAAO,CAAC,CAAC;QACxB,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,eAAe,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAuB,EACvB,SAAS,GAAG,KAAK;IAEjB,MAAM,KAAK,GAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAChD,MAAM,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC1C,MAAM,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YAClC,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,uEAAuE;gBACvE,wEAAwE;gBACxE,sEAAsE;gBACtE,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;oBAAE,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACN,sEAAsE;gBACtE,qEAAqE;gBACrE,aAAa,CAAC,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,qEAAqE;YACrE,qEAAqE;YACrE,mDAAmD;YACnD,aAAa,CAAC,UAAU,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;YAAS,CAAC;QACT,cAAc,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,QAAQ,GAAG,gBAAgB,CAAC;IACpC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;AACpF,CAAC","sourcesContent":["/**\n * In-process dispatch for one MCP tool call: build a fresh commander program\n * holding only the commands the selected tool table exposes, run the argv through\n * it, and hand back what the CLI would have printed.\n *\n * This is the proven harness pattern (test/helpers/harness.ts runLoamNow)\n * moved to the commands layer, minus the chdir: the server's own cwd IS the\n * workdir, so every call resolves loam.json exactly as the CLI would in that\n * directory — the server serves ONE repository, the one it started in, and\n * never changes directory. In-process rather than a child per call because a\n * child re-pays LikeC4/Langium startup on every validate, and because in dev\n * there is no built binary to exec.\n *\n * The capture is process-global (console, exitCode), which is safe under\n * exactly one condition the serve loop guarantees: calls are strictly\n * sequential — each one is awaited to completion before the next frame is\n * read — and `parseAsync` resolves only after the action has fully run (the\n * entire test suite rests on that same guarantee). Nothing here may be\n * module-level state: two serve sessions in one process (the tests do this)\n * must not see each other.\n *\n * NOTE for test/agents.test.ts's scan: registration happens through the\n * imported register functions; this module must never contain the literal\n * dot-command-paren call, comments included, or the CLI surface count breaks.\n */\nimport { Command, CommanderError } from \"commander\";\nimport { format } from \"node:util\";\nimport { emitJsonError } from \"../../core/envelope/json.js\";\nimport { registerValidate } from \"../validate/validate.js\";\nimport { registerStatus } from \"../status/status.js\";\nimport { registerList } from \"../list/list.js\";\nimport { registerShow } from \"../show/show.js\";\nimport { registerDelta } from \"../delta/delta.js\";\nimport { registerDiff } from \"../diff/diff.js\";\nimport { registerExplore } from \"../explore.js\";\nimport { registerDependencies } from \"../dependencies.js\";\nimport { registerDoctor } from \"../doctor.js\";\nimport { registerContext } from \"../context/context.js\";\nimport { registerGate } from \"../gate/gate.js\";\nimport { registerExplain } from \"../explain/explain.js\";\nimport { registerInstructions } from \"../instructions.js\";\nimport { registerSteps } from \"../steps/steps.js\";\nimport { registerNew } from \"../new/new.js\";\nimport { registerRebase } from \"../rebase/rebase.js\";\nimport { registerGherkin } from \"../gherkin/gherkin.js\";\nimport { registerArchive } from \"../archive/archive.js\";\n\nexport interface DispatchResult {\n  readonly stdout: string;\n  readonly stderr: string;\n  readonly code: number;\n}\n\n/** Console sinks for one dispatch — a value, not module state, so calls cannot share buffers. */\nexport interface Sinks {\n  readonly stdout: string[];\n  readonly stderr: string[];\n}\n\n/**\n * Every console method Node's Console writes to STDOUT — the protocol stream,\n * where one stray line corrupts the transport. Hooking only `log` was the\n * reviewed defect here: a `console.info` in any command, or in a dependency a\n * command loads, would have written straight into the client's frame stream\n * with every suite green. `warn`/`error` go to stderr, captured for the\n * server log rather than the wire.\n */\nconst STDOUT_METHODS = [\n  \"log\", \"info\", \"debug\", \"dir\", \"dirxml\", \"table\",\n  \"group\", \"groupCollapsed\", \"groupEnd\", \"count\", \"countReset\", \"timeLog\", \"timeEnd\",\n] as const;\nconst STDERR_METHODS = [\"warn\", \"error\"] as const;\n\n/**\n * Replace the console methods named above with sink writers; the returned\n * function restores every original. Captured output is `format(...)`ed, so\n * `table`/`group` lose their layout — acceptable on purpose: the invariant\n * bought here is that their BYTES stay off the protocol stream, not that\n * their rendering survives.\n */\nexport function captureConsole(sinks: Sinks): () => void {\n  const target = console as unknown as Record<string, unknown>;\n  const writer = (sink: string[]) => (...parts: unknown[]): void => {\n    sink.push(format(...parts));\n  };\n  const toStdout = writer(sinks.stdout);\n  const toStderr = writer(sinks.stderr);\n  const original = new Map<string, unknown>();\n  for (const [names, replacement] of [\n    [STDOUT_METHODS, toStdout],\n    [STDERR_METHODS, toStderr],\n  ] as const) {\n    for (const name of names) {\n      // A method absent on this Node build has nothing to capture — and\n      // nothing to restore, so it must not enter the map either.\n      if (typeof target[name] !== \"function\") continue;\n      original.set(name, target[name]);\n      target[name] = replacement;\n    }\n  }\n  return () => {\n    for (const [name, method] of original) target[name] = method;\n  };\n}\n\n/** Commander output codes whose printed output is the point, not a usage failure. */\nconst PASS_THROUGH = new Set([\"commander.help\", \"commander.helpDisplayed\", \"commander.version\"]);\n\n/**\n * The scoped program, output routed into `sinks`. configureOutput and\n * exitOverride are set BEFORE the register calls on purpose: commander copies\n * inherited settings onto a subcommand when it is created, so settings applied\n * after registration would leave every subcommand writing to the real stdout —\n * which for an MCP server is the protocol stream.\n */\nfunction readProgram(sinks: Sinks, authoring = false): Command {\n  const program = new Command();\n  program.name(\"loam\");\n  program.exitOverride();\n  program.configureOutput({\n    writeOut: (text) => sinks.stdout.push(text),\n    writeErr: (text) => sinks.stderr.push(text),\n  });\n  registerValidate(program);\n  registerStatus(program);\n  registerList(program);\n  registerShow(program);\n  registerDelta(program);\n  registerDiff(program);\n  registerExplore(program);\n  registerDependencies(program);\n  registerDoctor(program);\n  registerContext(program);\n  registerGate(program);\n  registerExplain(program);\n  // The two that read no config at all. They are here for the same reason they\n  // are in MCP_TOOLS: an agent meets `instructions` and `steps` BEFORE the\n  // repository is wired, and every generated skill's first line points at\n  // `loam instructions <workflow>`. This list and MCP_TOOLS are two copies of\n  // one roster, and nothing counted them against each other until a tool\n  // advertised in `tools/list` and absent here answered a `tools/call` with\n  // `unknown command 'instructions'` — an envelope that reads as the caller's\n  // mistake. `test/mcp-serve.test.ts` now calls every advertised tool.\n  registerInstructions(program);\n  registerSteps(program);\n  if (authoring) {\n    registerNew(program);\n    registerRebase(program);\n    registerGherkin(program);\n    registerArchive(program);\n  }\n  return program;\n}\n\n/**\n * Run one tool argv. Never throws: whatever goes wrong becomes an envelope in\n * `stdout` with `code` 1, so the serve loop's answer to THIS call is the only\n * thing affected — one bad call must never take the server down, and a\n * memoised rejection cannot exist because nothing here outlives the call.\n */\nexport async function runToolArgv(\n  argv: readonly string[],\n  authoring = false,\n): Promise<DispatchResult> {\n  const sinks: Sinks = { stdout: [], stderr: [] };\n  const previousExitCode = process.exitCode;\n  const restoreConsole = captureConsole(sinks);\n  process.exitCode = undefined;\n  try {\n    await readProgram(sinks, authoring).parseAsync([\"node\", \"loam\", ...argv]);\n  } catch (err) {\n    if (err instanceof CommanderError) {\n      if (PASS_THROUGH.has(err.code)) {\n        // Unreachable through the tool schemas (the argv builder refuses every\n        // '-'-prefixed string, so --help/--version cannot arrive), kept for the\n        // day it is not: the output already sits in the sinks; keep its code.\n        if (process.exitCode === undefined) process.exitCode = err.exitCode;\n      } else {\n        // The same envelope cli.ts's catch emits for a usage error, so an MCP\n        // caller still receives machine-readable JSON, not a bare exception.\n        emitJsonError(\"invalid-option\", err.message.replace(/^error: /, \"\"));\n      }\n    } else {\n      // An unexpected throw from a command action: the CLI's own catch-all\n      // (`internal`) — the one code with no stable meaning, carried so the\n      // caller gets an envelope rather than a dead call.\n      emitJsonError(\"internal\", err instanceof Error ? err.message : String(err));\n    }\n  } finally {\n    restoreConsole();\n  }\n  const code = typeof process.exitCode === \"number\" ? process.exitCode : 0;\n  process.exitCode = previousExitCode;\n  return { stdout: sinks.stdout.join(\"\\n\"), stderr: sinks.stderr.join(\"\\n\"), code };\n}\n"]}
+{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../../../src/commands/mcp/dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxD,OAAO,EAAE,SAAS,EAAgB,MAAM,yBAAyB,CAAC;AAQlE;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG;IACrB,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO;IAChD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS;CAC1E,CAAC;AACX,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,OAAO,CAAU,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,KAAY;IACzC,MAAM,MAAM,GAAG,OAA6C,CAAC;IAC7D,MAAM,MAAM,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,CAAC,GAAG,KAAgB,EAAQ,EAAE;QAC/D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;IAC9B,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC5C,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI;QACjC,CAAC,cAAc,EAAE,QAAQ,CAAC;QAC1B,CAAC,cAAc,EAAE,QAAQ,CAAC;KAClB,EAAE,CAAC;QACX,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,kEAAkE;YAClE,2DAA2D;YAC3D,IAAI,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,UAAU;gBAAE,SAAS;YACjD,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,EAAE;QACV,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;IAC/D,CAAC,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,yBAAyB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAKjG;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAoB;IAC5C,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAC9B,CAAC,QAAQ,EAAE,cAAc,CAAC;IAC1B,CAAC,MAAM,EAAE,YAAY,CAAC;IACtB,CAAC,MAAM,EAAE,YAAY,CAAC;IACtB,CAAC,OAAO,EAAE,aAAa,CAAC;IACxB,CAAC,OAAO,EAAE,aAAa,CAAC;IACxB,CAAC,MAAM,EAAE,YAAY,CAAC;IACtB,CAAC,SAAS,EAAE,eAAe,CAAC;IAC5B,CAAC,cAAc,EAAE,oBAAoB,CAAC;IACtC,CAAC,QAAQ,EAAE,cAAc,CAAC;IAC1B,CAAC,SAAS,EAAE,eAAe,CAAC;IAC5B,CAAC,OAAO,EAAE,aAAa,CAAC;IACxB,CAAC,MAAM,EAAE,YAAY,CAAC;IACtB,CAAC,SAAS,EAAE,eAAe,CAAC;IAC5B,CAAC,cAAc,EAAE,oBAAoB,CAAC;IACtC,CAAC,OAAO,EAAE,aAAa,CAAC;IACxB,CAAC,KAAK,EAAE,WAAW,CAAC;IACpB,CAAC,QAAQ,EAAE,cAAc,CAAC;IAC1B,CAAC,SAAS,EAAE,eAAe,CAAC;IAC5B,CAAC,SAAS,EAAE,eAAe,CAAC;CAC7B,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAyB;IACzD,MAAM,QAAQ,GAAgB,EAAE,CAAC;IACjC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;;YACpD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,wDAAwD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;IACvJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,KAAY,EAAE,UAAgC;IACjE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,OAAO,CAAC,YAAY,EAAE,CAAC;IACvB,OAAO,CAAC,eAAe,CAAC;QACtB,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3C,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;KAC5C,CAAC,CAAC;IACH,KAAK,MAAM,QAAQ,IAAI,UAAU;QAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,KAAK,GAAuB,SAAS;IAC9D,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC5C,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,WAAW,CAAC,IAAuB,EAAE,UAAgC;IAClF,MAAM,KAAK,GAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAChD,MAAM,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC1C,MAAM,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YAClC,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,uEAAuE;gBACvE,wEAAwE;gBACxE,sEAAsE;gBACtE,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;oBAAE,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACN,sEAAsE;gBACtE,qEAAqE;gBACrE,aAAa,CAAC,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,qEAAqE;YACrE,qEAAqE;YACrE,mDAAmD;YACnD,aAAa,CAAC,UAAU,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;YAAS,CAAC;QACT,cAAc,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,QAAQ,GAAG,gBAAgB,CAAC;IACpC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;AACpF,CAAC","sourcesContent":["/**\n * In-process dispatch for one MCP tool call: build a fresh commander program\n * holding only the commands the selected tool table exposes, run the argv through\n * it, and hand back what the CLI would have printed.\n *\n * This is the proven harness pattern (test/helpers/harness.ts runLoamNow)\n * moved to the commands layer, minus the chdir: the server's own cwd IS the\n * workdir, so every call resolves loam.json exactly as the CLI would in that\n * directory — the server serves ONE repository, the one it started in, and\n * never changes directory. In-process rather than a child per call because a\n * child re-pays LikeC4/Langium startup on every validate, and because in dev\n * there is no built binary to exec.\n *\n * The capture is process-global (console, exitCode), which is safe under\n * exactly one condition the serve loop guarantees: calls are strictly\n * sequential — each one is awaited to completion before the next frame is\n * read — and `parseAsync` resolves only after the action has fully run (the\n * entire test suite rests on that same guarantee). Nothing here may be\n * module-level state: two serve sessions in one process (the tests do this)\n * must not see each other.\n *\n * NOTE for test/agents.test.ts's scan: registration happens through the\n * imported register functions; this module must never contain the literal\n * dot-command-paren call, comments included, or the CLI surface count breaks.\n */\nimport { Command, CommanderError } from \"commander\";\nimport { format } from \"node:util\";\nimport { emitJsonError } from \"../../core/envelope/json.js\";\nimport { registerValidate } from \"../validate/validate.js\";\nimport { registerStatus } from \"../status/status.js\";\nimport { registerList } from \"../list/list.js\";\nimport { registerShow } from \"../show/show.js\";\nimport { registerDelta } from \"../delta/delta.js\";\nimport { registerTasks } from \"../tasks/tasks.js\";\nimport { registerDiff } from \"../diff/diff.js\";\nimport { registerExplore } from \"../explore.js\";\nimport { registerDependencies } from \"../dependencies.js\";\nimport { registerDoctor } from \"../doctor.js\";\nimport { registerContext } from \"../context/context.js\";\nimport { registerAdopt } from \"../adopt/adopt.js\";\nimport { registerGate } from \"../gate/gate.js\";\nimport { registerExplain } from \"../explain/explain.js\";\nimport { registerInstructions } from \"../instructions.js\";\nimport { registerSteps } from \"../steps/steps.js\";\nimport { registerNew } from \"../new/new.js\";\nimport { registerRebase } from \"../rebase/rebase.js\";\nimport { registerGherkin } from \"../gherkin/gherkin.js\";\nimport { registerArchive } from \"../archive/archive.js\";\nimport type { ToolRunOutcome } from \"../../core/mcp/protocol.js\";\nimport type { ToolRunner } from \"./serve.js\";\nimport { MCP_TOOLS, type McpTool } from \"../../core/mcp/tools.js\";\n\n/** Console sinks for one dispatch — a value, not module state, so calls cannot share buffers. */\nexport interface Sinks {\n  readonly stdout: string[];\n  readonly stderr: string[];\n}\n\n/**\n * Every console method Node's Console writes to STDOUT — the protocol stream,\n * where one stray line corrupts the transport. Hooking only `log` was the\n * reviewed defect here: a `console.info` in any command, or in a dependency a\n * command loads, would have written straight into the client's frame stream\n * with every suite green. `warn`/`error` go to stderr, captured for the\n * server log rather than the wire.\n */\nconst STDOUT_METHODS = [\n  \"log\", \"info\", \"debug\", \"dir\", \"dirxml\", \"table\",\n  \"group\", \"groupCollapsed\", \"groupEnd\", \"count\", \"countReset\", \"timeLog\", \"timeEnd\",\n] as const;\nconst STDERR_METHODS = [\"warn\", \"error\"] as const;\n\n/**\n * Replace the console methods named above with sink writers; the returned\n * function restores every original. Captured output is `format(...)`ed, so\n * `table`/`group` lose their layout — acceptable on purpose: the invariant\n * bought here is that their BYTES stay off the protocol stream, not that\n * their rendering survives.\n */\nexport function captureConsole(sinks: Sinks): () => void {\n  const target = console as unknown as Record<string, unknown>;\n  const writer = (sink: string[]) => (...parts: unknown[]): void => {\n    sink.push(format(...parts));\n  };\n  const toStdout = writer(sinks.stdout);\n  const toStderr = writer(sinks.stderr);\n  const original = new Map<string, unknown>();\n  for (const [names, replacement] of [\n    [STDOUT_METHODS, toStdout],\n    [STDERR_METHODS, toStderr],\n  ] as const) {\n    for (const name of names) {\n      // A method absent on this Node build has nothing to capture — and\n      // nothing to restore, so it must not enter the map either.\n      if (typeof target[name] !== \"function\") continue;\n      original.set(name, target[name]);\n      target[name] = replacement;\n    }\n  }\n  return () => {\n    for (const [name, method] of original) target[name] = method;\n  };\n}\n\n/** Commander output codes whose printed output is the point, not a usage failure. */\nconst PASS_THROUGH = new Set([\"commander.help\", \"commander.helpDisplayed\", \"commander.version\"]);\n\n/** One command's registration onto a program — the shape every `registerX` export has. */\ntype Registrar = (program: Command) => void;\n\n/**\n * Every command a tool table may name, keyed by the `command` its tool carries.\n * A LOOKUP, not a roster: which of these a call's program registers is decided\n * by the active tool table alone (`toolRunner`), so the authoring writers —\n * new, rebase, gherkin, archive — exist in it only when `--author` put their\n * tools in the table, and the table the read-only hints describe is the one\n * place that gate is written.\n *\n * `instructions` and `steps` read no config at all, and are in MCP_TOOLS\n * because an agent meets them BEFORE the repository is wired: every generated\n * skill's first line points at `loam instructions <workflow>`. They are why\n * registration follows the table. This list and MCP_TOOLS used to be two\n * copies of one roster, and nothing counted them against each other until a\n * tool advertised in `tools/list` and absent here answered a `tools/call` with\n * `unknown command 'instructions'` — an envelope that reads as the caller's\n * mistake. `test/mcp-serve.test.ts` calls every advertised tool, and checks\n * this lookup against both tables directly.\n */\nconst REGISTRARS = new Map<string, Registrar>([\n  [\"validate\", registerValidate],\n  [\"status\", registerStatus],\n  [\"list\", registerList],\n  [\"show\", registerShow],\n  [\"delta\", registerDelta],\n  [\"tasks\", registerTasks],\n  [\"diff\", registerDiff],\n  [\"explore\", registerExplore],\n  [\"dependencies\", registerDependencies],\n  [\"doctor\", registerDoctor],\n  [\"context\", registerContext],\n  [\"adopt\", registerAdopt],\n  [\"gate\", registerGate],\n  [\"explain\", registerExplain],\n  [\"instructions\", registerInstructions],\n  [\"steps\", registerSteps],\n  [\"new\", registerNew],\n  [\"rebase\", registerRebase],\n  [\"gherkin\", registerGherkin],\n  [\"archive\", registerArchive],\n]);\n\n/**\n * Resolve every command `tools` name to its registrar, or throw naming each\n * one that has none. This is the server's STARTUP check, and it runs once per\n * table: `toolRunner` calls it before the first frame is read, so a tool\n * advertised with no registrar — the roster drift above, arriving again —\n * stops `loam mcp` at launch, through cli.ts's catch like any other throw,\n * before a client has been promised anything. It used to run inside every call's program build, where one\n * missing entry turned EVERY `tools/call` into an `internal` envelope naming\n * it, the tools that were wired correctly included: a call's outcome\n * depended on a tool it never named.\n */\nexport function resolveRegistrars(tools: readonly McpTool[]): readonly Registrar[] {\n  const resolved: Registrar[] = [];\n  const missing: string[] = [];\n  for (const command of new Set(tools.map((tool) => tool.command))) {\n    const register = REGISTRARS.get(command);\n    if (register === undefined) missing.push(`'${command}'`);\n    else resolved.push(register);\n  }\n  if (missing.length > 0) {\n    throw new Error(`loam mcp: no command registered for MCP tool command ${missing.join(\", \")} — add it to REGISTRARS in src/commands/mcp/dispatch.ts`);\n  }\n  return resolved;\n}\n\n/**\n * The scoped program, output routed into `sinks`, holding exactly the commands\n * the resolved table names. configureOutput and exitOverride are set BEFORE the\n * register calls on purpose: commander copies inherited settings onto a\n * subcommand when it is created, so settings applied after registration would\n * leave every subcommand writing to the real stdout — which for an MCP server\n * is the protocol stream.\n */\nfunction readProgram(sinks: Sinks, registrars: readonly Registrar[]): Command {\n  const program = new Command();\n  program.name(\"loam\");\n  program.exitOverride();\n  program.configureOutput({\n    writeOut: (text) => sinks.stdout.push(text),\n    writeErr: (text) => sinks.stderr.push(text),\n  });\n  for (const register of registrars) register(program);\n  return program;\n}\n\n/**\n * The runner `loam mcp` serves `tools` with. Throws HERE, at construction, when\n * the table names a command with no registrar (`resolveRegistrars`); the\n * runner it returns never throws, and builds each call's program from the\n * registrars resolved once — so no call can fail for the sake of a tool it\n * did not name.\n */\nexport function toolRunner(tools: readonly McpTool[] = MCP_TOOLS): ToolRunner {\n  const registrars = resolveRegistrars(tools);\n  return (argv) => runToolArgv(argv, registrars);\n}\n\n/**\n * Run one tool argv. Never throws: whatever goes wrong becomes an envelope in\n * `stdout` with `code` 1, so the serve loop's answer to THIS call is the only\n * thing affected — one bad call must never take the server down, and a\n * memoised rejection cannot exist because nothing here outlives the call.\n */\nasync function runToolArgv(argv: readonly string[], registrars: readonly Registrar[]): Promise<ToolRunOutcome> {\n  const sinks: Sinks = { stdout: [], stderr: [] };\n  const previousExitCode = process.exitCode;\n  const restoreConsole = captureConsole(sinks);\n  process.exitCode = undefined;\n  try {\n    await readProgram(sinks, registrars).parseAsync([\"node\", \"loam\", ...argv]);\n  } catch (err) {\n    if (err instanceof CommanderError) {\n      if (PASS_THROUGH.has(err.code)) {\n        // Unreachable through the tool schemas (the argv builder refuses every\n        // '-'-prefixed string, so --help/--version cannot arrive), kept for the\n        // day it is not: the output already sits in the sinks; keep its code.\n        if (process.exitCode === undefined) process.exitCode = err.exitCode;\n      } else {\n        // The same envelope cli.ts's catch emits for a usage error, so an MCP\n        // caller still receives machine-readable JSON, not a bare exception.\n        emitJsonError(\"invalid-option\", err.message.replace(/^error: /, \"\"));\n      }\n    } else {\n      // An unexpected throw from a command action: the CLI's own catch-all\n      // (`internal`) — the one code with no stable meaning, carried so the\n      // caller gets an envelope rather than a dead call.\n      emitJsonError(\"internal\", err instanceof Error ? err.message : String(err));\n    }\n  } finally {\n    restoreConsole();\n  }\n  const code = typeof process.exitCode === \"number\" ? process.exitCode : 0;\n  process.exitCode = previousExitCode;\n  return { stdout: sinks.stdout.join(\"\\n\"), stderr: sinks.stderr.join(\"\\n\"), code };\n}\n"]}

package/dist/commands/mcp/mcp.js

@@ -1,4 +1,4 @@
-import { runToolArgv } from "./dispatch.js";
+import { toolRunner } from "./dispatch.js";
 import { serve } from "./serve.js";
 import { MCP_TOOLS } from "../../core/mcp/tools.js";
 import { MCP_AUTHOR_TOOLS } from "../../core/mcp/author-tools.js";
@@ -15,20 +15,61 @@ export function registerMcp(program) {
         // is JSON-RPC frames either way; there is no human rendering to switch off.
         .option("--json", "emit the machine contract instead of the human view")
         .action(async (opts) => {
-        // No docs-repo gate at startup, deliberately (the add-command preamble
-        // decision): a launch-time refusal would print a non-JSON-RPC line into
-        // the client's protocol stream and kill the handshake with nothing a
-        // client can parse. Every tool call flows through the same command path
-        // the CLI uses, so a missing or broken loam.json arrives as the ordinary
-        // `no-config`/`config-invalid` envelope in a tool result — readable, and
-        // actionable, by the agent on the other end. The server serves the
-        // repository it was started in (each call resolves loam.json through
-        // process.cwd()) and never changes directory.
-        const tools = opts.author ? [...MCP_TOOLS, ...MCP_AUTHOR_TOOLS] : MCP_TOOLS;
-        const run = opts.author
-            ? (argv) => runToolArgv(argv, true)
-            : runToolArgv;
-        await serve({ input: process.stdin, output: process.stdout, log: process.stderr }, run, tools);
+        await startMcp(mcpToolTable(opts.author === true), {
+            input: process.stdin,
+            output: process.stdout,
+            log: process.stderr,
+        });
     });
 }
+/**
+ * The table `loam mcp` serves: the read surface, and the bounded writers after
+ * it only when the server was launched with `--author`.
+ *
+ * A function of its own, exported, because nothing pinned it inline. The
+ * in-process tests hand `startMcp` a table directly and the stdio smoke
+ * spawned `loam mcp` only without the flag, so this choice written as
+ * `MCP_TOOLS` alone left every test green — while every config `loam init
+ * --mcp-author` writes launches `loam mcp --author`, and those hosts would
+ * have lost the authoring tools without a word. test/mcp-serve.test.ts holds
+ * both values here; test/mcp-stdio.test.ts spawns `loam mcp --author` and holds
+ * the flag to it.
+ */
+export function mcpToolTable(author) {
+    return author ? [...MCP_TOOLS, ...MCP_AUTHOR_TOOLS] : MCP_TOOLS;
+}
+/**
+ * The action's body: serve `tools` on `io` until its input ends — or refuse
+ * before the first byte when the table itself is defective.
+ *
+ * Exported, with the stdio triple injected, so the startup refusal is pinned
+ * WHERE it happens. A test of `toolRunner` alone could not see the wiring
+ * here: rewritten as `(argv) => toolRunner(tools)(argv)`, every call would
+ * build its own runner, the refusal would move back to every `tools/call`, and
+ * a test that only called `toolRunner` would still pass.
+ */
+export function startMcp(tools, io) {
+    // No docs-repo gate at startup, deliberately (the add-command preamble
+    // decision): a launch-time refusal would print a non-JSON-RPC line into
+    // the client's protocol stream and kill the handshake with nothing a
+    // client can parse. Every tool call flows through the same command path
+    // the CLI uses, so a missing or broken loam.json arrives as the ordinary
+    // `no-config`/`config-invalid` envelope in a tool result — readable, and
+    // actionable, by the agent on the other end. The server serves the
+    // repository it was started in (each call resolves loam.json through
+    // process.cwd()) and never changes directory.
+    // One table decides both what `tools/list` advertises and which commands
+    // a `tools/call` can reach (`./dispatch.ts`'s `toolRunner`).
+    //
+    // `toolRunner` is the ONE launch-time refusal, and it is not the gate the
+    // paragraph above declines: it throws only when the table itself names a
+    // command with no registrar — a defect in the shipped binary that no
+    // repository state causes and no client can repair. Refusing here, before
+    // the first frame, costs the handshake; answering it per call instead
+    // turned every `tools/call` into an `internal` envelope, the correctly
+    // wired tools included. Without `--json` (how a client launches it) the
+    // message goes to stderr through cli.ts's catch, and stdout stays empty.
+    const run = toolRunner(tools);
+    return serve(io, run, tools);
+}
 //# sourceMappingURL=mcp.js.map

package/dist/commands/mcp/mcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../src/commands/mcp/mcp.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAMlE,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,OAAO;SACJ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,UAAU,EAAE,4EAA4E,CAAC;QACjG,mEAAmE;QACnE,2EAA2E;QAC3E,4EAA4E;QAC5E,sEAAsE;QACtE,yEAAyE;QACzE,4EAA4E;SAC3E,MAAM,CAAC,QAAQ,EAAE,qDAAqD,CAAC;SACvE,MAAM,CAAC,KAAK,EAAE,IAAgB,EAAE,EAAE;QACjC,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,wEAAwE;QACxE,yEAAyE;QACzE,yEAAyE;QACzE,mEAAmE;QACnE,qEAAqE;QACrE,8CAA8C;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM;YACrB,CAAC,CAAC,CAAC,IAAuB,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC;YACtD,CAAC,CAAC,WAAW,CAAC;QAChB,MAAM,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;AACP,CAAC","sourcesContent":["/**\n * `loam mcp` — serve the read surface, plus bounded writers under `--author`.\n *\n * The action wires the real stdio triple into the serve loop and waits for\n * stdin EOF; everything with a decision in it lives in `./serve.ts`,\n * `./dispatch.ts` and `src/core/mcp/`. This module carries the one command\n * registration of the package (test/agents.test.ts counts registrations by\n * their literal spelling, so the sibling modules must never spell one).\n */\nimport type { Command } from \"commander\";\nimport { runToolArgv } from \"./dispatch.js\";\nimport { serve } from \"./serve.js\";\nimport { MCP_TOOLS } from \"../../core/mcp/tools.js\";\nimport { MCP_AUTHOR_TOOLS } from \"../../core/mcp/author-tools.js\";\n\ninterface McpOptions {\n  author?: boolean;\n}\n\nexport function registerMcp(program: Command): void {\n  program\n    .command(\"mcp\")\n    .description(\"Serve loam commands as MCP tools over stdio (JSON-RPC 2.0)\")\n    .option(\"--author\", \"opt in to safe authoring tools; vouch and committing archive stay excluded\")\n    // Declared for the uniform surface every command owes (`--json` is\n    // mandatory, test/agents.test.ts), and it is not inert: it governs the one\n    // pre-loop surface this command has — a usage error like `loam mcp --bogus`\n    // aborts before the action runs, and cli.ts's catch reads raw argv to\n    // decide whether that refusal is an envelope. Once the loop runs, stdout\n    // is JSON-RPC frames either way; there is no human rendering to switch off.\n    .option(\"--json\", \"emit the machine contract instead of the human view\")\n    .action(async (opts: McpOptions) => {\n      // No docs-repo gate at startup, deliberately (the add-command preamble\n      // decision): a launch-time refusal would print a non-JSON-RPC line into\n      // the client's protocol stream and kill the handshake with nothing a\n      // client can parse. Every tool call flows through the same command path\n      // the CLI uses, so a missing or broken loam.json arrives as the ordinary\n      // `no-config`/`config-invalid` envelope in a tool result — readable, and\n      // actionable, by the agent on the other end. The server serves the\n      // repository it was started in (each call resolves loam.json through\n      // process.cwd()) and never changes directory.\n      const tools = opts.author ? [...MCP_TOOLS, ...MCP_AUTHOR_TOOLS] : MCP_TOOLS;\n      const run = opts.author\n        ? (argv: readonly string[]) => runToolArgv(argv, true)\n        : runToolArgv;\n      await serve({ input: process.stdin, output: process.stdout, log: process.stderr }, run, tools);\n    });\n}\n"]}
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../src/commands/mcp/mcp.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAgB,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,SAAS,EAAgB,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAMlE,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,OAAO;SACJ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,UAAU,EAAE,4EAA4E,CAAC;QACjG,mEAAmE;QACnE,2EAA2E;QAC3E,4EAA4E;QAC5E,sEAAsE;QACtE,yEAAyE;QACzE,4EAA4E;SAC3E,MAAM,CAAC,QAAQ,EAAE,qDAAqD,CAAC;SACvE,MAAM,CAAC,KAAK,EAAE,IAAgB,EAAE,EAAE;QACjC,MAAM,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE;YACjD,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,OAAO,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,MAAe;IAC1C,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAyB,EAAE,EAAW;IAC7D,uEAAuE;IACvE,wEAAwE;IACxE,qEAAqE;IACrE,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,mEAAmE;IACnE,qEAAqE;IACrE,8CAA8C;IAC9C,yEAAyE;IACzE,6DAA6D;IAC7D,EAAE;IACF,0EAA0E;IAC1E,yEAAyE;IACzE,qEAAqE;IACrE,0EAA0E;IAC1E,sEAAsE;IACtE,uEAAuE;IACvE,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;AAC/B,CAAC","sourcesContent":["/**\n * `loam mcp` — serve the read surface, plus bounded writers under `--author`.\n *\n * The action asks `mcpToolTable` which table its flag selects and hands it,\n * with the real stdio triple, to `startMcp`, which resolves the table once and\n * serves it until stdin EOF; everything else with a decision in it lives in\n * `./serve.ts`, `./dispatch.ts` and `src/core/mcp/`. This module carries the\n * one command registration of the package (test/agents.test.ts counts\n * registrations by their literal spelling, so the sibling modules must never\n * spell one).\n */\nimport type { Command } from \"commander\";\nimport { toolRunner } from \"./dispatch.js\";\nimport { serve, type ServeIo } from \"./serve.js\";\nimport { MCP_TOOLS, type McpTool } from \"../../core/mcp/tools.js\";\nimport { MCP_AUTHOR_TOOLS } from \"../../core/mcp/author-tools.js\";\n\ninterface McpOptions {\n  author?: boolean;\n}\n\nexport function registerMcp(program: Command): void {\n  program\n    .command(\"mcp\")\n    .description(\"Serve loam commands as MCP tools over stdio (JSON-RPC 2.0)\")\n    .option(\"--author\", \"opt in to safe authoring tools; vouch and committing archive stay excluded\")\n    // Declared for the uniform surface every command owes (`--json` is\n    // mandatory, test/agents.test.ts), and it is not inert: it governs the one\n    // pre-loop surface this command has — a usage error like `loam mcp --bogus`\n    // aborts before the action runs, and cli.ts's catch reads raw argv to\n    // decide whether that refusal is an envelope. Once the loop runs, stdout\n    // is JSON-RPC frames either way; there is no human rendering to switch off.\n    .option(\"--json\", \"emit the machine contract instead of the human view\")\n    .action(async (opts: McpOptions) => {\n      await startMcp(mcpToolTable(opts.author === true), {\n        input: process.stdin,\n        output: process.stdout,\n        log: process.stderr,\n      });\n    });\n}\n\n/**\n * The table `loam mcp` serves: the read surface, and the bounded writers after\n * it only when the server was launched with `--author`.\n *\n * A function of its own, exported, because nothing pinned it inline. The\n * in-process tests hand `startMcp` a table directly and the stdio smoke\n * spawned `loam mcp` only without the flag, so this choice written as\n * `MCP_TOOLS` alone left every test green — while every config `loam init\n * --mcp-author` writes launches `loam mcp --author`, and those hosts would\n * have lost the authoring tools without a word. test/mcp-serve.test.ts holds\n * both values here; test/mcp-stdio.test.ts spawns `loam mcp --author` and holds\n * the flag to it.\n */\nexport function mcpToolTable(author: boolean): readonly McpTool[] {\n  return author ? [...MCP_TOOLS, ...MCP_AUTHOR_TOOLS] : MCP_TOOLS;\n}\n\n/**\n * The action's body: serve `tools` on `io` until its input ends — or refuse\n * before the first byte when the table itself is defective.\n *\n * Exported, with the stdio triple injected, so the startup refusal is pinned\n * WHERE it happens. A test of `toolRunner` alone could not see the wiring\n * here: rewritten as `(argv) => toolRunner(tools)(argv)`, every call would\n * build its own runner, the refusal would move back to every `tools/call`, and\n * a test that only called `toolRunner` would still pass.\n */\nexport function startMcp(tools: readonly McpTool[], io: ServeIo): Promise<void> {\n  // No docs-repo gate at startup, deliberately (the add-command preamble\n  // decision): a launch-time refusal would print a non-JSON-RPC line into\n  // the client's protocol stream and kill the handshake with nothing a\n  // client can parse. Every tool call flows through the same command path\n  // the CLI uses, so a missing or broken loam.json arrives as the ordinary\n  // `no-config`/`config-invalid` envelope in a tool result — readable, and\n  // actionable, by the agent on the other end. The server serves the\n  // repository it was started in (each call resolves loam.json through\n  // process.cwd()) and never changes directory.\n  // One table decides both what `tools/list` advertises and which commands\n  // a `tools/call` can reach (`./dispatch.ts`'s `toolRunner`).\n  //\n  // `toolRunner` is the ONE launch-time refusal, and it is not the gate the\n  // paragraph above declines: it throws only when the table itself names a\n  // command with no registrar — a defect in the shipped binary that no\n  // repository state causes and no client can repair. Refusing here, before\n  // the first frame, costs the handshake; answering it per call instead\n  // turned every `tools/call` into an `internal` envelope, the correctly\n  // wired tools included. Without `--json` (how a client launches it) the\n  // message goes to stderr through cli.ts's catch, and stdout stays empty.\n  const run = toolRunner(tools);\n  return serve(io, run, tools);\n}\n"]}

package/dist/commands/mcp/serve.js.map

@@ -1 +1 @@
-{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../../src/commands/mcp/serve.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EACL,cAAc,EACd,aAAa,EACb,cAAc,EACd,SAAS,EACT,SAAS,GACV,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,SAAS,EAAgB,MAAM,yBAAyB,CAAC;AAWlE,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,EAAW,EACX,OAAmB,EACnB,KAAK,GAAuB,SAAS;IAErC,2EAA2E;IAC3E,mEAAmE;IACnE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,qBAAqB,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAChE,2EAA2E;IAC3E,kEAAkE;IAClE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAChD,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QAClB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK;YAAE,MAAM,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7E,CAAC;IACD,6EAA6E;IAC7E,yDAAyD;IACzD,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,IAAY,EACZ,EAAW,EACX,OAAmB,EACnB,KAAyB;IAEzB,MAAM,OAAO,GAAiB,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO;IACtC,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IACD,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,UAAU,CACvB,IAA6C,EAC7C,EAAW,EACX,OAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7B,yEAAyE;YACzE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,QAAQ,YAAY,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CACnB,KAAK,CAAC,IAAI,KAAK,QAAQ;YACrB,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC;YACvC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CACtD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yEAAyE;QACzE,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,QAAQ,YAAY,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACvG,CAAC;AACH,CAAC","sourcesContent":["/**\n * The MCP stdio loop: read newline-delimited JSON-RPC frames from `input`,\n * answer on `output`, log on `log`. Streams are injected so the tests drive\n * a whole session in-process with PassThrough pairs; `loam mcp` passes the\n * real stdio triple.\n *\n * Two invariants everything else leans on:\n *\n * - `output` carries protocol frames and NOTHING else — every byte goes\n *   through `frame()`. Command output cannot leak here: the dispatcher hooks\n *   console and commander's own writers, and no command in src/ writes to\n *   process.stdout directly (verified at implementation time; the dispatcher\n *   comment records the guarantee it needs). Logging — the startup line, a\n *   tool's captured stderr — goes to `log`, which MCP permits.\n *\n * - Frames are handled STRICTLY SEQUENTIALLY: each one is awaited before the\n *   next is looked at. This is not an optimization opportunity — the\n *   dispatcher's console capture is process-global, so two overlapping calls\n *   would interleave their captured output into each other's envelopes.\n *\n * The loop ends when `input` ends: per the MCP stdio lifecycle the client\n * closes stdin to shut the server down, so EOF resolves this promise, the\n * action resolves, and cli.ts — the only process-exit decider — lets the\n * process drain to exit 0. No signal handling, no exit call here.\n */\nimport type { Readable, Writable } from \"node:stream\";\nimport { frame, splitFrames } from \"../../core/mcp/framing.js\";\nimport {\n  INTERNAL_ERROR,\n  errorResponse,\n  resultResponse,\n  routeLine,\n  toolReply,\n} from \"../../core/mcp/protocol.js\";\nimport type { RouteOutcome } from \"../../core/mcp/protocol.js\";\nimport type { DispatchResult } from \"./dispatch.js\";\nimport { MCP_TOOLS, type McpTool } from \"../../core/mcp/tools.js\";\n\nexport interface ServeIo {\n  readonly input: Readable;\n  readonly output: Writable;\n  readonly log: Writable;\n}\n\n/** The dispatcher, as a parameter: serve() stays testable with a stub and owns no registration. */\nexport type ToolRunner = (argv: readonly string[]) => Promise<DispatchResult>;\n\nexport async function serve(\n  io: ServeIo,\n  runTool: ToolRunner,\n  tools: readonly McpTool[] = MCP_TOOLS,\n): Promise<void> {\n  // One startup line, to stderr only — a client is entitled to a stdout that\n  // has never carried anything but frames, from the very first byte.\n  io.log.write(`loam mcp: serving ${process.cwd()} over stdio\\n`);\n  // Decode at the stream, not per chunk: a UTF-8 code point split across two\n  // chunks would corrupt if each chunk were stringified on its own.\n  io.input.setEncoding(\"utf8\");\n  let rest = \"\";\n  for await (const chunk of io.input) {\n    const split = splitFrames(rest + String(chunk));\n    rest = split.rest;\n    for (const line of split.lines) await handleLine(line, io, runTool, tools);\n  }\n  // A final frame the client sent without a trailing newline is still a frame:\n  // EOF terminates it exactly as the delimiter would have.\n  if (rest.trim() !== \"\") await handleLine(rest, io, runTool, tools);\n}\n\nasync function handleLine(\n  line: string,\n  io: ServeIo,\n  runTool: ToolRunner,\n  tools: readonly McpTool[],\n): Promise<void> {\n  const outcome: RouteOutcome = routeLine(line, tools);\n  if (outcome.kind === \"ignore\") return;\n  if (outcome.kind === \"reply\") {\n    io.output.write(frame(outcome.response));\n    return;\n  }\n  await handleCall(outcome, io, runTool);\n}\n\n/** One tools/call, contained: whatever this call does, the loop survives it. */\nasync function handleCall(\n  call: Extract<RouteOutcome, { kind: \"call\" }>,\n  io: ServeIo,\n  runTool: ToolRunner,\n): Promise<void> {\n  try {\n    const run = await runTool(call.argv);\n    if (run.stderr.trim() !== \"\") {\n      // A command's diagnostics are server-side logging, never protocol bytes.\n      io.log.write(`loam mcp: ${call.toolName} stderr: ${run.stderr.trim()}\\n`);\n    }\n    const reply = toolReply(run);\n    io.output.write(frame(\n      reply.kind === \"result\"\n        ? resultResponse(call.id, reply.result)\n        : errorResponse(call.id, reply.code, reply.message),\n    ));\n  } catch (err) {\n    // The dispatcher already converts everything it can into an envelope, so\n    // reaching here means the failure was outside it (or in the wrapping\n    // itself). It becomes a JSON-RPC error for THIS id — the caller learns\n    // which call died, with the reason — and the loop reads the next frame.\n    const detail = err instanceof Error ? err.message : String(err);\n    io.output.write(frame(errorResponse(call.id, INTERNAL_ERROR, `${call.toolName} failed: ${detail}`)));\n  }\n}\n"]}
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../../src/commands/mcp/serve.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EACL,cAAc,EACd,aAAa,EACb,cAAc,EACd,SAAS,EACT,SAAS,GACV,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,SAAS,EAAgB,MAAM,yBAAyB,CAAC;AAWlE,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,EAAW,EACX,OAAmB,EACnB,KAAK,GAAuB,SAAS;IAErC,2EAA2E;IAC3E,mEAAmE;IACnE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,qBAAqB,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAChE,2EAA2E;IAC3E,kEAAkE;IAClE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAChD,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QAClB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK;YAAE,MAAM,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7E,CAAC;IACD,6EAA6E;IAC7E,yDAAyD;IACzD,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,IAAY,EACZ,EAAW,EACX,OAAmB,EACnB,KAAyB;IAEzB,MAAM,OAAO,GAAiB,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO;IACtC,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IACD,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,UAAU,CACvB,IAA6C,EAC7C,EAAW,EACX,OAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7B,yEAAyE;YACzE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,QAAQ,YAAY,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CACnB,KAAK,CAAC,IAAI,KAAK,QAAQ;YACrB,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC;YACvC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CACtD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yEAAyE;QACzE,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,QAAQ,YAAY,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACvG,CAAC;AACH,CAAC","sourcesContent":["/**\n * The MCP stdio loop: read newline-delimited JSON-RPC frames from `input`,\n * answer on `output`, log on `log`. Streams are injected so the tests drive\n * a whole session in-process with PassThrough pairs; `loam mcp` passes the\n * real stdio triple.\n *\n * Two invariants everything else leans on:\n *\n * - `output` carries protocol frames and NOTHING else — every byte goes\n *   through `frame()`. Command output cannot leak here: the dispatcher hooks\n *   console and commander's own writers, and no command in src/ writes to\n *   process.stdout directly (verified at implementation time; the dispatcher\n *   comment records the guarantee it needs). Logging — the startup line, a\n *   tool's captured stderr — goes to `log`, which MCP permits.\n *\n * - Frames are handled STRICTLY SEQUENTIALLY: each one is awaited before the\n *   next is looked at. This is not an optimization opportunity — the\n *   dispatcher's console capture is process-global, so two overlapping calls\n *   would interleave their captured output into each other's envelopes.\n *\n * The loop ends when `input` ends: per the MCP stdio lifecycle the client\n * closes stdin to shut the server down, so EOF resolves this promise, the\n * action resolves, and cli.ts — the only process-exit decider — lets the\n * process drain to exit 0. No signal handling, no exit call here.\n */\nimport type { Readable, Writable } from \"node:stream\";\nimport { frame, splitFrames } from \"../../core/mcp/framing.js\";\nimport {\n  INTERNAL_ERROR,\n  errorResponse,\n  resultResponse,\n  routeLine,\n  toolReply,\n} from \"../../core/mcp/protocol.js\";\nimport type { RouteOutcome, ToolRunOutcome } from \"../../core/mcp/protocol.js\";\nimport { MCP_TOOLS, type McpTool } from \"../../core/mcp/tools.js\";\n\nexport interface ServeIo {\n  readonly input: Readable;\n  readonly output: Writable;\n  readonly log: Writable;\n}\n\n/** The dispatcher, as a parameter: serve() stays testable with a stub and owns no registration. */\nexport type ToolRunner = (argv: readonly string[]) => Promise<ToolRunOutcome>;\n\nexport async function serve(\n  io: ServeIo,\n  runTool: ToolRunner,\n  tools: readonly McpTool[] = MCP_TOOLS,\n): Promise<void> {\n  // One startup line, to stderr only — a client is entitled to a stdout that\n  // has never carried anything but frames, from the very first byte.\n  io.log.write(`loam mcp: serving ${process.cwd()} over stdio\\n`);\n  // Decode at the stream, not per chunk: a UTF-8 code point split across two\n  // chunks would corrupt if each chunk were stringified on its own.\n  io.input.setEncoding(\"utf8\");\n  let rest = \"\";\n  for await (const chunk of io.input) {\n    const split = splitFrames(rest + String(chunk));\n    rest = split.rest;\n    for (const line of split.lines) await handleLine(line, io, runTool, tools);\n  }\n  // A final frame the client sent without a trailing newline is still a frame:\n  // EOF terminates it exactly as the delimiter would have.\n  if (rest.trim() !== \"\") await handleLine(rest, io, runTool, tools);\n}\n\nasync function handleLine(\n  line: string,\n  io: ServeIo,\n  runTool: ToolRunner,\n  tools: readonly McpTool[],\n): Promise<void> {\n  const outcome: RouteOutcome = routeLine(line, tools);\n  if (outcome.kind === \"ignore\") return;\n  if (outcome.kind === \"reply\") {\n    io.output.write(frame(outcome.response));\n    return;\n  }\n  await handleCall(outcome, io, runTool);\n}\n\n/** One tools/call, contained: whatever this call does, the loop survives it. */\nasync function handleCall(\n  call: Extract<RouteOutcome, { kind: \"call\" }>,\n  io: ServeIo,\n  runTool: ToolRunner,\n): Promise<void> {\n  try {\n    const run = await runTool(call.argv);\n    if (run.stderr.trim() !== \"\") {\n      // A command's diagnostics are server-side logging, never protocol bytes.\n      io.log.write(`loam mcp: ${call.toolName} stderr: ${run.stderr.trim()}\\n`);\n    }\n    const reply = toolReply(run);\n    io.output.write(frame(\n      reply.kind === \"result\"\n        ? resultResponse(call.id, reply.result)\n        : errorResponse(call.id, reply.code, reply.message),\n    ));\n  } catch (err) {\n    // The dispatcher already converts everything it can into an envelope, so\n    // reaching here means the failure was outside it (or in the wrapping\n    // itself). It becomes a JSON-RPC error for THIS id — the caller learns\n    // which call died, with the reason — and the loop reads the next frame.\n    const detail = err instanceof Error ? err.message : String(err);\n    io.output.write(frame(errorResponse(call.id, INTERNAL_ERROR, `${call.toolName} failed: ${detail}`)));\n  }\n}\n"]}