actual-mcp-server 0.11.4 → 0.11.6

package/README.md

@@ -41,7 +41,7 @@ Most Actual Budget MCP implementations are simple stdio bridges designed for sin
 - **74 tools, the most comprehensive coverage available.** Accounts, transactions, categories, payees, tags, notes, rules, budgets, batch operations, bank sync, and more. Covers the reachable Actual Budget API with no genuine gaps.
 - **HTTP and stdio transport.** Runs as a real remote server for LibreChat/LobeChat (`--http`), or as a direct local process for Claude Desktop (`--stdio`). No Docker or HTTP server is needed for local use.
 - **6 exclusive ActualQL-powered tools.** Search and summarise transactions by month, amount, category, or payee using Actual Budget's native query engine. Aggregated results, no raw data dumped into the AI context window.
-- **Multi-budget switching at runtime.** Configure multiple budget files and let the AI switch between them mid-conversation with `actual_budgets_switch`.
+- **Multi-budget switching at runtime.** Configure multiple budget files and let the AI switch between them mid-conversation with `actual_budgets_switch`. Works on both transports: HTTP keys the active budget to the MCP session, and stdio (Claude Desktop, Claude Code, Cursor) gets a synthetic per-process session so a switch is scoped to that process rather than shared globally (#348).
 - **Multi-user ready with OIDC.** Secure every session with JWKS-validated JWTs and per-user budget ACLs. No shared tokens required.
 - **Production-grade reliability.** Connection pooling (up to 15 concurrent sessions), automatic retry with exponential backoff, and a full test suite (unit + E2E + integration).
 
@@ -774,4 +774,4 @@ The software is provided **as-is**, without warranty of any kind. The author acc
 
 ---
 
-**Version:** 0.11.4 | **Tool Count:** 74 (verified LibreChat-compatible)
+**Version:** 0.11.6 | **Tool Count:** 74 (verified LibreChat-compatible)

package/dist/src/lib/ActualConnectionPool.js

@@ -172,6 +172,28 @@ class ActualConnectionPool {
      * downloadBudget(newSyncId) call. switchBudget's fast path uses this so
      * subsequent comparisons reflect the loaded budget. See #172.
      */
+    /**
+     * #349 (review follow-up): invalidate the tracked syncId on EVERY entry.
+     *
+     * `@actual-app/api` is a process-global singleton with ONE loaded budget, while
+     * this pool tracks up to MAX_CONCURRENT_SESSIONS entries that each carry their
+     * own `syncId`. An import performed by session A therefore changes the loaded
+     * budget for sessions B..N as well, but only A knows it happened. Invalidating
+     * A alone leaves B's next switchBudget matching the #172 fast path against a
+     * record that is no longer true, returning success while B operates on A's
+     * imported budget: the same failure #349 fixed, arriving from a direction the
+     * user cannot see.
+     *
+     * Returns the number of entries invalidated, for logging.
+     */
+    invalidateAllLoadedSyncIds(sentinel) {
+        let n = 0;
+        for (const entry of this.connections.values()) {
+            entry.syncId = sentinel;
+            n += 1;
+        }
+        return n;
+    }
     updateLoadedSyncId(sessionId, newSyncId) {
         const entry = this.connections.get(sessionId);
         if (entry) {

package/dist/src/lib/actual-adapter.js

@@ -1771,8 +1771,10 @@ export async function getBudgets() {
  *
  * Issue #156:
  *   * Per-session: writes to the per-session map keyed by current sessionId.
- *     Stdio / non-session callers fall back to the env-default budget and
- *     cannot switch (returns an error).
+ *     Since #348 stdio HAS a session (a synthetic per-process id minted in
+ *     stdioServer.ts), so it can switch. Genuinely session-less callers (CLI
+ *     scripts, startup health checks) still fall back to the env-default budget
+ *     and cannot switch (returns an error).
  *   * ACL: refuses when the target budget's syncId is not in this session's
  *     allowedBudgets.
  *   * Exact match only (substring matching removed: it was a sharp edge that
@@ -1790,8 +1792,10 @@ export async function switchBudget(name) {
     // Stdio / no-session callers: per-session map has no slot for them, so the
     // switch would have no effect. Refuse explicitly rather than silently no-op.
     if (!sessionId) {
-        throw new Error('Budget switch requires an MCP session. Stdio/local callers operate on the env-default budget; ' +
-            'configure ACTUAL_BUDGET_SYNC_ID (or the BUDGET_n_* variants) to select a different default.');
+        throw new Error('Budget switch requires an MCP session. This caller has none, which means a CLI script or an ' +
+            'internal startup path rather than a client: both HTTP and stdio clients get a session (#348). ' +
+            'Such callers operate on the env-default budget; configure ACTUAL_BUDGET_SYNC_ID (or the ' +
+            'BUDGET_n_* variants) to select a different default.');
     }
     const key = name.toLowerCase();
     const found = budgetRegistry.get(key);
@@ -1890,7 +1894,22 @@ export async function switchBudget(name) {
     // next withActualApi call would find no pool entry and fall back to the
     // legacy init+shutdown path. Failure here is logged but not fatal: the
     // legacy fallback still works, just less efficiently.
-    if (_skipApiInitForTests) {
+    //
+    // #348 EXCEPTION: never for a stdio session. stdio gained a synthetic session
+    // id so it could switch budgets at all, but it must stay on the legacy
+    // init/shutdown cycle. A pooled entry for stdio would be created here and then
+    // NEVER refreshed, because connectionPool.touch() is called only from
+    // httpServer.ts; it would expire after SESSION_IDLE_TIMEOUT_MINUTES and
+    // cleanupIdleConnections would api.shutdown() it WITHOUT holding withApiLock,
+    // which can tear the singleton down underneath an in-flight operation. The
+    // legacy path re-reads getActiveBudgetConfig() on every call, so the switch
+    // still takes effect; it just costs an init per operation, which is what stdio
+    // already did before this ticket.
+    if (store?.transport === 'stdio') {
+        logger.debug(`[ADAPTER] switchBudget: session ${sessionId} is stdio; skipping pool materialisation ` +
+            '(stdio stays on the legacy init/shutdown path by design, #348).');
+    }
+    else if (_skipApiInitForTests) {
         setApiInitialized(true);
     }
     else {
@@ -2037,13 +2056,40 @@ export async function exportBudget() {
  */
 export async function importBudget(input, opts = {}) {
     observability.incrementToolCall('actual.budgets.import').catch(() => { });
-    return queueWriteOperation(async () => {
+    const result = await queueWriteOperation(async () => {
         return await withConcurrency(() => retry(() => rawImportBudget(input, opts), {
             retries: 0,
             backoffMs: 200,
             isRetryable: isRetryableError,
         }));
     });
+    // #349: an import CHANGES WHICH BUDGET IS LOADED, so the pool's record of it
+    // must stop naming the old one.
+    //
+    // switchBudget's #172 fast path skips the re-download when
+    // `currentEntry.syncId === found.syncId`, trusting that field as the record of
+    // what is loaded. Every other path that changes the loaded budget keeps it in
+    // sync; this one did not. The result was a switch BACK to the configured budget
+    // returning `{success: true}` while the session stayed on the imported copy, so
+    // subsequent writes and deletes landed in the wrong budget. That is the
+    // reported-success-with-no-effect class of #347, with financial data at the
+    // other end of it.
+    //
+    // The sentinel is deliberate rather than the imported id alone: configured sync
+    // ids are UUIDs, so an `imported:` prefix can never compare equal to one, which
+    // makes the fast path structurally unable to match after an import. An imported
+    // budget frequently has no cloud sync id at all, so there is no true value to
+    // record here; what matters is that the stale one is gone.
+    // EVERY entry, not just this session's. The api singleton is process-global with
+    // one loaded budget, so an import by session A changes what B..N are looking at
+    // too. Invalidating only A would leave the others matching the fast path against
+    // a record that is no longer true.
+    const invalidated = connectionPool.invalidateAllLoadedSyncIds(`imported:${result.id}`);
+    if (invalidated > 0) {
+        logger.debug(`[ADAPTER] importBudget: invalidated the pooled syncId on ${invalidated} session(s) ` +
+            `(now "imported:${result.id}"), so a switch back re-downloads instead of no-opping (#349).`);
+    }
+    return result;
 }
 /**
  * Read the budget's synced preferences: number format, date format, currency,

package/dist/src/server/stdioServer.js

@@ -2,10 +2,33 @@
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+import { randomUUID } from 'node:crypto';
 import logger from '../logger.js';
 import actualToolsManager from '../actualToolsManager.js';
+import { requestContext } from '../lib/requestContext.js';
 export async function startStdioServer(mcp, capabilities, implementedTools, serverDescription, serverInstructions, toolSchemas, version) {
     const toolsList = Array.isArray(implementedTools) ? implementedTools : [];
+    // #348: a synthetic session identity for this stdio process.
+    //
+    // WHY THIS EXISTS. The active budget lives in a per-session map keyed on
+    // sessionId (`sessionBudgetState` in actual-adapter.ts), read by
+    // getActiveBudgetConfig() from requestContext. Until this, stdio never entered
+    // a requestContext scope, so it had no sessionId, no slot in that map, and
+    // actual_budgets_switch refused outright rather than writing somewhere nobody
+    // reads. That refusal was correct: the alternative reports success while the
+    // budget never changes, which is the silent-no-op class of #347.
+    //
+    // WHY NOT A GLOBAL. #156 removed a process-global activeBudgetKey because in
+    // multi-user HTTP mode one user's switch changed the budget for everyone,
+    // across ACL boundaries. Reintroducing a global "just for stdio" would put that
+    // back in shared code. A per-PROCESS id is safe precisely because stdio is
+    // single-user by construction: one process, one pipe, one human. Two stdio
+    // processes get two ids and two slots, so nothing leaks between them.
+    //
+    // A uuid rather than a fixed string, so log lines are distinguishable across
+    // restarts and can never collide with an HTTP session id.
+    const stdioSessionId = `stdio-${randomUUID()}`;
+    logger.debug(`[STDIO] session id ${stdioSessionId}`);
     const server = new Server({ name: serverDescription || 'actual-mcp-server', version: version || '0.1.0' }, { capabilities, instructions: serverInstructions });
     // List tools handler — mirrors createServerInstance() in httpServer.ts
     server.setRequestHandler(ListToolsRequestSchema, async () => {
@@ -33,7 +56,29 @@ export async function startStdioServer(mcp, capabilities, implementedTools, serv
             throw new Error('Tool name must be a string');
         }
         logger.debug(`[STDIO] tools/call ${rawName}`);
-        const result = await mcp.executeTool(rawName, args ?? {});
+        // Wrap the DISPATCH, not server.connect(). The transport invokes this handler
+        // from an I/O event, which is outside any scope established around connect(),
+        // so an AsyncLocalStorage context opened there would not be visible here.
+        // Everything downstream is awaited inside this callback, so it propagates.
+        //
+        // Only `sessionId` is placed in the store, deliberately:
+        //   - no `principal`, or getActiveBudgetConfig() would attempt the #189
+        //     preferred-budget restore for a caller that has no authenticated
+        //     identity, and the env default would stop being authoritative.
+        //   - `transport: 'stdio'` is what keeps stdio OFF the pooled path.
+        //     switchBudget's slow path calls connectionPool.getConnection(), so
+        //     WITHOUT this marker the first switch would silently move stdio onto
+        //     the pooled branch: writes would then rely on api.sync() instead of the
+        //     legacy init/shutdown cycle every existing stdio persistence behaviour
+        //     is built on, and the entry would never be touched (touch() is called
+        //     only from httpServer.ts), so it would expire after the idle timeout and
+        //     be torn down by the cleanup sweep without the api lock, possibly
+        //     mid-operation. That is a far larger change than this ticket, and it is
+        //     not one we want by accident.
+        //   - `allowedBudgets` is absent, so under AUTH_PROVIDER=oidc switchBudget
+        //     still denies. Fail closed: a local pipe must not gain budget access an
+        //     HTTP caller would need an ACL for.
+        const result = await requestContext.run({ sessionId: stdioSessionId, transport: 'stdio' }, () => mcp.executeTool(rawName, args ?? {}));
         return {
             content: [{ type: 'text', text: typeof result === 'string' ? result : JSON.stringify(result) }],
         };

package/dist/src/tools/accounts_delete.js

@@ -3,13 +3,65 @@ import adapter from '../lib/actual-adapter.js';
 const InputSchema = z.object({
     id: z.string().describe('Account ID to delete'),
 });
+/**
+ * #347: this tool used to return `{success: true}` unconditionally, which was a
+ * lie for CLOSED accounts.
+ *
+ * Verified in upstream source. `api.deleteAccount(id)` maps to
+ * `account-close({id, forced: true})`, and `closeAccount` opens with:
+ *
+ *   const account = await db.first('SELECT * FROM accounts WHERE id = ? AND tombstone = 0', [id]);
+ *   if (!account || account.closed === 1) return;      // <- silent no-op
+ *
+ * So a closed account is a no-op with no error, and the tool reported success
+ * anyway. Confirmed against a live server: nine deletions all reported success
+ * and the seven closed ones survived.
+ *
+ * WHY VERIFY AFTER, NOT CHECK BEFORE. The obvious fix is to look the account up
+ * first and refuse if it is closed. That breaks a case which looks identical from
+ * here but is not: `closeAccount` DELETES (tombstones) an account that has zero
+ * transactions, and `reopenAccount` only clears the `closed` flag, never the
+ * tombstone. `getAccounts()` filters `tombstone = 0`, so a close-then-reopen
+ * leaves an id that no longer appears in any listing. A pre-check would call that
+ * "not found" and throw, where the caller's intent (make this account not exist)
+ * is in fact already satisfied. The repo's own teardown idiom does exactly this:
+ * close first, then delete.
+ *
+ * Verifying AFTER answers the question the caller actually asked, "is it gone?",
+ * rather than a proxy for it. It also closes a race the pre-check could not: the
+ * read and the write land in different sessions, so a concurrent close could
+ * commit between them and reproduce the original false success.
+ *
+ * The deliberate consequence is that deleting an id that never existed still
+ * reports success. That is idempotent-delete semantics, it matches the behaviour
+ * before this change, and the post-condition ("no account with this id exists")
+ * is true either way.
+ */
 const tool = {
     name: 'actual_accounts_delete',
-    description: 'Delete an account from Actual Budget. Note: The account must not have any transactions. This operation cannot be undone.',
+    description: 'Delete an account from Actual Budget. DESTRUCTIVE: if the account has transactions, they are ' +
+        'deleted too, paired transfer transactions are unlinked, and the transfer payee is removed. This ' +
+        'cannot be undone. A CLOSED account cannot be deleted (Actual silently ignores it): reopen it with ' +
+        'actual_accounts_reopen first. Deleting an account that does not exist reports success.',
     inputSchema: InputSchema,
     call: async (args, _meta) => {
         const input = InputSchema.parse(args || {});
         await adapter.deleteAccount(input.id);
+        // The verification the old code skipped. One read, after the write, so the
+        // success claim is about the observed state rather than about the call having
+        // returned.
+        const remaining = (await adapter.getAccounts());
+        const survivor = Array.isArray(remaining) ? remaining.find((a) => a?.id === input.id) : undefined;
+        if (survivor) {
+            // Reachable when the account is closed: upstream returned without acting.
+            // Anything else that leaves it present is equally worth surfacing, so the
+            // message covers the general case and names the likely one.
+            throw new Error(`Account "${survivor.name ?? input.id}" (${input.id}) still exists after the delete` +
+                (survivor.closed === true
+                    ? ': it is CLOSED, and Actual silently ignores a delete on a closed account. Reopen it with ' +
+                        'actual_accounts_reopen and delete it again, or leave it closed if you only wanted it out of the way.'
+                    : '. The delete was accepted but had no effect; check the account state in Actual.'));
+        }
         return { success: true };
     },
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "actual-mcp-server",
   "displayName": "Actual MCP Server",
-  "version": "0.11.4",
+  "version": "0.11.6",
   "engines": {
     "node": ">=22.0.0",
     "npm": ">=10.0.0"
@@ -30,7 +30,7 @@
     "verify-tools": "npm run build && node scripts/verify-tools.js",
     "check:coverage": "node scripts/list-actual-api-methods.mjs",
     "direct-sync": "node scripts/direct-sync/bank-sync-direct.mjs",
-    "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/generated_tools.smoke.test.js && node tests/unit/schema_validation.test.js && node tests/unit/schema_json_openai_compat.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/workflow_release_guards.test.js && node tests/unit/report_train_failure.test.js && node tests/unit/unit_chain_membership.test.js && node tests/unit/api_surface_drift.test.js && node tests/unit/api_coverage_baseline.test.js && node tests/unit/train_preflight.test.js && node tests/unit/verify_published_artifacts.test.js && node tests/unit/report_train_stale.test.js && node tests/unit/stdio_framing_check.test.js && node tests/unit/server_info.test.js && node tests/unit/transfers_create.test.js && node tests/unit/bot_target_branch.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/payees_delete.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/transactions_update_splits.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js && node tests/unit/adapter_op_timeout.test.js && node tests/unit/adapter_write_queue_wakeup.test.js && node tests/unit/ci_workflow_guards.test.js && node tests/unit/node_version_guard.test.js && node tests/unit/node_version_drift.test.js && node tests/unit/observability_smoke.test.js && node tests/unit/residue_pattern.test.js && node tests/unit/dual_transport_gate.test.js && node tests/unit/manual_assertions_use_helper.test.js && node tests/unit/server_version_guard.test.js && node tests/unit/payee_rules_reference_filter.test.js && node tests/unit/oidc_metadata_discovery.test.js && node tests/unit/httpServer_oauth_metadata_route.test.js && node tests/unit/httpServer_mcp_info_route.test.js && node tests/unit/residue_sweep_balance_account.test.js && node tests/unit/tool_factory.test.js && node tests/unit/budget_registry_parse.test.js && node tests/unit/preferences_get.test.js && node tests/unit/budgets_export.test.js && node tests/unit/budgets_import.test.js && node tests/unit/budget_acl_dynamic.test.js && node tests/unit/budget_acl_identity_map.test.js && node tests/unit/budget_acl_userinfo.test.js && node tests/unit/acl_e2e_fixture_contract.test.js && node tests/unit/budget_acl_middleware.test.js && node tests/unit/rules_stage.test.js",
+    "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/generated_tools.smoke.test.js && node tests/unit/schema_validation.test.js && node tests/unit/schema_json_openai_compat.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/workflow_release_guards.test.js && node tests/unit/report_train_failure.test.js && node tests/unit/unit_chain_membership.test.js && node tests/unit/api_surface_drift.test.js && node tests/unit/api_coverage_baseline.test.js && node tests/unit/train_preflight.test.js && node tests/unit/verify_published_artifacts.test.js && node tests/unit/report_train_stale.test.js && node tests/unit/stdio_framing_check.test.js && node tests/unit/server_info.test.js && node tests/unit/transfers_create.test.js && node tests/unit/bot_target_branch.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/accounts_delete.test.js && node tests/unit/payees_delete.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/transactions_update_splits.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/stdio_budget_switch.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js && node tests/unit/adapter_op_timeout.test.js && node tests/unit/adapter_write_queue_wakeup.test.js && node tests/unit/ci_workflow_guards.test.js && node tests/unit/node_version_guard.test.js && node tests/unit/node_version_drift.test.js && node tests/unit/observability_smoke.test.js && node tests/unit/residue_pattern.test.js && node tests/unit/dual_transport_gate.test.js && node tests/unit/manual_assertions_use_helper.test.js && node tests/unit/server_version_guard.test.js && node tests/unit/payee_rules_reference_filter.test.js && node tests/unit/oidc_metadata_discovery.test.js && node tests/unit/httpServer_oauth_metadata_route.test.js && node tests/unit/httpServer_mcp_info_route.test.js && node tests/unit/residue_sweep_balance_account.test.js && node tests/unit/tool_factory.test.js && node tests/unit/budget_registry_parse.test.js && node tests/unit/preferences_get.test.js && node tests/unit/budgets_export.test.js && node tests/unit/budgets_import.test.js && node tests/unit/budgets_import_syncid.test.js && node tests/unit/budget_acl_dynamic.test.js && node tests/unit/budget_acl_identity_map.test.js && node tests/unit/budget_acl_userinfo.test.js && node tests/unit/acl_e2e_fixture_contract.test.js && node tests/unit/budget_acl_middleware.test.js && node tests/unit/rules_stage.test.js",
     "test:adapter": "npm run build && node dist/src/tests_adapter_runner.js",
     "test:e2e": "npx playwright test",
     "test:e2e:docker": "./tests/e2e/run-docker-e2e.sh",