actual-mcp-server 0.22.37 → 0.22.40

package/README.md

@@ -836,7 +836,7 @@ The software is provided **as-is**, without warranty of any kind. The author acc
 
 ---
 
-**Version:** 0.22.37 | **Tool Count:** 84 (verified LibreChat-compatible)
+**Version:** 0.22.40 | **Tool Count:** 84 (verified LibreChat-compatible)
 
 ## Sponsor
 

package/dist/src/actualToolsManager.js

@@ -1,6 +1,7 @@
 // src/actualToolsManager.ts
 import logger from './logger.js';
 import { formatZodError } from './lib/zod-error-format.js';
+import { errorLogFields } from './lib/errors.js';
 import config from './config.js';
 import { createModuleLogger } from './lib/loggerFactory.js';
 import { resolvePublishedToolNames, unavailableError } from './lib/toolsets.js';
@@ -211,26 +212,39 @@ class ActualToolsManager {
             toolsetLog.warn('Refused a call to an unpublished tool', { tool: name, setting: unavailable.setting });
             throw unavailable;
         }
+        const startTime = Date.now();
         try {
             const result = await tool.call(args);
             // Force-serialize/deserialize to ensure result is JSON-safe (no circular refs,
             // Buffers, class instances, etc). Convert undefined -> null so callers always
             // receive a valid JSON value.
-            const safe = result === undefined ? null : JSON.parse(JSON.stringify(result));
-            logger.info(`[TOOL RESULT] ${name}: ${JSON.stringify(safe)}`);
+            const json = JSON.stringify(result === undefined ? null : result);
+            const safe = JSON.parse(json);
+            // Content-free by design (#556): tool arguments and results are the user's budget
+            // data and never reach the logs. This record is the one place content COULD be
+            // logged, so an opt-in for debugging (#557) belongs here and nowhere else.
+            // `durationMs`, not `ms`: the logger reserves a top-level `ms` key (src/logger.ts).
+            logger.info('[TOOL RESULT]', { tool: name, durationMs: Date.now() - startTime, outcome: 'ok', bytes: Buffer.byteLength(json, 'utf8') });
             return safe;
         }
         catch (err) {
             // Format Zod validation errors into one actionable, consistent message (#206).
             // Duck-type on `.issues` so any structurally-compatible ZodError is handled.
+            // The failure record mirrors the success one (#556): tool, duration and outcome,
+            // never the arguments. It never carries the error MESSAGE either (#559): that text
+            // is for the client and can quote input or upstream content. errorLogFields gives
+            // the class, a refusal's kind, and the throw site's withLogMessage text if any.
+            const failure = { tool: name, durationMs: Date.now() - startTime, outcome: 'error' };
             if (err && typeof err === 'object' && 'issues' in err) {
                 const formattedMsg = formatZodError(err, tool.inputSchema);
-                logger.error(`[TOOL ERROR] ${name}: ${formattedMsg}`);
+                // The #206 text is for the client only: a schema's custom refine message can quote
+                // input (transactions_create echoes the split amounts), so the log gets the issue
+                // codes, which come from Zod and never from the arguments.
+                const issueCodes = [...new Set((err.issues ?? []).map((i) => String(i?.code)))];
+                logger.error(`[TOOL ERROR] ${name}`, { ...failure, errorClass: 'ZodError', issueCodes });
                 throw new Error(formattedMsg);
             }
-            const e = err;
-            const msg = e && typeof e.message === 'string' ? e.message : String(err);
-            logger.error(`[TOOL ERROR] ${name}: ${msg}`);
+            logger.error(`[TOOL ERROR] ${name}`, { ...failure, ...errorLogFields(err) });
             throw err;
         }
     }

package/dist/src/lib/actual-adapter.js

@@ -13,7 +13,7 @@ import observability from '../observability.js';
 import { retry, isRetryableError, isRateLimitError } from './retry.js';
 import { withOpTimeout } from './opTimeout.js';
 import { markInitFailure } from './init-failure.js';
-import { NotFoundRefusal, OutOfRangeRefusal, constraintErrorMsg } from './errors.js';
+import { NotFoundRefusal, OutOfRangeRefusal, constraintErrorMsg, errorLogFields } from './errors.js';
 import { amountOpMismatch } from './schemas/schedule-amount.js';
 import { findMatchingRule } from './rule-matching.js';
 import logger from '../logger.js';
@@ -1198,7 +1198,9 @@ async function processWriteQueue() {
                             resolve(result);
                         }
                         catch (error) {
-                            logger.error('[WRITE QUEUE] Operation failed:', error);
+                            // Class and log-safe text only (#559): a refusal names the id the caller sent
+                            // (which can be a name, #388), and upstream text can quote the written values.
+                            logger.error('[WRITE QUEUE] Operation failed', errorLogFields(error));
                             // #419: remember an infrastructure-level failure so the batch-end
                             // shutdown self-heals (see drainForceFullShutdown above).
                             if (_shouldDropPoolOnError(error))
@@ -1656,7 +1658,8 @@ export async function createCategory(category) {
             return normalizeToId(raw);
         }
         catch (error) {
-            logger.error('[CREATE CATEGORY] Error creating category:', error);
+            // Upstream's message quotes the category name (#559), so the log gets the class only.
+            logger.error('[CREATE CATEGORY] Error creating category', errorLogFields(error));
             // Re-throw the error with proper context
             if (error instanceof Error) {
                 throw error;
@@ -2672,7 +2675,8 @@ export async function updateRule(id, fields) {
         // omitted conditions or actions takes the stored value, which contributes no new refs.
         const addedRefs = newRuleReferences(rule, existingRule);
         assertRuleReferencesExist(addedRefs, await loadRuleReferenceListings(addedRefs), RULE_REFUSAL_CHANGED);
-        logger.debug(`[UPDATE RULE] Updating rule ${id} with merged fields: ${JSON.stringify(rule)}`);
+        // Rule id only: conditions and actions carry payee ids, notes and amounts (#556).
+        logger.debug(`[UPDATE RULE] Updating rule ${id}`);
         await withConcurrency(() => retry(() => rawUpdateRule(rule), { retries: 0, backoffMs: 200, isRetryable: isRetryableError }));
         logger.debug(`[UPDATE RULE] Update completed for rule ${id}`);
     }, { preservesListings: PRESERVES_ALL_ENTITY_LISTINGS });
@@ -3442,7 +3446,7 @@ export async function runQuery(queryString) {
                             catch (err) {
                                 // Catch errors from the query execution to prevent unhandled rejections
                                 const msg = err?.message || String(err);
-                                logger.error(`[ADAPTER] Query execution error: ${msg}`);
+                                logger.error('[ADAPTER] Query execution error', errorLogFields(err)); // #559: msg can quote the query
                                 if (msg.includes('does not exist in table') || msg.includes('Field') || msg.includes('does not exist')) {
                                     throw new Error(`Invalid field in query: ${msg}`);
                                 }
@@ -3550,7 +3554,7 @@ export async function runQuery(queryString) {
                         catch (err) {
                             // Catch errors from the query execution to prevent unhandled rejections
                             const msg = err?.message || String(err);
-                            logger.error(`[ADAPTER] Query execution error: ${msg}`);
+                            logger.error('[ADAPTER] Query execution error', errorLogFields(err)); // #559: msg can quote the query
                             if (msg.includes('does not exist in table') || msg.includes('Field') || msg.includes('does not exist')) {
                                 throw new Error(`Invalid field in query: ${msg}`);
                             }
@@ -3585,7 +3589,8 @@ export async function runQuery(queryString) {
     catch (error) {
         // Top-level catch to ensure no unhandled rejections escape
         const errorMsg = error?.message || String(error);
-        logger.error(`[ADAPTER] Query execution failed: ${errorMsg}`);
+        // The message can embed the whole query (#559); the client still receives it below.
+        logger.error('[ADAPTER] Query execution failed', errorLogFields(error));
         // If the error already contains formatted validation errors with suggestions, preserve them
         if (errorMsg.includes('Invalid SQL query:') && (errorMsg.includes('Available fields:') || errorMsg.includes('Available tables:'))) {
             throw error; // Re-throw the well-formatted validation error without wrapping

package/dist/src/lib/errors.js

@@ -148,3 +148,28 @@ export function constraintErrorMsg(entityType, id, listTool) {
     return `Failed to delete ${entityType.toLowerCase()} "${id}". ` +
         `It may be referenced by other records. Use ${listTool} to verify it exists.`;
 }
+/**
+ * Log-safe error text (#559). An error's MESSAGE is for the client and may quote what the
+ * caller sent: a category name, a query, a rule value, or upstream text we do not control.
+ * The server never logs it. `withLogMessage` attaches a separate, content-free sentence
+ * that the `[TOOL ERROR]` record may log instead; set it where the error is thrown, and
+ * keep anything the caller supplied out of it.
+ */
+const LOG_MESSAGE = Symbol.for('actual-mcp-server.logMessage');
+export function withLogMessage(error, logMessage) {
+    Object.defineProperty(error, LOG_MESSAGE, { value: logMessage, enumerable: false });
+    return error;
+}
+export function errorLogFields(error) {
+    const errorClass = error instanceof Error ? (Object.getPrototypeOf(error)?.constructor?.name || 'Error') : error === null ? 'null' : typeof error;
+    const fields = { errorClass };
+    if (isPreflightRefusal(error))
+        fields.refusalKind = error.refusalKind;
+    const code = typeof error === 'object' && error !== null ? error.code : undefined;
+    if (typeof code === 'string' && /^E[A-Z0-9_]{1,40}$/.test(code))
+        fields.code = code;
+    const logMessage = typeof error === 'object' && error !== null ? error[LOG_MESSAGE] : undefined;
+    if (typeof logMessage === 'string')
+        fields.logMessage = logMessage;
+    return fields;
+}

package/dist/src/lib/retry.js

@@ -1,5 +1,6 @@
 import { DEFAULT_RETRY_ATTEMPTS, DEFAULT_RETRY_BACKOFF_MS, MAX_RETRY_DELAY_MS } from './constants.js';
 import { ModuleLoggers } from './loggerFactory.js';
+import { errorLogFields } from './errors.js';
 const log = ModuleLoggers.RETRY;
 /**
  * Error-message fragments that mark a TRANSIENT / infrastructure-level failure:
@@ -92,16 +93,16 @@ export async function retry(fn, opts) {
             // (#177). With no classifier, behaviour is unchanged (retry until the
             // attempt budget is exhausted), preserving every existing call site.
             if (isRetryable && !isRetryable(err)) {
-                log.debug('Not retrying non-transient error', { error: err?.message });
+                log.debug('Not retrying non-transient error', errorLogFields(err));
                 throw err;
             }
             attempt++;
             if (attempt > retries) {
-                log.error(`All retry attempts exhausted after ${retries} tries`, err);
+                log.error(`All retry attempts exhausted after ${retries} tries`, undefined, errorLogFields(err));
                 throw err;
             }
             const delay = Math.min(backoffMs * Math.pow(2, attempt - 1), MAX_RETRY_DELAY_MS);
-            log.debug(`Retry attempt ${attempt}/${retries} after ${delay}ms`, { error: err.message });
+            log.debug(`Retry attempt ${attempt}/${retries} after ${delay}ms`, errorLogFields(err));
             await new Promise(r => setTimeout(r, delay));
         }
     }

package/dist/src/lib/toolFactory.js

@@ -14,6 +14,7 @@
  */
 import { createModuleLogger } from './loggerFactory.js';
 import observability from '../observability.js';
+import { errorLogFields } from './errors.js';
 const log = createModuleLogger('TOOLS');
 /**
  * Create a tool definition with automatic error handling and logging
@@ -54,23 +55,24 @@ export function createTool(config) {
         call: async (args, meta) => {
             const startTime = Date.now();
             try {
+                // No args, input or result in these records (#556): they are budget data.
                 // Validate input against schema
-                log.debug(`Validating input for ${name}`, { args });
+                log.debug(`Validating input for ${name}`);
                 const input = schema.parse(args || {});
                 // Execute handler
-                log.debug(`Executing ${name}`, { input });
+                log.debug(`Executing ${name}`);
                 const result = await handler(input, meta);
                 // Log success
                 const duration = Date.now() - startTime;
-                log.debug(`${name} completed in ${duration}ms`, { result });
+                log.debug(`${name} completed in ${duration}ms`);
                 // Track observability
                 await observability.incrementToolCall(name);
                 return { result };
             }
             catch (error) {
-                // Log error with details
+                // Class and log-safe text only (#559): the message and stack can quote input.
                 const duration = Date.now() - startTime;
-                log.error(`${name} failed after ${duration}ms`, error, { args });
+                log.error(`${name} failed after ${duration}ms`, undefined, { tool: name, durationMs: duration, outcome: 'error', ...errorLogFields(error) });
                 // Track observability (still increment even on failure)
                 await observability.incrementToolCall(name);
                 // Re-throw for MCP error handling

package/dist/src/server/httpServer.js

@@ -403,7 +403,8 @@ advertisedUrl) {
                 throw new Error('Tool name must be a string');
             }
             const name = rawName;
-            logger.debug(`[TOOL CALL] ${name} args=${JSON.stringify(args)}`);
+            // Tool name only: arguments are budget data and never reach the logs (#556).
+            logger.debug(`[TOOL CALL] ${name}`);
             // Prefer ActualMCPConnection executor if provided
             if (typeof mcp.executeTool === 'function') {
                 const result = await mcp.executeTool(name, args ?? {});

package/dist/src/tools/categories_create.js

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import adapter from '../lib/actual-adapter.js';
 import { CommonSchemas } from '../lib/schemas/common.js';
+import { withLogMessage } from '../lib/errors.js';
 const InputSchema = z.object({
     name: CommonSchemas.name,
     group_id: CommonSchemas.categoryGroupId,
@@ -36,7 +37,8 @@ const tool = {
                 throw new Error(`Failed to create category: Invalid or missing group_id. Use actual_category_groups_get to get available category groups first.`);
             }
             if (errorMessage.includes('already exists') || errorMessage.includes('duplicate')) {
-                throw new Error(`Failed to create category: A category named "${input.name}" already exists in this group.`);
+                // The client needs the name; the log gets content-free text (#559).
+                throw withLogMessage(new Error(`Failed to create category: A category named "${input.name}" already exists in this group.`), 'category name already exists in this group');
             }
             throw new Error(`Failed to create category: ${errorMessage}`);
         }

package/dist/src/tools/query_run.js

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import adapter from '../lib/actual-adapter.js';
 import { validateQueryShape } from '../lib/query-validator.js';
+import { errorLogFields, withLogMessage } from '../lib/errors.js';
 const InputSchema = z.object({
     query: z.string().min(1).describe('ActualQL query string to execute'),
 });
@@ -27,7 +28,8 @@ Tables:
             const input = InputSchema.parse(args || {});
             // Detect and reject GraphQL-like syntax with nested objects
             if (input.query.trim().startsWith('query ') && input.query.includes('{') && input.query.includes('}')) {
-                throw new Error(`GraphQL syntax is not fully supported. Please use SQL instead.\n\nExample: SELECT id, date, amount, payee.name, category.name FROM transactions ORDER BY date DESC LIMIT 5\n\nYour query attempted: ${input.query.substring(0, 100)}...`);
+                // The client sees its own query echoed; the log gets content-free text (#559).
+                throw withLogMessage(new Error(`GraphQL syntax is not fully supported. Please use SQL instead.\n\nExample: SELECT id, date, amount, payee.name, category.name FROM transactions ORDER BY date DESC LIMIT 5\n\nYour query attempted: ${input.query.substring(0, 100)}...`), 'GraphQL-style query rejected');
             }
             // Read-only shape gate (#162): reject writes / schema changes / stacked
             // statements before the query reaches the q() builder. Throws on violation.
@@ -38,21 +40,24 @@ Tables:
         catch (error) {
             // Provide helpful error messages
             const errorMessage = error?.message || String(error);
+            // Each rewrap keeps the original's log-safe text (#559), e.g. the GraphQL rejection above.
+            const logSafe = errorLogFields(error).logMessage;
+            const carry = (e) => (logSafe ? withLogMessage(e, logSafe) : e);
             // Check if error is about payee_name, category_name, account_name
             if (errorMessage.includes('payee_name') || errorMessage.includes('category_name') || errorMessage.includes('account_name')) {
-                throw new Error(`Field name error: Use dot notation for joins.\n• Use payee.name (NOT payee_name)\n• Use category.name (NOT category_name)\n• Use account.name (NOT account_name)\n\nExample: SELECT id, date, amount, payee.name FROM transactions LIMIT 5\n\nOriginal error: ${errorMessage}`);
+                throw carry(new Error(`Field name error: Use dot notation for joins.\n• Use payee.name (NOT payee_name)\n• Use category.name (NOT category_name)\n• Use account.name (NOT account_name)\n\nExample: SELECT id, date, amount, payee.name FROM transactions LIMIT 5\n\nOriginal error: ${errorMessage}`));
             }
             if (errorMessage.includes('does not exist in the schema')) {
-                throw new Error(`Invalid table or field name. Available tables: transactions, accounts, categories, payees, category_groups, schedules, rules. Use dot notation for joins (e.g., category.name). Original error: ${errorMessage}`);
+                throw carry(new Error(`Invalid table or field name. Available tables: transactions, accounts, categories, payees, category_groups, schedules, rules. Use dot notation for joins (e.g., category.name). Original error: ${errorMessage}`));
             }
             else if (errorMessage.includes('ActualQL query builder not available')) {
-                throw new Error('ActualQL query builder is not available. The Actual Budget API may not be properly initialized.');
+                throw carry(new Error('ActualQL query builder is not available. The Actual Budget API may not be properly initialized.'));
             }
             else if (errorMessage.includes('parse') || errorMessage.includes('syntax')) {
-                throw new Error(`Query syntax error: ${errorMessage}\n\nRecommended: Use SQL syntax\nExample: SELECT * FROM transactions ORDER BY date DESC LIMIT 5\n\nSee the tool description for the supported WHERE operators and join syntax.`);
+                throw carry(new Error(`Query syntax error: ${errorMessage}\n\nRecommended: Use SQL syntax\nExample: SELECT * FROM transactions ORDER BY date DESC LIMIT 5\n\nSee the tool description for the supported WHERE operators and join syntax.`));
             }
             else {
-                throw new Error(`Query execution failed: ${errorMessage}`);
+                throw carry(new Error(`Query execution failed: ${errorMessage}`));
             }
         }
     },

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "actual-mcp-server",
   "displayName": "Actual MCP Server",
-  "version": "0.22.37",
+  "version": "0.22.40",
   "engines": {
     "node": ">=22.0.0",
     "npm": ">=10.0.0"
@@ -30,7 +30,7 @@
     "verify-tools": "npm run build && node scripts/verify-tools.js",
     "check:coverage": "node scripts/list-actual-api-methods.mjs",
     "direct-sync": "node scripts/direct-sync/bank-sync-direct.mjs",
-    "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/transactions_aggregate.test.js && node tests/unit/account_flow_summary.test.js && node tests/unit/recurring_expenses_summary.test.js && node tests/unit/generated_tools.smoke.test.js &&node tests/unit/schema_validation.test.js && node tests/unit/schema_json_openai_compat.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/e2e_spec_collection.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/new_tool_completeness.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/workflow_release_guards.test.js && node tests/unit/report_train_failure.test.js && node tests/unit/unit_chain_membership.test.js && node tests/unit/api_surface_drift.test.js && node tests/unit/write_effect_audit_staleness.test.js && node tests/unit/write_effect_audit_membership.test.js && node tests/unit/tool_annotations.test.js && node tests/unit/tool_id_schema_drift.test.js && node tests/unit/filter_id_resolution.test.js && node tests/unit/filter_id_tool_wiring.test.js && node tests/unit/api_coverage_baseline.test.js && node tests/unit/train_preflight.test.js && node tests/unit/verify_published_artifacts.test.js && node tests/unit/report_train_stale.test.js && node tests/unit/stdio_framing_check.test.js && node tests/unit/server_info.test.js && node tests/unit/transfers_create.test.js && node tests/unit/bot_target_branch.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/adapter_set_budget_batch.test.js && node tests/unit/budget_updates_batch.test.js && node tests/unit/rules_create.test.js && node tests/unit/adapter_rule_reference_guard.test.js && node tests/unit/rules_create_batch.test.js && node tests/unit/budgets_hold_for_next_month.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/httpServer_init_failure_report.test.js && node tests/unit/stdio_init_failure_report.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/accounts_delete.test.js && node tests/unit/update_tools_not_found.test.js && node tests/unit/accounts_close.test.js && node tests/unit/accounts_reopen.test.js && node tests/unit/payees_delete.test.js && node tests/unit/payees_merge.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/session_ownership.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/oidc_resource_identifier.test.js && node tests/unit/httpServer_oidc_resource_metadata.test.js && node tests/unit/oidc_error_cause.test.js && node tests/unit/httpServer_oidc_error_body.test.js && node tests/unit/oidc_token_source.test.js && node tests/unit/config_oidc_assertion_refines.test.js && node tests/unit/httpServer_oidc_assertion_mode.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpErrorHandler.test.js && node tests/unit/httpServer_error_handler_wiring.test.js && node tests/unit/httpServer_trust_proxy.test.js && node tests/unit/httpServer_batch_cap.test.js && node tests/unit/dotenv_stdout_quiet.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/adapter_drain_listing_cache.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_selection_precondition.test.js && node tests/unit/budget_load_abandonment.test.js && node tests/unit/budget_loader_postcondition.test.js && node tests/unit/budget_loader_import_allowlist.test.js && node tests/unit/budget_import_tracking.test.js && node tests/unit/pool_shutdown_under_lock.test.js && node tests/unit/api_lock_affinity.test.js && node tests/unit/commit_message_closing_keyword.test.js && node tests/unit/write_queue_stranding.test.js && node tests/unit/write_queue_stranded_bound.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/transactions_update_splits.test.js && node tests/unit/transactions_update_split_convert.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/transactions_update_batch.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/stdio_budget_switch.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js && node tests/unit/adapter_op_timeout.test.js && node tests/unit/adapter_write_queue_wakeup.test.js && node tests/unit/ci_workflow_guards.test.js && node tests/unit/node_version_guard.test.js && node tests/unit/node_version_drift.test.js && node tests/unit/playwright_version_drift.test.js && node tests/unit/observability_smoke.test.js && node tests/unit/residue_pattern.test.js && node tests/unit/batch_uncategorized_cleanup.test.js && node tests/unit/dual_transport_gate.test.js && node tests/unit/manual_assertions_use_helper.test.js && node tests/unit/server_version_guard.test.js && node tests/unit/server_version_probe_outside_op_timeout.test.js && node tests/unit/payee_rules_reference_filter.test.js && node tests/unit/oidc_metadata_discovery.test.js && node tests/unit/httpServer_oauth_metadata_route.test.js && node tests/unit/httpServer_mcp_info_route.test.js && node tests/unit/residue_sweep_balance_account.test.js && node tests/unit/tool_factory.test.js && node tests/unit/budget_registry_parse.test.js && node tests/unit/preferences_get.test.js && node tests/unit/budgets_export.test.js && node tests/unit/budgets_import.test.js && node tests/unit/budgets_import_syncid.test.js && node tests/unit/budget_acl_dynamic.test.js && node tests/unit/budget_acl_identity_map.test.js && node tests/unit/budget_acl_userinfo.test.js && node tests/unit/acl_e2e_fixture_contract.test.js && node tests/unit/budget_acl_middleware.test.js && node tests/unit/rules_stage.test.js && node tests/unit/oidc_scope_list.test.js && node tests/unit/get_context.test.js && node tests/unit/contributor_docs.test.js && node tests/unit/toolsets.test.js && node tests/unit/toolsets_entrypoint.test.js && node tests/unit/tools_list_size_budget.test.js && node tests/unit/rules_update_schedules_schema.test.js && node tests/unit/schedules_update_amount_guard.test.js && node tests/unit/source_text_helper.test.js && node tests/unit/transport_onerror.test.js && node tests/unit/adapter_transaction_batch_abort.test.js && node tests/unit/transactions_merge_adapter.test.js && node tests/unit/schedules_dead_conditions.test.js && node tests/unit/session_ownership_express.test.js && node tests/unit/pool_orphan_sweep.test.js && node tests/unit/budget_acl_parse.test.js",
+    "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/transactions_aggregate.test.js && node tests/unit/account_flow_summary.test.js && node tests/unit/recurring_expenses_summary.test.js && node tests/unit/generated_tools.smoke.test.js &&node tests/unit/schema_validation.test.js && node tests/unit/schema_json_openai_compat.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/e2e_spec_collection.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/new_tool_completeness.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/workflow_release_guards.test.js && node tests/unit/report_train_failure.test.js && node tests/unit/unit_chain_membership.test.js && node tests/unit/api_surface_drift.test.js && node tests/unit/write_effect_audit_staleness.test.js && node tests/unit/write_effect_audit_membership.test.js && node tests/unit/tool_annotations.test.js && node tests/unit/tool_id_schema_drift.test.js && node tests/unit/filter_id_resolution.test.js && node tests/unit/filter_id_tool_wiring.test.js && node tests/unit/api_coverage_baseline.test.js && node tests/unit/train_preflight.test.js && node tests/unit/verify_published_artifacts.test.js && node tests/unit/report_train_stale.test.js && node tests/unit/stdio_framing_check.test.js && node tests/unit/server_info.test.js && node tests/unit/transfers_create.test.js && node tests/unit/bot_target_branch.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/adapter_set_budget_batch.test.js && node tests/unit/budget_updates_batch.test.js && node tests/unit/rules_create.test.js && node tests/unit/adapter_rule_reference_guard.test.js && node tests/unit/rules_create_batch.test.js && node tests/unit/budgets_hold_for_next_month.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/httpServer_init_failure_report.test.js && node tests/unit/stdio_init_failure_report.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/accounts_delete.test.js && node tests/unit/update_tools_not_found.test.js && node tests/unit/accounts_close.test.js && node tests/unit/accounts_reopen.test.js && node tests/unit/payees_delete.test.js && node tests/unit/payees_merge.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/session_ownership.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/oidc_resource_identifier.test.js && node tests/unit/httpServer_oidc_resource_metadata.test.js && node tests/unit/oidc_error_cause.test.js && node tests/unit/httpServer_oidc_error_body.test.js && node tests/unit/oidc_token_source.test.js && node tests/unit/config_oidc_assertion_refines.test.js && node tests/unit/httpServer_oidc_assertion_mode.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpErrorHandler.test.js && node tests/unit/httpServer_error_handler_wiring.test.js && node tests/unit/httpServer_trust_proxy.test.js && node tests/unit/httpServer_batch_cap.test.js && node tests/unit/dotenv_stdout_quiet.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/adapter_drain_listing_cache.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_selection_precondition.test.js && node tests/unit/budget_load_abandonment.test.js && node tests/unit/budget_loader_postcondition.test.js && node tests/unit/budget_loader_import_allowlist.test.js && node tests/unit/budget_import_tracking.test.js && node tests/unit/pool_shutdown_under_lock.test.js && node tests/unit/api_lock_affinity.test.js && node tests/unit/commit_message_closing_keyword.test.js && node tests/unit/write_queue_stranding.test.js && node tests/unit/write_queue_stranded_bound.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/transactions_update_splits.test.js && node tests/unit/transactions_update_split_convert.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/transactions_update_batch.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/stdio_budget_switch.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/tool_content_logging.test.js && node tests/unit/adapter_error_logging.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js && node tests/unit/adapter_op_timeout.test.js && node tests/unit/adapter_write_queue_wakeup.test.js && node tests/unit/ci_workflow_guards.test.js && node tests/unit/node_version_guard.test.js && node tests/unit/node_version_drift.test.js && node tests/unit/playwright_version_drift.test.js && node tests/unit/observability_smoke.test.js && node tests/unit/residue_pattern.test.js && node tests/unit/batch_uncategorized_cleanup.test.js && node tests/unit/dual_transport_gate.test.js && node tests/unit/manual_assertions_use_helper.test.js && node tests/unit/server_version_guard.test.js && node tests/unit/server_version_probe_outside_op_timeout.test.js && node tests/unit/payee_rules_reference_filter.test.js && node tests/unit/oidc_metadata_discovery.test.js && node tests/unit/httpServer_oauth_metadata_route.test.js && node tests/unit/httpServer_mcp_info_route.test.js && node tests/unit/residue_sweep_balance_account.test.js && node tests/unit/tool_factory.test.js && node tests/unit/budget_registry_parse.test.js && node tests/unit/preferences_get.test.js && node tests/unit/budgets_export.test.js && node tests/unit/budgets_import.test.js && node tests/unit/budgets_import_syncid.test.js && node tests/unit/budget_acl_dynamic.test.js && node tests/unit/budget_acl_identity_map.test.js && node tests/unit/budget_acl_userinfo.test.js && node tests/unit/acl_e2e_fixture_contract.test.js && node tests/unit/budget_acl_middleware.test.js && node tests/unit/rules_stage.test.js && node tests/unit/oidc_scope_list.test.js && node tests/unit/get_context.test.js && node tests/unit/contributor_docs.test.js && node tests/unit/toolsets.test.js && node tests/unit/toolsets_entrypoint.test.js && node tests/unit/tools_list_size_budget.test.js && node tests/unit/rules_update_schedules_schema.test.js && node tests/unit/schedules_update_amount_guard.test.js && node tests/unit/source_text_helper.test.js && node tests/unit/transport_onerror.test.js && node tests/unit/adapter_transaction_batch_abort.test.js && node tests/unit/transactions_merge_adapter.test.js && node tests/unit/schedules_dead_conditions.test.js && node tests/unit/session_ownership_express.test.js && node tests/unit/pool_orphan_sweep.test.js && node tests/unit/budget_acl_parse.test.js",
     "test:adapter": "npm run build && node dist/src/tests_adapter_runner.js",
     "test:e2e": "npx playwright test",
     "test:e2e:docker": "./tests/e2e/run-docker-e2e.sh",