actual-mcp-server 0.22.47 → 0.22.49

package/README.md

@@ -836,7 +836,7 @@ The software is provided **as-is**, without warranty of any kind. The author acc
 
 ---
 
-**Version:** 0.22.47 | **Tool Count:** 84 (verified LibreChat-compatible)
+**Version:** 0.22.49 | **Tool Count:** 84 (verified LibreChat-compatible)
 
 ## Sponsor
 

package/dist/src/actualConnection.js

@@ -4,7 +4,7 @@ import os from 'os';
 import api from '@actual-app/api';
 import { loadBudgetTracked } from './lib/budgetLoader.js';
 import { withApiLock } from './lib/apiLock.js';
-import { withOpTimeout } from './lib/opTimeout.js';
+import { initApiLoggedIn } from './lib/apiLogin.js';
 import logger from './logger.js';
 import config from './config.js';
 import { connectionPool } from './lib/ActualConnectionPool.js';
@@ -69,11 +69,7 @@ export async function connectToActual() {
             // settle, `.finally(release)` would never run, and the process-global api mutex would be
             // wedged permanently for every session: the exact #270 class. Both pool sites already bound
             // their `api.init` this way, and this was the only `api.init` in the repo that did not.
-            await withOpTimeout(() => api.init({
-                dataDir: DATA_DIR,
-                serverURL: SERVER_URL,
-                password: PASSWORD,
-            }), 'connectToActual init');
+            await initApiLoggedIn(DATA_DIR, { serverUrl: SERVER_URL, password: PASSWORD || '' }, 'connectToActual init');
             log.info(`Downloading budget with sync ID: ${BUDGET_SYNC_ID}`);
             await loadBudgetTracked(BUDGET_SYNC_ID, BUDGET_PASSWORD);
         });
@@ -132,8 +128,12 @@ export async function shutdownActual() {
 /**
  * Initialize connection for a specific MCP session
  * Uses connection pooling to give each session its own Actual Budget connection
+ *
+ * #571: `budget` is the budget the session opens on (httpServer resolves it with
+ * initialBudgetForSession). Without it the pool logs in to the default server and downloads the
+ * default budget, which is wrong whenever the session's restored budget lives on another server.
  */
-export async function connectToActualForSession(sessionId) {
+export async function connectToActualForSession(sessionId, budget) {
     if (!useConnectionPool) {
         // Fallback to shared connection
         return connectToActual();
@@ -141,7 +141,7 @@ export async function connectToActualForSession(sessionId) {
     try {
         // Ensure connection pool initialization is complete before accepting connections
         await connectionPool.waitForInitialization();
-        await connectionPool.getConnection(sessionId);
+        await connectionPool.getConnection(sessionId, budget);
         logger.info(`Actual API connection ready for session: ${sessionId}`);
     }
     catch (err) {

package/dist/src/lib/ActualConnectionPool.js

@@ -17,9 +17,9 @@ import path from 'path';
 import os from 'os';
 import fs from 'fs';
 import { isApiInitialized, setApiInitialized } from './apiState.js';
+import { initApiLoggedIn } from './apiLogin.js';
 import { withApiLock, isApiLockHeld } from './apiLock.js';
 import { loadBudgetTracked } from './budgetLoader.js';
-import { withOpTimeout } from './opTimeout.js';
 const DEFAULT_DATA_DIR = path.resolve(os.homedir() || '.', '.actual');
 class ActualConnectionPool {
     connections = new Map();
@@ -297,7 +297,9 @@ class ActualConnectionPool {
         const SERVER_URL = budgetOverride?.serverUrl ?? config.ACTUAL_SERVER_URL;
         const PASSWORD = budgetOverride?.password ?? config.ACTUAL_PASSWORD;
         const BUDGET_SYNC_ID = budgetOverride?.syncId ?? config.ACTUAL_BUDGET_SYNC_ID;
-        const BUDGET_PASSWORD = budgetOverride?.encryptionPassword ?? process.env.ACTUAL_BUDGET_PASSWORD;
+        // #571: an override carries its own budget's encryption password, absent included. Falling back
+        // to the default budget's would bind a budget from another server to a password it never had.
+        const BUDGET_PASSWORD = budgetOverride ? budgetOverride.encryptionPassword : process.env.ACTUAL_BUDGET_PASSWORD;
         // Use shared data directory so changes persist across sessions
         // This is critical: all sessions must share the same database to avoid data loss
         const DATA_DIR = config.MCP_BRIDGE_DATA_DIR || DEFAULT_DATA_DIR;
@@ -322,11 +324,7 @@ class ActualConnectionPool {
                 // Bound the session-open init/download (#270): this is the HTTP exposure.
                 // A stalled upstream here would otherwise hang session open unbounded and,
                 // because the api singleton is process-global, wedge other sessions too.
-                await withOpTimeout(() => api.init({
-                    dataDir: DATA_DIR,
-                    serverURL: SERVER_URL,
-                    password: PASSWORD,
-                }), 'pool init');
+                await initApiLoggedIn(DATA_DIR, { serverUrl: SERVER_URL, password: PASSWORD || '' }, 'pool init');
                 logger.info(`[ConnectionPool] Downloading budget for session: ${sessionId}`);
                 // #390: the shared tracked loader, not a hand-written download. It clears the record
                 // BEFORE starting and keeps an abandoned load registered, so a session-open download that
@@ -409,11 +407,7 @@ class ActualConnectionPool {
             // process-global singleton, so it takes the same mutex.
             await withApiLock(async () => {
                 // Bound the session-open init/download (#270), same as getConnection.
-                await withOpTimeout(() => api.init({
-                    dataDir: DATA_DIR,
-                    serverURL: SERVER_URL,
-                    password: PASSWORD,
-                }), 'pool init');
+                await initApiLoggedIn(DATA_DIR, { serverUrl: SERVER_URL, password: PASSWORD || '' }, 'pool init');
                 // #390: the shared tracked loader, not a hand-written download. It clears the record
                 // BEFORE starting and keeps an abandoned load registered, so a session-open download that
                 // outruns ACTUAL_OP_TIMEOUT_MS cannot silently re-point the singleton later.

package/dist/src/lib/actual-adapter.js

@@ -23,7 +23,8 @@ import { parseBudgetRegistry } from './budget-registry.js';
 import { getPreferredBudgetSyncId, setPreferredBudgetSyncId, pickAllowedPreferredBudget } from './budget-preference-store.js';
 import { requestContext } from './requestContext.js';
 import { connectionPool } from './ActualConnectionPool.js';
-import { isApiInitialized, setApiInitialized, getLoadedBudgetSyncId, awaitAbandonedBudgetLoad, hasPendingBudgetLoad } from './apiState.js';
+import { isApiInitialized, setApiInitialized, getLoadedBudgetSyncId, awaitAbandonedBudgetLoad, hasPendingBudgetLoad, isApiLoggedInTo, setLoginsSpanServers } from './apiState.js';
+import { initApiLoggedIn } from './apiLogin.js';
 import { withApiLock } from './apiLock.js';
 import { loadBudgetTracked, importBudgetTracked } from './budgetLoader.js';
 /**
@@ -36,6 +37,7 @@ const budgetRegistry = parseBudgetRegistry(process.env, {
     syncId: config.ACTUAL_BUDGET_SYNC_ID,
     encryptionPassword: config.ACTUAL_BUDGET_PASSWORD,
 });
+setLoginsSpanServers(new Set([...budgetRegistry.values()].map((b) => JSON.stringify([b.serverUrl, b.password || '']))).size > 1);
 logger.info(`[ADAPTER] Budget registry: ${budgetRegistry.size} budget(s) — ` +
     [...budgetRegistry.values()].map(b => `"${b.name}" (${b.serverUrl})`).join(', '));
 /**
@@ -108,6 +110,25 @@ function getActiveBudgetConfig() {
     }
     return [...budgetRegistry.values()][0];
 }
+/**
+ * #571: the budget a NEW session should open on, resolved before its session id is live.
+ *
+ * httpServer opens the pool connection from `onsessioninitialized`, which runs inside the
+ * initialize request's context: principal and ACL are there, the session id is not yet. Without
+ * the id, getActiveBudgetConfig cannot restore the #189 preference, so the connection logged in
+ * to the DEFAULT server and downloaded the default budget even when the session's budget lives
+ * on another server, and the session's first call then asked the default server for it.
+ *
+ * Runs getActiveBudgetConfig with the id added to the CURRENT context, so the ACL and principal
+ * of the initialize request still decide. Its memoisation goes through setSessionBudget, which
+ * the isSessionLive guard keeps from recording a session that already ended.
+ *
+ * Shape credit: @jospaquim (PR #569).
+ */
+export function initialBudgetForSession(sessionId) {
+    const store = requestContext.getStore() ?? {};
+    return requestContext.run({ ...store, sessionId }, () => getActiveBudgetConfig());
+}
 /**
  * Global API session mutex.
  * @actual-app/api is a singleton with a single SQLite connection — concurrent
@@ -172,7 +193,10 @@ async function ensureLoadedBudgetMatchesSession() {
     }
     const wanted = getActiveBudgetConfig();
     const loaded = getLoadedBudgetSyncId();
-    if (loaded === wanted.syncId)
+    // #571: the sync id alone is not a match. The same sync id can exist on two servers (a budget
+    // copied between them), and a match against the wrong server would run this session's
+    // operation on the other server's copy.
+    if (loaded === wanted.syncId && isApiLoggedInTo(loginOf(wanted)))
         return;
     // Deliberately a WARN: reaching here means two sessions are on different budgets and this
     // one would otherwise have operated on the other's data.
@@ -185,7 +209,11 @@ async function ensureLoadedBudgetMatchesSession() {
     // per operation, a drain can now change budgets MID-BATCH, and the single trailing api.sync()
     // covers only the last one. Without this, an earlier session's write is applied locally and
     // silently waits for the next load of that budget to propagate, which an ephemeral data dir
-    // would lose entirely.
+    // would lose entirely. Runs on a cross-login re-selection too, while the old login is still
+    // current: initApiLoggedIn's close deliberately does not sync (see there for the out-of-sync
+    // failure a syncing close caused at session open), so this is the only sync the outgoing budget
+    // gets. It is still a sync of a copy that may be stale if another process wrote the data dir:
+    // #575 tracks that hazard, which every sync here and after writes shares.
     if (loaded) {
         try {
             await withOpTimeout(() => api.sync(), 'sync');
@@ -197,7 +225,45 @@ async function ensureLoadedBudgetMatchesSession() {
             });
         }
     }
-    await loadBudgetTracked(wanted.syncId, wanted.encryptionPassword);
+    await loadBudgetOnItsServer(wanted);
+}
+function loginOf(budget) {
+    return { serverUrl: budget.serverUrl, password: budget.password || '' };
+}
+/**
+ * #571: load a budget over a login to the server that HOLDS it. MUST be called inside the api lock.
+ *
+ * Every re-selection over a live singleton goes through here (the #390 precondition, which the
+ * kept-alive stdio singleton of #419 reaches too, and switchBudget's same-auth fast path). Both
+ * used to download over whatever login the singleton already had, which is right on a single
+ * server and wrong as soon as another session has logged the singleton in to a different one:
+ * reproduced live as a session on server X failing every call with "Budget not found" for as
+ * long as a session on server Y was active.
+ *
+ * Same server: no new login, so the #127 auth burst #134 removed does not come back.
+ *
+ * Different or unknown server: log in to the budget's own server with the budget's own password
+ * through initApiLoggedIn, which first clears the records and closes the outgoing budget WITHOUT
+ * syncing it, then download. The #390 precondition syncs the outgoing budget before calling here;
+ * switchBudget's same-auth fast path does not, so a pending change there syncs at that budget's
+ * next load.
+ *
+ * Failure: initApiLoggedIn clears the loaded-budget and login records before anything else, so
+ * any failure leaves both unknown, the next operation of ANY session re-selects, and the error
+ * reaches the caller as an ordinary tool error. The live flag is deliberately NOT cleared:
+ * clearing it would send every session through the legacy per-operation init (the #127 burst)
+ * until a new session happened to open, while the cleared records already force the one re-login
+ * that recovery needs.
+ *
+ * Never takes the api lock itself: the lock is not reentrant and every caller already holds it.
+ */
+async function loadBudgetOnItsServer(budget) {
+    const login = loginOf(budget);
+    if (!isApiLoggedInTo(login)) {
+        logger.info(`[ADAPTER] logging the api in to ${budget.serverUrl} before loading "${budget.name}"`);
+        await withAuthRetry(() => initApiLoggedIn(config.MCP_BRIDGE_DATA_DIR, login, 'init'));
+    }
+    await loadBudgetTracked(budget.syncId, budget.encryptionPassword);
 }
 // Per-op timeout (#270) lives in ./opTimeout.ts so ActualConnectionPool can bound
 // its own session-open init/download without a circular import back into this
@@ -741,11 +807,7 @@ async function initActualApiForOperation() {
         // withAuthRetry does not retry it. Wrapping per-attempt (not the whole retry
         // loop) means legitimate #127 auth-rate-limit backoff (up to ~25s) is not
         // counted against ACTUAL_OP_TIMEOUT_MS.
-        await withAuthRetry(() => withOpTimeout(() => api.init({
-            dataDir: DATA_DIR,
-            serverURL: budget.serverUrl,
-            password: budget.password || '',
-        }), 'init'));
+        await withAuthRetry(() => initApiLoggedIn(DATA_DIR, loginOf(budget), 'init'));
         logger.debug('[ADAPTER] Downloading budget');
         // Bound downloadBudget (#270): the legacy stdio path re-downloads on every
         // op, and a stall here was the production hang. On timeout it rejects and
@@ -4005,8 +4067,10 @@ export async function switchBudget(name) {
         }
         else {
             await withApiLock(async () => {
-                // Bound the in-place budget reload too (#270).
-                await loadBudgetTracked(found.syncId, found.encryptionPassword);
+                // Bound the in-place budget reload too (#270). #571: "same auth" compares against THIS
+                // session's pool entry, but the singleton may be logged in to another session's server by
+                // now, so the load still has to make sure it is talking to this budget's server.
+                await loadBudgetOnItsServer(found);
             });
         }
         connectionPool.updateLoadedSyncId(sessionId, found.syncId);

package/dist/src/lib/apiLogin.js

@@ -0,0 +1,75 @@
+import api from '@actual-app/api';
+import { withOpTimeout } from './opTimeout.js';
+import { setApiLogin, setLoadedBudgetSyncId, registerBudgetLoad, loginsSpanServers } from './apiState.js';
+// Upstream's `init` returns its module-level handler object, the same one every time. Upstream
+// exports no other way to reach `close-budget`. Nothing can be open before the first init, which
+// is when this is still unset.
+let upstreamLib = null;
+/**
+ * #571: the ONLY place in src/ that calls `api.init`.
+ *
+ * With a multi-server budget registry, whether the singleton may skip a login depends on
+ * knowing which server (and password) it is logged in to, and an unknown login counts as a
+ * mismatch. A site that called `api.init` without recording the login would therefore not be
+ * wrong, only slow: every later operation would log in again, which is the #127 auth burst that
+ * #134 removed. Routing every init through here makes "logged in" and "recorded" one step, and
+ * `tests/unit/multi_server_budget_selection.test.js` fails on any raw `api.init(` elsewhere.
+ *
+ * Order, every time:
+ *  1. clear the login and loaded-budget records. Upstream's init points the client at the new
+ *     server before it signs in, so a login that throws or times out leaves the client on a
+ *     server with nothing proven; clearing first means nothing trusts it afterwards, and the
+ *     next operation of any session re-selects.
+ *  2. close any open budget with upstream's `close-budget`, which does NOT sync. Upstream's init
+ *     does not close an open budget, so without this a pending change of the outgoing budget
+ *     would next try to sync against the new server. Harmless when nothing is open (the legacy
+ *     per-operation cycle has already shut down). Never `api.shutdown`: it syncs before it
+ *     closes, and syncing an in-memory copy that is stale against its own data dir (another
+ *     process wrote that budget) fails "out-of-sync" and leaves the local copy permanently
+ *     unopenable; every session open on that budget then fails until the copy is deleted. The
+ *     v0.22.48 full run hit exactly that after the stdio #270 regression, which v0.22.47 survived
+ *     because its session open only ran upstream's download, whose own close does not sync
+ *     either. This removes only the session-open trigger: the adapter precondition still syncs
+ *     the outgoing budget before re-selecting (so a pending change is not lost), and that sync
+ *     carries the same stale-copy hazard when a second process writes the data dir (#575).
+ *     Anything still pending syncs at that budget's next load. Not the pool's shutdown helpers: those drop pool entries, and the other sessions'
+ *     entries are still valid.
+ *  3. log in, then record the login.
+ *
+ * Bounded by the op timeout (#270). Callers that retry on the auth rate limit wrap this whole
+ * call in `withAuthRetry`, so each attempt is bounded on its own.
+ *
+ * A timeout does not cancel (`withOpTimeout` races), so a timed-out close or login keeps running
+ * after the caller has thrown and released the lock. A late close would close the budget the next
+ * operation loaded, in any deployment, so it is always registered with the #393 abandoned-load
+ * registry: every `withApiLock` acquisition settles it, bounded and failing closed, before it runs
+ * anything. A late login is registered only when the registry names more than one login
+ * (`loginsSpanServers`): there it could move the client to another server under the next
+ * operation, while with one login it lands on the only server there is, and registering it would
+ * replace #270's per-request recovery with a fail-closed wait on every operation. The close
+ * has no such exemption: it waits on upstream's spreadsheet and services (not on running handlers), so a close
+ * that stalls makes every session wait, bounded and failing closed, in a one-login deployment
+ * too (the accepted #393 trade-off; making the close and login abortable is #574). Their late
+ * success records nothing (the records were cleared in step 1 and `setApiLogin` is only reached by
+ * a caller still waiting), so the next operation logs in again.
+ */
+export async function initApiLoggedIn(dataDir, login, label) {
+    setApiLogin(null);
+    setLoadedBudgetSyncId(null);
+    if (upstreamLib) {
+        const closing = upstreamLib.send('close-budget');
+        registerBudgetLoad(closing);
+        await withOpTimeout(() => closing, `${label} (close outgoing budget)`);
+    }
+    const loggingIn = api.init({
+        dataDir,
+        serverURL: login.serverUrl,
+        password: login.password,
+    });
+    if (loginsSpanServers())
+        registerBudgetLoad(loggingIn);
+    const lib = await withOpTimeout(() => loggingIn, label);
+    if (lib && typeof lib.send === 'function')
+        upstreamLib = lib;
+    setApiLogin(login);
+}

package/dist/src/lib/apiState.js

@@ -25,8 +25,35 @@ export function setApiInitialized(value) {
     _apiInitialized = value;
     // A singleton that is not live holds no budget. Clearing here means a shutdown can never
     // leave a stale claim behind for the next caller to trust.
-    if (!value)
+    if (!value) {
         _loadedBudgetSyncId = null;
+        _apiLogin = null;
+    }
+}
+let _apiLogin = null;
+export function setApiLogin(login) {
+    _apiLogin = login ? { serverUrl: login.serverUrl, password: login.password } : null;
+}
+export function isApiLoggedInTo(login) {
+    return !!_apiLogin && _apiLogin.serverUrl === login.serverUrl && _apiLogin.password === login.password;
+}
+/**
+ * #571: whether the budget registry names more than one login (server URL and password).
+ *
+ * Decides whether a timed-out `api.init` is registered as an abandoned load. With ONE login a
+ * late-landing init points the client at the only server there is, which is harmless, and
+ * registering it would turn one stalled login into a fail-closed wait on every later operation
+ * until upstream gave up (the per-request recovery #270 guarantees, checked by
+ * tests/unit/adapter_op_timeout.test.js). With several, a late landing can move the client to
+ * another server under the next operation, so it must be settled first. Set once, by the adapter,
+ * from the parsed registry.
+ */
+let _loginsSpanServers = false;
+export function setLoginsSpanServers(value) {
+    _loginsSpanServers = value;
+}
+export function loginsSpanServers() {
+    return _loginsSpanServers;
 }
 /**
  * #390: the syncId of the budget the SINGLETON currently holds, as distinct from the budget

package/dist/src/server/httpServer.js

@@ -9,7 +9,7 @@ import { getLocalIp } from '../utils.js';
 import actualToolsManager from '../actualToolsManager.js';
 import { getConnectionState, connectToActualForSession, shutdownActualForSession, shutdownActual, canAcceptNewSession, isConnectionPoolEnabled } from '../actualConnection.js';
 import { connectionPool } from '../lib/ActualConnectionPool.js';
-import { clearSessionBudgetState, setSessionLivenessCheck } from '../lib/actual-adapter.js';
+import { clearSessionBudgetState, setSessionLivenessCheck, initialBudgetForSession } from '../lib/actual-adapter.js';
 import { errorLogFields } from '../lib/errors.js';
 import observability from '../observability.js';
 import config from '../config.js';
@@ -538,7 +538,15 @@ advertisedUrl) {
                         sessionInitPromises.set(sid, initPromise);
                         // Initialize connection pool for this session
                         try {
-                            await connectToActualForSession(sid);
+                            // #571: open on the session's own budget (a restored #189 preference may live on
+                            // another server), not on the default one.
+                            const budget = initialBudgetForSession(sid);
+                            await connectToActualForSession(sid, {
+                                serverUrl: budget.serverUrl,
+                                password: budget.password || '',
+                                syncId: budget.syncId,
+                                encryptionPassword: budget.encryptionPassword,
+                            });
                             // Only register the transport if the pool connection succeeded.
                             // The pool stamped lastActivity when it created the entry, so it
                             // is already the source of truth for this session's idle clock.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "actual-mcp-server",
   "displayName": "Actual MCP Server",
-  "version": "0.22.47",
+  "version": "0.22.49",
   "engines": {
     "node": ">=22.0.0",
     "npm": ">=10.0.0"
@@ -30,7 +30,7 @@
     "verify-tools": "npm run build && node scripts/verify-tools.js",
     "check:coverage": "node scripts/list-actual-api-methods.mjs",
     "direct-sync": "node scripts/direct-sync/bank-sync-direct.mjs",
-    "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/transactions_aggregate.test.js && node tests/unit/account_flow_summary.test.js && node tests/unit/recurring_expenses_summary.test.js && node tests/unit/generated_tools.smoke.test.js &&node tests/unit/schema_validation.test.js && node tests/unit/schema_json_openai_compat.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/e2e_spec_collection.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/new_tool_completeness.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/workflow_release_guards.test.js && node tests/unit/report_train_failure.test.js && node tests/unit/unit_chain_membership.test.js && node tests/unit/api_surface_drift.test.js && node tests/unit/write_effect_audit_staleness.test.js && node tests/unit/write_effect_audit_membership.test.js && node tests/unit/tool_annotations.test.js && node tests/unit/tool_id_schema_drift.test.js && node tests/unit/filter_id_resolution.test.js && node tests/unit/filter_id_tool_wiring.test.js && node tests/unit/api_coverage_baseline.test.js && node tests/unit/train_preflight.test.js && node tests/unit/verify_published_artifacts.test.js && node tests/unit/report_train_stale.test.js && node tests/unit/stdio_framing_check.test.js && node tests/unit/server_info.test.js && node tests/unit/transfers_create.test.js && node tests/unit/bot_target_branch.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/adapter_set_budget_batch.test.js && node tests/unit/budget_updates_batch.test.js && node tests/unit/rules_create.test.js && node tests/unit/adapter_rule_reference_guard.test.js && node tests/unit/rules_create_batch.test.js && node tests/unit/budgets_hold_for_next_month.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/httpServer_init_failure_report.test.js && node tests/unit/stdio_init_failure_report.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/accounts_delete.test.js && node tests/unit/update_tools_not_found.test.js && node tests/unit/accounts_close.test.js && node tests/unit/accounts_reopen.test.js && node tests/unit/payees_delete.test.js && node tests/unit/payees_merge.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/session_ownership.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/oidc_resource_identifier.test.js && node tests/unit/httpServer_oidc_resource_metadata.test.js && node tests/unit/oidc_error_cause.test.js && node tests/unit/httpServer_oidc_error_body.test.js && node tests/unit/oidc_token_source.test.js && node tests/unit/config_oidc_assertion_refines.test.js && node tests/unit/httpServer_oidc_assertion_mode.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpErrorHandler.test.js && node tests/unit/httpServer_error_handler_wiring.test.js && node tests/unit/httpServer_trust_proxy.test.js && node tests/unit/httpServer_batch_cap.test.js && node tests/unit/dotenv_stdout_quiet.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/adapter_drain_listing_cache.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_acl_listing.test.js && node tests/unit/budget_selection_precondition.test.js && node tests/unit/budget_load_abandonment.test.js && node tests/unit/budget_loader_postcondition.test.js && node tests/unit/budget_loader_import_allowlist.test.js && node tests/unit/budget_import_tracking.test.js && node tests/unit/pool_shutdown_under_lock.test.js && node tests/unit/api_lock_affinity.test.js && node tests/unit/commit_message_closing_keyword.test.js && node tests/unit/write_queue_stranding.test.js && node tests/unit/write_queue_stranded_bound.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/transactions_update_splits.test.js && node tests/unit/transactions_update_split_convert.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/transactions_update_batch.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/stdio_budget_switch.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/tool_content_logging.test.js && node tests/unit/adapter_error_logging.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js && node tests/unit/adapter_op_timeout.test.js && node tests/unit/adapter_write_queue_wakeup.test.js && node tests/unit/ci_workflow_guards.test.js && node tests/unit/node_version_guard.test.js && node tests/unit/node_version_drift.test.js && node tests/unit/playwright_version_drift.test.js && node tests/unit/observability_smoke.test.js && node tests/unit/residue_pattern.test.js && node tests/unit/batch_uncategorized_cleanup.test.js && node tests/unit/dual_transport_gate.test.js && node tests/unit/manual_assertions_use_helper.test.js && node tests/unit/server_version_guard.test.js && node tests/unit/server_version_probe_outside_op_timeout.test.js && node tests/unit/payee_rules_reference_filter.test.js && node tests/unit/oidc_metadata_discovery.test.js && node tests/unit/httpServer_oauth_metadata_route.test.js && node tests/unit/httpServer_mcp_info_route.test.js && node tests/unit/residue_sweep_balance_account.test.js && node tests/unit/tool_factory.test.js && node tests/unit/budget_registry_parse.test.js && node tests/unit/preferences_get.test.js && node tests/unit/budgets_export.test.js && node tests/unit/budgets_import.test.js && node tests/unit/budgets_import_syncid.test.js && node tests/unit/budget_acl_dynamic.test.js && node tests/unit/budget_acl_identity_map.test.js && node tests/unit/budget_acl_userinfo.test.js && node tests/unit/acl_e2e_fixture_contract.test.js && node tests/unit/budget_acl_middleware.test.js && node tests/unit/rules_stage.test.js && node tests/unit/oidc_scope_list.test.js && node tests/unit/get_context.test.js && node tests/unit/contributor_docs.test.js && node tests/unit/toolsets.test.js && node tests/unit/toolsets_entrypoint.test.js && node tests/unit/tools_list_size_budget.test.js && node tests/unit/rules_update_schedules_schema.test.js && node tests/unit/schedules_update_amount_guard.test.js && node tests/unit/source_text_helper.test.js && node tests/unit/transport_onerror.test.js && node tests/unit/adapter_transaction_batch_abort.test.js && node tests/unit/transactions_merge_adapter.test.js && node tests/unit/schedules_dead_conditions.test.js && node tests/unit/session_ownership_express.test.js && node tests/unit/pool_orphan_sweep.test.js && node tests/unit/session_budget_state_cleanup.test.js && node tests/unit/http_session_delete.test.js && node tests/unit/budget_acl_parse.test.js && node tests/unit/server_instructions.test.js && node tests/unit/query_run_empty_hint.test.js",
+    "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/transactions_aggregate.test.js && node tests/unit/account_flow_summary.test.js && node tests/unit/recurring_expenses_summary.test.js && node tests/unit/generated_tools.smoke.test.js &&node tests/unit/schema_validation.test.js && node tests/unit/schema_json_openai_compat.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/e2e_spec_collection.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/new_tool_completeness.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/workflow_release_guards.test.js && node tests/unit/report_train_failure.test.js && node tests/unit/unit_chain_membership.test.js && node tests/unit/api_surface_drift.test.js && node tests/unit/write_effect_audit_staleness.test.js && node tests/unit/write_effect_audit_membership.test.js && node tests/unit/tool_annotations.test.js && node tests/unit/tool_id_schema_drift.test.js && node tests/unit/filter_id_resolution.test.js && node tests/unit/filter_id_tool_wiring.test.js && node tests/unit/api_coverage_baseline.test.js && node tests/unit/train_preflight.test.js && node tests/unit/verify_published_artifacts.test.js && node tests/unit/report_train_stale.test.js && node tests/unit/stdio_framing_check.test.js && node tests/unit/server_info.test.js && node tests/unit/transfers_create.test.js && node tests/unit/bot_target_branch.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/adapter_set_budget_batch.test.js && node tests/unit/budget_updates_batch.test.js && node tests/unit/rules_create.test.js && node tests/unit/adapter_rule_reference_guard.test.js && node tests/unit/rules_create_batch.test.js && node tests/unit/budgets_hold_for_next_month.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/httpServer_init_failure_report.test.js && node tests/unit/stdio_init_failure_report.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/accounts_delete.test.js && node tests/unit/update_tools_not_found.test.js && node tests/unit/accounts_close.test.js && node tests/unit/accounts_reopen.test.js && node tests/unit/payees_delete.test.js && node tests/unit/payees_merge.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/session_ownership.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/oidc_resource_identifier.test.js && node tests/unit/httpServer_oidc_resource_metadata.test.js && node tests/unit/oidc_error_cause.test.js && node tests/unit/httpServer_oidc_error_body.test.js && node tests/unit/oidc_token_source.test.js && node tests/unit/config_oidc_assertion_refines.test.js && node tests/unit/httpServer_oidc_assertion_mode.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpErrorHandler.test.js && node tests/unit/httpServer_error_handler_wiring.test.js && node tests/unit/httpServer_trust_proxy.test.js && node tests/unit/httpServer_batch_cap.test.js && node tests/unit/dotenv_stdout_quiet.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/adapter_drain_listing_cache.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_acl_listing.test.js && node tests/unit/budget_selection_precondition.test.js && node tests/unit/multi_server_budget_selection.test.js && node tests/unit/multi_server_budget_selection_stdio.test.js && node tests/unit/multi_server_session_open_http.test.js && node tests/unit/budget_load_abandonment.test.js && node tests/unit/budget_loader_postcondition.test.js && node tests/unit/budget_loader_import_allowlist.test.js && node tests/unit/budget_import_tracking.test.js && node tests/unit/pool_shutdown_under_lock.test.js && node tests/unit/api_lock_affinity.test.js && node tests/unit/commit_message_closing_keyword.test.js && node tests/unit/write_queue_stranding.test.js && node tests/unit/write_queue_stranded_bound.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/transactions_update_splits.test.js && node tests/unit/transactions_update_split_convert.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/transactions_update_batch.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/stdio_budget_switch.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/tool_content_logging.test.js && node tests/unit/adapter_error_logging.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js && node tests/unit/adapter_op_timeout.test.js && node tests/unit/adapter_write_queue_wakeup.test.js && node tests/unit/ci_workflow_guards.test.js && node tests/unit/node_version_guard.test.js && node tests/unit/node_version_drift.test.js && node tests/unit/playwright_version_drift.test.js && node tests/unit/observability_smoke.test.js && node tests/unit/residue_pattern.test.js && node tests/unit/batch_uncategorized_cleanup.test.js && node tests/unit/dual_transport_gate.test.js && node tests/unit/manual_assertions_use_helper.test.js && node tests/unit/server_version_guard.test.js && node tests/unit/server_version_probe_outside_op_timeout.test.js && node tests/unit/payee_rules_reference_filter.test.js && node tests/unit/oidc_metadata_discovery.test.js && node tests/unit/httpServer_oauth_metadata_route.test.js && node tests/unit/httpServer_mcp_info_route.test.js && node tests/unit/residue_sweep_balance_account.test.js && node tests/unit/tool_factory.test.js && node tests/unit/budget_registry_parse.test.js && node tests/unit/preferences_get.test.js && node tests/unit/budgets_export.test.js && node tests/unit/budgets_import.test.js && node tests/unit/budgets_import_syncid.test.js && node tests/unit/budget_acl_dynamic.test.js && node tests/unit/budget_acl_identity_map.test.js && node tests/unit/budget_acl_userinfo.test.js && node tests/unit/acl_e2e_fixture_contract.test.js && node tests/unit/budget_acl_middleware.test.js && node tests/unit/rules_stage.test.js && node tests/unit/oidc_scope_list.test.js && node tests/unit/get_context.test.js && node tests/unit/contributor_docs.test.js && node tests/unit/toolsets.test.js && node tests/unit/toolsets_entrypoint.test.js && node tests/unit/tools_list_size_budget.test.js && node tests/unit/rules_update_schedules_schema.test.js && node tests/unit/schedules_update_amount_guard.test.js && node tests/unit/source_text_helper.test.js && node tests/unit/transport_onerror.test.js && node tests/unit/adapter_transaction_batch_abort.test.js && node tests/unit/transactions_merge_adapter.test.js && node tests/unit/schedules_dead_conditions.test.js && node tests/unit/session_ownership_express.test.js && node tests/unit/pool_orphan_sweep.test.js && node tests/unit/session_budget_state_cleanup.test.js && node tests/unit/http_session_delete.test.js && node tests/unit/budget_acl_parse.test.js && node tests/unit/server_instructions.test.js && node tests/unit/query_run_empty_hint.test.js",
     "test:adapter": "npm run build && node dist/src/tests_adapter_runner.js",
     "test:e2e": "npx playwright test",
     "test:e2e:docker": "./tests/e2e/run-docker-e2e.sh",