actual-mcp-server 0.22.49 → 0.23.0

package/README.md

@@ -516,6 +516,8 @@ All configuration is via environment variables. Copy `.env.example` to `.env` to
 | **Security & Authentication** ||||
 | `AUTH_PROVIDER` | `none` | No | Auth mode: `none` (static Bearer) or `oidc` (JWKS-validated JWT) |
 | `MCP_SSE_AUTHORIZATION` | _(none)_ | No | Static Bearer token (`AUTH_PROVIDER=none`; highly recommended in production) |
+| `MCP_STATIC_TOKENS` | _(none)_ | No | Several static Bearer tokens, one per client, each with its own principal and budget allow-list (#572). JSON keyed by principal: `{"alice":{"tokenEnv":"MCP_TOKEN_ALICE","budgets":["Home"]}}`. Budgets are registry names. Can coexist with `MCP_SSE_AUTHORIZATION` (which stays unrestricted); refused with `AUTH_PROVIDER=oidc`. See [Security](docs/SECURITY_AND_PRIVACY.md) |
+| `MCP_TOKEN_*` | _(none)_ | If named | The token values `MCP_STATIC_TOKENS` points at, one variable per principal (`MCP_TOKEN_ALICE`). At least 32 characters (`openssl rand -hex 32`), unique, RFC 6750 characters only; a bad one refuses to start |
 | `MCP_ALLOW_UNAUTHENTICATED` | `false` | No | Opt-out for required-by-default HTTP auth (#242). On a non-loopback bind with no token and no OIDC the server refuses to start; set to `true` to run open deliberately (e.g. behind your own proxy) |
 | `OIDC_ISSUER` | _(none)_ | If OIDC | OIDC issuer URL (e.g., `https://sso.example.com`) |
 | `OIDC_ALLOW_INSECURE_ISSUER` | `false` | No | Allow a plaintext (http) OIDC issuer on a trusted network (#244). Off by default (http issuer refused at startup); set `true` only for local/LAN testing |
@@ -836,7 +838,7 @@ The software is provided **as-is**, without warranty of any kind. The author acc
 
 ---
 
-**Version:** 0.22.49 | **Tool Count:** 84 (verified LibreChat-compatible)
+**Version:** 0.23.0 | **Tool Count:** 84 (verified LibreChat-compatible)
 
 ## Sponsor
 

package/dist/src/auth/static-tokens.js

@@ -0,0 +1,167 @@
+// src/auth/static-tokens.ts
+//
+// #572: several static Bearer tokens, each bound to its own principal and budget
+// allow-list (MCP_STATIC_TOKENS). Proposed and first implemented by @jospaquim in
+// PR #569; reimplemented here on develop.
+//
+// Why: with the single MCP_SSE_AUTHORIZATION token every caller is the one
+// principal 'static-bearer', so several MCP clients on one server share the #189
+// per-principal budget preference and have no budget isolation without OIDC.
+// Here each client presents its own token, which resolves to a principal (keys
+// the #189 preference and session ownership) and to the request's allowedBudgets,
+// enforced by the SAME chokepoints OIDC uses (_enforceBudgetAcl, switchBudget,
+// the #570 listing and import guards). One enforcement path, two ways to fill it.
+//
+// Format (JSON object keyed by principal; budgets are registry NAMES):
+//   MCP_STATIC_TOKENS={"alice":{"tokenEnv":"MCP_TOKEN_ALICE","budgets":["Home"]}}
+// The token itself lives in the variable `tokenEnv` names, so the JSON can sit in
+// a compose file while the secrets stay in the secret store.
+//
+// WHY THIS MODULE IMPORTS ONLY node:crypto. config.ts calls parseStaticTokensConfig
+// at config-parse time (the budget-acl-parse.ts pattern, #551): importing the
+// logger, config or the adapter from here would create an ESM cycle. It throws and
+// never logs.
+//
+// ERROR-TEXT CONTRACT. A thrown message names principals, variable names and
+// budget names only, never a token value.
+import { createHash, timingSafeEqual } from 'node:crypto';
+/** Principal reserved for the legacy MCP_SSE_AUTHORIZATION token. */
+export const LEGACY_STATIC_PRINCIPAL = 'static-bearer';
+/** Minimum token length: `openssl rand -hex 16` produces exactly this. */
+export const MIN_TOKEN_LENGTH = 32;
+const PRINCIPAL_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+// Restricted to one family so a principal cannot point at ACTUAL_PASSWORD or any
+// other secret, and so logger.ts can scrub every value of the family.
+const TOKEN_ENV_RE = /^MCP_TOKEN_[A-Z0-9_]+$/;
+// RFC 6750 b64token: '=' only as trailing padding, so whitespace and other
+// characters a header cannot carry intact are refused at startup.
+const B64TOKEN_RE = /^[A-Za-z0-9._~+/-]+=*$/;
+/** True when the raw value is set (unset and blank both mean "feature off"). */
+export function staticTokensConfigured(raw) {
+    return raw !== undefined && raw.trim() !== '';
+}
+/**
+ * Shape check of MCP_STATIC_TOKENS, run by config.ts at startup on both
+ * transports. Returns {} when unset or blank. Touches no environment and no
+ * registry: that is resolveStaticTokens, HTTP only.
+ */
+export function parseStaticTokensConfig(raw) {
+    if (!staticTokensConfigured(raw))
+        return {};
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error('MCP_STATIC_TOKENS is not valid JSON');
+    }
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error('MCP_STATIC_TOKENS must be a JSON object keyed by principal');
+    }
+    const entries = Object.entries(parsed);
+    if (entries.length === 0) {
+        throw new Error('MCP_STATIC_TOKENS is set but defines no principals');
+    }
+    const out = {};
+    for (const [principal, value] of entries) {
+        if (!PRINCIPAL_RE.test(principal)) {
+            throw new Error(`MCP_STATIC_TOKENS: invalid principal name "${principal}" (letters, digits, . _ -; at most 64)`);
+        }
+        if (principal === LEGACY_STATIC_PRINCIPAL) {
+            throw new Error(`MCP_STATIC_TOKENS: principal "${LEGACY_STATIC_PRINCIPAL}" is reserved for MCP_SSE_AUTHORIZATION`);
+        }
+        if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+            throw new Error(`MCP_STATIC_TOKENS: entry for "${principal}" must be an object {"tokenEnv", "budgets"}`);
+        }
+        const { tokenEnv, budgets } = value;
+        if (typeof tokenEnv !== 'string' || !TOKEN_ENV_RE.test(tokenEnv)) {
+            throw new Error(`MCP_STATIC_TOKENS: "${principal}".tokenEnv must be a variable name starting with MCP_TOKEN_ (A to Z, 0 to 9, _)`);
+        }
+        if (!Array.isArray(budgets) || budgets.length === 0 || !budgets.every((b) => typeof b === 'string' && b.trim() !== '')) {
+            throw new Error(`MCP_STATIC_TOKENS: "${principal}".budgets must be a non-empty array of budget names`);
+        }
+        out[principal] = { tokenEnv, budgets: [...budgets] };
+    }
+    return out;
+}
+function digestOf(token) {
+    return createHash('sha256').update(token, 'utf8').digest();
+}
+/**
+ * Resolve MCP_STATIC_TOKENS against the environment and the budget registry, and
+ * build the matcher's entries: one per static principal, plus the legacy token
+ * when set. Called by startHttpServer before it binds, so a refusal stops startup
+ * the way an unreadable TLS key does. Returns [] when neither token source is set.
+ */
+export function resolveStaticTokens(raw, env, registry, legacyToken) {
+    const parsed = parseStaticTokensConfig(raw);
+    const byName = new Map();
+    for (const b of registry)
+        byName.set(b.name.toLowerCase(), b);
+    const entries = [];
+    // Uniqueness is checked on digests: equal digests are equal tokens, and no
+    // token value has to be held to compare them.
+    const seen = new Map();
+    if (legacyToken)
+        seen.set(digestOf(legacyToken).toString('hex'), 'MCP_SSE_AUTHORIZATION');
+    for (const [principal, { tokenEnv, budgets }] of Object.entries(parsed)) {
+        const token = env[tokenEnv];
+        if (token === undefined || token === '') {
+            throw new Error(`MCP_STATIC_TOKENS: "${principal}".tokenEnv names ${tokenEnv}, which is unset or empty`);
+        }
+        if (token.length < MIN_TOKEN_LENGTH) {
+            throw new Error(`MCP_STATIC_TOKENS: the token in ${tokenEnv} is shorter than ${MIN_TOKEN_LENGTH} characters`);
+        }
+        if (!B64TOKEN_RE.test(token)) {
+            throw new Error(`MCP_STATIC_TOKENS: the token in ${tokenEnv} contains characters outside the RFC 6750 token set ` +
+                '(letters, digits, . _ ~ + / -, and = only as trailing padding)');
+        }
+        const allowedBudgets = [];
+        for (const name of budgets) {
+            const found = byName.get(name.toLowerCase());
+            // A "*" sync id would read as "unrestricted" to every ACL check, so it is
+            // refused like an unknown name: a static principal is always restricted, and
+            // the unrestricted case is the legacy token.
+            if (!found || found.syncId === '*') {
+                const available = [...byName.values()].map((b) => `"${b.name}"`).join(', ');
+                throw new Error(`MCP_STATIC_TOKENS: "${principal}" references unknown budget "${name}". Available: ${available}`);
+            }
+            if (!allowedBudgets.includes(found.syncId))
+                allowedBudgets.push(found.syncId);
+        }
+        const digest = digestOf(token);
+        const other = seen.get(digest.toString('hex'));
+        if (other) {
+            throw new Error(`MCP_STATIC_TOKENS: the token in ${tokenEnv} is not unique (also used by ${other})`);
+        }
+        seen.set(digest.toString('hex'), tokenEnv);
+        entries.push({ principal, allowedBudgets, digest });
+    }
+    if (legacyToken)
+        entries.push({ principal: LEGACY_STATIC_PRINCIPAL, digest: digestOf(legacyToken) });
+    return entries;
+}
+function matchWith(presented, entries, compare) {
+    const digest = digestOf(presented);
+    let match;
+    // Every entry is compared, with no early exit, so timing reveals neither which
+    // principal matched nor how many exist. Digests are all 32 bytes, so there is
+    // no length short-circuit either (the pre-#572 matcher had one).
+    for (const e of entries) {
+        if (compare(digest, e.digest) && !match)
+            match = e;
+    }
+    return match;
+}
+/** Constant-time lookup of a presented Bearer token. Used for static AND legacy tokens. */
+export function matchBearerToken(presented, entries) {
+    return matchWith(presented, entries, timingSafeEqual);
+}
+/**
+ * Test seam: the matcher with an injected compare, so a test can count compares.
+ * Separate from matchBearerToken so no production caller can pass a compare that
+ * is not constant time.
+ */
+export function _matchBearerTokenWithCompareForTests(presented, entries, compare) {
+    return matchWith(presented, entries, compare);
+}

package/dist/src/config.js

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import { parseIdentityMap } from './auth/identity-map.js';
 import { parseBudgetAcl } from './auth/budget-acl-parse.js';
+import { parseStaticTokensConfig, staticTokensConfigured } from './auth/static-tokens.js';
 // #466: the byte count body-parser will ACTUALLY enforce for MCP_HTTP_BODY_LIMIT, or
 // null when the value must be refused. Mirrors `bytes.parse` (what body-parser uses)
 // without importing that transitive package: floor(number * unit), units b and kb
@@ -101,6 +102,24 @@ export const configSchema = z.object({
     MCP_BRIDGE_PORT: z.string().default('3600'),
     MCP_TRANSPORT_MODE: z.enum(['--http']).default('--http'),
     MCP_SSE_AUTHORIZATION: z.string().optional(),
+    // #572: several static Bearer tokens, each with its own principal and budget
+    // allow-list, as a JSON object keyed by principal:
+    //   {"alice":{"tokenEnv":"MCP_TOKEN_ALICE","budgets":["Home"]}}
+    // Only the SHAPE is checked here (both transports). The tokens themselves
+    // (MCP_TOKEN_*) and the budget names are resolved by the HTTP server before it
+    // binds (src/auth/static-tokens.ts). Unset or blank means the feature is off.
+    MCP_STATIC_TOKENS: z
+        .string()
+        .optional()
+        .superRefine((v, ctx) => {
+        try {
+            parseStaticTokensConfig(v);
+        }
+        catch (err) {
+            // Safe by contract: names principals and variables, never a token value.
+            ctx.addIssue({ code: 'custom', message: err instanceof Error ? err.message : String(err) });
+        }
+    }),
     // #242: explicit opt-out for the required-by-default HTTP auth gate. When auth
     // is unconfigured AND the bind is non-loopback, the server refuses to start
     // unless this is the exact string 'true'. Strict parse (only 'true' enables)
@@ -318,6 +337,14 @@ export const configSchema = z.object({
         'unrelated userId, so matching sub denies every user. Use AUTH_BUDGET_ACL_CLAIM=auto (the default, ' +
         'which mirrors that precedence), or pin a claim that your IdP also used to populate Actual user_name. ' +
         'See #343.',
+})
+    // #572: static tokens are their own authentication mode. Under OIDC the verified
+    // JWT decides the principal and AUTH_BUDGET_ACL the budgets, so a static token
+    // would either be ignored or open a second door; refuse the pairing.
+    .refine((cfg) => !(cfg.AUTH_PROVIDER === 'oidc' && staticTokensConfigured(cfg.MCP_STATIC_TOKENS)), {
+    path: ['MCP_STATIC_TOKENS'],
+    message: 'MCP_STATIC_TOKENS cannot be combined with AUTH_PROVIDER=oidc: under OIDC the verified token decides ' +
+        'the principal and AUTH_BUDGET_ACL decides its budgets. Unset one of them (#572).',
 })
     // When native TLS is enabled, both the cert and key paths must be provided.
     // MCP_ENABLE_HTTPS is transformed to a boolean above, so this object-level

package/dist/src/index.js

@@ -303,7 +303,9 @@ Docs & source: https://github.com/agigante80/actual-mcp-server`);
         if (useHttp || useTestMcpClient) {
             const decision = enforceHttpAuthPosture({
                 bindHost,
-                hasStaticToken: !!process.env.MCP_SSE_AUTHORIZATION,
+                // #572: MCP_STATIC_TOKENS is authentication too. A set-but-unresolvable value
+                // still counts here: startHttpServer refuses it before binding.
+                hasStaticToken: !!process.env.MCP_SSE_AUTHORIZATION || !!process.env.MCP_STATIC_TOKENS?.trim(),
                 oidcEnabled: process.env.AUTH_PROVIDER === 'oidc',
                 allowUnauthenticated: process.env.MCP_ALLOW_UNAUTHENTICATED === 'true',
             });
@@ -379,7 +381,10 @@ Docs & source: https://github.com/agigante80/actual-mcp-server`);
         }
     }
     main().catch((err) => {
-        logger.error('Failed to start Actual MCP bridge:', err.message || String(err));
+        // #572: the message goes INTO the format string. Passed as a second argument, winston
+        // treats a string as metadata and printed it one character per line ("0": "M", ...),
+        // so an operator never saw why startup failed.
+        logger.error(`Failed to start Actual MCP bridge: ${err?.message || String(err)}`);
         process.exit(1);
     });
 })();

package/dist/src/lib/actual-adapter.js

@@ -108,7 +108,23 @@ function getActiveBudgetConfig() {
             return restored;
         }
     }
-    return [...budgetRegistry.values()][0];
+    // #572: a restricted caller with no selection and no restorable preference starts
+    // on its FIRST PERMITTED budget in registry order (the order the operator controls
+    // and every listing shows; the allow-list is a set), instead of the default it may
+    // not use. Keyed on the list, not the auth mode, so OIDC restricted principals get
+    // it too: before #572 one whose list excluded the default got "Budget ACL:" on every
+    // call until it switched. With no restricting list, or nothing in the registry
+    // permitted, this is the default as before, and _enforceBudgetAcl then refuses.
+    // Not memoised: a later switch writes the session slot, and the next call
+    // recomputes the same answer from the same list.
+    const values = [...budgetRegistry.values()];
+    const restricting = restrictingAllowList(store?.allowedBudgets);
+    if (restricting) {
+        const permitted = values.find((b) => restricting.includes(b.syncId));
+        if (permitted)
+            return permitted;
+    }
+    return values[0];
 }
 /**
  * #571: the budget a NEW session should open on, resolved before its session id is live.
@@ -447,10 +463,12 @@ function abortBatchOnInfrastructureError(error, ctx) {
 function _enforceBudgetAcl(toolName) {
     const sessionId = requestContext.getStore()?.sessionId;
     // Trusted-local short-circuit. stdio and startup health checks run with no
-    // sessionId; in non-OIDC modes those are by-construction trusted (single
-    // user, local process). The ACL only applies when an authenticated multi-
-    // user context is in play (AUTH_PROVIDER === 'oidc').
-    if (!sessionId && config.AUTH_PROVIDER !== 'oidc') {
+    // sessionId AND no allow-list; in non-OIDC modes those are by-construction
+    // trusted (single user, local process). #572: a context that CARRIES a list is
+    // always checked, session or not (the HTTP initialize context has a static
+    // principal's list and no session id yet), so the skip is narrowed to contexts
+    // with no list.
+    if (!sessionId && config.AUTH_PROVIDER !== 'oidc' && !requestContext.getStore()?.allowedBudgets) {
         return;
     }
     const allowedBudgets = restrictedAllowedBudgets(toolName);
@@ -502,6 +520,17 @@ function restrictedAllowedBudgets(toolName) {
         throw new Error('Budget ACL: no allowedBudgets in request context. ' +
             'This request bypassed the budget-acl middleware. Refusing for safety. See #156.');
     }
+    return restrictingAllowList(allowedBudgets);
+}
+/**
+ * #572: THE allow-list predicate: the list when it restricts, else `undefined`.
+ * A missing list and a list containing `"*"` do not restrict. An EMPTY list does:
+ * it is the deny state (budget-acl.ts gives [] to a principal with no access), so it
+ * restricts to nothing. Used by restrictedAllowedBudgets, switchBudget, the
+ * _enforceBudgetAcl skip and the getActiveBudgetConfig fallback, so they cannot
+ * disagree about who is restricted.
+ */
+function restrictingAllowList(allowedBudgets) {
     if (!allowedBudgets || allowedBudgets.includes('*'))
         return undefined;
     return allowedBudgets;
@@ -4008,8 +4037,11 @@ export async function switchBudget(name) {
     if (!found)
         throw notFound();
     // ACL enforcement: the target budget must be in this session's allowedBudgets.
-    // OIDC mode: explicit ACL required. Non-OIDC: short-circuit allow (single-user).
-    if (config.AUTH_PROVIDER === 'oidc') {
+    // OIDC mode: explicit ACL required. #572: any mode whose request carries a
+    // restricting list (MCP_STATIC_TOKENS) is checked against it too; with no list
+    // outside OIDC the caller is unrestricted (legacy bearer, no-auth).
+    const restricting = restrictingAllowList(allowedBudgets);
+    if (config.AUTH_PROVIDER === 'oidc' || restricting) {
         if (!allowedBudgets) {
             logger.warn(JSON.stringify({
                 event: 'acl_denied',
@@ -4020,7 +4052,7 @@ export async function switchBudget(name) {
             }));
             throw new Error(`Budget ACL: cannot switch to "${found.name}". No allowedBudgets in request context.`);
         }
-        if (!allowedBudgets.includes('*') && !allowedBudgets.includes(found.syncId)) {
+        if (restricting && !restricting.includes(found.syncId)) {
             logger.warn(JSON.stringify({
                 event: 'acl_denied',
                 attemptedBudget: found.syncId,

package/dist/src/lib/apiLogin.js

@@ -1,6 +1,8 @@
 import api from '@actual-app/api';
 import { withOpTimeout } from './opTimeout.js';
 import { setApiLogin, setLoadedBudgetSyncId, registerBudgetLoad, loginsSpanServers } from './apiState.js';
+import { createModuleLogger } from './loggerFactory.js';
+const log = createModuleLogger('API-LOGIN');
 // Upstream's `init` returns its module-level handler object, the same one every time. Upstream
 // exports no other way to reach `close-budget`. Nothing can be open before the first init, which
 // is when this is still unset.
@@ -43,14 +45,15 @@ let upstreamLib = null;
  * after the caller has thrown and released the lock. A late close would close the budget the next
  * operation loaded, in any deployment, so it is always registered with the #393 abandoned-load
  * registry: every `withApiLock` acquisition settles it, bounded and failing closed, before it runs
- * anything. A late login is registered only when the registry names more than one login
- * (`loginsSpanServers`): there it could move the client to another server under the next
- * operation, while with one login it lands on the only server there is, and registering it would
- * replace #270's per-request recovery with a fail-closed wait on every operation. The close
+ * anything. With one login, upstream logs in itself and the login is not registered: it lands on
+ * the only server there is, and registering it would replace #270's per-request recovery with a
+ * fail-closed wait on every operation. With more than one (`loginsSpanServers`), a late login
+ * could move the client to another server, so #574 performs it as our own abortable fetch and
+ * registers only the credential-less init that follows (see `initOverFetchedLogin`). The close
  * has no such exemption: it waits on upstream's spreadsheet and services (not on running handlers), so a close
  * that stalls makes every session wait, bounded and failing closed, in a one-login deployment
- * too (the accepted #393 trade-off; making the close and login abortable is #574). Their late
- * success records nothing (the records were cleared in step 1 and `setApiLogin` is only reached by
+ * too (the accepted #393 trade-off; upstream's close takes no signal, so it stays unabortable).
+ * A late close, login or init records nothing (the records were cleared in step 1 and `setApiLogin` is only reached by
  * a caller still waiting), so the next operation logs in again.
  */
 export async function initApiLoggedIn(dataDir, login, label) {
@@ -61,15 +64,176 @@ export async function initApiLoggedIn(dataDir, login, label) {
         registerBudgetLoad(closing);
         await withOpTimeout(() => closing, `${label} (close outgoing budget)`);
     }
+    if (loginsSpanServers()) {
+        await initOverFetchedLogin(dataDir, login, label);
+        return;
+    }
     const loggingIn = api.init({
         dataDir,
         serverURL: login.serverUrl,
         password: login.password,
     });
-    if (loginsSpanServers())
-        registerBudgetLoad(loggingIn);
     const lib = await withOpTimeout(() => loggingIn, label);
     if (lib && typeof lib.send === 'function')
         upstreamLib = lib;
     setApiLogin(login);
 }
+/**
+ * #574: the multi-login path. Upstream's sign-in takes no signal, so a stalled login could only
+ * be raced, and its late answer then pointed the client at its server and wrote its token under
+ * whatever operation ran next. Here the login is our own fetch, aborted at the bound, and the
+ * client is only touched after that fetch has answered in time:
+ *  1. the bounded login: the fetch and its body read, nothing else. `finally` aborts it, which
+ *     is a no-op once it has answered. There is deliberately no `signal.aborted` check after
+ *     it (round 1 of the gate asked for one, round 2 reversed it): the `finally` aborts on
+ *     success too, so the check would fail every login, and a timeout rejects the awaited race
+ *     before the next line runs, which `multi_server_budget_selection.test.js` row 22 pins
+ *     with a fetch that ignores the abort.
+ *  2. a credential-less `api.init` (local: `setServer` plus a fresh in-memory store), then
+ *     `subscribe-set-token` on the handle it returns. Neither makes a network call, but both
+ *     are still raced, so both are registered like the close: a late one would re-point the
+ *     client or hand it the wrong server's token.
+ *
+ * An empty password keeps upstream's skip: no fetch and no token. Nothing of the previous server
+ * survives, because every `api.init` resets upstream's store (`init$3({ persist: false })`).
+ */
+async function initOverFetchedLogin(dataDir, login, label) {
+    let token = '';
+    if (login.password) {
+        const controller = new AbortController();
+        try {
+            token = await withOpTimeout(() => loginOverFetch(login, controller.signal), label);
+        }
+        finally {
+            controller.abort();
+        }
+    }
+    // `password: ''` is upstream's no-credential init (it signs in only on a truthy password).
+    const pointing = api.init({ dataDir, serverURL: login.serverUrl, password: '' });
+    registerBudgetLoad(pointing);
+    const lib = await withOpTimeout(() => pointing, label);
+    if (!lib || typeof lib.send !== 'function')
+        throw new Error(`Actual API ${label}: upstream init returned no handle`);
+    upstreamLib = lib;
+    if (token) {
+        // Local, but raced and registered like the init: a late token set after the next init would
+        // hand this server's token to whichever server the client then points at.
+        const setting = lib.send('subscribe-set-token', { token });
+        registerBudgetLoad(setting);
+        await withOpTimeout(() => setting, label);
+    }
+    setApiLogin(login);
+}
+function authError(reason) {
+    return Object.assign(new Error(`Authentication failed: ${reason}`), { code: reason });
+}
+/** The server URL as written into a message: no `user:pass@`, which an operator may put there. */
+function displayUrl(serverUrl) {
+    try {
+        const u = new URL(serverUrl);
+        u.username = '';
+        u.password = '';
+        return u.toString().replace(/\/$/, '');
+    }
+    catch {
+        return 'the configured server';
+    }
+}
+/**
+ * #574: upstream's password login (`signIn` over `post`), as our own fetch so it can be aborted.
+ * Resolves the session token. Errors follow upstream's `post`/`throwIfNot200` order and carry
+ * `.code` like its `withErrorCode`, because `classifyInitFailure` and `isRetryableAuthError`
+ * read them: in particular a 429 keeps upstream's raw text (`Too many requests, ...`), which is
+ * what the auth-rate-limit retry matches. Three cases go beyond upstream on purpose:
+ * `redirect-refused` (upstream follows a redirect and re-POSTs the password to its target),
+ * `invalid-server-url`, and `openid-required` (upstream returns `{ redirectUrl }` as a success,
+ * which a server-side password login cannot follow).
+ *
+ * Reads `globalThis.fetch` at call time; upstream captured its own at module load. Never logs
+ * or throws the password, the token or a response body.
+ */
+export async function loginOverFetch(login, signal) {
+    let url;
+    try {
+        url = new URL(login.serverUrl);
+    }
+    catch {
+        throw authError('invalid-server-url');
+    }
+    url.pathname = `${url.pathname.replace(/\/+$/, '')}/account/login`;
+    let res;
+    let text;
+    try {
+        res = await globalThis.fetch(url.toString(), {
+            method: 'POST',
+            body: JSON.stringify({ loginMethod: 'password', password: login.password }),
+            headers: { 'Content-Type': 'application/json' },
+            // 'manual', not 'error': under 'error' Node rejects a redirect with the same
+            // `TypeError: fetch failed` as a refused connection, which would map to the retried
+            // `network-failure`. Here the 3xx arrives as a status and is refused below.
+            redirect: 'manual',
+            signal,
+        });
+        text = await res.text();
+    }
+    catch (err) {
+        if (signal.aborted)
+            throw authError('aborted');
+        log.debug('Login request failed', { error: err instanceof Error ? err.name : 'unknown' });
+        throw authError('network-failure');
+    }
+    if (res.status >= 300 && res.status < 400) {
+        // Refused even for an http to https upgrade on the same host (the usual TLS proxy setup):
+        // following any redirect re-POSTs the password, and one rule is easier to trust than a
+        // same-host exception. The operator fixes it once, so the message names the server URL the
+        // redirect implies: its origin plus the path before `/account/login` (a subpath deployment
+        // keeps its subpath), never its userinfo or query. No hint when the Location is absent,
+        // unparseable, not http(s), or implies the URL already configured.
+        let hint = '';
+        const location = res.headers.get('Location');
+        try {
+            const target = new URL(location ?? '', url);
+            const suggested = target.origin + target.pathname.replace(/\/account\/login\/*$/, '').replace(/\/+$/, '');
+            if (location && /^https?:$/.test(target.protocol) && suggested !== displayUrl(login.serverUrl)) {
+                hint = ` (it redirects to ${suggested}; configure that URL instead)`;
+            }
+        }
+        catch {
+            // An unparseable Location gives no hint; the refusal stands.
+        }
+        throw Object.assign(new Error(`Authentication failed: redirect refused by ${displayUrl(login.serverUrl)}${hint}`), { code: 'redirect-refused' });
+    }
+    if (res.status !== 200) {
+        if (res.status === 500)
+            throw authError('internal');
+        if ((res.headers.get('Content-Type') ?? '').toLowerCase().includes('application/json')) {
+            let body;
+            try {
+                body = JSON.parse(text);
+            }
+            catch {
+                throw authError('parse-json');
+            }
+            const reason = body?.reason === 'unauthorized' && body?.details === 'token-not-found' ? 'token-expired' : body?.reason;
+            throw authError(reason || 'network-failure');
+        }
+        if (res.headers.has('ngrok-error-code'))
+            throw authError('network-failure');
+        throw authError(text.slice(0, 200) || 'network-failure');
+    }
+    let data;
+    try {
+        data = JSON.parse(text);
+    }
+    catch {
+        throw authError('parse-json');
+    }
+    if (data?.status !== 'ok')
+        throw authError(data?.description || data?.reason || 'unknown');
+    if (data.data?.returnUrl) {
+        throw Object.assign(new Error(`Authentication failed: ${displayUrl(login.serverUrl)} requires OpenID login, which a server password cannot use`), { code: 'openid-required' });
+    }
+    if (!data.data?.token)
+        throw new Error('login: User token not set');
+    return data.data.token;
+}

package/dist/src/lib/authPosture.js

@@ -76,7 +76,8 @@ export function enforceHttpAuthPosture(input, log = logger, exit = process.exit)
     const { decision, reason } = evaluateHttpAuthPosture(input);
     if (decision === 'refuse') {
         log.error(`Refusing to start: ${reason}. HTTP auth is required-by-default. ` +
-            'Set MCP_SSE_AUTHORIZATION to a strong token (openssl rand -hex 32), or ' +
+            'Set MCP_SSE_AUTHORIZATION to a strong token (openssl rand -hex 32), or set ' +
+            'MCP_STATIC_TOKENS (one token per client, #572), or ' +
             'set AUTH_PROVIDER=oidc, or bind a loopback host. To deliberately run open ' +
             '(for example behind your own authenticating proxy), set MCP_ALLOW_UNAUTHENTICATED=true.');
         exit(1);
@@ -85,7 +86,7 @@ export function enforceHttpAuthPosture(input, log = logger, exit = process.exit)
         log.warn(`Serving HTTP WITHOUT authentication: ${reason}. Anyone who can reach this ` +
             'port can read and modify your financial data. This is allowed only because ' +
             'MCP_ALLOW_UNAUTHENTICATED=true. Put an authenticating reverse proxy in front, ' +
-            'or set MCP_SSE_AUTHORIZATION / AUTH_PROVIDER=oidc.');
+            'or set MCP_SSE_AUTHORIZATION / MCP_STATIC_TOKENS / AUTH_PROVIDER=oidc.');
     }
     return decision;
 }

package/dist/src/lib/config-registry.js

@@ -67,7 +67,8 @@ export const SCHEMA_VARS_ALSO_READ_RAW = [
  * one. `.env.example` documents example members (BUDGET_1_*, BUDGET_2_*, ...); the
  * drift guard collapses any name starting with one of these to the family.
  */
-export const DYNAMIC_ENV_FAMILIES = ['BUDGET_'];
+// MCP_TOKEN_ (#572): the per-principal static token values that MCP_STATIC_TOKENS names.
+export const DYNAMIC_ENV_FAMILIES = ['BUDGET_', 'MCP_TOKEN_'];
 /**
  * Variables documented for the operator (e.g. in Docker) but read by the OS or
  * runtime, not by the app. The drift guard allows these in docs without requiring a

package/dist/src/logger.js

@@ -168,7 +168,9 @@ export function collectSecretValues(env = process.env) {
         // length guard avoids masking short/common values that could collide with benign log
         // text (a short secret is still masked by KEY name when under a sensitive field; only
         // the free-text VALUE scrub is skipped for it).
-        if (typeof v === 'string' && v.length >= 8 && /(PASSWORD|SECRET|AUTHORIZATION|_TOKEN)$/.test(k)) {
+        // MCP_TOKEN_* (#572) are the static Bearer tokens MCP_STATIC_TOKENS names; MCP_TOKEN_ALICE
+        // ends in neither suffix, so the family is matched by prefix.
+        if (typeof v === 'string' && v.length >= 8 && (/(PASSWORD|SECRET|AUTHORIZATION|_TOKEN)$/.test(k) || k.startsWith('MCP_TOKEN_'))) {
             out.push(v);
         }
     }

package/dist/src/server/httpServer.js

@@ -1,5 +1,5 @@
 import express from 'express';
-import { randomUUID, timingSafeEqual } from 'node:crypto';
+import { randomUUID } from 'node:crypto';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import { ListToolsRequestSchema, CallToolRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
@@ -9,7 +9,7 @@ import { getLocalIp } from '../utils.js';
 import actualToolsManager from '../actualToolsManager.js';
 import { getConnectionState, connectToActualForSession, shutdownActualForSession, shutdownActual, canAcceptNewSession, isConnectionPoolEnabled } from '../actualConnection.js';
 import { connectionPool } from '../lib/ActualConnectionPool.js';
-import { clearSessionBudgetState, setSessionLivenessCheck, initialBudgetForSession } from '../lib/actual-adapter.js';
+import { clearSessionBudgetState, setSessionLivenessCheck, initialBudgetForSession, getBudgetRegistry } from '../lib/actual-adapter.js';
 import { errorLogFields } from '../lib/errors.js';
 import observability from '../observability.js';
 import config from '../config.js';
@@ -23,6 +23,7 @@ import { stripJoseCause } from '../lib/oidc-error-cause.js';
 import { buildAcceptedAudiences } from '../lib/oidc-audiences.js';
 import { parseScopeList } from '../lib/oidc-scopes.js';
 import { budgetAclMiddleware } from '../auth/budget-acl.js';
+import { resolveStaticTokens, matchBearerToken, LEGACY_STATIC_PRINCIPAL } from '../auth/static-tokens.js';
 import { runAclPreflight } from '../auth/budget-acl-dynamic.js';
 import * as https from 'node:https';
 import { finished } from 'node:stream';
@@ -42,14 +43,19 @@ import { createHttpErrorHandler } from './httpErrorHandler.js';
 export { classifyInitFailure };
 export { requestContext };
 // Resolve the authenticated principal for the per-principal budget preference
-// (#189). OIDC: the verified JWT subject. Static-bearer: a single shared
-// identity (all bearer callers are the same user). Auth-disabled: undefined, so
-// the preference simply no-ops. Never derived from a client-supplied value.
+// (#189). OIDC: the verified JWT subject. A MCP_STATIC_TOKENS token (#572): its
+// own principal, set by authenticateRequest on a match. Legacy static bearer: a
+// single shared identity (all its callers are the same user). Auth-disabled:
+// undefined, so the preference simply no-ops. Never derived from a
+// client-supplied value.
 function resolvePrincipal(req) {
     if (config.AUTH_PROVIDER === 'oidc') {
         return req.auth?.subject;
     }
-    return config.MCP_SSE_AUTHORIZATION ? 'static-bearer' : undefined;
+    const staticPrincipal = req.staticPrincipal;
+    if (staticPrincipal)
+        return staticPrincipal;
+    return config.MCP_SSE_AUTHORIZATION ? LEGACY_STATIC_PRINCIPAL : undefined;
 }
 export async function startHttpServer(mcp, port, httpPath, capabilities, // was passed by index.ts
 implementedTools, // was passed by index.ts
@@ -59,6 +65,14 @@ toolSchemas, // was passed by index.ts
 version, // server version from package.json
 bindHost = 'localhost', // #239: interface to bind; forwarded to listen()
 advertisedUrl) {
+    // #572: resolve MCP_STATIC_TOKENS (token variables, budget names) before anything
+    // binds, so a bad entry refuses startup like an unreadable TLS key. The registry is
+    // read outside any request context, so it is the full, unfiltered list. config.ts
+    // already refused the variable under OIDC, where these entries are never consulted.
+    const bearerEntries = config.AUTH_PROVIDER === 'oidc'
+        ? []
+        : resolveStaticTokens(config.MCP_STATIC_TOKENS, process.env, getBudgetRegistry(), config.MCP_SSE_AUTHORIZATION);
+    const staticPrincipals = bearerEntries.filter((e) => e.allowedBudgets);
     const app = express();
     // Explicit body-size cap (#168). An oversized payload is rejected with HTTP 413
     // rather than buffered unbounded. Tunable via MCP_HTTP_BODY_LIMIT (default 512kb).
@@ -336,9 +350,11 @@ advertisedUrl) {
             res.status(401).json({ error: 'Unauthorized: OIDC authentication required' });
             return false;
         }
-        // Legacy static Bearer token mode (default).
-        // If MCP_SSE_AUTHORIZATION is not configured, allow all requests
-        if (!config.MCP_SSE_AUTHORIZATION) {
+        // Static Bearer token mode (default): MCP_SSE_AUTHORIZATION and/or MCP_STATIC_TOKENS
+        // (#572). Only when NEITHER is configured is every request allowed. Static tokens are
+        // authentication, so MCP_ALLOW_UNAUTHENTICATED (a posture opt-out for the no-auth
+        // case) does not relax this.
+        if (bearerEntries.length === 0) {
             return true;
         }
         const authHeader = req.headers.authorization;
@@ -354,20 +370,22 @@ advertisedUrl) {
             res.status(401).json({ error: 'Unauthorized: Invalid Authorization header format. Expected "Bearer <token>"' });
             return false;
         }
-        const token = match[1];
-        const expected = config.MCP_SSE_AUTHORIZATION;
-        // Constant-time comparison to defeat timing oracles (#157).
-        // Length-equality short-circuit precedes timingSafeEqual because the
-        // function requires equal-length buffers. Token length is observable
-        // via response timing regardless; the secret bytes are not.
-        const tokenBuf = Buffer.from(token, 'utf8');
-        const expectedBuf = Buffer.from(expected, 'utf8');
-        const equal = tokenBuf.length === expectedBuf.length && timingSafeEqual(tokenBuf, expectedBuf);
-        if (!equal) {
+        // Constant-time comparison to defeat timing oracles (#157): matchBearerToken
+        // compares SHA-256 digests with timingSafeEqual against every configured token,
+        // static and legacy, with no early exit (#572).
+        const hit = matchBearerToken(match[1], bearerEntries);
+        if (!hit) {
             logger.warn(`[HTTP] Unauthorized request from ${req.ip || req.connection.remoteAddress}: Invalid token`);
             res.status(401).json({ error: 'Unauthorized: Invalid token' });
             return false;
         }
+        // A static principal carries its resolved allow-list into the requestContext.run
+        // calls below, where the adapter's ACL chokepoints read it. The legacy token sets
+        // neither field: principal 'static-bearer', unrestricted, exactly as before #572.
+        if (hit.allowedBudgets) {
+            req.staticPrincipal = hit.principal;
+            req.allowedBudgets = [...hit.allowedBudgets];
+        }
         return true;
     };
     // Create a fresh Server instance per session
@@ -994,11 +1012,15 @@ advertisedUrl) {
                 void runAclPreflight();
             }
         }
-        else if (config.MCP_SSE_AUTHORIZATION) {
-            logger.info(`🔒 HTTP authentication enabled (static Bearer token required)`);
+        else if (bearerEntries.length > 0) {
+            // #572: principal names and budget COUNTS only; budget names are personal data.
+            const principals = staticPrincipals.map((e) => `${e.principal} (${e.allowedBudgets.length} budget(s))`).join(', ');
+            logger.info(`🔒 HTTP authentication enabled (Bearer token required)` +
+                (principals ? `; static principals: ${principals}` : '') +
+                (config.MCP_SSE_AUTHORIZATION ? `; MCP_SSE_AUTHORIZATION also accepted (unrestricted)` : ''));
         }
         else {
-            logger.warn(`⚠️  HTTP authentication disabled (no MCP_SSE_AUTHORIZATION or OIDC configured)`);
+            logger.warn(`⚠️  HTTP authentication disabled (no MCP_SSE_AUTHORIZATION, MCP_STATIC_TOKENS or OIDC configured)`);
         }
     });
     // Configure keep-alive to maintain persistent connections

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "actual-mcp-server",
   "displayName": "Actual MCP Server",
-  "version": "0.22.49",
+  "version": "0.23.0",
   "engines": {
     "node": ">=22.0.0",
     "npm": ">=10.0.0"
@@ -30,7 +30,7 @@
     "verify-tools": "npm run build && node scripts/verify-tools.js",
     "check:coverage": "node scripts/list-actual-api-methods.mjs",
     "direct-sync": "node scripts/direct-sync/bank-sync-direct.mjs",
-    "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/transactions_aggregate.test.js && node tests/unit/account_flow_summary.test.js && node tests/unit/recurring_expenses_summary.test.js && node tests/unit/generated_tools.smoke.test.js &&node tests/unit/schema_validation.test.js && node tests/unit/schema_json_openai_compat.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/e2e_spec_collection.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/new_tool_completeness.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/workflow_release_guards.test.js && node tests/unit/report_train_failure.test.js && node tests/unit/unit_chain_membership.test.js && node tests/unit/api_surface_drift.test.js && node tests/unit/write_effect_audit_staleness.test.js && node tests/unit/write_effect_audit_membership.test.js && node tests/unit/tool_annotations.test.js && node tests/unit/tool_id_schema_drift.test.js && node tests/unit/filter_id_resolution.test.js && node tests/unit/filter_id_tool_wiring.test.js && node tests/unit/api_coverage_baseline.test.js && node tests/unit/train_preflight.test.js && node tests/unit/verify_published_artifacts.test.js && node tests/unit/report_train_stale.test.js && node tests/unit/stdio_framing_check.test.js && node tests/unit/server_info.test.js && node tests/unit/transfers_create.test.js && node tests/unit/bot_target_branch.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/adapter_set_budget_batch.test.js && node tests/unit/budget_updates_batch.test.js && node tests/unit/rules_create.test.js && node tests/unit/adapter_rule_reference_guard.test.js && node tests/unit/rules_create_batch.test.js && node tests/unit/budgets_hold_for_next_month.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/httpServer_init_failure_report.test.js && node tests/unit/stdio_init_failure_report.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/accounts_delete.test.js && node tests/unit/update_tools_not_found.test.js && node tests/unit/accounts_close.test.js && node tests/unit/accounts_reopen.test.js && node tests/unit/payees_delete.test.js && node tests/unit/payees_merge.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/session_ownership.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/oidc_resource_identifier.test.js && node tests/unit/httpServer_oidc_resource_metadata.test.js && node tests/unit/oidc_error_cause.test.js && node tests/unit/httpServer_oidc_error_body.test.js && node tests/unit/oidc_token_source.test.js && node tests/unit/config_oidc_assertion_refines.test.js && node tests/unit/httpServer_oidc_assertion_mode.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpErrorHandler.test.js && node tests/unit/httpServer_error_handler_wiring.test.js && node tests/unit/httpServer_trust_proxy.test.js && node tests/unit/httpServer_batch_cap.test.js && node tests/unit/dotenv_stdout_quiet.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/adapter_drain_listing_cache.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_acl_listing.test.js && node tests/unit/budget_selection_precondition.test.js && node tests/unit/multi_server_budget_selection.test.js && node tests/unit/multi_server_budget_selection_stdio.test.js && node tests/unit/multi_server_session_open_http.test.js && node tests/unit/budget_load_abandonment.test.js && node tests/unit/budget_loader_postcondition.test.js && node tests/unit/budget_loader_import_allowlist.test.js && node tests/unit/budget_import_tracking.test.js && node tests/unit/pool_shutdown_under_lock.test.js && node tests/unit/api_lock_affinity.test.js && node tests/unit/commit_message_closing_keyword.test.js && node tests/unit/write_queue_stranding.test.js && node tests/unit/write_queue_stranded_bound.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/transactions_update_splits.test.js && node tests/unit/transactions_update_split_convert.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/transactions_update_batch.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/stdio_budget_switch.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/tool_content_logging.test.js && node tests/unit/adapter_error_logging.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js && node tests/unit/adapter_op_timeout.test.js && node tests/unit/adapter_write_queue_wakeup.test.js && node tests/unit/ci_workflow_guards.test.js && node tests/unit/node_version_guard.test.js && node tests/unit/node_version_drift.test.js && node tests/unit/playwright_version_drift.test.js && node tests/unit/observability_smoke.test.js && node tests/unit/residue_pattern.test.js && node tests/unit/batch_uncategorized_cleanup.test.js && node tests/unit/dual_transport_gate.test.js && node tests/unit/manual_assertions_use_helper.test.js && node tests/unit/server_version_guard.test.js && node tests/unit/server_version_probe_outside_op_timeout.test.js && node tests/unit/payee_rules_reference_filter.test.js && node tests/unit/oidc_metadata_discovery.test.js && node tests/unit/httpServer_oauth_metadata_route.test.js && node tests/unit/httpServer_mcp_info_route.test.js && node tests/unit/residue_sweep_balance_account.test.js && node tests/unit/tool_factory.test.js && node tests/unit/budget_registry_parse.test.js && node tests/unit/preferences_get.test.js && node tests/unit/budgets_export.test.js && node tests/unit/budgets_import.test.js && node tests/unit/budgets_import_syncid.test.js && node tests/unit/budget_acl_dynamic.test.js && node tests/unit/budget_acl_identity_map.test.js && node tests/unit/budget_acl_userinfo.test.js && node tests/unit/acl_e2e_fixture_contract.test.js && node tests/unit/budget_acl_middleware.test.js && node tests/unit/rules_stage.test.js && node tests/unit/oidc_scope_list.test.js && node tests/unit/get_context.test.js && node tests/unit/contributor_docs.test.js && node tests/unit/toolsets.test.js && node tests/unit/toolsets_entrypoint.test.js && node tests/unit/tools_list_size_budget.test.js && node tests/unit/rules_update_schedules_schema.test.js && node tests/unit/schedules_update_amount_guard.test.js && node tests/unit/source_text_helper.test.js && node tests/unit/transport_onerror.test.js && node tests/unit/adapter_transaction_batch_abort.test.js && node tests/unit/transactions_merge_adapter.test.js && node tests/unit/schedules_dead_conditions.test.js && node tests/unit/session_ownership_express.test.js && node tests/unit/pool_orphan_sweep.test.js && node tests/unit/session_budget_state_cleanup.test.js && node tests/unit/http_session_delete.test.js && node tests/unit/budget_acl_parse.test.js && node tests/unit/server_instructions.test.js && node tests/unit/query_run_empty_hint.test.js",
+    "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/transactions_aggregate.test.js && node tests/unit/account_flow_summary.test.js && node tests/unit/recurring_expenses_summary.test.js && node tests/unit/generated_tools.smoke.test.js &&node tests/unit/schema_validation.test.js && node tests/unit/schema_json_openai_compat.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/e2e_spec_collection.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/new_tool_completeness.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/workflow_release_guards.test.js && node tests/unit/report_train_failure.test.js && node tests/unit/unit_chain_membership.test.js && node tests/unit/api_surface_drift.test.js && node tests/unit/write_effect_audit_staleness.test.js && node tests/unit/write_effect_audit_membership.test.js && node tests/unit/tool_annotations.test.js && node tests/unit/tool_id_schema_drift.test.js && node tests/unit/filter_id_resolution.test.js && node tests/unit/filter_id_tool_wiring.test.js && node tests/unit/api_coverage_baseline.test.js && node tests/unit/train_preflight.test.js && node tests/unit/verify_published_artifacts.test.js && node tests/unit/report_train_stale.test.js && node tests/unit/stdio_framing_check.test.js && node tests/unit/server_info.test.js && node tests/unit/transfers_create.test.js && node tests/unit/bot_target_branch.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/adapter_set_budget_batch.test.js && node tests/unit/budget_updates_batch.test.js && node tests/unit/rules_create.test.js && node tests/unit/adapter_rule_reference_guard.test.js && node tests/unit/rules_create_batch.test.js && node tests/unit/budgets_hold_for_next_month.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/httpServer_init_failure_report.test.js && node tests/unit/stdio_init_failure_report.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/accounts_delete.test.js && node tests/unit/update_tools_not_found.test.js && node tests/unit/accounts_close.test.js && node tests/unit/accounts_reopen.test.js && node tests/unit/payees_delete.test.js && node tests/unit/payees_merge.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/session_ownership.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/oidc_resource_identifier.test.js && node tests/unit/httpServer_oidc_resource_metadata.test.js && node tests/unit/oidc_error_cause.test.js && node tests/unit/httpServer_oidc_error_body.test.js && node tests/unit/oidc_token_source.test.js && node tests/unit/config_oidc_assertion_refines.test.js && node tests/unit/httpServer_oidc_assertion_mode.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpErrorHandler.test.js && node tests/unit/httpServer_error_handler_wiring.test.js && node tests/unit/httpServer_trust_proxy.test.js && node tests/unit/httpServer_batch_cap.test.js && node tests/unit/dotenv_stdout_quiet.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/adapter_drain_listing_cache.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_acl_listing.test.js && node tests/unit/budget_selection_precondition.test.js && node tests/unit/multi_server_budget_selection.test.js && node tests/unit/static_tokens.test.js && node tests/unit/httpServer_static_tokens.test.js && node tests/unit/multi_server_budget_selection_stdio.test.js && node tests/unit/api_login_fetch.test.js && node tests/unit/multi_server_session_open_http.test.js && node tests/unit/budget_load_abandonment.test.js && node tests/unit/budget_loader_postcondition.test.js && node tests/unit/budget_loader_import_allowlist.test.js && node tests/unit/budget_import_tracking.test.js && node tests/unit/pool_shutdown_under_lock.test.js && node tests/unit/api_lock_affinity.test.js && node tests/unit/commit_message_closing_keyword.test.js && node tests/unit/write_queue_stranding.test.js && node tests/unit/write_queue_stranded_bound.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/transactions_update_splits.test.js && node tests/unit/transactions_update_split_convert.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/transactions_update_batch.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/stdio_budget_switch.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/tool_content_logging.test.js && node tests/unit/adapter_error_logging.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js && node tests/unit/adapter_op_timeout.test.js && node tests/unit/adapter_write_queue_wakeup.test.js && node tests/unit/ci_workflow_guards.test.js && node tests/unit/node_version_guard.test.js && node tests/unit/node_version_drift.test.js && node tests/unit/playwright_version_drift.test.js && node tests/unit/observability_smoke.test.js && node tests/unit/residue_pattern.test.js && node tests/unit/batch_uncategorized_cleanup.test.js && node tests/unit/dual_transport_gate.test.js && node tests/unit/manual_assertions_use_helper.test.js && node tests/unit/server_version_guard.test.js && node tests/unit/server_version_probe_outside_op_timeout.test.js && node tests/unit/payee_rules_reference_filter.test.js && node tests/unit/oidc_metadata_discovery.test.js && node tests/unit/httpServer_oauth_metadata_route.test.js && node tests/unit/httpServer_mcp_info_route.test.js && node tests/unit/residue_sweep_balance_account.test.js && node tests/unit/tool_factory.test.js && node tests/unit/budget_registry_parse.test.js && node tests/unit/preferences_get.test.js && node tests/unit/budgets_export.test.js && node tests/unit/budgets_import.test.js && node tests/unit/budgets_import_syncid.test.js && node tests/unit/budget_acl_dynamic.test.js && node tests/unit/budget_acl_identity_map.test.js && node tests/unit/budget_acl_userinfo.test.js && node tests/unit/acl_e2e_fixture_contract.test.js && node tests/unit/budget_acl_middleware.test.js && node tests/unit/rules_stage.test.js && node tests/unit/oidc_scope_list.test.js && node tests/unit/get_context.test.js && node tests/unit/contributor_docs.test.js && node tests/unit/toolsets.test.js && node tests/unit/toolsets_entrypoint.test.js && node tests/unit/tools_list_size_budget.test.js && node tests/unit/rules_update_schedules_schema.test.js && node tests/unit/schedules_update_amount_guard.test.js && node tests/unit/source_text_helper.test.js && node tests/unit/transport_onerror.test.js && node tests/unit/adapter_transaction_batch_abort.test.js && node tests/unit/transactions_merge_adapter.test.js && node tests/unit/schedules_dead_conditions.test.js && node tests/unit/session_ownership_express.test.js && node tests/unit/pool_orphan_sweep.test.js && node tests/unit/session_budget_state_cleanup.test.js && node tests/unit/http_session_delete.test.js && node tests/unit/budget_acl_parse.test.js && node tests/unit/server_instructions.test.js && node tests/unit/query_run_empty_hint.test.js",
     "test:adapter": "npm run build && node dist/src/tests_adapter_runner.js",
     "test:e2e": "npx playwright test",
     "test:e2e:docker": "./tests/e2e/run-docker-e2e.sh",