actual-mcp-server 0.26.0 → 0.26.1

package/README.md

@@ -169,4 +169,4 @@ MIT, see [LICENSE](LICENSE). Built on [Actual Budget](https://actualbudget.org/)
 
 ---
 
-**Version:** 0.26.0 | **Tool Count:** 85 (verified LibreChat-compatible)
+**Version:** 0.26.1 | **Tool Count:** 85 (verified LibreChat-compatible)

package/dist/src/config.js

@@ -89,6 +89,10 @@ export const configSchema = z.object({
     // password is set (e.g. an isolated Docker network where the hop is trusted).
     // Off by default so a plaintext upstream + encryption password is refused.
     ALLOW_INSECURE_UPSTREAM: z.string().optional().transform(val => val === 'true'),
+    // #620: upstream @actual-app/api logs at its own info/debug level (sync chatter, and on every
+    // import or bank sync a dump of each reconciled transaction) unless init is told otherwise.
+    // Off by default; `=== 'true'` fails safe, since turning it on is what carries the risk.
+    ACTUAL_API_VERBOSE: z.string().optional().transform(val => val === 'true'),
     MCP_BRIDGE_DATA_DIR: z.string().default('./actual-data'),
     // #332: where actual_budgets_export writes budget zips. A budget export is
     // megabytes of binary, so the tool returns a PATH plus metadata rather than

package/dist/src/index.js

@@ -5,12 +5,16 @@
 // guard cannot live in bin/ alone. It is a side-effect import: the module's top-level
 // `enforceNodeVersion()` fires here, exactly once.
 import './lib/node-version-guard.js';
+// #622: MUST be the second import. Registers the unhandledRejection and uncaughtException
+// handlers before any other module evaluates. They write gated records only (no reason,
+// message or stack) and get the logger later through attachProcessLogger below.
+import { attachProcessLogger } from './lib/processHandlersInstall.js';
 import { getMcpServerVersion } from './lib/mcp-version.js';
 import path from 'node:path';
 import { z } from 'zod';
-import { isKnownBenignRejection } from './lib/rejection-allowlist.js';
 import { buildServerInstructions } from './lib/serverInstructions.js';
 import { format } from 'node:util';
+import { writeSync } from 'node:fs';
 /*
  * #277 / #541: this module's version comes from `getMcpServerVersion()` (src/lib/mcp-version.ts),
  * which `--version`, `--help`, the startup banner, the MCP initialize `serverInfo.version` and
@@ -22,54 +26,6 @@ import { format } from 'node:util';
  * ignored `VERSION`, so a Docker image built as `X-dev-abc` printed plain `X` from
  * `--version` while clients saw `X-dev-abc`. One reader means one string.
  */
-// Add global error handlers
-process.on('unhandledRejection', (reason, promise) => {
-    console.error('=== UNHANDLED REJECTION ===');
-    console.error('Promise:', promise);
-    console.error('Reason:', reason);
-    if (reason instanceof Error) {
-        console.error('Stack:', reason.stack);
-    }
-    console.error('===========================');
-    // #275 backstop. The guard above catches both entry points, but a consumer that
-    // imports this package as a library reaches neither. Import attributes are the one
-    // construct here that fails on an under-floor Node, and it fails asynchronously,
-    // so name the real cause rather than letting the reader chase a packaging bug.
-    if (reason?.code === 'ERR_IMPORT_ASSERTION_TYPE_MISSING') {
-        console.error(`⚠️  This almost certainly means Node ${process.version} is too old.`);
-        console.error('⚠️  actual-mcp-server requires the Node version in package.json "engines".');
-        console.error('⚠️  Import attributes (`with { type: "json" }`) need Node 22 or newer.');
-    }
-    if (isKnownBenignRejection(reason)) {
-        console.error('⚠️  Known Actual API domain error escaped to unhandledRejection:');
-        console.error('⚠️  ' + String(reason));
-        console.error('⚠️  Server will continue running. The caller received an error response.');
-        return;
-    }
-    process.exit(1);
-});
-process.on('uncaughtException', (error) => {
-    const errMsg = String(error?.message || error);
-    const errType = error?.type;
-    // Bank sync errors from GoCardless/SimpleFIN can surface as uncaughtException
-    // from within the @actual-app/api SDK when the provider API returns an error
-    // asynchronously (e.g. RATE_LIMIT_EXCEEDED from GoCardless/Nordigen).
-    // These are non-fatal — the server should survive and continue serving requests.
-    if (errType === 'BankSyncError' ||
-        errMsg.includes('BankSyncError') ||
-        errMsg.includes('NORDIGEN_ERROR') ||
-        errMsg.includes('RATE_LIMIT_EXCEEDED') ||
-        errMsg.includes('Rate limit exceeded') ||
-        errMsg.includes('Failed syncing account') ||
-        errMsg.includes('GoCardless') ||
-        errMsg.includes('SimpleFIN')) {
-        console.error('⚠️  [BANK SYNC] Non-fatal bank sync error surfaced as uncaughtException (server continues):');
-        console.error('⚠️  ' + errMsg);
-        return;
-    }
-    console.error('Uncaught Exception:', error);
-    process.exit(1);
-});
 // Minimal early help handling before any side-effectful modules (prevents dotenv from running on --help)
 const argsEarly = process.argv.slice(2);
 // Set MCP_STDIO_MODE before the async IIFE so it is in place when src/logger.ts is first
@@ -191,7 +147,7 @@ Docs & source: https://github.com/agigante80/actual-mcp-server`);
         import('./actualConnection.js'),
         import('./lib/ActualMCPConnection.js'),
     ]);
-    const [{ startHttpServer }, { startStdioServer }, { enforceHttpAuthPosture, findWeakTokenVars }, loggerModule, utilsModule, actualToolsManagerModule,] = await Promise.all([
+    const [{ startHttpServer }, { startStdioServer }, { enforceHttpAuthPosture, findWeakTokenVars, describeAuthMode }, loggerModule, utilsModule, actualToolsManagerModule,] = await Promise.all([
         import('./server/httpServer.js'),
         import('./server/stdioServer.js'),
         import('./lib/authPosture.js'),
@@ -200,6 +156,9 @@ Docs & source: https://github.com/agigante80/actual-mcp-server`);
         import('./actualToolsManager.js'),
     ]);
     const logger = loggerModule.default;
+    // #622: the process handlers log survivable events through the logger from here on.
+    const { createModuleLogger } = await import('./lib/loggerFactory.js');
+    attachProcessLogger(createModuleLogger('PROCESS'));
     const { getLocalIp } = utilsModule;
     const actualToolsManager = actualToolsManagerModule.default;
     // #541: the build-time VERSION, or the root package version plus a dev suffix on a
@@ -213,7 +172,7 @@ Docs & source: https://github.com/agigante80/actual-mcp-server`);
     const useStdio = args.includes('--stdio');
     const useTestActualConnection = args.includes('--test-actual-connection');
     const useTestMcpClient = args.includes('--test-mcp-client');
-    const SERVER_DESCRIPTION = 'Bridge MCP server exposing Actual finance API to LibreChat.';
+    const SERVER_DESCRIPTION = 'Actual Budget over the Model Context Protocol';
     async function main() {
         // Mutual exclusion — stdio and http are incompatible transports
         if (useHttp && useStdio) {
@@ -359,7 +318,16 @@ Docs & source: https://github.com/agigante80/actual-mcp-server`);
             logger.info('---------');
             logger.info('🟡 MCP SERVER INFO');
             logger.info(`• Server Description:   ${SERVER_DESCRIPTION}`);
-            logger.info(`• OAuth Required:       false`);
+            // #626: the real mode, computed with the same blank-means-off rules as the
+            // posture check. MCP_SSE_AUTHORIZATION stays untrimmed: a whitespace-only
+            // value is still a live credential there.
+            const { staticTokensConfigured } = await import('./auth/static-tokens.js');
+            const authMode = describeAuthMode({
+                oidcEnabled: process.env.AUTH_PROVIDER === 'oidc',
+                hasStaticTokens: staticTokensConfigured(process.env.MCP_STATIC_TOKENS),
+                hasSseAuthorization: !!process.env.MCP_SSE_AUTHORIZATION,
+            });
+            logger.info(`• Auth mode:            ${authMode}`);
             logger.info(`• Capabilities:         ${Object.keys(capabilities).join(', ')}`);
             logger.info(`• Tools:                ${implementedTools.join(', ') || 'none'}`);
             logger.info(`• Server Instructions:  ${serverInstructionsText}`);
@@ -390,4 +358,12 @@ Docs & source: https://github.com/agigante80/actual-mcp-server`);
         logger.error(`Failed to start Actual MCP bridge: ${err?.message || String(err)}`);
         process.exit(1);
     });
-})();
+})().catch((err) => {
+    // #622: the prelude above (dotenv, the dynamic imports, the logger) runs before main(), so
+    // its failures never reach main().catch. Without this catch they escape as an
+    // unhandledRejection, whose gated record drops the message: a missing package or a broken
+    // build would name no module. Same residual as main().catch: startup text only. The logger
+    // may not exist yet, so this writes synchronously to stderr, never stdout.
+    writeSync(2, `Failed to start Actual MCP bridge: ${err?.message || String(err)}\n`);
+    process.exit(1);
+});

package/dist/src/lib/actual-adapter.js

@@ -19,7 +19,7 @@ import { findMatchingRule } from './rule-matching.js';
 import logger from '../logger.js';
 import { checkServerVersionOnce } from './server-version-guard.js';
 import config from '../config.js';
-import { parseBudgetRegistry } from './budget-registry.js';
+import { formatBudgetRegistrySummary, logSafeOrigin, parseBudgetRegistry } from './budget-registry.js';
 import { getPreferredBudgetSyncId, setPreferredBudgetSyncId, pickAllowedPreferredBudget } from './budget-preference-store.js';
 import { requestContext } from './requestContext.js';
 import { connectionPool } from './ActualConnectionPool.js';
@@ -38,8 +38,8 @@ const budgetRegistry = parseBudgetRegistry(process.env, {
     encryptionPassword: config.ACTUAL_BUDGET_PASSWORD,
 });
 setLoginsSpanServers(new Set([...budgetRegistry.values()].map((b) => JSON.stringify([b.serverUrl, b.password || '']))).size > 1);
-logger.info(`[ADAPTER] Budget registry: ${budgetRegistry.size} budget(s) — ` +
-    [...budgetRegistry.values()].map(b => `"${b.name}" (${b.serverUrl})`).join(', '));
+// #621: counts and schemes only; budget names and server hosts stay out of the startup log.
+logger.info(`[ADAPTER] ${formatBudgetRegistrySummary(budgetRegistry)}`);
 /**
  * Per-session active budget. Map from sessionId to lowercased budget key
  * (matches the keys in budgetRegistry).
@@ -276,7 +276,7 @@ function loginOf(budget) {
 async function loadBudgetOnItsServer(budget) {
     const login = loginOf(budget);
     if (!isApiLoggedInTo(login)) {
-        logger.info(`[ADAPTER] logging the api in to ${budget.serverUrl} before loading "${budget.name}"`);
+        logger.info(`[ADAPTER] logging the api in to ${logSafeOrigin(budget.serverUrl)} before loading "${budget.name}"`);
         await withAuthRetry(() => initApiLoggedIn(config.MCP_BRIDGE_DATA_DIR, login, 'init'));
     }
     await loadBudgetTracked(budget.syncId, budget.encryptionPassword);
@@ -828,7 +828,7 @@ async function initActualApiForOperation() {
     try {
         const budget = getActiveBudgetConfig();
         const DATA_DIR = config.MCP_BRIDGE_DATA_DIR;
-        logger.debug(`[ADAPTER] Initializing Actual API for operation (budget: "${budget.name}", server: ${budget.serverUrl})`);
+        logger.debug(`[ADAPTER] Initializing Actual API for operation (budget: "${budget.name}", server: ${logSafeOrigin(budget.serverUrl)})`);
         // Wrap api.init in auth-rate-limit retry so a transient too-many-requests
         // doesn't surface to the caller (and doesn't trigger #132's crash path).
         // Bound EACH init attempt with the op timeout (#270), inside withAuthRetry:
@@ -4078,6 +4078,9 @@ export async function switchBudget(name) {
     };
     if (!found)
         throw notFound();
+    // #628: tool results show the server origin only, never a userinfo credential, path or query.
+    // `found` keeps the raw URL, which the login below still needs.
+    const shownServerUrl = logSafeOrigin(found.serverUrl);
     // ACL enforcement: the target budget must be in this session's allowedBudgets.
     // OIDC mode: explicit ACL required. #572: any mode whose request carries a
     // restricting list (MCP_STATIC_TOKENS) is checked against it too; with no list
@@ -4129,7 +4132,7 @@ export async function switchBudget(name) {
         setSessionBudget(sessionId, key);
         setPreferredBudgetSyncId(store?.principal, found.syncId); // #189: persist at commit
         logger.info(`[ADAPTER] switchBudget no-op for session ${sessionId}: already on "${found.name}" (${found.syncId})`);
-        return { name: found.name, syncId: found.syncId, serverUrl: found.serverUrl };
+        return { name: found.name, syncId: found.syncId, serverUrl: shownServerUrl };
     }
     if (sameAuth) {
         // Same server + creds, different syncId. Reload budget file in place.
@@ -4150,8 +4153,8 @@ export async function switchBudget(name) {
         connectionPool.updateLoadedSyncId(sessionId, found.syncId);
         setSessionBudget(sessionId, key);
         setPreferredBudgetSyncId(store?.principal, found.syncId); // #189: persist at commit
-        logger.info(`[ADAPTER] Active budget switched for session ${sessionId} to: "${found.name}" (${found.syncId}) on ${found.serverUrl}`);
-        return { name: found.name, syncId: found.syncId, serverUrl: found.serverUrl };
+        logger.info(`[ADAPTER] Active budget switched for session ${sessionId} to: "${found.name}" (${found.syncId}) on ${logSafeOrigin(found.serverUrl)}`);
+        return { name: found.name, syncId: found.syncId, serverUrl: shownServerUrl };
     }
     // #581: hold this session's slot across the window between releasing the old entry and
     // creating the new one, so a concurrent initialize cannot take it and leave this session over
@@ -4220,8 +4223,8 @@ export async function switchBudget(name) {
         if (holdsSlot)
             connectionPool.releaseReservation(sessionId);
     }
-    logger.info(`[ADAPTER] Active budget switched for session ${sessionId} to: "${found.name}" (${found.syncId}) on ${found.serverUrl}`);
-    return { name: found.name, syncId: found.syncId, serverUrl: found.serverUrl };
+    logger.info(`[ADAPTER] Active budget switched for session ${sessionId} to: "${found.name}" (${found.syncId}) on ${logSafeOrigin(found.serverUrl)}`);
+    return { name: found.name, syncId: found.syncId, serverUrl: shownServerUrl };
 }
 /**
  * Clear the per-session budget state for a session, so the map does not
@@ -4242,7 +4245,8 @@ export function getBudgetRegistry() {
     return [...budgetRegistry.values()].filter(b => !allowed || allowed.includes(b.syncId)).map(b => ({
         name: b.name,
         syncId: b.syncId,
-        serverUrl: b.serverUrl,
+        // #628: origin only; the registry entry itself keeps the raw URL for the login.
+        serverUrl: logSafeOrigin(b.serverUrl),
         hasEncryption: !!b.encryptionPassword,
     }));
 }

package/dist/src/lib/apiLogin.js

@@ -1,4 +1,5 @@
 import api from '@actual-app/api';
+import config from '../config.js';
 import { withOpTimeout } from './opTimeout.js';
 import { setApiLogin, setLoadedBudgetSyncId, registerBudgetLoad, loginsSpanServers } from './apiState.js';
 import { createModuleLogger } from './loggerFactory.js';
@@ -38,6 +39,10 @@ let upstreamLib = null;
  *     entries are still valid.
  *  3. log in, then record the login.
  *
+ * Every init passes `verbose` explicitly (#620): upstream only sets its process-global verbose
+ * mode when the key is present, and its default is on, which writes reconciled transactions into
+ * our log through `wireConsoleAndDebug`.
+ *
  * Bounded by the op timeout (#270). Callers that retry on the auth rate limit wrap this whole
  * call in `withAuthRetry`, so each attempt is bounded on its own.
  *
@@ -72,6 +77,7 @@ export async function initApiLoggedIn(dataDir, login, label) {
         dataDir,
         serverURL: login.serverUrl,
         password: login.password,
+        verbose: config.ACTUAL_API_VERBOSE,
     });
     const lib = await withOpTimeout(() => loggingIn, label);
     if (lib && typeof lib.send === 'function')
@@ -109,7 +115,7 @@ async function initOverFetchedLogin(dataDir, login, label) {
         }
     }
     // `password: ''` is upstream's no-credential init (it signs in only on a truthy password).
-    const pointing = api.init({ dataDir, serverURL: login.serverUrl, password: '' });
+    const pointing = api.init({ dataDir, serverURL: login.serverUrl, password: '', verbose: config.ACTUAL_API_VERBOSE });
     registerBudgetLoad(pointing);
     const lib = await withOpTimeout(() => pointing, label);
     if (!lib || typeof lib.send !== 'function')

package/dist/src/lib/authPosture.js

@@ -218,3 +218,20 @@ export function enforceHttpAuthPosture(input, log = logger, exit = process.exit)
     }
     return decision;
 }
+/**
+ * One word naming the HTTP auth mode for the startup banner (#626). Precedence
+ * mirrors the listen callback's posture lines in httpServer.ts: OIDC, then the
+ * static token map, then the single shared bearer token, then none. With both
+ * token variables set this reports `static`, as the ticket specifies; the
+ * listen callback still names the extra unrestricted token, and #623 replaces
+ * the banner. Never prints an issuer, token or principal.
+ */
+export function describeAuthMode(input) {
+    if (input.oidcEnabled)
+        return 'oidc';
+    if (input.hasStaticTokens)
+        return 'static';
+    if (input.hasSseAuthorization)
+        return 'bearer';
+    return 'none';
+}

package/dist/src/lib/budget-registry.js

@@ -25,6 +25,44 @@
  * The AI uses `actual_budgets_list_available` to see all configured budgets,
  * then `actual_budgets_switch` with the budget name to switch between them.
  */
+/**
+ * #621: a server URL as it may appear in a log line: scheme, host and port only. URL userinfo
+ * (a reverse-proxy credential), path and query are dropped. Never throws; an unparseable URL
+ * or one with a `null` origin (a non-special scheme such as a schemeless `user:pass@host`
+ * typo) becomes `<invalid url>`. Display text only, for log lines and tool results (#628):
+ * its output is never used to connect, and the login itself must keep the full URL.
+ */
+export function logSafeOrigin(url) {
+    try {
+        const origin = new URL(url).origin;
+        return origin === 'null' ? '<invalid url>' : origin;
+    }
+    catch {
+        return '<invalid url>';
+    }
+}
+/**
+ * #621: the startup registry line, counts and schemes only, so no budget name, host or
+ * credential reaches the log. Servers are counted by the same [serverUrl, password] key
+ * setLoginsSpanServers uses, so the two can never disagree. Never throws.
+ */
+export function formatBudgetRegistrySummary(registry) {
+    const budgets = [...registry.values()];
+    const servers = new Set(budgets.map((b) => JSON.stringify([b.serverUrl, b.password || '']))).size;
+    const schemes = new Set();
+    for (const b of budgets) {
+        let scheme;
+        try {
+            const protocol = new URL(b.serverUrl).protocol;
+            scheme = protocol === 'http:' ? 'http' : protocol === 'https:' ? 'https' : 'other';
+        }
+        catch {
+            scheme = 'invalid';
+        }
+        schemes.add(scheme);
+    }
+    return `Budget registry: ${budgets.length} budget(s) across ${servers} server(s) (${[...schemes].sort().join(', ')})`;
+}
 /**
  * Parse the budget registry from environment variables.
  * Always includes the default budget from the provided defaults (ACTUAL_* vars).
@@ -62,7 +100,7 @@ export function parseBudgetRegistry(env, defaults) {
         // Mirror the default-budget check (#161): never send an E2E encryption
         // password over an http:// upstream unless ALLOW_INSECURE_UPSTREAM is set.
         if (encryptionPassword && env.ALLOW_INSECURE_UPSTREAM !== 'true' && /^http:\/\//i.test(serverUrl)) {
-            console.error(`[CONFIG] BUDGET_${i}_ENCRYPTION_PASSWORD is set but the upstream URL is http:// (${serverUrl}). ` +
+            console.error(`[CONFIG] BUDGET_${i}_ENCRYPTION_PASSWORD is set but the upstream URL is http:// (${logSafeOrigin(serverUrl)}). ` +
                 `Refusing to send the encryption password over plaintext (#161). ` +
                 `Use https:// or set ALLOW_INSECURE_UPSTREAM=true to override.`);
             process.exit(1);

package/dist/src/lib/mcp-version.js

@@ -3,6 +3,12 @@ import { existsSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { findRootPackageJson } from './node-version-guard.js';
+/**
+ * #624: the MCP initialize `serverInfo.name` on both transports. It equals the package.json
+ * name (tests/unit/server_identity.test.js pins that), so a client shows the server under the
+ * name it was installed as, never a description sentence.
+ */
+export const SERVER_NAME = 'actual-mcp-server';
 /**
  * #541: the single source of this server's own version, shared by the MCP initialize
  * `serverInfo.version` (src/index.ts) and the `actual_server_info` tool.

package/dist/src/lib/processHandlers.js

@@ -0,0 +1,183 @@
+/**
+ * #622: the process-level unhandledRejection and uncaughtException handlers, as a pure
+ * factory so unit tests can drive them without exiting. src/lib/processHandlersInstall.ts
+ * registers them on `process`.
+ *
+ * Records are built from gated fields only (logging convention v1, agreed with
+ * actual-sync): `{ type, code?, httpStatus?, category, safeMessage }`. The reason itself,
+ * its message, its stack and any upstream `.type` never reach a record or winston, because
+ * a rejection reason can carry a request object with an Authorization header, and upstream
+ * text can quote account or payee names (#559).
+ *
+ * INVARIANT: imports only node: builtins, ./errors.js and ./rejection-allowlist.js, never
+ * logger.ts or loggerFactory.ts. This module loads before MCP_STDIO_MODE is set, and the
+ * logger reads that variable when winston is built.
+ */
+import { errorLogFields } from './errors.js';
+import { isKnownBenignRejection } from './rejection-allowlist.js';
+/** Fixed sentence per category, used when the throw site set no log-safe text. */
+const SAFE_MESSAGES = {
+    not_found: 'A requested item was not found.',
+    validation: 'A request was rejected as invalid.',
+    auth: 'An upstream request was not authorized.',
+    timeout: 'An operation timed out.',
+    conflict: 'An operation conflicted with existing state.',
+    rate_limited: 'An upstream service rate limited the request.',
+    upstream_unavailable: 'An upstream service was unavailable.',
+    cancelled: 'An operation was cancelled.',
+    internal: 'An internal error occurred.',
+};
+const UNAVAILABLE_CODES = new Set(['ECONNREFUSED', 'ECONNRESET', 'ENOTFOUND', 'EAI_AGAIN', 'EPIPE']);
+/** Closed mapping, first match wins. Never reads message text. */
+export function categorizeError({ errorClass, refusalKind, code, httpStatus: s }) {
+    if (refusalKind === 'not-found')
+        return 'not_found';
+    if (refusalKind === 'out-of-range')
+        return 'validation';
+    if (s === 401 || s === 403)
+        return 'auth';
+    if (s === 404)
+        return 'not_found';
+    if (s === 408 || s === 504 || code === 'ETIMEDOUT')
+        return 'timeout';
+    if (s === 409)
+        return 'conflict';
+    if (s === 429)
+        return 'rate_limited';
+    if (s === 400 || s === 422)
+        return 'validation';
+    if ((s !== undefined && s >= 500 && s <= 599) || (code !== undefined && UNAVAILABLE_CODES.has(code))) {
+        return 'upstream_unavailable';
+    }
+    // The Node AbortError class (its ABORT_ERR code fails the E-shape gate). A fetch abort is a
+    // DOMException and falls to internal by design: this keys on the class, never on `name`.
+    if (errorClass === 'AbortError')
+        return 'cancelled';
+    return 'internal';
+}
+function isHttpStatus(v) {
+    return typeof v === 'number' && Number.isInteger(v) && v >= 100 && v <= 599;
+}
+function readHttpStatus(reason) {
+    if (typeof reason !== 'object' || reason === null)
+        return undefined;
+    const r = reason;
+    if (isHttpStatus(r.status))
+        return r.status;
+    if (isHttpStatus(r.statusCode))
+        return r.statusCode;
+    const response = r.response;
+    if (typeof response === 'object' && response !== null && isHttpStatus(response.status))
+        return response.status;
+    return undefined;
+}
+/**
+ * The gated error object of a record. `type` is the prototype class name, never the
+ * reason's own `.type` property (that can carry CR/LF from upstream). Can throw when the
+ * reason has a hostile getter; the handlers catch that and write the fixed fallback.
+ */
+export function errorRecordFields(reason) {
+    const { errorClass, refusalKind, code, logMessage } = errorLogFields(reason);
+    const httpStatus = readHttpStatus(reason);
+    const category = categorizeError({ errorClass, refusalKind, code, httpStatus });
+    const record = { type: errorClass, category, safeMessage: logMessage ?? SAFE_MESSAGES[category] };
+    if (code !== undefined)
+        record.code = code;
+    if (httpStatus !== undefined)
+        record.httpStatus = httpStatus;
+    return record;
+}
+const NODE_FLOOR_HINT = [
+    `This almost certainly means Node ${process.version} is too old.`,
+    'actual-mcp-server requires the Node version in package.json "engines".',
+    'Import attributes (`with { type: "json" }`) need Node 22 or newer.',
+];
+/**
+ * Upstream raises bank sync failures as plain Errors with no code, so message text is the
+ * only signal. This is a documented exception to the no-text-matching rule: the text only
+ * decides survive versus exit, and is never logged.
+ */
+function isBankSyncError(error) {
+    const errMsg = String(error?.message || error);
+    const errType = error?.type;
+    return (errType === 'BankSyncError' ||
+        errMsg.includes('BankSyncError') ||
+        errMsg.includes('NORDIGEN_ERROR') ||
+        errMsg.includes('RATE_LIMIT_EXCEEDED') ||
+        errMsg.includes('Rate limit exceeded') ||
+        errMsg.includes('Failed syncing account') ||
+        errMsg.includes('GoCardless') ||
+        errMsg.includes('SimpleFIN'));
+}
+export function createProcessHandlers(deps) {
+    const { exit, writeSync, getLogger } = deps;
+    // Fatal: the one synchronous record, then exit 1 even when the write fails. Never also
+    // through winston, which under stdio already writes to stderr (one record per event).
+    function crash(source, error) {
+        try {
+            writeSync(2, JSON.stringify({ level: 'error', event: 'sys_crash', source, error }) + '\n');
+        }
+        catch {
+            // stderr is a full or closed pipe: nothing more can be written.
+        }
+        finally {
+            exit(1);
+        }
+    }
+    function fallback(source) {
+        crash(source, { type: 'unknown', category: 'internal', safeMessage: SAFE_MESSAGES.internal });
+    }
+    function survive(source, event, message, error) {
+        const logger = getLogger();
+        if (logger) {
+            logger.warn(message, { event, source, error });
+        }
+        else {
+            writeSync(2, JSON.stringify({ level: 'warn', event, source, error }) + '\n');
+        }
+    }
+    function writeNodeFloorHint(error) {
+        if (error.code !== 'ERR_IMPORT_ASSERTION_TYPE_MISSING')
+            return;
+        for (const line of NODE_FLOOR_HINT)
+            writeSync(2, line + '\n');
+    }
+    function onUnhandledRejection(reason) {
+        try {
+            const error = errorRecordFields(reason);
+            // #275 backstop: a library consumer reaches neither entry point's guard, and import
+            // attributes fail asynchronously on an under-floor Node, so name the real cause.
+            writeNodeFloorHint(error);
+            if (isKnownBenignRejection(reason)) {
+                survive('unhandledRejection', 'process.rejection_benign', 'Process-level rejection survived', error);
+                return;
+            }
+            crash('unhandledRejection', error);
+        }
+        catch {
+            fallback('unhandledRejection');
+        }
+    }
+    function onUncaughtException(reason) {
+        try {
+            const error = errorRecordFields(reason);
+            writeNodeFloorHint(error);
+            // GoCardless and SimpleFIN failures can surface here from inside @actual-app/api when
+            // the provider answers asynchronously (RATE_LIMIT_EXCEEDED, for example). Non-fatal.
+            if (isBankSyncError(reason)) {
+                if (error.category === 'internal') {
+                    error.category = 'upstream_unavailable';
+                    if (error.safeMessage === SAFE_MESSAGES.internal)
+                        error.safeMessage = SAFE_MESSAGES.upstream_unavailable;
+                }
+                survive('uncaughtException', 'bank_sync.exception_benign', 'Bank sync error survived', error);
+                return;
+            }
+            crash('uncaughtException', error);
+        }
+        catch {
+            fallback('uncaughtException');
+        }
+    }
+    return { onUnhandledRejection, onUncaughtException };
+}

package/dist/src/lib/processHandlersInstall.js

@@ -0,0 +1,25 @@
+/**
+ * #622: side-effect module that registers the process-level handlers. src/index.ts imports
+ * it SECOND, right after ./node-version-guard.js (#275), so the handlers are armed before
+ * any other module evaluates. The logger arrives later through attachProcessLogger, once
+ * src/index.ts has set MCP_STDIO_MODE and loaded src/logger.ts; until then the handlers
+ * write one fixed JSON line to stderr.
+ *
+ * INVARIANT: no import of logger.ts or loggerFactory.ts (see processHandlers.ts).
+ */
+import { writeSync } from 'node:fs';
+import { createProcessHandlers } from './processHandlers.js';
+let attached;
+/** Route the survivable records through the logger from now on. */
+export function attachProcessLogger(logger) {
+    attached = logger;
+}
+const handlers = createProcessHandlers({
+    exit: (code) => process.exit(code),
+    writeSync: (fd, text) => {
+        writeSync(fd, text);
+    },
+    getLogger: () => attached,
+});
+process.on('unhandledRejection', handlers.onUnhandledRejection);
+process.on('uncaughtException', handlers.onUncaughtException);

package/dist/src/lib/rejection-allowlist.js

@@ -7,9 +7,10 @@
  *
  * INVARIANT: this module MUST remain side-effect-free.
  *
- * src/index.ts registers the process.on('unhandledRejection', ...) handler
- * AFTER importing this module (ESM static imports are evaluated before the
- * top-level body runs). Any side effect introduced here, e.g. importing a
+ * src/lib/processHandlersInstall.ts (the second import of src/index.ts, #622)
+ * registers the process.on('unhandledRejection', ...) handler AFTER importing
+ * this module through processHandlers.ts (ESM static imports are evaluated
+ * before the top-level body runs). Any side effect introduced here, e.g. importing a
  * logger that performs winston/file-handle init, importing dotenv, or any
  * code that runs at module load, opens a window during ESM evaluation in
  * which an unhandled rejection bypasses this allow-list and crashes the

package/dist/src/server/httpServer.js

@@ -5,6 +5,8 @@ import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/
 import { ListToolsRequestSchema, CallToolRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
 import logger, { resolveRequestId } from '../logger.js';
 import { attachTransportErrorLogger } from '../lib/transportErrorLogger.js';
+import { SERVER_NAME } from '../lib/mcp-version.js';
+import { createModuleLogger } from '../lib/loggerFactory.js';
 import { getLocalIp } from '../utils.js';
 import actualToolsManager from '../actualToolsManager.js';
 import { getConnectionState, connectToActualForSession, shutdownActualForSession, shutdownActual, admitSession, releaseAdmission, isConnectionPoolEnabled } from '../actualConnection.js';
@@ -43,6 +45,7 @@ import { buildToolListEntries } from '../lib/tool-list-entry.js';
 import { classifyInitFailure } from '../lib/init-failure.js';
 import { createHttpErrorHandler } from './httpErrorHandler.js';
 export { classifyInitFailure };
+const httpLog = createModuleLogger('HTTP');
 export { requestContext };
 // Resolve the authenticated principal for the per-principal budget preference
 // (#189). OIDC: the verified JWT subject. A MCP_STATIC_TOKENS token (#572): its
@@ -486,7 +489,7 @@ advertisedUrl) {
             capabilities: capabilitiesObj,
         };
         const server = new Server({
-            name: serverDescription || "actual-mcp-server",
+            name: SERVER_NAME,
             version: version || "0.1.0",
         }, serverOptions);
         attachTransportErrorLogger(server, 'http');
@@ -1124,9 +1127,9 @@ advertisedUrl) {
         // #239: when bound to a specific (non all-interfaces) host the server is NOT on
         // loopback, so point the health hint at the actual bind host instead of localhost.
         const healthHost = (!bindHost || bindHost === '0.0.0.0' || bindHost === '::') ? 'localhost' : bindHost;
-        console.info(`MCP Streamable HTTP Server listening on ${port}`);
-        console.info(`📨 MCP endpoint: ${advertised}`);
-        console.info(`❤️ Health check: ${scheme}://${healthHost}:${port}/health`);
+        const health = `${scheme}://${healthHost}:${port}/health`;
+        // #625: one structured record through the module logger instead of three console.info lines.
+        httpLog.info(`MCP Streamable HTTP Server listening on ${port}; MCP endpoint: ${advertised} (health: ${health})`, { port, endpoint: advertised, health });
         if (config.AUTH_PROVIDER === 'oidc') {
             logger.info(`🔒 OIDC authentication enabled (JWT Bearer token required; issuer: ${config.OIDC_ISSUER})`);
             // #345: name the userNames the ACL can match, once, at boot. Deliberately

package/dist/src/server/stdioServer.js

@@ -5,6 +5,7 @@ import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprot
 import { randomUUID } from 'node:crypto';
 import logger from '../logger.js';
 import { attachTransportErrorLogger } from '../lib/transportErrorLogger.js';
+import { SERVER_NAME } from '../lib/mcp-version.js';
 import actualToolsManager from '../actualToolsManager.js';
 import { requestContext } from '../lib/requestContext.js';
 import { buildToolListEntries } from '../lib/tool-list-entry.js';
@@ -85,7 +86,9 @@ export function createStdioCallToolHandler(mcp, stdioSessionId) {
         }
     };
 }
-export async function startStdioServer(mcp, capabilities, implementedTools, serverDescription, instructions, toolSchemas, version) {
+export async function startStdioServer(mcp, capabilities, implementedTools, 
+// #624: no longer the serverInfo name; kept so the positional signature matches HTTP.
+_serverDescription, instructions, toolSchemas, version) {
     const toolsList = Array.isArray(implementedTools) ? implementedTools : [];
     // #348: a synthetic session identity for this stdio process.
     //
@@ -108,7 +111,7 @@ export async function startStdioServer(mcp, capabilities, implementedTools, serv
     // restarts and can never collide with an HTTP session id.
     const stdioSessionId = `stdio-${randomUUID()}`;
     logger.debug(`[STDIO] session id ${stdioSessionId}`);
-    const server = new Server({ name: serverDescription || 'actual-mcp-server', version: version || '0.1.0' }, { capabilities, instructions });
+    const server = new Server({ name: SERVER_NAME, version: version || '0.1.0' }, { capabilities, instructions });
     attachTransportErrorLogger(server, 'stdio');
     // List tools handler — mirrors createServerInstance() in httpServer.ts
     server.setRequestHandler(ListToolsRequestSchema, async () => {

package/dist/src/tools/budgets_list_available.js

@@ -4,7 +4,7 @@ const InputSchema = z.object({});
 const tool = {
     name: 'actual_budgets_list_available',
     description: 'List the pre-configured budgets this session may switch to (a session limited to some budgets sees only those). ' +
-        'Each entry shows the budget name, sync ID, server URL, and whether it uses E2E encryption. ' +
+        'Each entry shows the budget name, sync ID, server origin, and whether it uses E2E encryption. ' +
         'Budgets are configured via BUDGET_n_NAME / BUDGET_n_SYNC_ID / BUDGET_n_SERVER_URL env vars. ' +
         'Pass the budget name to actual_budgets_switch to change the active budget.',
     inputSchema: InputSchema,

package/dist/src/tools/schedules_update.js

@@ -3,7 +3,7 @@ import adapter from '../lib/actual-adapter.js';
 import { CommonSchemas } from '../lib/schemas/common.js';
 import { RecurConfigSchema } from '../lib/schemas/recur.js';
 import { ScheduleAmountSchema, amountOpMismatch } from '../lib/schemas/schedule-amount.js';
-const InputSchema = z.object({
+const InputSchema = z.strictObject({
     id: CommonSchemas.scheduleId.describe('Schedule UUID'),
     name: z.string().optional()
         .describe('New display name'),
@@ -24,10 +24,12 @@ const InputSchema = z.object({
         .describe('New YYYY-MM-DD date or RecurConfig object'),
     posts_transaction: z.boolean().optional()
         .describe('Auto-post a transaction on each occurrence'),
-    completed: z.boolean().optional()
-        .describe('true marks it completed, false reactivates it'),
     resetNextDate: z.boolean().optional().default(false)
         .describe('Recalculate next_date'),
+    // #627: strict, because upstream updateSchedule refuses `completed` and `next_date` as
+    // system-managed. A stripped key would return success while changing nothing; an advertised
+    // one failed upstream after the write queue. Either is refused here, before any write, as
+    // "unexpected field(s): completed" (formatZodError sanitises the key); the description says why.
 }).superRefine((input, ctx) => {
     // #527: with both fields supplied the input alone decides. With only one, the answer
     // depends on the stored schedule, so adapter.updateSchedule checks it inside the write queue.
@@ -39,7 +41,7 @@ const InputSchema = z.object({
 });
 const tool = {
     name: 'actual_schedules_update',
-    description: `Update a schedule; supply only the fields to change. A new date replaces the stored recurrence, patterns included. Set resetNextDate: true when changing the date or recurrence.`,
+    description: `Update a schedule; supply only the fields to change. A new date replaces the stored recurrence, patterns included. Set resetNextDate: true when changing the date or recurrence. Completion and next_date are managed by Actual and cannot be set.`,
     inputSchema: InputSchema,
     call: async (args, _meta) => {
         const input = InputSchema.parse(args || {});

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "actual-mcp-server",
   "displayName": "Actual MCP Server",
-  "version": "0.26.0",
+  "version": "0.26.1",
   "mcpName": "io.github.agigante80/actual-mcp-server",
   "engines": {
     "node": ">=22.0.0",
@@ -31,7 +31,7 @@
     "verify-tools": "npm run build && node scripts/verify-tools.js",
     "check:coverage": "node scripts/list-actual-api-methods.mjs",
     "direct-sync": "node scripts/direct-sync/bank-sync-direct.mjs",
-    "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/transactions_aggregate.test.js && node tests/unit/account_flow_summary.test.js && node tests/unit/recurring_expenses_summary.test.js && node tests/unit/generated_tools.smoke.test.js &&node tests/unit/schema_validation.test.js && node tests/unit/schema_json_openai_compat.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/e2e_spec_collection.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/install_snippets.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/new_tool_completeness.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/workflow_release_guards.test.js && node tests/unit/report_train_failure.test.js && node tests/unit/unit_chain_membership.test.js && node tests/unit/api_surface_drift.test.js && node tests/unit/write_effect_audit_staleness.test.js && node tests/unit/write_effect_audit_membership.test.js && node tests/unit/tool_annotations.test.js && node tests/unit/tool_id_schema_drift.test.js && node tests/unit/filter_id_resolution.test.js && node tests/unit/filter_id_tool_wiring.test.js && node tests/unit/api_coverage_baseline.test.js && node tests/unit/train_preflight.test.js && node tests/unit/verify_published_artifacts.test.js && node tests/unit/report_train_stale.test.js && node tests/unit/stdio_framing_check.test.js && node tests/unit/server_info.test.js && node tests/unit/transfers_create.test.js && node tests/unit/bot_target_branch.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/adapter_set_budget_batch.test.js && node tests/unit/budget_updates_batch.test.js && node tests/unit/rules_create.test.js && node tests/unit/adapter_rule_reference_guard.test.js && node tests/unit/rules_create_batch.test.js && node tests/unit/budgets_hold_for_next_month.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/httpServer_init_failure_report.test.js && node tests/unit/stdio_init_failure_report.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/schedules_dates.test.js && node tests/unit/bank_sync.test.js && node tests/unit/accounts_delete.test.js && node tests/unit/update_tools_not_found.test.js && node tests/unit/accounts_close.test.js && node tests/unit/accounts_reopen.test.js && node tests/unit/payees_delete.test.js && node tests/unit/payees_merge.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/session_ownership.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/oidc_resource_identifier.test.js && node tests/unit/httpServer_oidc_resource_metadata.test.js && node tests/unit/oidc_error_cause.test.js && node tests/unit/httpServer_oidc_error_body.test.js && node tests/unit/oidc_token_source.test.js && node tests/unit/config_oidc_assertion_refines.test.js && node tests/unit/httpServer_oidc_assertion_mode.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpErrorHandler.test.js && node tests/unit/httpServer_error_handler_wiring.test.js && node tests/unit/httpServer_trust_proxy.test.js && node tests/unit/httpServer_batch_cap.test.js && node tests/unit/dotenv_stdout_quiet.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/adapter_drain_listing_cache.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_acl_listing.test.js && node tests/unit/budget_selection_precondition.test.js && node tests/unit/multi_server_budget_selection.test.js && node tests/unit/static_tokens.test.js && node tests/unit/httpServer_static_tokens.test.js && node tests/unit/httpServer_host_validation.test.js && node tests/unit/multi_server_budget_selection_stdio.test.js && node tests/unit/api_login_fetch.test.js && node tests/unit/multi_server_session_open_http.test.js && node tests/unit/budget_load_abandonment.test.js && node tests/unit/budget_loader_postcondition.test.js && node tests/unit/budget_loader_import_allowlist.test.js && node tests/unit/budget_import_tracking.test.js && node tests/unit/pool_shutdown_under_lock.test.js && node tests/unit/api_lock_affinity.test.js && node tests/unit/commit_message_closing_keyword.test.js && node tests/unit/write_queue_stranding.test.js && node tests/unit/write_queue_stranded_bound.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/transactions_update_splits.test.js && node tests/unit/transactions_update_split_convert.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/transactions_update_batch.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/stdio_budget_switch.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/tool_content_logging.test.js && node tests/unit/adapter_error_logging.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js && node tests/unit/adapter_op_timeout.test.js && node tests/unit/adapter_write_queue_wakeup.test.js && node tests/unit/ci_workflow_guards.test.js && node tests/unit/node_version_guard.test.js && node tests/unit/node_version_drift.test.js && node tests/unit/playwright_version_drift.test.js && node tests/unit/observability_smoke.test.js && node tests/unit/residue_pattern.test.js && node tests/unit/harness_cleanup.test.js && node tests/unit/harness_stdio_data_dir.test.js && node tests/unit/batch_uncategorized_cleanup.test.js && node tests/unit/rules_stage342_cleanup.test.js && node tests/unit/residue_unreadable.test.js && node tests/unit/dual_transport_gate.test.js && node tests/unit/manual_assertions_use_helper.test.js && node tests/unit/server_version_guard.test.js && node tests/unit/server_version_probe_outside_op_timeout.test.js && node tests/unit/payee_rules_reference_filter.test.js && node tests/unit/oidc_metadata_discovery.test.js && node tests/unit/httpServer_oauth_metadata_route.test.js && node tests/unit/httpServer_mcp_info_route.test.js && node tests/unit/residue_sweep_balance_account.test.js && node tests/unit/tool_factory.test.js && node tests/unit/budget_registry_parse.test.js && node tests/unit/preferences_get.test.js && node tests/unit/budgets_export.test.js && node tests/unit/budgets_import.test.js && node tests/unit/budgets_import_syncid.test.js && node tests/unit/budget_acl_dynamic.test.js && node tests/unit/budget_acl_identity_map.test.js && node tests/unit/budget_acl_userinfo.test.js && node tests/unit/acl_e2e_fixture_contract.test.js && node tests/unit/budget_acl_middleware.test.js && node tests/unit/rules_stage.test.js && node tests/unit/oidc_scope_list.test.js && node tests/unit/get_context.test.js && node tests/unit/contributor_docs.test.js && node tests/unit/toolsets.test.js && node tests/unit/toolsets_entrypoint.test.js && node tests/unit/tools_list_size_budget.test.js && node tests/unit/rules_update_schedules_schema.test.js && node tests/unit/schedules_update_amount_guard.test.js && node tests/unit/source_text_helper.test.js && node tests/unit/transport_onerror.test.js && node tests/unit/adapter_transaction_batch_abort.test.js && node tests/unit/transactions_merge_adapter.test.js && node tests/unit/schedules_dead_conditions.test.js && node tests/unit/session_ownership_express.test.js && node tests/unit/pool_orphan_sweep.test.js && node tests/unit/session_budget_state_cleanup.test.js && node tests/unit/http_session_delete.test.js && node tests/unit/budget_acl_parse.test.js && node tests/unit/server_instructions.test.js && node tests/unit/query_run_empty_hint.test.js && node tests/unit/session_admission_race.test.js && node tests/unit/pool_admission_reservation.test.js && node tests/unit/config_max_sessions_per_principal.test.js && node tests/unit/session_principal_cap.test.js && node tests/unit/schema_published_parity.test.js && node tests/unit/manual_borrowed_category.test.js && node tests/unit/manual_budget_no_borrowed_writes.test.js && node tests/unit/refresh_test_budget_snapshot.test.js && node tests/unit/docs_check.test.js && node tests/unit/docs_markers.test.js && node tests/unit/docs_links_fixture.test.js && node tests/unit/docs_index.test.js && node tests/unit/docs_tools.test.js && node tests/unit/docs_readme_size.test.js && node tests/unit/template_lockstep.test.js && node tests/unit/client_examples.test.js && node tests/unit/mcp_server_json.test.js",
+    "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/transactions_aggregate.test.js && node tests/unit/account_flow_summary.test.js && node tests/unit/recurring_expenses_summary.test.js && node tests/unit/generated_tools.smoke.test.js &&node tests/unit/schema_validation.test.js && node tests/unit/schema_json_openai_compat.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/e2e_spec_collection.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/install_snippets.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/new_tool_completeness.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/workflow_release_guards.test.js && node tests/unit/report_train_failure.test.js && node tests/unit/unit_chain_membership.test.js && node tests/unit/api_surface_drift.test.js && node tests/unit/write_effect_audit_staleness.test.js && node tests/unit/write_effect_audit_membership.test.js && node tests/unit/tool_annotations.test.js && node tests/unit/tool_id_schema_drift.test.js && node tests/unit/filter_id_resolution.test.js && node tests/unit/filter_id_tool_wiring.test.js && node tests/unit/api_coverage_baseline.test.js && node tests/unit/train_preflight.test.js && node tests/unit/verify_published_artifacts.test.js && node tests/unit/report_train_stale.test.js && node tests/unit/stdio_framing_check.test.js && node tests/unit/server_info.test.js && node tests/unit/transfers_create.test.js && node tests/unit/bot_target_branch.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/adapter_set_budget_batch.test.js && node tests/unit/budget_updates_batch.test.js && node tests/unit/rules_create.test.js && node tests/unit/adapter_rule_reference_guard.test.js && node tests/unit/rules_create_batch.test.js && node tests/unit/budgets_hold_for_next_month.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/httpServer_init_failure_report.test.js && node tests/unit/stdio_init_failure_report.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/schedules_dates.test.js && node tests/unit/bank_sync.test.js && node tests/unit/accounts_delete.test.js && node tests/unit/update_tools_not_found.test.js && node tests/unit/accounts_close.test.js && node tests/unit/accounts_reopen.test.js && node tests/unit/payees_delete.test.js && node tests/unit/payees_merge.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/session_ownership.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/oidc_resource_identifier.test.js && node tests/unit/httpServer_oidc_resource_metadata.test.js && node tests/unit/oidc_error_cause.test.js && node tests/unit/httpServer_oidc_error_body.test.js && node tests/unit/oidc_token_source.test.js && node tests/unit/config_oidc_assertion_refines.test.js && node tests/unit/httpServer_oidc_assertion_mode.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpErrorHandler.test.js && node tests/unit/httpServer_error_handler_wiring.test.js && node tests/unit/httpServer_trust_proxy.test.js && node tests/unit/httpServer_batch_cap.test.js && node tests/unit/dotenv_stdout_quiet.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/adapter_drain_listing_cache.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_acl_listing.test.js && node tests/unit/budget_selection_precondition.test.js && node tests/unit/multi_server_budget_selection.test.js && node tests/unit/static_tokens.test.js && node tests/unit/httpServer_static_tokens.test.js && node tests/unit/httpServer_host_validation.test.js && node tests/unit/multi_server_budget_selection_stdio.test.js && node tests/unit/api_login_fetch.test.js && node tests/unit/api_login_verbose_optin.test.js && node tests/unit/config_actual_api_verbose.test.js && node tests/unit/multi_server_session_open_http.test.js && node tests/unit/budget_load_abandonment.test.js && node tests/unit/budget_loader_postcondition.test.js && node tests/unit/budget_loader_import_allowlist.test.js && node tests/unit/budget_import_tracking.test.js && node tests/unit/pool_shutdown_under_lock.test.js && node tests/unit/api_lock_affinity.test.js && node tests/unit/commit_message_closing_keyword.test.js && node tests/unit/write_queue_stranding.test.js && node tests/unit/write_queue_stranded_bound.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/transactions_update_splits.test.js && node tests/unit/transactions_update_split_convert.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/transactions_update_batch.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/stdio_budget_switch.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/tool_content_logging.test.js && node tests/unit/adapter_error_logging.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js && node tests/unit/adapter_op_timeout.test.js && node tests/unit/adapter_write_queue_wakeup.test.js && node tests/unit/ci_workflow_guards.test.js && node tests/unit/node_version_guard.test.js && node tests/unit/node_version_drift.test.js && node tests/unit/playwright_version_drift.test.js && node tests/unit/observability_smoke.test.js && node tests/unit/residue_pattern.test.js && node tests/unit/harness_cleanup.test.js && node tests/unit/harness_stdio_data_dir.test.js && node tests/unit/batch_uncategorized_cleanup.test.js && node tests/unit/rules_stage342_cleanup.test.js && node tests/unit/residue_unreadable.test.js && node tests/unit/dual_transport_gate.test.js && node tests/unit/manual_assertions_use_helper.test.js && node tests/unit/server_version_guard.test.js && node tests/unit/server_version_probe_outside_op_timeout.test.js && node tests/unit/payee_rules_reference_filter.test.js && node tests/unit/oidc_metadata_discovery.test.js && node tests/unit/httpServer_oauth_metadata_route.test.js && node tests/unit/httpServer_mcp_info_route.test.js && node tests/unit/residue_sweep_balance_account.test.js && node tests/unit/tool_factory.test.js && node tests/unit/budget_registry_parse.test.js && node tests/unit/server_no_console.test.js && node tests/unit/auth_mode.test.js && node tests/unit/process_handlers.test.js && node tests/unit/process_handlers_child.test.js && node tests/unit/server_identity.test.js && node tests/unit/budgets_serverurl_redaction.test.js && node tests/unit/budgets_serverurl_redaction_default.test.js && node tests/unit/preferences_get.test.js && node tests/unit/budgets_export.test.js && node tests/unit/budgets_import.test.js && node tests/unit/budgets_import_syncid.test.js && node tests/unit/budget_acl_dynamic.test.js && node tests/unit/budget_acl_identity_map.test.js && node tests/unit/budget_acl_userinfo.test.js && node tests/unit/acl_e2e_fixture_contract.test.js && node tests/unit/budget_acl_middleware.test.js && node tests/unit/rules_stage.test.js && node tests/unit/oidc_scope_list.test.js && node tests/unit/get_context.test.js && node tests/unit/contributor_docs.test.js && node tests/unit/toolsets.test.js && node tests/unit/toolsets_entrypoint.test.js && node tests/unit/tools_list_size_budget.test.js && node tests/unit/rules_update_schedules_schema.test.js && node tests/unit/schedules_update_amount_guard.test.js && node tests/unit/source_text_helper.test.js && node tests/unit/transport_onerror.test.js && node tests/unit/adapter_transaction_batch_abort.test.js && node tests/unit/transactions_merge_adapter.test.js && node tests/unit/schedules_dead_conditions.test.js && node tests/unit/session_ownership_express.test.js && node tests/unit/pool_orphan_sweep.test.js && node tests/unit/session_budget_state_cleanup.test.js && node tests/unit/http_session_delete.test.js && node tests/unit/budget_acl_parse.test.js && node tests/unit/server_instructions.test.js && node tests/unit/query_run_empty_hint.test.js && node tests/unit/session_admission_race.test.js && node tests/unit/pool_admission_reservation.test.js && node tests/unit/config_max_sessions_per_principal.test.js && node tests/unit/session_principal_cap.test.js && node tests/unit/schema_published_parity.test.js && node tests/unit/manual_borrowed_category.test.js && node tests/unit/manual_budget_no_borrowed_writes.test.js && node tests/unit/refresh_test_budget_snapshot.test.js && node tests/unit/docs_check.test.js && node tests/unit/docs_markers.test.js && node tests/unit/docs_links_fixture.test.js && node tests/unit/docs_index.test.js && node tests/unit/docs_tools.test.js && node tests/unit/docs_readme_size.test.js && node tests/unit/template_lockstep.test.js && node tests/unit/client_examples.test.js && node tests/unit/mcp_server_json.test.js",
     "test:adapter": "npm run build && node dist/src/tests_adapter_runner.js",
     "test:e2e": "npx playwright test",
     "test:e2e:docker": "./tests/e2e/run-docker-e2e.sh",