af360 0.1.4 → 0.1.11

package/dist/package.json

@@ -1,23 +1,22 @@
 {
   "name": "af360",
-  "version": "0.1.4",
+  "version": "0.1.11",
   "description": "Watches the things you have built - folders, repos and sites - and tells you what needs you. Runs entirely on your own machine.",
   "license": "UNLICENSED",
   "author": "Afeleos LLC",
   "homepage": "https://afeleos.com",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Afeleos-LLC/AF360.git"
-  },
-  "bugs": {
-    "url": "https://github.com/Afeleos-LLC/AF360/issues"
-  },
+  "mcpName": "com.afeleos/af360",
   "keywords": [
     "local-first",
     "projects",
     "git",
     "monitoring",
-    "privacy"
+    "privacy",
+    "mcp",
+    "model-context-protocol"
+  ],
+  "os": [
+    "win32"
   ],
   "bin": {
     "af360": "bin/af360.mjs"

package/lib/mcpActivity.mjs

@@ -104,6 +104,67 @@
  * the rail says af360 could not identify what asked, rather than guessing.
  *
  * ============================================================
+ * **AND ON EVERY INSTALLED COPY THE PARENT IS AF360 ITSELF** (R340, owner
+ * ruling 2026-09-05, measured on 0.1.6).
+ * ============================================================
+ *
+ * THE PARAGRAPH ABOVE IS TRUE AND WAS NOT ENOUGH, AND THE SENTENCE THAT GAVE
+ * IT AWAY IS FOUR LINES UP: *"the process that spawned this one, which for an
+ * MCP server is the client itself."* **THAT STOPPED BEING TRUE WHEN R306
+ * SHIPPED.** A packaged install writes the alias entry `af360.exe mcp`; the
+ * alias resolves to af360's own native host; and that host starts node on
+ * bin/af360.mjs AS A CHILD. The client is this process's GRANDparent.
+ *
+ * So the owner read `estate_status asked by af360` three times over a Log room
+ * whose whole purpose is naming who asked, and af360 was naming itself - the
+ * exact defect guard 4 exists to prevent, arriving through the one name the
+ * guard did not know was its own.
+ *
+ * **THE HONEST ANSWER SHIPS AND THE REAL ONE IS OWED.** `observeCaller` now
+ * refuses OWN_APP as flatly as it refuses the runtime, so the record says af360
+ * could not identify what asked - which is TRUE, and which a reader can act on.
+ * Naming the client for real means walking up one more hop, `caller-name`
+ * answers with a name rather than a pid, and a parent-of-pid verb is a NEW DOOR
+ * in af360-bridge.exe. **THAT IS THE OWNER'S TO RULE (RULINGS 001) AND IT IS
+ * RECORDED AS OWED IN 0b.4, NOT TAKEN QUIETLY HERE.**
+ *
+ * ============================================================
+ * **AND HE RULED IT. THE DEBT ABOVE IS PAID** (R349/R350, owner ruling
+ * 2026-09-05, measured on the installed 0.1.7 before a line was written).
+ * ============================================================
+ *
+ * **THE PARAGRAPH ABOVE IS KEPT WHOLE AND NOT REWRITTEN** (RULINGS 65): a debt
+ * that was named, carried for a day and then paid is a different fact from one
+ * nobody ever wrote down, and only one of those is true here.
+ *
+ * `caller-chain` is the door, the owner opened it, and `callerFromChain` is the
+ * rule that reads it - **which is NOT the rule R350 was drafted with.** Driven
+ * against this machine's live client before it was built, the drafted rule
+ * answered `cmd`, because the client spawns af360 through a shell. Driven
+ * against a node-based client it answered `powershell`, the client's own
+ * launcher. Two false sentences, both found by measuring rather than by
+ * reasoning, which is R349's whole reason for ordering the measurement first.
+ *
+ * **WHAT DID NOT CHANGE, AND IT IS EVERY GUARD THIS FILE CLAIMS.** The four
+ * guards below hold exactly as written: `observeCaller` still takes no
+ * parameters, the binary is still found without the environment, the mask still
+ * runs - now on EVERY hop rather than on one - and the shape gate still has a
+ * constant fallback. **AND ONE CLAIM GOT STRONGER RATHER THAN WEAKER**: the old
+ * verb opened a process HANDLE to read a name; the new one reads a snapshot
+ * struct and opens no handle on any walked process at all, so "af360 cannot
+ * start, stop or signal anything through this door" became a property of the
+ * code instead of a promise about it.
+ *
+ * THE OTHER HALF OF WHAT WAS MEASURED, BECAUSE A HALF-ANSWERED QUESTION READS
+ * AS A WHOLE ONE: every `tools/call` IS logged - `noteToolCall` sits before the
+ * branch in scripts/mcp-server.mjs and cannot be skipped by an unknown tool, a
+ * refusal or a config fault - and REPEATS COLLAPSE FOR DISPLAY ONLY, per tool
+ * and per caller, inside `COLLAPSE_MS`, rendered `x3` (lib/mcpRail.mjs
+ * `collapse`). Nothing is dropped from the file. **AN ASK THAT NEVER REACHED
+ * THIS SERVER LEAVES NO TRACE HERE AND CANNOT**: a client that answers from its
+ * own context did not ask af360, and af360 must not invent a line for it.
+ *
+ * ============================================================
  * ONE FILE, IN AF360'S OWN HOME, APPEND-ONLY, CAPPED (RULINGS 56a, 56c)
  * ============================================================
  *
@@ -203,6 +264,58 @@ export const UNIDENTIFIED = "unidentified";
  */
 export const CALLER_SHAPE = /^[a-z0-9][a-z0-9._+-]{0,31}$/;
 
+/**
+ * AF360'S OWN IMAGE NAME, AS WINDOWS REPORTS IT (R340, owner ruling
+ * 2026-09-05).
+ *
+ * THE BRIDGE RETURNS `ProcessName`, WHICH CARRIES NO EXTENSION - "af360", not
+ * "af360.exe" - so this is the alias name with its `.exe` already off. It is
+ * the one literal in this file that has a twin elsewhere (`ALIAS_NAME` in
+ * lib/connections.mjs) and it is NOT imported from there: that module reaches
+ * a config parser and a filesystem walk, and this one is loaded by the cockpit
+ * for its path constants. A four-character duplicate is cheaper than that
+ * graph, and scripts/mcp-fixture.mjs asserts the two agree so the duplicate
+ * cannot drift.
+ *
+ * IT IS COMPARED, NEVER WRITTEN. Like every other value here it can only ever
+ * cause UNIDENTIFIED to be recorded; no branch puts it in a line.
+ */
+export const OWN_APP = "af360";
+
+/**
+ * THE SHELLS af360 WALKS STRAIGHT PAST (R349/R350, owner ruling 2026-09-05).
+ *
+ * **THE MEASUREMENT THAT PUT THIS LIST HERE, AND IT WAS TAKEN OFF THE OWNER'S
+ * OWN LIVE CLIENT.** R350 as drafted said the asker is *"the first ancestor
+ * that is neither af360's own runtime nor its executable"*. Run against the
+ * real chain on 2026-09-05, that rule answered `cmd`:
+ *
+ *     node -> af360 -> cmd -> claude -> sh
+ *                      ^^^ the rule as drafted stopped here
+ *
+ * `.claude.json` registers af360 as `"command": "af360.exe"`, and the client
+ * spawns that through `cmd /d /s /c "af360.exe ^"mcp^""`. **SO THERE IS A
+ * SHELL BETWEEN AF360'S HOST AND THE CLIENT, AND `estate_status asked by cmd`
+ * IS R340'S DEFECT WEARING A DIFFERENT NAME** - a false sentence, which is the
+ * worst thing this repo can ship (CLAUDE.md 0).
+ *
+ * **THE OWNER RULED THE LIST RATHER THAN A SESSION GUESSING IT** (2026-09-05,
+ * on the measurement above): *"shells are plumbing, not askers."* A shell does
+ * not ask af360 anything; it is only ever interposed by the client's own spawn,
+ * so walking past one lands on the client rather than away from it.
+ *
+ * **IT IS A SKIP LIST AND `node` IS NOT ON IT, AND THAT DISTINCTION IS THE
+ * WHOLE RULING.** See `callerFromChain`: a conduit is walked THROUGH, a runtime
+ * is walked INTO A STOP. Adding `node` here would name a node client's
+ * launcher, which is the second false sentence the measurement found.
+ */
+export const CONDUIT = Object.freeze(["cmd", "powershell", "pwsh", "sh", "bash"]);
+
+/** THE WALK'S CEILING ON THIS SIDE, and it is the bridge's own `ChainMax`.
+ *  A second bound in a second language is a bound that drifts, so
+ *  scripts/bridge-doors-fixture.mjs asserts the two numbers agree. */
+export const CHAIN_MAX = 16;
+
 /** THE OBSERVED NAME, and it starts as the honest answer rather than as null:
  *  until af360 has looked, af360 has not identified anything. */
 let CALLER = UNIDENTIFIED;
@@ -223,17 +336,34 @@ export function callerName() {
  *
  * EVERY FAILURE IS THE SAME FAILURE: the constant. No bridge (an npm install,
  * a Mac, a tree nobody has built the shell in), a dead parent, a name the shape
- * gate refuses, af360's own runtime looking back - all of them leave CALLER at
- * UNIDENTIFIED, and the rail then says af360 could not identify what asked.
+ * gate refuses, af360's own runtime looking back, AF360'S OWN APP LOOKING BACK
+ * (R340) - all of them leave CALLER at UNIDENTIFIED, and the rail then says
+ * af360 could not identify what asked.
  * NOTHING HERE MAY EVER FAIL AN ANSWER, so it cannot throw.
+ *
+ * **WHAT IT DOES SINCE R340 IS READ THE KERNEL AND ASK ~~`callerFrom`~~
+ * `callerFromChain` (R349/R350).** Every rule that decides moved there so a
+ * fixture can drive it with a name this machine's process tree does not happen
+ * to contain; this function keeps the two things only it can do - the ppid and
+ * the bridge - and keeps guard 1.
+ *
+ * **AND THE VERB IT ASKS CHANGED ON 2026-09-05, WHICH IS THE DEBT R340 WROTE
+ * DOWN BEING PAID.** `caller-name` answered ONE hop, and on every packaged
+ * install that hop is af360's own host, so af360 could only ever say it could
+ * not tell. `caller-chain` answers the ancestors by name, af360 walks them, and
+ * the client is named where the walk can name it.
  */
 export async function observeCaller() {
   if (looked) return CALLER;
   looked = true;
   try {
     /* THE KERNEL'S OWN NUMBER. Node did not choose it and a caller cannot set
-       it: it is the process that spawned this one, which for an MCP server is
-       the client itself. */
+       it: it is the process that spawned this one.
+       ~~"which for an MCP server is the client itself"~~ **AND THAT CLAUSE WAS
+       THE DEFECT** (R340). It is the client on a `node <entry> mcp` entry and
+       it is AF360'S OWN HOST on the alias entry every packaged install writes.
+       The number is still unforgeable; what it points AT depends on how af360
+       was started, and this file may not assume one shape. */
     const ppid = process.ppid;
     if (!Number.isInteger(ppid) || ppid <= 0) return CALLER;
 
@@ -244,31 +374,196 @@ export async function observeCaller() {
 
     /* `fixedPath` refuses AF360_BRIDGE - guard 2 in the header, and the whole
        reason lib/bridge.mjs grew a second resolver. Two seconds is generous
-       against a measured 149ms round trip and it runs once. */
-    const r = await bridge("caller-name", String(ppid), { fixedPath: true, timeout: 2_000 });
+       against a measured 149ms round trip - the chain walk was measured at
+       ~77ms on 2026-09-05, snapshot included - and it runs once. */
+    /* **IT IS THE ppid AND NOT `process.pid`, AND THAT IS LOAD-BEARING RATHER
+       THAN INCIDENTAL.** The chain comes back nearest-first, so sending this
+       process's own id would put af360's OWN node at the head of it - and
+       `callerFromChain` STOPS at a runtime, so every answer on every machine
+       would silently become the constant. This exact confusion produced a wrong
+       answer while this was being driven on 2026-09-05, against real data, and
+       it is written here because the failure is INVISIBLE: nothing throws,
+       nothing logs, af360 just quietly stops naming anybody.
+       scripts/mcp-rail-fixture.mjs asserts the call site passes `ppid`. */
+    const r = await bridge("caller-chain", String(ppid), { fixedPath: true, timeout: 2_000 });
     if (!r.ok) return CALLER;
 
-    /* THE MASK FIRST (RULINGS 57b, guard 3), then the gate. Order matters: a
-       name the mask ate comes back as "[secret masked]", which has brackets and
-       a space in it, so the gate refuses it and af360 says it could not
-       identify the caller - rather than writing af360's own redaction marker
-       into a row as though it were somebody's name. */
-    const seen = mask(String(r.out ?? "")).trim().toLowerCase();
-
-    /* AF360'S OWN RUNTIME IS NOT AN ANSWER (RULINGS 42a). A wrapper script
-       between the client and af360 leaves this process's parent as node, and
-       "node asked" would be af360 naming itself as the agent. The comparison is
-       against THIS process's own executable rather than the literal alone, so a
-       renamed runtime is caught too. */
-    const ownRuntime = path.basename(process.execPath, ".exe").toLowerCase();
-    if (seen === "node" || seen === ownRuntime) return CALLER;
-
-    if (!CALLER_SHAPE.test(seen)) return CALLER;
-    CALLER = seen;
+    CALLER = callerFromChain(r.out);
   } catch { /* a courtesy to the rail must never become a failed answer */ }
   return CALLER;
 }
 
+/**
+ * THE WHOLE DECISION, AND NOTHING BUT THE DECISION (R340, 2026-09-05).
+ *
+ * ============================================================
+ * WHY IT IS A FUNCTION, AND WHY IT TAKES THE ARGUMENT observeCaller REFUSES
+ * ============================================================
+ *
+ * R340's fixture has to DRIVE TWO DISTINCT CLIENTS and watch each get named.
+ * `observeCaller` reads the kernel, so on this machine it can only ever
+ * observe one parent, and a fixture that asserts anything about a second would
+ * have to REBUILD these rules beside them. **A TWIN OF A REDACTION-SHAPED RULE
+ * IS A RULE THAT DRIFTS**, and this repo has already ruled that twice (RULINGS
+ * 44a; lib/shareExport.mjs's own header). So the rules move to where a fixture
+ * can reach the SHIPPING copy, and `observeCaller` is what remains: a kernel
+ * read, and a call to this.
+ *
+ * **THE NO-PARAMETER GUARD IS NOT WEAKENED, BECAUSE THE GUARD WAS NEVER ABOUT
+ * THIS FUNCTION.** Guard 1 says nothing UPSTREAM can hand this module a name -
+ * and nothing can: `observeCaller` still takes no arguments, it is still the
+ * only caller of this in the shipping path, and it still feeds it one value it
+ * got from the bridge. This function RETURNS and never assigns: `CALLER` has
+ * exactly one writer, four lines above, and grep proves it. A fixture calling
+ * this gets a verdict back and changes nothing about what the writer stamps.
+ *
+ * EVERY REFUSAL RETURNS THE SAME CONSTANT, and there are five:
+ *
+ *   1. THE MASK ATE IT (RULINGS 57b, guard 3). Run FIRST, on purpose: a name
+ *      the mask redacted comes back as "[secret masked]" - brackets and a
+ *      space - so the shape gate refuses it and af360 says it could not tell,
+ *      rather than writing its own redaction marker as somebody's name.
+ *   2. "node" - a bare runtime is not an answer to "who asked".
+ *   3. THIS PROCESS'S OWN EXECUTABLE, compared rather than assumed, so a
+ *      renamed runtime is caught too.
+ *   4. AF360'S OWN APP (R340). See OWN_APP.
+ *   5. THE SHAPE GATE. Not a filter - one narrow shape or nothing.
+ *
+ * @param {unknown} raw whatever `caller-name` printed. Compared and classified;
+ *   it reaches a log line only by being RETURNED and only if it survives all
+ *   five.
+ * @returns {string} the observed name, or UNIDENTIFIED.
+ */
+export function callerFrom(raw) {
+  const seen = mask(String(raw ?? "")).trim().toLowerCase();
+
+  /* AF360'S OWN RUNTIME IS NOT AN ANSWER (RULINGS 42a). A wrapper script
+     between the client and af360 leaves this process's parent as node, and
+     "node asked" would be af360 naming itself as the agent. The comparison is
+     against THIS process's own executable rather than the literal alone, so a
+     renamed runtime is caught too. */
+  const ownRuntime = path.basename(process.execPath, ".exe").toLowerCase();
+  if (seen === "node" || seen === ownRuntime) return UNIDENTIFIED;
+
+  /* AND NEITHER IS AF360'S OWN APP (R340, owner ruling 2026-09-05, measured
+     on the installed 0.1.6). THE LINE ABOVE HELD A RULE THIS ONE COMPLETES:
+     af360 never names itself, and for eight days it only knew how to spot
+     itself wearing the RUNTIME's name.
+     WHAT THE OWNER READ, AND IT WAS af360 ANSWERING WITH ITS OWN NAME:
+         estate_status asked by af360 - answered from af360's last look.
+     Claude Code asked. Every time.
+     THE CAUSE IS R306'S OWN REPAIR, AND IT IS NOT A REGRESSION IN IT. The
+     alias entry a packaged install writes is `af360.exe mcp`, the alias
+     resolves to `shell/bin/af360.exe`, and that executable STARTS NODE ON
+     bin/af360.mjs AS A CHILD (shell/Af360Shell.cs, McpVerb.Run). So the
+     parent of this process is not the client at all - IT IS AF360. The
+     kernel's number is still the kernel's number; what moved is what sits
+     on the other end of it.
+     BOTH SYMPTOMS ARE ONE CAUSE. Before the alias the entry was `node
+     <entry> mcp`, the parent WAS the client, and the client was Claude Code -
+     which is itself node, so the line above refused it and the row read
+     "af360 could not identify what asked". That is the single older entry in
+     the owner's log, and it was the guard working correctly.
+     **THIS IS A WRONG ANSWER BECOMING A TRUE ONE, NOT A MISSING ONE BEING
+     FILLED IN** (RULINGS 59). Naming the real client means walking UP past
+     af360's own host to its parent, and `caller-name` returns a name and not a
+     pid - so it needs a NEW BRIDGE VERB, which is a door, which is the owner's
+     (RULINGS 001) and is OWED IN 0b.4 rather than taken here. Until that ruling
+     af360 says the thing it can prove: it could not tell.
+     **THE OWNER RULED THE DOOR ON 2026-09-05 AND THE DEBT IS PAID (R349).**
+     `caller-chain` walks the ancestors and `callerFromChain` below decides over
+     them. THIS LINE DOES NOT MOVE AND MUST NOT: reaching this function with
+     `af360` still means af360 is looking at itself, and the answer to that is
+     still the honest sentence. What changed is that the CHAIN no longer STOPS
+     at af360 - it walks past it and asks this question of the next name up. */
+  if (seen === OWN_APP) return UNIDENTIFIED;
+
+  if (!CALLER_SHAPE.test(seen)) return UNIDENTIFIED;
+  return seen;
+}
+
+/**
+ * THE ASKER, PICKED OUT OF THE ANCESTORS (R349/R350, owner ruling 2026-09-05).
+ *
+ * ============================================================
+ * TWO LISTS, AND THEY DO OPPOSITE THINGS. THAT IS THE RULING.
+ * ============================================================
+ *
+ * A reader who takes this for one list with two spellings has the rule
+ * backwards, so it is said plainly:
+ *
+ *   A CONDUIT IS WALKED THROUGH.  af360's own executable, and a shell. Neither
+ *                                 ever ASKS af360 anything - af360 wrote the
+ *                                 first one, and the second was interposed by
+ *                                 the client's own spawn - so the client is
+ *                                 further up and walking past reaches it.
+ *   A RUNTIME IS WALKED INTO A     `node`, and this process's own executable.
+ *   STOP.                         af360 cannot tell a node CLIENT from a node
+ *                                 WRAPPER around one, and the two want
+ *                                 opposite answers. So it stops and says it
+ *                                 could not tell.
+ *
+ * **BOTH HALVES WERE MEASURED BEFORE EITHER WAS BUILT (R349's own order), AND
+ * EACH ONE CAUGHT A FALSE SENTENCE:**
+ *
+ *     the owner's live client   node -> af360 -> cmd -> claude -> sh
+ *     skip only af360           names `cmd`         <- the client's SHELL
+ *     this rule                 names `claude`      <- the client
+ *
+ *     a node-based client       node -> af360 -> node -> powershell -> claude
+ *     treat node as a conduit   names `powershell`  <- the CLIENT'S LAUNCHER
+ *     this rule                 stops at node, says af360 could not tell
+ *
+ * **THE SECOND ROW IS WHY THE STOP EXISTS AND WHY IT IS NOT A DEFECT.** A
+ * Node-based CLI client is UNNAMEABLE BY THIS WALK, deliberately and for ever:
+ * the only thing that would separate it from a wrapper is its COMMAND LINE, and
+ * this door returns names and refuses command lines by construction
+ * (shell/Af360Bridge.cs). A limit that could only be closed by widening a
+ * security bound is a limit af360 keeps. docs/SECURITY-MODEL.md records it as
+ * one (RULINGS 63: an unproven residual is a prediction, not a disclaimer).
+ *
+ * **AND THE ANSWER AT A STOP IS THE CONSTANT, NEVER THE RUNTIME'S NAME** (the
+ * owner's own words on ruling this: *"the honest sentence, never a runtime's
+ * name in the asker slot"*). `node` never reaches the caller field. That is
+ * `callerFrom`'s existing first refusal and this function reuses it rather than
+ * restating it - a twin of a redaction-shaped rule is a rule that drifts
+ * (RULINGS 44a), which is the same argument that lifted `callerFrom` out of
+ * `observeCaller` in the first place.
+ *
+ * **THE MASK RUNS ON EVERY HOP AND NOT ONLY ON THE ONE THAT WINS** (RULINGS
+ * 57b, guard 3). A redacted name comes back as `[secret masked]`, which is not
+ * a conduit and not a runtime, so it falls to the shape gate and refuses.
+ *
+ * @param {unknown} raw whatever `caller-chain` printed: names, one per line,
+ *   nearest ancestor first. Only ever COMPARED against constants in this
+ *   module, exactly as the tool enum is; a value reaches a log line by being
+ *   RETURNED and only after surviving `callerFrom`.
+ * @returns {string} the asker's name, or UNIDENTIFIED.
+ */
+export function callerFromChain(raw) {
+  let hops = 0;
+  for (const line of String(raw ?? "").split("\n")) {
+    const seen = mask(line).trim().toLowerCase();
+    if (seen === "") continue;
+
+    /* THE BRIDGE ALREADY CAPS THE WALK AT `ChainMax`. THIS SIDE CAPS IT AGAIN
+       ANYWAY, and not out of tidiness: `r.out` is a string this module did not
+       produce, and a reader of this loop should not have to go and read a C#
+       file to know it terminates. */
+    if (++hops > CHAIN_MAX) break;
+
+    if (seen === OWN_APP || CONDUIT.includes(seen)) continue;
+
+    /* THE FIRST NAME THAT IS NOT PLUMBING IS THE ANSWER, WHATEVER IT IS - and
+       `callerFrom` is what decides whether it is an answer af360 may say. A
+       runtime, a masked string and a name the shape gate refuses all come back
+       as the constant from there, so there is exactly one refusal path in this
+       module and this function does not own a second copy of it. */
+    return callerFrom(seen);
+  }
+  return UNIDENTIFIED;
+}
+
 /**
  * The shape of every line this file can ever contain, as a regex, so the walk
  * can assert the whole file against it in one move rather than hunting for

package/package.json

@@ -1,23 +1,22 @@
 {
   "name": "af360",
-  "version": "0.1.4",
+  "version": "0.1.11",
   "description": "Watches the things you have built - folders, repos and sites - and tells you what needs you. Runs entirely on your own machine.",
   "license": "UNLICENSED",
   "author": "Afeleos LLC",
   "homepage": "https://afeleos.com",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Afeleos-LLC/AF360.git"
-  },
-  "bugs": {
-    "url": "https://github.com/Afeleos-LLC/AF360/issues"
-  },
+  "mcpName": "com.afeleos/af360",
   "keywords": [
     "local-first",
     "projects",
     "git",
     "monitoring",
-    "privacy"
+    "privacy",
+    "mcp",
+    "model-context-protocol"
+  ],
+  "os": [
+    "win32"
   ],
   "bin": {
     "af360": "bin/af360.mjs"