aontu 0.52.0 → 0.53.0

package/src/lsp.ts

@@ -18,8 +18,12 @@
 
 import type { Val } from './type'
 
-import { Aontu } from './aontu'
+import { Aontu, VERSION } from './aontu'
 import { getHint } from './err'
+import { collectNils } from './walk'
+import { collectDeprecations, deprecationMessage } from './utility'
+import { why } from './query'
+import type { WhyConjunct } from './provenance'
 
 
 // LSP DiagnosticSeverity subset.
@@ -28,8 +32,12 @@ const SEVERITY_WARNING = 2
 const SEVERITY_INFORMATION = 3
 const SEVERITY_HINT = 4
 
-// Reported to the client in the initialize response.
-const LSP_VERSION = '0.1.0'
+// Reported to the client in the initialize response. It is the
+// ENGINE's version, not a number of the server's own: a separately
+// maintained one drifts, and had -- the server answered 0.1.0 against
+// a package at 0.52.1, so a client could not tell which engine it was
+// talking to (status-2026-08-21.md section 10).
+const LSP_VERSION = VERSION
 
 
 // Zero-based line / UTF-16 character offset (LSP Position).
@@ -45,6 +53,9 @@ type Diagnostic = {
   code?: string
   source: string
   message: string
+  // LSP DiagnosticTag values; [1] is Unnecessary, [2] is Deprecated —
+  // the native tag editors strike through (G3 phase 4).
+  tags?: number[]
 }
 
 
@@ -73,9 +84,13 @@ type OutMessage = {
 // functions, syntax errors) produce diagnostics.
 function computeDiagnostics(
   src: string,
-  opts?: { vars?: Record<string, Val> }
+  opts?: { vars?: Record<string, Val>, trust?: any }
 ): Diagnostic[] {
-  const aontu = new Aontu()
+  // The trust profile (G5, docs/trust.md): the LSP is the
+  // highest-exposure surface — merely OPENING a hostile .aon file in an
+  // editor performs its reads — so the handler confines evaluation to
+  // the workspace root and threads the profile through here.
+  const aontu = new Aontu(null == opts?.trust ? {} : { trust: opts.trust })
 
   let root: any
   let ac: any
@@ -92,9 +107,10 @@ function computeDiagnostics(
     return [parseErrorDiagnostic(err)]
   }
 
-  const nils: any[] = []
+  // The walk's `seen` set is reused below to dedup context errors
+  // against the nils already found in the tree.
   const seen = new Set()
-  walkNils(root, nils, seen)
+  const nils: any[] = collectNils(root, seen)
 
   // Errors recorded on the context but not present in the tree — e.g. a
   // budget_passes exhaustion nil, which is about the whole evaluation
@@ -109,34 +125,35 @@ function computeDiagnostics(
     }
   }
 
-  return nils.map(nilToDiagnostic)
-}
-
-
-// Walk a unified Val tree collecting every NilVal exactly once. A NilVal
-// in the result always represents an error; valid non-concrete values
-// (scalar kinds, refs, conjuncts) are never NilVals.
-function walkNils(v: any, out: any[], seen: Set<any>) {
-  if (null == v || 'object' !== typeof v || true !== v.isVal) return
-  if (seen.has(v)) return
-  seen.add(v)
-
-  if (v.isNil) {
-    out.push(v)
-    return
-  }
-
-  const peg = v.peg
-  if (Array.isArray(peg)) {
-    for (const c of peg) walkNils(c, out, seen)
-  }
-  else if (null != peg && 'object' === typeof peg) {
-    for (const k in peg) walkNils(peg[k], out, seen)
+  const out = nils.map(nilToDiagnostic)
+
+  // Deprecation tags (G3 phase 4): every sited value carrying the
+  // deprecate() record — the declaration and, because the record rides
+  // meets and reference clones, every use resolving through it — gets
+  // the native Deprecated tag (2) at Hint severity, so editors strike
+  // it through without shouting.
+  for (const { val } of collectDeprecations(root)) {
+    const v: any = val
+    if (1 > (v.site?.row ?? -1) || 1 > (v.site?.col ?? -1)) {
+      continue
+    }
+    out.push({
+      range: {
+        start: { line: v.site.row - 1, character: v.site.col - 1 },
+        end: {
+          line: v.site.row - 1,
+          character: v.site.col - 1 + siteExtent(v),
+        },
+      },
+      severity: 4,
+      code: 'deprecated',
+      source: 'aontu',
+      message: deprecationMessage(v.deprecation),
+      tags: [2],
+    })
   }
 
-  // Spread constraints live off-peg on Map/List Vals.
-  const spreadCj = v.spread?.cj
-  if (spreadCj) walkNils(spreadCj, out, seen)
+  return out
 }
 
 
@@ -169,9 +186,39 @@ function nilToDiagnostic(nil: any): Diagnostic {
 
 
 // Length (UTF-16 units, like LSP characters) of the offending value's
-// canonical form, used to size the diagnostic range (minimum 1).
+// SOURCE TEXT, used to size the diagnostic range (minimum 1).
 function labelLength(nil: any): number {
-  const c = nil.primary?.canon
+  return null == nil.primary ? 1 : siteExtent(nil.primary)
+}
+
+
+// The extent to underline for a value: its SOURCE TEXT's length, with
+// the canon as the fallback and 1 as the floor.
+//
+// CANON IS NOT SOURCE TEXT, which is the whole point of Site.len:
+// `0x1F` has canon `31`, so sizing by canon underlines two characters
+// of a four-character literal — hovering `0x1F` highlighted `0x` and
+// hovering `1F` answered nothing. The Go twin is the same fallback in
+// go/check.go (Problem.Len, ValueSpan.Len), in bytes there because it
+// is added to a byte offset before conversion.
+//
+// The fallback is for a value carrying no stamped span — one propagated
+// onto a result rather than written by a document — where canon is all
+// there is and an approximate underline beats none. A REPORT never
+// guesses this way: vet and why emit len only when it is known, because
+// there a wrong length is a corrupted document rather than a wonky
+// highlight.
+function siteExtent(v: any): number {
+  const len = v?.site?.len
+  if ('number' === typeof len && len > 0) {
+    return len
+  }
+  // CANON IS READ DEFENSIVELY, as every other reader here does: it is a
+  // getter that unifies, and a host-supplied value can throw from it
+  // (hover-refuses-bad-input). A hover that cannot measure a value
+  // still has to answer for the rest of the document.
+  let c = ''
+  try { c = v?.canon } catch { c = '' }
   return 'string' === typeof c && c.length > 0 ? c.length : 1
 }
 
@@ -251,10 +298,52 @@ type Hover = { contents: MarkupContent, range?: Range }
 // the position is not over a value with a known source location. Because
 // hover reads the *unified* tree, a literal shows its resolved value and
 // kind (e.g. a reference target resolves to the value it points at).
-function computeHover(src: string, position: Position): Hover | null {
+// HOVER PROVENANCE (G7 phase 7) is CONFIG-GATED and off by default:
+// the contributions that met at the hovered path, appended to the
+// value's own hover. Hover already re-unifies the whole document per
+// request, so an editor that asks for this pays a second instrumented
+// evaluation knowingly, and one that does not pays nothing.
+function provenanceMarkdown(
+  src: string, path: string[], trust?: any): string {
+  if (0 === path.length) {
+    return ''
+  }
+  // A document with an error ELSEWHERE still hovers — the tree the
+  // hover walked is there — while `why` refuses it, so the record may
+  // be absent for a value the cursor is sitting on.
+  const report = why(src, '$.' + path.join('.'), { trust } as any)
+  return contributionsMarkdown(report.record?.conjuncts ?? [])
+}
+
+
+// The contributions as hover markdown. Exported for the direct test
+// (ADR-002): a siteless contribution and a named file are both shapes
+// the record allows and no hover produces, hover evaluating one
+// unnamed document.
+export function contributionsMarkdown(conjuncts: WhyConjunct[]): string {
+  if (0 === conjuncts.length) {
+    return ''
+  }
+  return '\n\n---\n\nContributions:\n' + conjuncts.map((c) =>
+    '- `' + c.canon + '` — ' + c.role +
+    (0 > c.site.row ? '' : ' (' +
+      ('' === c.site.file ? '' : c.site.file + ':') +
+      c.site.row + ':' + c.site.col + ')')).join('\n')
+}
+
+
+// HOVER RUNS UNDER THE SAME CAPABILITY AS DIAGNOSTICS. It used to
+// evaluate through `new Aontu()` -- the full system resolver -- BESIDE
+// confined diagnostics in the same server, so a workspace-confined
+// session still resolved an escaping include the moment a cursor rested
+// on it (use-cases/REVIEW.md finding G). One document, two postures, is
+// not a confinement.
+function computeHover(
+  src: string, position: Position, provenance?: boolean,
+  trust?: any): Hover | null {
   let root: any
   try {
-    root = new Aontu().unify(src, { collect: true })
+    root = new Aontu(null == trust ? {} : { trust }).unify(src, { collect: true })
   }
   catch {
     return null
@@ -274,7 +363,12 @@ function computeHover(src: string, position: Position): Hover | null {
   if (null == best) return null
 
   return {
-    contents: { kind: 'markdown', value: hoverMarkdown(best.val) },
+    contents: {
+      kind: 'markdown',
+      value: hoverMarkdown(best.val) +
+        (true === provenance
+          ? provenanceMarkdown(src, best.val.path, trust) : ''),
+    },
     range: {
       start: { line: best.line, character: best.start },
       end: { line: best.line, character: best.end },
@@ -296,15 +390,24 @@ function collectHoverCandidates(
   const col = v.site.col
   let canon = ''
   try { canon = v.canon } catch { canon = '' }
+  // The span to highlight: the value's own source text where it has
+  // one, canon otherwise. See siteExtent.
+  const span = siteExtent(v)
+  const spanSrc = 'string' === typeof v.site?.src ? v.site.src : ''
   // Hover targets concrete values (scalars, kinds, refs, …), not
   // containers: a map/list source span is not reliably reconstructable
   // from a single site, and the same restriction in the Go port keeps
   // hover behaviour identical across implementations. The walk still
   // recurses into containers below to reach their leaf values. Canon is
   // single-line, so its length approximates the on-line source span.
-  if (row >= 1 && col >= 1 && canon.length > 0 && !canon.includes('\n') &&
+  // Single-line is decided by the SOURCE TEXT when there is one: a
+  // multi-line token cannot be described by one line's start and end,
+  // and canon's newlines are not the token's. Falling back to canon
+  // keeps the old test for a value with no stamped span.
+  const multiline = '' === spanSrc ? canon.includes('\n') : spanSrc.includes('\n')
+  if (row >= 1 && col >= 1 && canon.length > 0 && !multiline &&
     !v.isMap && !v.isList) {
-    out.push({ val: v, line: row - 1, start: col - 1, end: col - 1 + canon.length })
+    out.push({ val: v, line: row - 1, start: col - 1, end: col - 1 + span })
   }
 
   const peg = v.peg
@@ -358,11 +461,20 @@ type CompletionItem = {
 const COMPLETION_FUNCTION = 3
 const COMPLETION_KEYWORD = 14
 
-// The seventeen built-in functions. Kept in sync with the engine by
+// The twenty-eight built-in functions. Kept in sync with the engine by
 // `lsp.test.ts`, which asserts each is recognised and no others are.
+// The Go port derives its list from the engine's own name set
+// (`BuiltinFuncNames`, go/func.go), which is why a name added there
+// and forgotten here diverges silently — as `id` and `refer` did
+// between G4 phases 1/2 and G8 phase 1.
 const BUILTIN_FUNCS = [
-  'above', 'below', 'close', 'copy', 'hide', 'key', 'lower', 'max',
-  'min', 'move', 'neq', 'open', 'path', 'pref', 'super', 'type', 'upper',
+  'above', 'add', 'below', 'close', 'copy', 'deprecate', 'div', 'each',
+  'filter', 'greatest',
+  'hide', 'id', 'key', 'least', 'length', 'lower',
+  'match', 'max', 'min', 'mod', 'move', 'mul', 'must', 'neq', 'open',
+  'pack', 'path', 'pick',
+  'pref', 're', 'refer', 'rem', 'sub', 'sum', 'super', 'type', 'unique',
+  'upper',
 ]
 
 // Scalar-kind and literal keywords.
@@ -371,7 +483,9 @@ const BUILTIN_FUNCS = [
 const KIND_KEYWORDS = [
   'string', 'number', 'integer', 'float', 'biginteger', 'bigdecimal', 'boolean',
 ]
-const LITERAL_KEYWORDS = ['true', 'false', 'null', 'top']
+// `_` joins these as of G8 phase 3: it is a literal of the language
+// now, not text.
+const LITERAL_KEYWORDS = ['_', 'true', 'false', 'null', 'top']
 
 
 // Context-free completion: the built-in functions, scalar-kind keywords
@@ -395,11 +509,103 @@ function computeCompletions(): CompletionItem[] {
 // messages and returns the messages to send back, tracking open document
 // text and recomputing diagnostics on open/change/close. Not safe for
 // concurrent use; drive it from a single loop (as the stdio server does).
+// A file:// uri's filesystem path, for the workspace-root confinement.
+// Percent-decoded; a non-file uri (or none) yields undefined.
+//
+// EXPORTED, inline as contributionsMarkdown is: part of the reusable
+// LSP library surface, and the twin of the package-visible uriToPath in
+// go/lsp/handler.go. Anything driving this module with its own
+// transport has to turn a client's uri into a path the same way the
+// confinement does, and the rules below are not guessable from outside.
+//
+// THE DRIVE-LETTER SLASH. A file uri names an absolute path after the
+// authority, so on Windows the standard spelling every editor sends is
+// file:///C:/Users/me/project — three slashes, and the third belongs to
+// the PATH. Stripping only `file://` leaves `/C:/Users/me/project`,
+// which is not a Windows path at all, so the workspace-root
+// confinement below compared real paths against nonsense and an editor
+// on Windows got no confinement it could rely on. Both ports carried
+// the defect identically (go/lsp/handler.go uriToPath), and no test
+// caught it because both ports' tests built the uri as `'file://' +
+// path` — two slashes, which is not what a client sends and which
+// accidentally produced a usable path.
+//
+// The leading slash is dropped only before a DRIVE LETTER, so a POSIX
+// path keeps the root it needs: file:///tmp/x stays /tmp/x.
+export function uriToPath(uri: unknown): string | undefined {
+  if ('string' !== typeof uri || !uri.startsWith('file://')) {
+    return undefined
+  }
+  const path = percentDecode(uri.slice('file://'.length))
+  // AN EMPTY PATH IS NOT A ROOT. `file://` on its own yields '', and
+  // '' is not nullish — so it won the `??` chain below and arrived as
+  // `{ include: { root: '' } }`, a confinement root that then resolves
+  // against the process working directory: the same client params made
+  // the server allow or deny an include depending on where it was
+  // started from. The Go twin never had it, because its chain tests
+  // `"" != folder` explicitly (go/lsp/handler.go). Answering undefined
+  // is what makes the two chains agree.
+  if ('' === path) {
+    return undefined
+  }
+  return driveLetterPath(path) ? path.slice(1) : path
+}
+
+
+// Percent-decoding that CANNOT THROW. `decodeURIComponent` raises a
+// URIError on a malformed escape (`%ZZ`), and this runs on a uri a
+// CLIENT sent — so a stray percent in a workspace path took the
+// exception straight out of the initialize handler, where the Go twin
+// swallowed the same failure and used the raw text
+// (go/lsp/handler.go). Two ports, two behaviours, for an input neither
+// of them controls.
+//
+// The agreement runs the other way for the SECOND way an escape can
+// fail to decode. `%FF` is well-formed and names a raw byte — a
+// perfectly good Linux filename — which Go produced and a JavaScript
+// string cannot hold at all, so the ports derived different workspace
+// roots for a uri a byte-oriented client really sends. Only one
+// direction is reachable from both languages, so Go now declines to
+// unescape a result that is not valid UTF-8 and both ports keep the
+// raw text. An undecodable path is still a path, and refusing to serve
+// a session over it helps nobody.
+function percentDecode(text: string): string {
+  try {
+    return decodeURIComponent(text)
+  }
+  catch {
+    return text
+  }
+}
+
+
+// Whether p is `/X:…` for a drive letter X — the one shape whose
+// leading slash is uri syntax rather than path. Mirrors the same
+// predicate in go/lsp/handler.go.
+function driveLetterPath(p: string): boolean {
+  return 3 <= p.length && '/' === p[0] && ':' === p[2] &&
+    /[A-Za-z]/.test(p[1])
+}
+
+
 class LspHandler {
   private docs = new Map<string, string>()
   private shutdownOK = false
   private exited = false
 
+  // The trust profile evaluation runs under (G5, docs/trust.md):
+  // workspace-root confinement by default, set from the initialize
+  // params. An `initializationOptions.aontu.trust.include` of 'system',
+  // 'none' or { root } widens or narrows it explicitly. Undefined —
+  // no workspace root and no explicit option — falls back to today's
+  // unconfined behaviour, which single-file sessions rely on.
+  private trust: any = undefined
+
+  // Hover provenance (G7 phase 7): off unless an editor asks for it
+  // with `initializationOptions.aontu.provenance`. It costs a second,
+  // instrumented evaluation per hover, which is a cost to opt into.
+  private provenance = false
+
   // True once an `exit` notification has been received.
   get shouldExit(): boolean { return this.exited }
 
@@ -413,8 +619,34 @@ class LspHandler {
   // Process one incoming message, returning zero or more to send.
   handle(msg: Message): OutMessage[] {
     switch (msg.method) {
-      case 'initialize':
+      case 'initialize': {
+        const params = msg.params ?? {}
+        this.provenance =
+          true === params.initializationOptions?.aontu?.provenance
+        const explicit = params.initializationOptions?.aontu?.trust?.include
+        if (null != explicit) {
+          // An explicit setting wins — validated, and an unrecognised
+          // value confines to NOTHING rather than silently widening:
+          // deny is the safe reading of a setting the server does not
+          // understand. The same rule as the Go handler.
+          this.trust =
+            'system' === explicit ? undefined :
+              'none' === explicit ? { include: 'none' } :
+                ('string' === typeof explicit?.root && '' !== explicit.root)
+                  ? { include: { root: explicit.root } } :
+                  (null != explicit?.mem && 'object' === typeof explicit.mem)
+                    ? { include: { mem: explicit.mem } } :
+                    { include: 'none' }
+        }
+        else {
+          const root = uriToPath(params.workspaceFolders?.[0]?.uri)
+            ?? uriToPath(params.rootUri)
+            ?? (('string' === typeof params.rootPath && '' !== params.rootPath)
+              ? params.rootPath : undefined)
+          this.trust = null != root ? { include: { root } } : undefined
+        }
         return [{ jsonrpc: '2.0', id: msg.id, result: initializeResult() }]
+      }
 
       case 'initialized':
         return []
@@ -455,7 +687,8 @@ class LspHandler {
         const uri = msg.params?.textDocument?.uri
         const pos = msg.params?.position
         const text = null != uri ? this.docs.get(uri) : undefined
-        const hover = (null != text && null != pos) ? computeHover(text, pos) : null
+        const hover = (null != text && null != pos)
+          ? computeHover(text, pos, this.provenance, this.trust) : null
         return [{ jsonrpc: '2.0', id: msg.id, result: hover }]
       }
 
@@ -477,7 +710,8 @@ class LspHandler {
   }
 
   private publish(uri: string): OutMessage {
-    return publishDiagnosticsMsg(uri, computeDiagnostics(this.docs.get(uri) ?? ''))
+    return publishDiagnosticsMsg(uri,
+      computeDiagnostics(this.docs.get(uri) ?? '', { trust: this.trust }))
   }
 } /* node:coverage ignore next 28 */
 

package/src/mcp-server.ts

@@ -0,0 +1,187 @@
+/* Copyright (c) 2025 Richard Rodger, MIT License */
+
+// Aontu MCP server (stdio).
+//
+//   aontu-mcp [--root <dir>]
+//
+// Speaks the Model Context Protocol over stdio: newline-delimited
+// JSON-RPC 2.0, one message per line. This binary is intentionally
+// thin — every tool and every protocol decision lives in the reusable
+// library ./mcp, the same three-layer split the language server uses
+// (docs/lsp.md).
+//
+// NDJSON, not the LSP's Content-Length framing: MCP stdio transport
+// is line-delimited, and a server that invented its own framing would
+// not be reachable by any client.
+//
+// The one startup decision is the PATH CAPABILITY: `--root <dir>`
+// grants the served evaluation the CLI's `--trust root:<dir>` posture
+// — includes resolve confined below the root, and every tool's
+// document arguments accept `<name>Path` file alternatives, confined
+// the same way. Without it the server denies all includes and refuses
+// path arguments (./mcp). The root is realpath'd HERE, once, so the
+// confinement prefix the library compares against is the real
+// directory, not a spelling of it.
+
+import { realpathSync, statSync } from 'node:fs'
+
+import { handle, parseError } from './mcp'
+import type { McpRequest, McpResponse } from './mcp'
+import { VERSION } from './aontu'
+
+
+const USAGE = 'aontu-mcp - Aontu MCP server (stdio, NDJSON JSON-RPC)\n' +
+  '\n' +
+  '  aontu-mcp [--root <dir>]\n' +
+  '\n' +
+  '  --root <dir>  Serve <name>Path file arguments and resolve\n' +
+  '                @"..." includes, confined below <dir>\n' +
+  '                (realpath-checked). Without it, served evaluation\n' +
+  '                denies every include and refuses path arguments.\n'
+
+
+// The startup arguments. Parsed here rather than in bin/aontu-mcp.js
+// so the parsing is import-testable; unknown options REFUSE rather
+// than warn, because a server whose operator typo'd --root must not
+// come up quietly unconfined.
+export type ServerArgs = {
+  root?: string
+  help?: boolean
+  err?: string
+}
+
+export function parseArgs(argv: string[]): ServerArgs {
+  let root: string | undefined
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i]
+    if ('-h' === arg || '--help' === arg) {
+      return { help: true }
+    }
+    if ('--root' === arg) {
+      const dir = argv[++i]
+      if (null == dir) {
+        return { err: 'aontu-mcp: --root needs a directory' }
+      }
+      root = dir
+    }
+    else {
+      return { err: `aontu-mcp: unknown option ${arg} (try --help)` }
+    }
+  }
+  return { root }
+}
+
+
+// A line-oriented JSON-RPC codec: feed it incoming chunks, and it
+// splits lines, dispatches them, and writes replies. Kept
+// transport-injectable (write/onExit) so the wiring is unit-testable
+// without real stdio, exactly as the LSP's FrameCodec is.
+class LineCodec {
+  private buffer = ''
+
+  constructor(
+    private write: (line: string) => void,
+    private onExit: (code: number) => void,
+    private version: string,
+    private root?: string,
+  ) { }
+
+  push(chunk: string | Buffer) {
+    this.buffer += chunk.toString()
+    for (; ;) {
+      const nl = this.buffer.indexOf('\n')
+      if (nl < 0) {
+        return
+      }
+      const line = this.buffer.slice(0, nl).trim()
+      this.buffer = this.buffer.slice(nl + 1)
+      if ('' !== line) {
+        this.line(line)
+      }
+    }
+  }
+
+  end() {
+    this.onExit(0)
+  }
+
+  private line(line: string) {
+    let msg: McpRequest
+    try {
+      msg = JSON.parse(line)
+    }
+    catch {
+      this.send(parseError())
+      return
+    }
+    const out = handle(msg, this.version, this.root)
+    if (null != out) {
+      this.send(out)
+    }
+  }
+
+  private send(out: McpResponse) {
+    this.write(JSON.stringify(out) + '\n')
+  }
+}
+
+
+// The streams and exit are injectable (defaulting to real stdio) so
+// the full wiring is unit-testable. Returns undefined when the
+// arguments end the run before a codec exists (--help, a bad option,
+// a --root that is not a directory).
+function main(
+  stdin: NodeJS.ReadableStream = process.stdin,
+  write: (line: string) => void = (line) => void process.stdout.write(line),
+  exit: (code: number) => void = (code) => process.exit(code),
+  version: string = VERSION,
+  argv: string[] = process.argv.slice(2),
+  errwrite: (line: string) => void =
+    (line) => void process.stderr.write(line),
+): LineCodec | undefined {
+  const args = parseArgs(argv)
+  if (true === args.help) {
+    write(USAGE)
+    exit(0)
+    return undefined
+  }
+  if (null != args.err) {
+    errwrite(args.err + '\n')
+    exit(2)
+    return undefined
+  }
+
+  // FAIL FAST on a root that is not a real directory: every later
+  // call would refuse anyway, but a misconfigured server that answers
+  // a thousand confusing refusals is worse than one that says so at
+  // startup.
+  let root: string | undefined
+  if (null != args.root) {
+    try {
+      root = realpathSync(args.root)
+      if (!statSync(root).isDirectory()) {
+        throw new Error('not a directory')
+      }
+    }
+    catch {
+      errwrite(`aontu-mcp: --root ${args.root} is not a directory\n`)
+      exit(2)
+      return undefined
+    }
+  }
+
+  const codec = new LineCodec(write, exit, version, root)
+  stdin.on('data', (chunk: Buffer) => codec.push(chunk))
+  stdin.on('end', () => codec.end())
+  return codec
+} /* node:coverage ignore next 11 */
+
+
+// No require.main guard here: bin/aontu-mcp.js is the executable entry
+// and calls main() itself, so this module stays import-only.
+
+
+export {
+  LineCodec,
+  main,
+}