atris 3.58.7 → 3.58.8

package/lib/receipt-block.js

@@ -98,18 +98,116 @@ function directProofText(value) {
   return ran ? `${ran[1]} passed` : text;
 }
 
-function proofText(receipt) {
+// A receipt is a text from a good employee: one sentence a friend would send,
+// plus one link a stranger can check. Ids, statuses, scores and verifier
+// output stay underneath (they feed the rating); they never lead the surface.
+// Standard: atris-labs atris/wiki/systems/receipt-standard.md
+
+function sentence(value) {
+  const text = trimPunctuation(value);
+  if (!text) return '';
+  return `${text.charAt(0).toUpperCase()}${text.slice(1)}.`;
+}
+
+// Bracketed IPv6 hosts need their own alternative: the plain class stops at
+// ] and would cut http://[::1]:3000 down to http://[::1 .
+const URL_RE = /https?:\/\/\[[0-9a-f.:]+\][^\s)>\]]*|https?:\/\/[^\s)>\]]+/i;
+const URL_RE_GLOBAL = new RegExp(URL_RE.source, 'gi');
+
+// A stranger cannot open localhost, loopback or *.local addresses, so they
+// never count as the check link no matter which field they came from.
+// Parsing with URL normalizes tricks like 127.1 or 0x7f.1 into 127.0.0.1.
+function localCheckUrl(url) {
+  let host;
+  try {
+    host = new URL(url).hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  if (host.startsWith('[') && host.endsWith(']')) host = host.slice(1, -1);
+  return host === 'localhost'
+    || host === '0.0.0.0'
+    || host === '::1'
+    || host.startsWith('127.')
+    || host.endsWith('.local');
+}
+
+// A checked/tested note that is nothing but a local URL carries no check a
+// stranger can run; the verifier line speaks instead.
+function localOnlyUrl(text) {
+  const value = trimPunctuation(text);
+  return /^https?:\/\/\S+$/i.test(value) && localCheckUrl(value);
+}
+
+function firstUrl(...values) {
+  for (const value of values) {
+    if (!value) continue;
+    for (const raw of String(value).match(URL_RE_GLOBAL) || []) {
+      const url = raw.replace(/[.,;:]+$/, '');
+      if (!localCheckUrl(url)) return url;
+    }
+  }
+  return '';
+}
+
+// The link a stranger can click. Read explicit link fields first, then any
+// URL the landing text already mentions. Local-only hosts never count, and
+// empty means the receipt has none.
+function checkLink(receipt) {
+  const land = landing(receipt);
+  const res = result(receipt);
+  return firstUrl(
+    land.link, land.url, land.check_url, land.proof_url,
+    res.link, res.url, res.pr_url, res.share_url, res.tick?.pr_url, res.tick?.share_url,
+    land.checked, land.tested,
+  );
+}
+
+// What a reader can check: the link when there is one, else the plain
+// check that passed. Never "verifier passed" or "receipt is present".
+function checkText(receipt) {
+  const link = checkLink(receipt);
+  if (link) return link;
   const land = landing(receipt);
   const verifier = verifierResult(receipt);
-  if (land.checked) return directProofText(land.checked);
-  if (land.tested) return directProofText(land.tested);
+  if (land.checked && !localOnlyUrl(land.checked)) return directProofText(land.checked);
+  if (land.tested && !localOnlyUrl(land.tested)) return directProofText(land.tested);
   if (verifier) {
-    const command = lowerLine(verifier.command || receipt?.verifier || 'configured verifier');
+    const command = lowerLine(verifier.command || receipt?.verifier || 'the checks');
     return `${command} ${verifier.passed ? 'passed' : 'failed'}`;
   }
-  if (result(receipt).passed === true) return 'receipt says verifier passed';
-  if (receipt?.at) return `receipt saved at ${lowerLine(receipt.at)}`;
-  return 'receipt is present';
+  if (result(receipt).passed === true) return 'the checks passed';
+  return '';
+}
+
+// Dollars a mission actually brought in. Read from the landing (or result)
+// so a member can write it next to what happened; the backend sums the same
+// field into the member rating. Only a real number or a plain decimal string
+// may count: Number() alone would read true as 1, [5] as 5, "0x10" as 16 and
+// "1e3" as 1000. Junk and negatives count as zero.
+const PLAIN_DECIMAL_RE = /^\d+(\.\d+)?$/;
+
+function plainDecimalAmount(value) {
+  if (typeof value === 'number') return Number.isFinite(value) ? value : 0;
+  if (typeof value !== 'string') return 0;
+  const text = value.trim();
+  return PLAIN_DECIMAL_RE.test(text) ? Number(text) : 0;
+}
+
+function earnedUsd(receipt) {
+  const land = landing(receipt);
+  const res = result(receipt);
+  for (const value of [land.earned_usd, res.earned_usd, res.tick?.earned_usd]) {
+    if (value === undefined || value === null || value === '') continue;
+    const amount = plainDecimalAmount(value);
+    return amount > 0 ? Math.round(amount * 100) / 100 : 0;
+  }
+  return 0;
+}
+
+function usdText(amount) {
+  const whole = Number.isInteger(amount);
+  return `$${amount.toLocaleString('en-US', { minimumFractionDigits: whole ? 0 : 2, maximumFractionDigits: 2 })}`;
 }
 
 function nextText(receipt) {
@@ -117,43 +215,53 @@ function nextText(receipt) {
   return lowerLine(text);
 }
 
+function whatText(receipt, max = 180) {
+  return historicalLandingText(trimPunctuation(changedText(receipt)), max);
+}
+
+// One line: "What happened. Check it: <link or check>."
+function checkLine(receipt, max = 160) {
+  const check = trimPunctuation(checkText(receipt));
+  if (!check) return '';
+  // A link stays bare so it copies clean; a plain check reads as a sentence.
+  return firstUrl(check) ? `Check it: ${check}` : `Check it: ${truncateLine(check, max)}.`;
+}
+
 function renderEmailLine(receipt) {
-  const what = historicalLandingText(trimPunctuation(changedText(receipt)), 180);
-  const scale = scaleText(receipt);
-  const proof = historicalLandingText(trimPunctuation(proofText(receipt)), 90);
-  return `${what}; ${scale}; we know because ${proof}.`;
+  const what = sentence(whatText(receipt));
+  const check = checkLine(receipt);
+  return check ? `${what} ${check}` : what;
 }
 
 function renderMorningCardRow(receipt) {
-  return `- mission: ${renderEmailLine(receipt).replace(/\.$/, '')}`;
+  return `- ${renderEmailLine(receipt).replace(/\.$/, '')}`;
 }
 
+// Three lines lead. The machinery (size, status, mission id) sits below as
+// details, where a builder can find it and a customer never has to read it.
 function renderPageSection(receipt) {
   const next = nextText(receipt);
-  const lines = [
-    '## mission receipt',
-    '',
-    `- what: ${truncateLine(trimPunctuation(changedText(receipt)), 160)}`,
-    `- how big: ${scaleText(receipt)}`,
-    `- how we know: ${truncateLine(trimPunctuation(proofText(receipt)), 160)}`,
-    `- status: ${statusText(receipt)}`,
-  ];
-  if (receipt?.mission_id) lines.push(`- mission: ${lowerLine(receipt.mission_id)}`);
-  if (next) lines.push(`- next: ${truncateLine(trimPunctuation(next), 160)}`);
+  const check = checkLine(receipt);
+  const lines = ['## mission receipt', '', sentence(whatText(receipt, 160))];
+  if (check) lines.push(check);
+  if (next) lines.push(`Next: ${sentence(truncateLine(next, 160))}`);
+  const details = [scaleText(receipt), `status ${statusText(receipt)}`];
+  const earned = earnedUsd(receipt);
+  if (earned > 0) details.push(`earned ${usdText(earned)}`);
+  if (receipt?.mission_id) details.push(`mission ${lowerLine(receipt.mission_id)}`);
+  lines.push('', `details: ${details.join('; ')}`);
   return lines.join('\n');
 }
 
 function renderCard(receipt) {
-  const status = statusText(receipt);
-  const what = truncateLine(trimPunctuation(changedText(receipt)), 64);
-  const scale = scaleText(receipt);
-  const proof = truncateLine(trimPunctuation(proofText(receipt)), 88);
+  const what = sentence(whatText(receipt, 64));
+  const check = trimPunctuation(checkText(receipt));
   return {
     kind: 'statement',
     headline: what,
     text: what,
-    kicker: `${status} mission receipt`,
-    sub: `${scale}; ${proof}`,
+    kicker: 'mission receipt',
+    sub: check ? `Check it: ${truncateLine(check, 88)}` : '',
     brand: 'atris',
     size: 'og',
     theme: 'atris',
@@ -161,6 +269,7 @@ function renderCard(receipt) {
 }
 
 module.exports = {
+  earnedUsd,
   renderCard,
   renderPageSection,
   renderEmailLine,

package/lib/runner-command.js

@@ -8,7 +8,7 @@
 // so autonomous runs are reproducible, while keeping explicit per-run/env knobs
 // first in precedence. Precedence: explicit model -> ATRIS_RUNNER_MODEL env ->
 // ATRIS_RUNNER_PROFILE -> legacy ATRIS_CLAUDE_MODEL env -> pinned default.
-const DEFAULT_CLAUDE_RUNNER_MODEL = 'claude-opus-4-8';
+const DEFAULT_CLAUDE_RUNNER_MODEL = 'claude-opus-5-5';
 const DEFAULT_FABLE_RUNNER_MODEL = 'claude-fable-5';
 const DEFAULT_CLAUDE_RUNNER_BIN = 'claude';
 

package/lib/scorecard.js

@@ -245,14 +245,14 @@ function writeScorecard(atrisDir, data) {
 
   // Ensure scorecards.md exists
   if (!fs.existsSync(scorecardsPath)) {
-    const template = `# scorecards.md \u2014 Endgame Results\n\n> Append-only. One line per closed endgame. Records outcome metrics from the horizon.\n\n---\n\n`;
+    const template = `# scorecards.md: Endgame Results\n\n> Append-only. One line per closed endgame. Records outcome metrics from the horizon.\n\n---\n\n`;
     fs.writeFileSync(scorecardsPath, template, 'utf8');
   }
 
-  // Format: - **[date] slug**, shipped: X/Y, wall-clock: Nh, halt: Z%, reward: total, lessons: N
+  // Format: - **[date] slug** - shipped: X/Y - wall-clock: Nh - halt: Z% - reward: total - lessons: N
   const haltPercent = Math.round(haltRatio * 100);
   const wallClockStr = wallClockHours < 1 ? `${Math.round(wallClockHours * 60)}m` : `${wallClockHours.toFixed(1)}h`;
-  const line = `- **[${endDate}] ${slug}** \u2014 shipped: ${tasksShipped}/${tasksAttempted} \u2014 wall-clock: ${wallClockStr} \u2014 halt: ${haltPercent}% \u2014 reward: ${totalReward} \u2014 lessons: ${lessonsGenerated}\n`;
+  const line = `- **[${endDate}] ${slug}** - shipped: ${tasksShipped}/${tasksAttempted} - wall-clock: ${wallClockStr} - halt: ${haltPercent}% - reward: ${totalReward} - lessons: ${lessonsGenerated}\n`;
 
   // Append to file
   fs.appendFileSync(scorecardsPath, line, 'utf8');
@@ -302,7 +302,7 @@ function readScorecards(atrisDir) {
   const scorecards = [];
 
   for (const line of content.split('\n')) {
-    const match = line.match(/^- \*\*\[(.+?)\]\s+(.+?)\*\*\s*\u2014\s*shipped:\s*(\d+)\/(\d+)\s*\u2014\s*wall-clock:\s*(.+?)\s*\u2014\s*halt:\s*(\d+)%\s*\u2014\s*reward:\s*(-?\d+)\s*\u2014\s*lessons:\s*(\d+)$/);
+    const match = line.match(/^- \*\*\[(.+?)\]\s+(.+?)\*\*\s*[-\u2014]\s*shipped:\s*(\d+)\/(\d+)\s*[-\u2014]\s*wall-clock:\s*(.+?)\s*[-\u2014]\s*halt:\s*(\d+)%\s*[-\u2014]\s*reward:\s*(-?\d+)\s*[-\u2014]\s*lessons:\s*(\d+)$/);
     if (!match) continue;
 
     const [, endDate, slug, shipped, attempted, wallClockStr, haltPercent, reward, lessons] = match;

package/lib/sleep-sync.js

@@ -0,0 +1,11 @@
+'use strict';
+
+// Block the current thread for ms milliseconds without burning a core.
+// Atomics.wait parks the thread; a Date.now() loop keeps it at full CPU.
+function sleepSync(ms) {
+  const duration = Math.max(0, Number(ms) || 0);
+  if (!duration) return;
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, duration);
+}
+
+module.exports = { sleepSync };

package/lib/state-detection.js

@@ -271,6 +271,32 @@ function getTodayInboxItems(workspaceDir) {
 /**
  * Detect workspace state: fresh install, has inbox items, in-progress work, or blocked
  */
+// Blocked means a task whose status is failed: the DB has no separate
+// blocked status, doneTask logs a failed task as a "blocked" event, and the
+// board renders failed tasks under "## Blocked". Once this workspace has rows
+// in the task DB, the DB is the only source. The DB file is shared by every
+// workspace on the machine, so a workspace with no rows there falls back to
+// the Blocked section of its own TODO.md, never a word elsewhere in a title.
+function hasBlockedTasks(atrisDir, todoFile, legacyTaskContextFile) {
+  try {
+    const taskDb = require('./task-db');
+    if (fs.existsSync(taskDb.getDbPath())) {
+      const db = taskDb.open();
+      const workspaceRoot = taskDb.workspaceRoot(path.dirname(path.resolve(atrisDir)));
+      if (taskDb.listTasks(db, { workspaceRoot, limit: 1 }).length) {
+        return taskDb.listTasks(db, { workspaceRoot, status: 'failed', limit: 1 }).length > 0;
+      }
+    }
+  } catch (e) {
+    if (process.env.ATRIS_DEBUG) console.error('[state-detection] db blocked read failed:', e.message);
+  }
+  const taskFilePath = fs.existsSync(todoFile)
+    ? todoFile
+    : (fs.existsSync(legacyTaskContextFile) ? legacyTaskContextFile : null);
+  if (!taskFilePath) return false;
+  return getTasksFromTodoSection(fs.readFileSync(taskFilePath, 'utf8'), 'Blocked').length > 0;
+}
+
 function detectWorkspaceState(workspaceDir) {
   const atrisDir = path.join(workspaceDir, 'atris');
   const featuresDir = path.join(atrisDir, 'features');
@@ -317,15 +343,8 @@ function detectWorkspaceState(workspaceDir) {
     }
   }
 
-  // Check for blocked tasks (prefer TODO.md, fallback to legacy TASK_CONTEXTS.md)
-  const taskFilePath = fs.existsSync(todoFile)
-    ? todoFile
-    : (fs.existsSync(legacyTaskContextFile) ? legacyTaskContextFile : null);
-  if (taskFilePath) {
-    const content = fs.readFileSync(taskFilePath, 'utf8');
-    if (content.includes('Risk Level: High') || /\bblocked\b/i.test(content)) {
-      return { state: 'blocked', reason: 'Tasks marked as blocked or high risk' };
-    }
+  if (hasBlockedTasks(atrisDir, todoFile, legacyTaskContextFile)) {
+    return { state: 'blocked', reason: 'Tasks marked as blocked' };
   }
 
   // Default: setup complete but no active work

package/lib/task-db.js

@@ -34,6 +34,7 @@ const { isDecisionTask } = require('./task-decision');
 const { parseVerifyCommand } = require('./auto-accept-certified');
 const { taskExplanation } = require('./task-explanation');
 const { treeHashFor } = require('./tree-hash');
+const { sleepSync } = require('./sleep-sync');
 
 const DEFAULT_DB_PATH = path.join(os.homedir(), '.atris', 'tasks.db');
 const TASK_EPISODES_FILE = path.join('.atris', 'state', 'task_episodes.jsonl');
@@ -2224,8 +2225,7 @@ function withBusyRetry(fn, attempts = 8) {
       const busy = /SQLITE_BUSY|database is locked/i.test(msg) || code === 'SQLITE_BUSY' || code === 5;
       if (!busy) throw e;
       // Sleep synchronously, node:sqlite is sync; matches the rest of the API
-      const end = Date.now() + delay + Math.floor(Math.random() * delay);
-      while (Date.now() < end) {} // tight loop is fine, delay is small
+      sleepSync(delay + Math.floor(Math.random() * delay));
       delay = Math.min(delay * 2, 500);
     }
   }
@@ -2234,6 +2234,7 @@ function withBusyRetry(fn, attempts = 8) {
 
 module.exports = {
   open,
+  withBusyRetry,
   close,
   getDbPath,
   workspaceRoot,

package/lib/todo-fallback.js

@@ -34,7 +34,7 @@ function cleanTaskTitle(text) {
   const withoutTags = raw.replace(/\s*\[[\w-]+\]/g, '').trim();
   const bold = withoutTags.match(/^\*\*(.+?)\*\*\s*(?:[\u2014-]\s*)?(.*)$/);
   if (!bold) return withoutTags;
-  return [bold[1], bold[2]].filter(Boolean).join(' \u2014 ').trim();
+  return [bold[1], bold[2]].filter(Boolean).join(' - ').replace(/\s*\u2014\s*/g, ' - ').trim();
 }
 
 function parseSection(content, sectionName) {

package/lib/wish-delegate.js

@@ -2,6 +2,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const { BACKEND_ROOT_HINT, resolveBackendRoot } = require('../utils/backend-root');
 const { getLogPath, ensureLogDirectory, createLogFile, addInboxIdea } = require('./file-ops');
 const { resolveFunctionalOwner } = require('./functional-owner');
 const { buildMissionRoom, writeMissionRoomReceipt } = require('./mission-room');
@@ -55,7 +56,6 @@ const {
 } = require('./wish-audit');
 
 const METRIC_OPS = { '>=': '--gte', '<=': '--lte', '==': '--eq', '>': '--gt', '<': '--lt' };
-const METRIC_VERIFY_ROOT = '/Users/keshavrao/arena/atrisos-backend';
 const DAY_MS = 24 * 60 * 60 * 1000;
 const HOUR_MS = 60 * 60 * 1000;
 const IMPLICIT_ANSWER_STALE_MS = HOUR_MS;
@@ -105,8 +105,11 @@ function parseMetricExpression(text) {
 
 // Wire to backend/scripts/metric_verify.py: exits 0 when the metric meets
 // target and prints a JSON line with value + proof_uri.
-function metricVerifierCommand(parsed) {
-  return `cd ${METRIC_VERIFY_ROOT} && venv/bin/python backend/scripts/metric_verify.py ${parsed.metric} ${parsed.flag} ${parsed.target}`;
+function metricVerifierCommand(parsed, workspace) {
+  const backend = resolveBackendRoot(workspace);
+  if (!backend) throw new Error(BACKEND_ROOT_HINT);
+  const quoted = `'${backend.replace(/'/g, `'\\''`)}'`;
+  return `cd ${quoted} && venv/bin/python backend/scripts/metric_verify.py ${parsed.metric} ${parsed.flag} ${parsed.target}`;
 }
 
 const MISSION_TERMINAL_STATUSES = new Set(['complete', 'stopped']);
@@ -489,7 +492,9 @@ function scorecardText(value) {
 }
 
 function readWishReviewRewardRows(root = process.cwd()) {
-  const file = path.resolve(root, '..', 'atrisos-backend', '.atris', 'state', 'scorecards.jsonl');
+  const backend = resolveBackendRoot(root);
+  if (!backend) return [];
+  const file = path.join(backend, '.atris', 'state', 'scorecards.jsonl');
   return readJsonLines(file).filter((row) => {
     const haystack = `${scorecardText(row.source)} ${scorecardText(row.feedback)}`;
     return /wish_review/i.test(haystack);
@@ -514,6 +519,7 @@ function reviewLine(review) {
 
 function printRewards(root = process.cwd()) {
   const reviews = readWishEvents(root).filter((event) => event && event.kind === 'review');
+  if (!resolveBackendRoot(root)) console.error(BACKEND_ROOT_HINT);
   const rewardRows = readWishReviewRewardRows(root);
   console.log(`reviews count: ${reviews.length}`);
   console.log(`avg score: ${averageReviewScore(reviews)}`);
@@ -749,7 +755,7 @@ function startWishDelegation(wish, audit, root, options = {}) {
   const suppliedVerifyHasCommand = !!(suppliedVerifyPlan && suppliedVerifyPlan.command);
   const userVerifyProvided = options.userVerifyProvided === true || options.verifyPlanExplicit === true;
   let verifyPlan = metricPlan
-    ? { command: metricVerifierCommand(metricPlan), outcome: `metric ${metricPlan.expression} is met`, status: 'metric' }
+    ? { command: metricVerifierCommand(metricPlan, root), outcome: `metric ${metricPlan.expression} is met`, status: 'metric' }
     : (suppliedVerifyPlan || deriveVerifyPlan(taskText));
   if (!metricPlan && frontendWish && designContext.auditCommand && !userVerifyProvided && !suppliedVerifyHasCommand && !(verifyPlan && verifyPlan.command)) {
     verifyPlan = designVerifyPlan(designContext);
@@ -1529,6 +1535,10 @@ function runCapturedWish(text, root = process.cwd(), options = {}) {
   const asJson = !!options.asJson;
   const noMission = !!options.noMission;
   const builderMode = String(options.asMode || '').trim() === 'builder';
+  if (options.metric?.ok && !resolveBackendRoot(root)) {
+    console.error(BACKEND_ROOT_HINT);
+    return 2;
+  }
   let engineOverride = '';
   try {
     engineOverride = validateEngineOverride(options.engineOverride, root);
@@ -1617,6 +1627,10 @@ function runAgainWish(positionals, root = process.cwd(), options = {}) {
 function applyAnswer(wish, answer, root, options = {}) {
   const asJson = !!options.asJson;
   const noMission = !!options.noMission;
+  if (wish.metric && !resolveBackendRoot(root)) {
+    console.error(BACKEND_ROOT_HINT);
+    return 2;
+  }
   let engineOverride = '';
   try {
     engineOverride = validateEngineOverride(options.engineOverride, root);

package/mcp/atris-mcp/index.mjs

@@ -4,11 +4,9 @@
 // Auth resolves the same way as the CLI: ATRIS_API_KEY, then
 // the logged-in atris token, then ~/.atris/design-api-key.
 
-import { realpathSync } from 'node:fs';
+import { readFileSync, realpathSync } from 'node:fs';
+import { createInterface } from 'node:readline';
 import { fileURLToPath } from 'node:url';
-import { Server } from '@modelcontextprotocol/sdk/server/index.js';
-import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import designApi from '../../lib/design-api.js';
 
 const { resolveDesignKey, designRequest, pollDesignJob, billingOf } = designApi;
@@ -141,34 +139,89 @@ export async function handleTool(name, args = {}, key) {
   return fail(`unknown tool: ${name}`);
 }
 
-export function createServer() {
-  const server = new Server(
-    { name: 'atris', version: '1.0.0' },
-    { capabilities: { tools: {} } },
-  );
+async function serveStdio() {
+  const { name, version } = JSON.parse(readFileSync(new URL('../../package.json', import.meta.url), 'utf8'));
+  const knownVersions = new Set(['2024-11-05', '2025-03-26', '2025-06-18', '2025-11-25']);
+  const send = (message, onWritten) => process.stdout.write(`${JSON.stringify({ jsonrpc: '2.0', ...message })}\n`, onWritten);
+  const input = createInterface({ input: process.stdin, crlfDelay: Infinity });
+  const inFlight = new Set();
+  const pendingById = new Map();
 
-  server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }));
-
-  server.setRequestHandler(CallToolRequestSchema, async (request) => {
-    const key = resolveDesignKey();
-    if (!key) {
-      return fail('no api key found. set ATRIS_API_KEY or run: atris login (or save a key in ~/.atris/design-api-key)');
-    }
+  for await (const line of input) {
+    if (!line.trim()) continue;
+    let request;
     try {
-      return await handleTool(request.params.name, request.params.arguments || {}, key);
-    } catch (error) {
-      return fail(`design call failed: ${(error && error.message) || error}`);
+      request = JSON.parse(line);
+    } catch {
+      send({ id: null, error: { code: -32700, message: 'parse error' } });
+      continue;
+    }
+    if (!request || typeof request !== 'object' || Array.isArray(request)
+      || request.jsonrpc !== '2.0' || typeof request.method !== 'string') {
+      send({ id: request?.id ?? null, error: { code: -32600, message: 'invalid request' } });
+      continue;
     }
-  });
+    if (request.method === 'notifications/cancelled') {
+      const pending = pendingById.get(request.params?.requestId);
+      if (pending) pending.cancelled = true;
+      continue;
+    }
+    if (!Object.hasOwn(request, 'id')) continue;
 
-  return server;
+    const id = request.id;
+    let result;
+    if (request.method === 'initialize') {
+      result = {
+        protocolVersion: knownVersions.has(request.params?.protocolVersion)
+          ? request.params.protocolVersion : '2025-06-18',
+        capabilities: { tools: {} },
+        serverInfo: { name, version },
+      };
+    } else if (request.method === 'ping') {
+      result = {};
+    } else if (request.method === 'tools/list') {
+      result = { tools: TOOLS };
+    } else if (request.method === 'tools/call') {
+      const pending = { cancelled: false };
+      const work = (async () => {
+        try {
+          const key = resolveDesignKey();
+          result = key
+            ? await handleTool(request.params?.name, request.params?.arguments || {}, key)
+            : fail('no api key found. set ATRIS_API_KEY or run: atris login (or save a key in ~/.atris/design-api-key)');
+        } catch (error) {
+          result = fail(`design call failed: ${(error && error.message) || error}`);
+        }
+        if (!pending.cancelled) {
+          await new Promise((resolve, reject) => {
+            send({ id, result }, (error) => (error ? reject(error) : resolve()));
+          });
+        }
+      })();
+      inFlight.add(work);
+      pendingById.set(id, pending);
+      const done = () => {
+        inFlight.delete(work);
+        if (pendingById.get(id) === pending) pendingById.delete(id);
+      };
+      work.then(done, (error) => {
+        done();
+        process.stderr.write(`mcp response write failed: ${(error && error.message) || error}\n`);
+        process.exitCode = 1;
+      });
+      continue;
+    } else {
+      send({ id, error: { code: -32601, message: 'method not found' } });
+      continue;
+    }
+    send({ id, result });
+  }
+  await Promise.allSettled(inFlight);
 }
 
 // Auto-start only when run directly (`atris mcp`, `npx atris-mcp`,
 // node index.mjs); realpathSync resolves the npm bin symlink.
 const invokedPath = process.argv[1] ? realpathSync(process.argv[1]) : '';
 if (invokedPath && invokedPath === fileURLToPath(import.meta.url)) {
-  const server = createServer();
-  const transport = new StdioServerTransport();
-  await server.connect(transport);
+  await serveStdio();
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "atris",
-  "version": "3.58.7",
+  "version": "3.58.8",
   "description": "you say what you want in plain words. atris builds it, checks it, and shows you proof.",
   "main": "bin/atris.js",
   "bin": {
@@ -101,8 +101,5 @@
   "bugs": {
     "url": "https://github.com/atrislabs/atris/issues"
   },
-  "homepage": "https://github.com/atrislabs/atris#readme",
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.0"
-  }
+  "homepage": "https://github.com/atrislabs/atris#readme"
 }

package/scripts/det/det.js

@@ -84,7 +84,7 @@ function catalogText() {
   );
   const gitRows = GIT_SCRIPTS.map((g) => `  ${g.name.padEnd(15)} ${g.usage}\n    ${g.ask}`);
   return (
-    'deterministic task scripts — run: node det.js <script> <mode> < input\n\n' +
+    'deterministic task scripts: run node det.js <script> <mode> < input\n\n' +
     rows.join('\n\n') +
     '\n\ngit-facing (read the repo, run the script directly; not via det.js):\n\n' +
     gitRows.join('\n\n') +
@@ -121,7 +121,7 @@ async function main() {
   }
   const git = GIT_SCRIPTS.find((g) => g.name === script);
   if (git) {
-    process.stdout.write(`${git.name} reads the repo, not stdin — run it directly:\n  ${git.usage}\n`);
+    process.stdout.write(`${git.name} reads the repo, not stdin; run it directly:\n  ${git.usage}\n`);
     return;
   }
   const entry = CATALOG[script];

package/scripts/det/pr-description.js

@@ -78,7 +78,7 @@ function areaBullets(files) {
     if (counts.A) parts.push(`${counts.A} added`);
     if (counts.M) parts.push(`${counts.M} changed`);
     if (counts.D) parts.push(`${counts.D} removed`);
-    bullets.push(`- **${area}** — ${parts.join(', ')} (+${added}/-${deleted})`);
+    bullets.push(`- **${area}**: ${parts.join(', ')} (+${added}/-${deleted})`);
   }
   return bullets;
 }
@@ -108,7 +108,7 @@ function build(input) {
   const commits = (input && input.commits) || [];
   const files = (input && input.files) || [];
   if (!commits.length && !files.length) {
-    return { error: 'no commits or files vs base — is the branch ahead of it?' };
+    return { error: 'no commits or files vs base: is the branch ahead of it?' };
   }
   const totals = files.reduce(
     (a, f) => ({ added: a.added + (f.added || 0), deleted: a.deleted + (f.deleted || 0) }),

package/scripts/det/test.js

@@ -211,7 +211,7 @@ check(
     { path: 'scripts/det/b.js', status: 'M', added: 2, deleted: 1 },
     { path: 'test/x.test.js', status: 'A', added: 5, deleted: 0 },
   ]),
-  ['- **scripts** — 1 added, 1 changed (+12/-1)', '- **test** — 1 added (+5/-0)']
+  ['- **scripts**: 1 added, 1 changed (+12/-1)', '- **test**: 1 added (+5/-0)']
 );
 // test plan lists touched test files, then a check per non-test area
 check(
@@ -267,7 +267,7 @@ check('det.git.json', JSON.parse(catalogJson()).git['commit-msg'].usage.includes
 // stdin catalog stays separate from the git list (routing must not mix them)
 check('det.git.notRoutable', CATALOG['commit-msg'], undefined);
 
-console.log(`ok — ${passed} checks passed`);
+console.log(`ok: ${passed} checks passed`);
 
 // hunk-filter: keeps only matching hunks, drops non-matching files entirely
 {

package/utils/api.js

@@ -97,7 +97,7 @@ function httpRequest(urlString, options) {
     // Socket idle timeout (fires if no data received for this duration)
     if (timeoutMs > 0) {
       req.setTimeout(timeoutMs, () => {
-        req.destroy(new Error(`Request timeout after ${Math.round(timeoutMs / 1000)}s — try --timeout=300`));
+        req.destroy(new Error(`request timeout after ${Math.round(timeoutMs / 1000)}s, try --timeout=300`));
       });
     }
     // Hard deadline — kill request after 2x the timeout regardless of activity