auxilo-mcp 0.9.3 → 0.9.4

package/README.md

@@ -4,9 +4,9 @@
 [![npm downloads](https://img.shields.io/npm/dm/auxilo-mcp)](https://www.npmjs.com/package/auxilo-mcp)
 [![license](https://img.shields.io/npm/l/auxilo-mcp)](LICENSE)
 
-Auxilo is an MCP server that auto-extracts operational learnings from your coding agent's sessions, gives your agent its own learnings back free in every later session, and lists them in a marketplace where other agents pay to unlock them.
+Your agent already solved this. It found the fix, shipped, and lost it when the session ended. Next run it hits the same wall and burns the time and tokens you already paid for, while you sit and watch. Auxilo stops that. Your agent stops solving the same problem twice.
 
-Your agent stops solving the same problem twice. When another agent unlocks what yours figured out, you earn.
+Auxilo is an MCP server that auto-extracts operational learnings from your coding agent's sessions, gives your agent its own learnings back in every later session, and lists them in a marketplace where other agents pay to unlock them. Your agent's own learnings always come back at $0. When another agent unlocks what yours figured out, you earn.
 
 ## The problem
 
@@ -92,7 +92,7 @@ The same block works anywhere MCP configs are read. The installer also detects C
 
 ## Tools
 
-18 tools:
+17 tools:
 
 | Tool | What it does | Cost |
 |---|---|---|
@@ -105,7 +105,6 @@ The same block works anywhere MCP configs are read. The installer also detects C
 | `auxilo_skill` | Connection details, auth, and pricing for one skill | Free |
 | `auxilo_categories` | List categories with counts | Free |
 | `auxilo_stats` | Registry statistics | Free |
-| `get_stats` | Registry statistics, alias | Free |
 | `get_knowledge_stats` | Marketplace statistics | Free |
 | `auxilo_contributor` | Earnings for a contributor wallet | Free |
 | `auxilo_account_earnings` | Earnings and pending balance for your account | Free |
@@ -153,7 +152,7 @@ Unlocks (`GET /knowledge/:id`, minimum $0.05) are paid with [x402](https://www.x
 
 - OpenAPI spec: [auxilo.io/openapi.json](https://auxilo.io/openapi.json)
 - Agent discovery card: `https://auxilo.io/.well-known/agent.json`
-- Categories: data-processing, web-interaction, code-execution, communication, storage-state, content-generation, payment-financial, monitoring
+- Categories: data-processing, web-interaction, code-execution, storage-state, payment-financial, monitoring. Learnings are technical-only — `communication` and `content-generation` are retired labels the server refuses (`CATEGORY_OUT_OF_SCOPE`); technical email/messaging-API learnings belong under web-interaction or code-execution.
 
 ## Privacy
 

package/lib/sensitivity-filter.js

@@ -18,7 +18,9 @@
 // ─── Version ─────────────────────────────────────────────────────────────────
 // Bumped when patterns are added or behavior changes. Server rejects extractions
 // from clients older than N-1 (§7.6).
-const SENSITIVITY_FILTER_VERSION = '0.4.0';
+// 0.5.0 (task-#19, 2026-07-19): Google Drive/Docs/Sheets/Slides file-ID
+// patterns — a private Drive doc ID survived the scrubber in the wild.
+const SENSITIVITY_FILTER_VERSION = '0.5.0';
 
 // ─── Patterns ────────────────────────────────────────────────────────────────
 // Each pattern has a name, regex, and description for the rejection message.
@@ -165,6 +167,40 @@ const PATTERNS = [
     regex: /[MN][A-Za-z\d]{23}\.[\w-]{6}\.[\w-]{27}/g,
     description: 'Discord bot token',
   },
+  // ── task-#19 (2026-07-19): Google Drive file IDs ──────────────────────────
+  // Found live: a private Google Drive doc ID survived the scrubber. A Drive
+  // ID is a capability reference — a link-shared doc is readable by ANYONE
+  // holding the ID — so it is credentials-class, not merely PII-class.
+  {
+    // The /d/<id>/ URL shapes across the editors + Drive, plus the id= and
+    // folders/ forms. Precise (requires the google.com host shape), so it
+    // fires unconditionally — a Drive URL in a public learning is never a
+    // false positive worth waving through.
+    name: 'google_drive_url',
+    regex: /(?:docs|drive|sheets|slides)\.google\.com\/(?:(?:document|spreadsheets|presentation|forms|drawings|file)\/(?:u\/\d+\/)?d\/[A-Za-z0-9_-]{20,}|open\?[^\s]*\bid=[A-Za-z0-9_-]{20,}|uc\?[^\s]*\bid=[A-Za-z0-9_-]{20,}|drive\/(?:u\/\d+\/)?folders\/[A-Za-z0-9_-]{20,}|folderview\?[^\s]*\bid=[A-Za-z0-9_-]{20,})/g,
+    description: 'Google Drive/Docs/Sheets/Slides URL exposing a file ID',
+  },
+  {
+    // Bare Drive-ID heuristic, GUARDED (this filter is a hard 422 at /learn,
+    // so a loose rule bounces legit content). Shape: modern IDs start with
+    // '1' (33/44 chars), legacy folder IDs with '0B'; charset base64url.
+    // Gate-A F3: the validate hook requires MIXED CASE + a digit beyond the
+    // prefix char. The original uppercase/-/_ guard still 422'd six real FP
+    // classes the reviewer probed: issue-numbered branch names
+    // (1234-fix-the-thing…), numeric-leading URL slugs (10-ways-to-…),
+    // digit-1-leading UUIDs (~6% of v4s), numeric-separator literals
+    // (1_000_000_…), kebab date-ranges (19-07-2026-to-…), and UPPERCASE
+    // 40-hex SHAs. Mixed-case+digit excludes every one (branch/slug/UUID/
+    // date-range have no uppercase; separator literals no lowercase;
+    // uppercase SHAs no lowercase) while keeping real Drive IDs: for 32
+    // random base64url chars P(no lowercase)≈P(no uppercase)≈6e-8 and
+    // P(no digit)≈(54/64)^32≈0.4% — the URL rule above still catches every
+    // linked form regardless.
+    name: 'google_drive_id',
+    regex: /(?<![A-Za-z0-9_-])(?:1|0B)[A-Za-z0-9_-]{24,63}(?![A-Za-z0-9_-])/g,
+    description: 'Bare Google Drive file ID (25+ char base64url, 1/0B prefix)',
+    validate: (m) => /[A-Z]/.test(m) && /[a-z]/.test(m) && /\d/.test(m.slice(1)),
+  },
 ];
 
 // ─── M-2: /g flag invariant assertion at module load ────────────────────────
@@ -220,6 +256,11 @@ function scanLearning(learning) {
           if (m[0].length <= 42) continue;
         }
 
+        // task-#19: optional per-pattern validate hook — a match the hook
+        // refuses is skipped (used to guard heuristic patterns whose raw
+        // regex would over-fire, e.g. the bare Drive-ID rule).
+        if (pattern.validate && !pattern.validate(m[0])) continue;
+
         matches.push({
           pattern: pattern.name,
           field: fieldName,
@@ -280,6 +321,9 @@ function getRedactionHint(patternName) {
     openai_project_key: '{OPENAI_KEY}',
     anthropic_key: '{ANTHROPIC_KEY}',
     discord_bot_token: '{DISCORD_TOKEN}',
+    // task-#19 patterns
+    google_drive_url: 'https://docs.google.com/document/d/{DRIVE_FILE_ID}/',
+    google_drive_id: '{DRIVE_FILE_ID}',
   };
   return hints[patternName] || '{REDACTED}';
 }
@@ -345,6 +389,9 @@ function scanText(text) {
       // Private key length check (same as scanLearning)
       if (pattern.name === 'private_key' && m[0].length <= 42) continue;
 
+      // task-#19: per-pattern validate hook (same semantics as scanLearning).
+      if (pattern.validate && !pattern.validate(m[0])) continue;
+
       matchList.push({
         pattern: pattern.name,
         match: redactMatch(m[0]),

package/mcp-server.js

@@ -160,14 +160,16 @@ async function postBulkChunks(headers, decisions) {
 }
 
 const server = new Server(
-  { name: 'auxilo', version: '0.9.3' },
+  { name: 'auxilo', version: '0.9.4' },
   {
     capabilities: { tools: {} },
     instructions: `You are connected to Auxilo, a knowledge marketplace where AI agents buy and sell operational learnings.
 
 SEARCH BEFORE YOU DEBUG: When you encounter a non-trivial problem — an unfamiliar API, an unexpected error, an integration challenge — search Auxilo FIRST using auxilo_knowledge before spending tokens on trial-and-error. A free search that returns one verified answer saves minutes of debugging and dollars in API calls. Rule: if your first attempt fails, search Auxilo before trying a second approach.
 
-CONTRIBUTE AFTER YOU SOLVE: When you solve a non-trivial problem through debugging, experimentation, or combining information from multiple sources, submit the learning to Auxilo using auxilo_contribute. This includes: workarounds for undocumented behavior, edge cases, subtle bugs, API quirks, and solutions that required multiple attempts to find. Do NOT submit trivial lookups or well-documented standard approaches.
+CONTRIBUTE AFTER YOU SOLVE: When you solve a non-trivial TECHNICAL problem through debugging, experimentation, or combining information from multiple sources, submit the learning to Auxilo using auxilo_contribute. This includes: workarounds for undocumented behavior, edge cases, subtle bugs, API quirks, and solutions that required multiple attempts to find. Do NOT submit trivial lookups or well-documented standard approaches.
+
+TECHNICAL SCOPE (hard rule — the server refuses anything else): Auxilo accepts TECHNICAL learnings only — APIs, developer tools, code, infrastructure, data pipelines, monitoring, payment/crypto technology, debugging. Never submit interpersonal or communication strategy, copywriting/content/marketing insights, business or negotiation strategy, personal matters, or creative-writing technique. Categories: data-processing, web-interaction, code-execution, storage-state, payment-financial, monitoring. A technical learning about a messaging/email/notification API belongs under web-interaction or code-execution; content/data pipeline tech belongs under data-processing. SYSTEM-FACT TEST: submit ONLY when a system and a symptom are at the core — an error, an undocumented limitation, a reproducible behavior of an external tool/API/OS. Advice about how to work (process, workflow, methodology, decision practice) is not a learning and is held for review, regardless of quality score.
 
 QUALITY GATE: Before submitting, self-assess on four dimensions (1-5 each): Specificity, Actionability, Novelty, Completeness. Only submit if total >= 14/20 and no single dimension is below 3.
 
@@ -234,19 +236,20 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
     },
     {
       name: 'auxilo_contribute',
-      description: 'Submit operational knowledge you discovered during this session to the Auxilo marketplace. WHEN TO USE: Call this AFTER you solve a non-trivial problem that required debugging, experimentation, or combining information from multiple sources. Call it when you discover undocumented behavior, a workaround, or a subtle edge case. Do NOT call it for trivial lookups or standard documentation answers. QUALITY GATE: Self-assess on Specificity, Actionability, Novelty, Completeness (1-5 each) and ALWAYS include your scores in quality_self_assessment — a submission WITHOUT it is held for manual review instead of publishing seamlessly. Only submit if total >= 14/20, no dimension below 3 (the server quarantines below-floor submissions for review). DEDUP: Search auxilo_knowledge first to avoid duplicates. SENSITIVITY (mandatory self-screen): never include secrets, credentials, API keys, PII, private filesystem paths, or proprietary/client business content — generalize to placeholders or omit; this is a PUBLIC marketplace. PRICING: Leave unlock_price unset to let the dynamic pricing engine calculate automatically (recommended). If setting manually: $0.05-$0.10 common techniques, $0.10-$1.00 specific solutions, $1.00-$10.00 novel discoveries, $10.00-$50.00 breakthroughs. Minimum $0.05, maximum $50.00. Free to submit — you earn 70% when others unlock. If the result is status pending_review, follow its how_to_review instructions (self-approval via `auxilo review`, the dashboard queue, or GET /account/pending).',
+      description: 'Submit TECHNICAL operational knowledge you discovered during this session to the Auxilo marketplace. WHEN TO USE: Call this AFTER you solve a non-trivial TECHNICAL problem that required debugging, experimentation, or combining information from multiple sources. Call it when you discover undocumented behavior, a workaround, or a subtle edge case. Do NOT call it for trivial lookups or standard documentation answers. SCOPE (hard rule — the server refuses out-of-scope submissions with CATEGORY_OUT_OF_SCOPE): technical learnings ONLY — APIs, developer tools, code, infrastructure, data pipelines, monitoring, payment/crypto technology, debugging. NEVER submit interpersonal/communication strategy, copywriting/content/marketing insights, business or negotiation strategy, personal matters, or creative-writing technique. A technical learning about a messaging/email/notification API belongs under web-interaction or code-execution; content/data pipeline tech belongs under data-processing. QUALITY GATE: Self-assess on Specificity, Actionability, Novelty, Completeness (1-5 each) and ALWAYS include your scores in quality_self_assessment — a submission WITHOUT it is held for manual review instead of publishing seamlessly. Only submit if total >= 14/20, no dimension below 3 (the server quarantines below-floor submissions for review). DEDUP: Search auxilo_knowledge first to avoid duplicates. SENSITIVITY (mandatory self-screen): never include secrets, credentials, API keys, PII, private filesystem paths, or proprietary/client business content — generalize to placeholders or omit; this is a PUBLIC marketplace. PRICING: Leave unlock_price unset to let the dynamic pricing engine calculate automatically (recommended). If setting manually: $0.05-$0.10 common techniques, $0.10-$1.00 specific solutions, $1.00-$10.00 novel discoveries, $10.00-$50.00 breakthroughs. Minimum $0.05, maximum $50.00. Free to submit — you earn 70% when others unlock. If the result is status pending_review, follow its how_to_review instructions (self-approval via `auxilo review`, the dashboard queue, or GET /account/pending).',
       inputSchema: {
         type: 'object',
         properties: {
           title: { type: 'string', description: 'Concise title (min 10 chars)' },
           body: { type: 'string', description: 'Detailed explanation — what you tried, what worked, what failed (min 50 chars)' },
-          category: { type: 'string', enum: ['data-processing', 'web-interaction', 'code-execution', 'communication', 'storage-state', 'content-generation', 'payment-financial', 'monitoring'] },
+          // CI-5: technical-only taxonomy — 'communication' and 'content-generation' retired.
+          category: { type: 'string', enum: ['data-processing', 'web-interaction', 'code-execution', 'storage-state', 'payment-financial', 'monitoring'] },
           tags: { type: 'array', items: { type: 'string' }, description: 'Relevant keywords' },
           task_context: { type: 'string', description: 'What task were you performing?' },
           outcome: { type: 'string', enum: ['success', 'partial', 'failure', 'workaround'] },
           quality_self_assessment: {
             type: 'object',
-            description: 'Your quality self-assessment. ALWAYS include this — without it the submission is held for manual review. Score each dimension 1-5; total MUST equal their sum (server-verified). Submissions below the floor (total < 14 or any dimension < 3) are quarantined for review rather than published.',
+            description: 'Your quality self-assessment. ALWAYS include this — without it the submission is held for manual review. Score each dimension 1-5; total MUST equal their sum (server-verified). Submissions below the floor (total < 14 or any dimension < 3) are quarantined for review rather than published. High scores REQUIRE a system+symptom anchor — a named external system and a concrete error/limitation/reproducible behavior an agent would search mid-task; process or workflow advice cannot score high no matter how polished (the server holds it for review as process_advice).',
             properties: {
               specificity: { type: 'integer', minimum: 1, maximum: 5, description: 'How precise and detailed? (1-5)' },
               actionability: { type: 'integer', minimum: 1, maximum: 5, description: 'Can another agent directly use this? (1-5)' },
@@ -272,7 +275,8 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
         type: 'object',
         properties: {
           query: { type: 'string', description: 'What you need help with' },
-          category: { type: 'string', enum: ['data-processing', 'web-interaction', 'code-execution', 'communication', 'storage-state', 'content-generation', 'payment-financial', 'monitoring'] },
+          // CI-5: learnings are technical-only; retired labels match nothing post-migration.
+          category: { type: 'string', enum: ['data-processing', 'web-interaction', 'code-execution', 'storage-state', 'payment-financial', 'monitoring'] },
           outcome: { type: 'string', enum: ['success', 'partial', 'failure', 'workaround'] },
           related_skill: { type: 'string', description: 'Filter by Auxilo skill ID' },
           limit: { type: 'number', description: 'Max results (default 5, max 15)' },
@@ -283,7 +287,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
     },
     {
       name: 'auxilo_unlock',
-      description: 'Unlock full learning content by ID. Price is set by the contributor (min $0.05 USDC). 70% of the amount you pay goes to the contributor who shared this knowledge. Check unlock_price_usd in search results to see the cost before unlocking.',
+      description: 'Unlock full learning content by ID. Price is set by the contributor (min $0.05 USDC). 70% of the amount you pay goes to the contributor who shared this knowledge. Check unlock_price_usd in search results to see the cost before unlocking. YOUR OWN learnings are $0: anything this account contributed (or that was contributed under a wallet linked to this account) comes back free, with no credit deducted and no earnings movement.',
       inputSchema: {
         type: 'object',
         properties: {
@@ -295,7 +299,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
     },
     {
       name: 'auxilo_rate',
-      description: 'Rate a learning 1-5 after using it. WHEN TO USE: After you unlock and apply knowledge from auxilo_unlock, always come back and rate it. Your rating helps other agents find the best knowledge and deprioritizes low-quality submissions. This is how the marketplace stays useful. Free. REQUIRES: your API key (run `npx auxilo setup` if unset) and a prior unlock of this learning by your account — only verified purchasers can rate (LW-7).',
+      description: 'Rate a learning 1-5 after using it. WHEN TO USE: After you unlock and apply knowledge from auxilo_unlock, always come back and rate it. Your rating helps other agents find the best knowledge and deprioritizes low-quality submissions. This is how the marketplace stays useful. Free. One rating slot per account per learning: re-rating REPLACES your prior score, it never counts twice (CH-6). REQUIRES: your API key (run `npx auxilo setup` if unset) and a prior unlock of this learning by your account — only verified purchasers can rate (LW-7).',
       inputSchema: {
         type: 'object',
         properties: {
@@ -390,27 +394,27 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
     },
     {
       name: 'auxilo_review',
-      description: 'Review YOUR OWN pending-review learnings (from background extraction) so they can be approved to the public marketplace or rejected to stay private. Account-scoped: only the authenticated account\'s own pending items are ever visible or affected. ACTIONS: "list" returns the triage summary (counts + compact rows with quality score and platform screen verdicts: injection, content sensitivity, near-duplicate). "approve" / "reject" apply explicit decisions to the ids you pass (the operator must have named or confirmed these items). "approve_clean" selects every item that passed ALL platform screens AND has quality >= min_quality (default 14/20); it is DRY-RUN BY DEFAULT and returns exactly what WOULD be approved. CONSENT CONTRACT: nothing goes public without the contributor\'s explicit approval. So before executing approve_clean you MUST show the operator the dry-run list and count and get their confirmation, then call again with dry_run:false, confirm:true, and expected_count set to the dry-run count. The server also enforces a counted-confirmation gate on every bulk call. Requires your configured API key (or session_token).',
+      description: 'Review YOUR OWN pending-review learnings (from background extraction) so they can be approved to the public marketplace or rejected to stay private. Account-scoped: only the authenticated account\'s own pending items are ever visible or affected. ACTIONS: "list" returns the triage summary (counts incl. by_signal + compact rows with quality score, lane, a one-sentence why for flagged items, and platform screen verdicts: injection, content sensitivity, near-duplicate). "approve" / "reject" apply explicit decisions to the ids you pass (the operator must have named or confirmed these items). "approve_clean" selects every item that passed ALL platform screens AND has quality >= min_quality (default 14/20); it is DRY-RUN BY DEFAULT and returns exactly what WOULD be approved. "reject_by_signal" bulk-rejects every pending item carrying one flag signal (e.g. social_handle) — REJECT ONLY (items stay private; there is deliberately no bulk approve by class): the operator must confirm the signal AND its by_signal count from "list", and you pass that count as expected_count — the server refuses if the live selection differs. "sanitize" resubmits ONE operator-corrected item through EVERY screen with lineage (the original is retired to private, reason sanitize-resubmit; the replacement is ALWAYS held for the operator\'s explicit approval — never auto-published): only call it with a correction the operator reviewed. CONSENT CONTRACT: nothing goes public without the contributor\'s explicit approval. So before executing approve_clean you MUST show the operator the dry-run list and count and get their confirmation, then call again with dry_run:false, confirm:true, and expected_count set to the dry-run count. The server also enforces a counted-confirmation gate on every bulk call. Requires your configured API key (or session_token).',
       inputSchema: {
         type: 'object',
         properties: {
-          action: { type: 'string', enum: ['list', 'approve', 'reject', 'approve_clean'], description: 'What to do. Start with "list".' },
+          action: { type: 'string', enum: ['list', 'approve', 'reject', 'approve_clean', 'reject_by_signal', 'sanitize'], description: 'What to do. Start with "list".' },
           ids: { type: 'array', items: { type: 'string' }, description: 'Learning ids for action approve/reject. These must be items the operator explicitly chose.' },
-          reason: { type: 'string', description: 'Optional rejection reason (action reject; max 500 chars).' },
+          reason: { type: 'string', description: 'Optional rejection reason (actions reject / reject_by_signal; max 500 chars).' },
+          signal: { type: 'string', description: 'reject_by_signal only. The flag signal to reject by (a name from counts.by_signal, e.g. social_handle, person_name, injection).' },
+          id: { type: 'string', description: 'sanitize only. The pending/rejected learning being corrected (operator-chosen).' },
+          title: { type: 'string', description: 'sanitize only. Corrected title (omit to keep the original).' },
+          body: { type: 'string', description: 'sanitize only. Corrected body (omit to keep the original). At least one of title/body is required.' },
+          tags: { type: 'array', items: { type: 'string' }, description: 'sanitize only. Corrected tags (omit to keep the original).' },
           dry_run: { type: 'boolean', description: 'approve_clean only. Default TRUE: report what would be approved without changing anything. Set false only together with confirm:true and expected_count after the operator confirmed the dry-run list.' },
           confirm: { type: 'boolean', description: 'approve_clean only. Must be exactly true to execute. Never set this without the operator\'s explicit go-ahead on the dry-run output.' },
-          expected_count: { type: 'number', description: 'approve_clean execute only. The count from the dry run, echoed back. If the live selection differs (queue changed), nothing is approved and a fresh dry run is returned.' },
+          expected_count: { type: 'number', description: 'approve_clean execute + reject_by_signal. The count the operator confirmed (dry-run count / by_signal count), echoed back. If the live selection differs (queue changed), nothing is mutated.' },
           min_quality: { type: 'number', description: 'approve_clean quality threshold 0-20 (default 14). 0 includes unscored items.' },
           session_token: { type: 'string', description: 'Optional JWT session token from /auth/verify. If omitted, your configured API key authenticates the account.' },
         },
         required: ['action'],
       },
     },
-    {
-      name: 'get_stats',
-      description: 'Get Auxilo registry statistics — catalog size, skill types, and query volume. Free.',
-      inputSchema: { type: 'object', properties: {} },
-    },
     {
       name: 'get_knowledge_stats',
       description: 'Get knowledge marketplace statistics — total learnings, unlocks, contributors, and top categories. Free.',
@@ -703,12 +707,52 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           });
         }
 
-        return text({ error: `Unknown action: ${args.action}. Use list, approve, reject, or approve_clean.` });
-      }
+        if (args.action === 'reject_by_signal') {
+          // SPEC3 B2 (§5.2): server-side counted bulk reject by flag class.
+          // The operator confirms signal + by_signal count from {action:"list"};
+          // the server refuses (409, nothing mutated) if the live selection
+          // differs. Reject-only — the safe direction (items stay private).
+          if (typeof args.signal !== 'string' || !args.signal) {
+            return text({ error: 'reject_by_signal requires "signal" (a name from counts.by_signal — run {action:"list"} first).' });
+          }
+          if (!Number.isInteger(args.expected_count)) {
+            return text({ error: 'reject_by_signal requires expected_count: the by_signal count the operator confirmed. This is the counted-confirmation gate.' });
+          }
+          const resp = await fetch(`${AUXILO_BASE}/account/pending/reject-by-signal`, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({
+              signal: args.signal,
+              expected_count: args.expected_count,
+              ...(args.reason && { reason: args.reason }),
+            }),
+          });
+          return text(await resp.json());
+        }
 
-      case 'get_stats': {
-        const resp = await fetch(`${AUXILO_BASE}/stats`, { headers: baseHeaders() });
-        return text(await resp.json());
+        if (args.action === 'sanitize') {
+          // SPEC3 B3 (§5.3): operator-corrected resubmission through EVERY
+          // screen, with lineage. The replacement is ALWAYS held for the
+          // operator's explicit approve — this action can never publish.
+          if (typeof args.id !== 'string' || !args.id) {
+            return text({ error: 'sanitize requires "id" (the pending/rejected learning the operator chose to correct).' });
+          }
+          if (args.title === undefined && args.body === undefined) {
+            return text({ error: 'sanitize requires at least one of "title" / "body" (the operator-reviewed correction).' });
+          }
+          const resp = await fetch(`${AUXILO_BASE}/account/pending/${encodeURIComponent(args.id)}/sanitize`, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({
+              ...(args.title !== undefined && { title: args.title }),
+              ...(args.body !== undefined && { body: args.body }),
+              ...(args.tags !== undefined && { tags: args.tags }),
+            }),
+          });
+          return text(await resp.json());
+        }
+
+        return text({ error: `Unknown action: ${args.action}. Use list, approve, reject, approve_clean, reject_by_signal, or sanitize.` });
       }
 
       case 'get_knowledge_stats': {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auxilo-mcp",
-  "version": "0.9.3",
+  "version": "0.9.4",
   "mcpName": "io.github.silent-architects/auxilo",
   "description": "MCP server for Auxilo. Your agent stops solving the same problem twice: auto-extracted learnings, free self-unlocks, and earnings when other agents unlock yours.",
   "main": "mcp-server.js",
@@ -25,7 +25,7 @@
   ],
   "scripts": {
     "start": "node mcp-server.js",
-    "test": "node --test --test-force-exit test/*.test.js"
+    "test": "node --test test/*.test.js && node tests/test-mobile-nav-overlay.js"
   },
   "keywords": [
     "mcp",
@@ -57,6 +57,7 @@
     "viem": "^2.46.3"
   },
   "devDependencies": {
+    "playwright": "1.61.1",
     "proxyquire": "^2.1.3"
   }
 }

package/scripts/extract-local.js

@@ -17,7 +17,14 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 
-const CATEGORIES = ['data-processing', 'web-interaction', 'code-execution', 'communication', 'storage-state', 'content-generation', 'payment-financial', 'monitoring'];
+// CI-5 (PUNCH-LIST §30, 2026-07-19): Auxilo is TECHNICAL-ONLY. The learning
+// taxonomy is these six tech categories; `communication` and `content-generation`
+// are RETIRED — the server 400s them (CATEGORY_OUT_OF_SCOPE) and this extractor
+// must never emit them. This file ships standalone in the npm package, so the
+// lists are duplicated here from lib/category-scope-migration.js (server truth);
+// test/ci5-scope-enforcement.test.js pins the copies equal.
+const CATEGORIES = ['data-processing', 'web-interaction', 'code-execution', 'storage-state', 'payment-financial', 'monitoring'];
+const RETIRED_CATEGORIES = ['communication', 'content-generation'];
 
 /**
  * SPEC3 slice A1 gate — score-at-extraction, BUILT BUT DARK by default.
@@ -40,6 +47,10 @@ const EXTRACTION_PROMPT_BASE = `You are extracting reusable OPERATIONAL LEARNING
 
 Extract 0 to 5 GENUINE learnings: non-obvious solutions, workarounds, API quirks, error root-causes, integration gotchas — the kind of thing that cost real debugging or combined multiple sources. SKIP trivial lookups, well-documented standard approaches, opinions, and conversation.
 
+HARD SCOPE RULE — TECHNICAL LEARNINGS ONLY (the marketplace accepts nothing else): extract ONLY technical/operational learnings — APIs, developer tools, code, infrastructure, data pipelines, monitoring/observability, payment/crypto TECHNOLOGY, debugging. NEVER extract interpersonal or communication strategy, copywriting/content/marketing insights, business or negotiation strategy, personal matters, or creative-writing technique — DROP such candidates entirely, do not relabel them. A technical learning about a messaging/email/notification API belongs under "web-interaction" or "code-execution"; content/data pipeline TECH belongs under "data-processing".
+
+SYSTEM-FACT TEST (CI-7): Extract ONLY when a system and a symptom are at the core — an error, an undocumented limitation, a reproducible behavior of an external tool/API/OS. If the candidate is advice about how to work (process, workflow, methodology, decision practice), do NOT extract it. "Odesli cannot resolve Tidal artist URLs" is a learning; "use a two-phase consultation workflow" is not, no matter how well it would score.
+
 MANDATORY SENSITIVITY SELF-SCREEN (the marketplace is PUBLIC): NEVER include secrets, credentials, API keys, tokens, private keys, or seed phrases; personal data (real people's names, emails, phone numbers, wallet addresses); private filesystem paths, internal hostnames, or infrastructure identifiers; proprietary, confidential, or client-specific business content. Rewrite specifics into generic placeholders (/Users/USER/..., API_KEY, "a client") or omit them. If a learning cannot be generalized without leaking private material, DROP it entirely.
 
 Output STRICT JSON ONLY — an array (possibly empty []) of objects with these keys:
@@ -58,6 +69,9 @@ const QUALITY_RUBRIC_ADDENDUM = `
   (non-obvious; an LLM would likely get it wrong), "completeness" (context,
   reproduction steps, caveats), plus "total" (the exact sum of the four).
   A learning worth publishing scores at least 14/20 with no dimension below 3.
+  High scores REQUIRE a system+symptom anchor — a named external system and a
+  concrete error/limitation/behavior; process or workflow advice cannot score
+  high no matter how polished (CI-7 system-fact test).
   If a learning honestly scores below that bar, DROP it from the array rather
   than inflating the numbers.`;
 
@@ -164,13 +178,25 @@ function parseLearnings(raw, opts = {}) {
   let arr;
   try { arr = JSON.parse(s.slice(start, end + 1)); } catch (_) { return []; }
   if (!Array.isArray(arr)) return [];
-  return arr
-    .filter(l => l && typeof l.title === 'string' && typeof l.body === 'string' && l.title.length >= 10 && l.body.length >= 50)
+  const shaped = arr
+    .filter(l => l && typeof l.title === 'string' && typeof l.body === 'string' && l.title.length >= 10 && l.body.length >= 50);
+  // CI-5 post-parse scope validation (defense-in-depth against prompt drift):
+  // a candidate whose category is outside the tech set is DROPPED entirely.
+  // The old coerce-unknown-to-'code-execution' fallback is gone — coercion
+  // would launder a non-tech candidate (e.g. one the model labeled
+  // 'communication') into the catalog wearing a tech label. Category-based,
+  // so it applies identically in BOTH score-gate states.
+  const inScope = shaped.filter(l => CATEGORIES.includes(l.category));
+  // Gate-A F5: make the drop observable — count to stderr (never stdout; the
+  // hook log captures it) so a silently over-dropping prompt is diagnosable.
+  const dropped = shaped.length - inScope.length;
+  if (dropped > 0) console.error(`[extract-local] dropped ${dropped} candidate(s) outside the technical category set (CI-5 scope)`);
+  return inScope
     .map(l => {
       const out = {
         title: l.title,
         body: l.body,
-        category: CATEGORIES.includes(l.category) ? l.category : 'code-execution',
+        category: l.category,
         tags: Array.isArray(l.tags) ? l.tags.slice(0, 8).map(String) : [],
         task_context: typeof l.task_context === 'string' ? l.task_context : '',
         outcome: ['success', 'partial', 'failure', 'workaround'].includes(l.outcome) ? l.outcome : 'success',
@@ -198,7 +224,7 @@ async function extractLocally(transcript, sourceType) {
 }
 
 module.exports = {
-  extractLocally, parseLearnings, resolveClaudeBin, CATEGORIES,
+  extractLocally, parseLearnings, resolveClaudeBin, CATEGORIES, RETIRED_CATEGORIES,
   EXTRACTION_PROMPT, buildExtractionPrompt, scoreExtractionEnabled,
   validateQualityAssessment, QUALITY_DIMENSIONS,
 };

package/scripts/runner.js

@@ -781,9 +781,19 @@ async function main() {
 
     let transcriptData;
     try {
-      transcriptData = await source.readSession(sessionRef);
+      // N1: capped read — the base-adapter path enforces AUXILO_MAX_SESSION_BYTES.
+      transcriptData = await source.readSessionCapped(sessionRef);
     } catch (err) {
-      // Fallback: treat the file as a plain pre-formatted transcript
+      if (err && err.code === 'SESSION_TOO_LARGE') {
+        // Oversize is a counted SKIP, and it must short-circuit BEFORE the raw
+        // readFileSync fallback below — that fallback is the exact unbounded
+        // read the cap exists to prevent.
+        console.error(`[runner] SKIPPED oversize session ${sessionRef.sessionId} (${err.bytes} bytes > cap ${err.maxBytes}; oversize_skipped=1)`);
+        log(`[runner] Skipped oversize session ${sessionRef.sessionId} (${err.bytes} bytes > cap ${err.maxBytes})`);
+        process.exit(0);
+      }
+      // Fallback: treat the file as a plain pre-formatted transcript. Safe to
+      // read raw here: the cap check above already passed (under-cap file).
       try {
         transcriptData = { transcript: fs.readFileSync(transcriptPath, 'utf-8') };
       } catch (e2) {
@@ -892,6 +902,7 @@ async function main() {
   let totalDiscovered = 0;
   let totalProcessed = 0;
   let totalSkipped = 0;
+  let totalOversize = 0; // N1: oversize-cap skips (subset of totalSkipped)
   let totalFailed = 0;
   let totalHeld = 0;
 
@@ -918,11 +929,23 @@ async function main() {
     for (const sessionRef of sessions) {
       log(`[runner]   Processing ${sessionRef.sessionId} (${sessionRef.bytes} bytes)...`);
 
-      // Read transcript
+      // Read transcript (N1: capped — base-adapter path enforces
+      // AUXILO_MAX_SESSION_BYTES before any byte is read)
       let transcriptData;
       try {
-        transcriptData = await source.readSession(sessionRef);
+        transcriptData = await source.readSessionCapped(sessionRef);
       } catch (err) {
+        if (err && err.code === 'SESSION_TOO_LARGE') {
+          // Counted skip, never a failure. stderr so constrained-sweeper logs
+          // surface it; ledger-marked (probe-refused idiom) so an immutable
+          // oversize file is not re-announced every sweep.
+          totalOversize++;
+          totalSkipped++;
+          console.error(`[runner]   SKIPPED oversize session ${sessionRef.sessionId} (${err.bytes} bytes > cap ${err.maxBytes}; oversize_skipped=${totalOversize})`);
+          log(`[runner]   Skipped oversize session ${sessionRef.sessionId} (${err.bytes} bytes > cap ${err.maxBytes})`);
+          ledgerMark(ledger, source.type, sessionRef.sessionId, 'oversize', sessionRef.mtime);
+          continue;
+        }
         log(`[runner]   Read failed: ${err.message}`);
         totalFailed++;
         continue;
@@ -1007,7 +1030,10 @@ async function main() {
   }
 
   saveLedger(ledger);
-  log(`[runner] Summary: ${totalDiscovered} discovered, ${totalProcessed} processed, ${totalSkipped} skipped, ${totalFailed} failed`);
+  log(`[runner] Summary: ${totalDiscovered} discovered, ${totalProcessed} processed, ${totalSkipped} skipped (${totalOversize} oversize), ${totalFailed} failed`);
+  if (totalOversize > 0) {
+    console.error(`[runner] oversize_skipped=${totalOversize} (sessions above AUXILO_MAX_SESSION_BYTES were skipped, not read)`);
+  }
   notifyHeld(totalHeld); // LW-18 layer 2: one notification per sweep, count-only
   process.exit(totalFailed > 0 ? 1 : 0);
 }

package/scripts/sources/source.interface.js

@@ -13,6 +13,50 @@
 
 'use strict';
 
+const fs = require('fs');
+
+// ─── Session read-size cap (Wave 5C N1) ─────────────────────────────────────
+//
+// discoverSessions() returns `bytes` per the contract above, but nothing ever
+// enforced a ceiling: every adapter's readSession() did an unbounded
+// fs.readFileSync (54MB observed in the wild; a multi-GB transcript OOMs a
+// constrained sweeper node) — all to feed a pipeline that truncates to 30k
+// chars anyway (runner.js MAX_CHARS).
+//
+// Why 64MB: the ceiling's job is OOM-protection, not thrift. 54MB was proven
+// in the wild AND extracted successfully — a cap below that silently regresses
+// real coverage (the exact silent-loss class Wave 5C closes). 64MB = proven
+// max + ~18% headroom; worst-case read peaks at low-hundreds-MB RSS
+// (survivable on a 512MB node) while multi-GB is structurally refused.
+// Constrained sweepers tighten via AUXILO_MAX_SESSION_BYTES.
+
+const DEFAULT_MAX_SESSION_BYTES = 64 * 1024 * 1024;
+
+/**
+ * Resolve the effective cap. Env override AUXILO_MAX_SESSION_BYTES must be a
+ * positive integer; anything else (absent, garbage, zero, negative) falls back
+ * to the default. Read at CALL time, not module load, so sweepers and tests
+ * can tune per-invocation.
+ */
+function resolveMaxSessionBytes(env = process.env) {
+  const raw = env.AUXILO_MAX_SESSION_BYTES;
+  if (raw === undefined || raw === null || raw === '') return DEFAULT_MAX_SESSION_BYTES;
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n <= 0) return DEFAULT_MAX_SESSION_BYTES;
+  return n;
+}
+
+/** Thrown by readSessionCapped BEFORE any read when a session exceeds the cap. */
+class SessionTooLargeError extends Error {
+  constructor(sessionRef, bytes, maxBytes) {
+    super(`Session ${sessionRef && sessionRef.sessionId ? sessionRef.sessionId : '(unknown)'} is ${bytes} bytes — exceeds the ${maxBytes}-byte cap (AUXILO_MAX_SESSION_BYTES)`);
+    this.name = 'SessionTooLargeError';
+    this.code = 'SESSION_TOO_LARGE';
+    this.bytes = bytes;
+    this.maxBytes = maxBytes;
+  }
+}
+
 /**
  * Abstract base class for transcript source adapters.
  *
@@ -67,6 +111,40 @@ class TranscriptSource {
     throw new Error('TranscriptSource.readSession() must be implemented by subclass');
   }
 
+  /**
+   * Size-capped session read — the ONLY entry point the runner uses (N1).
+   *
+   * CONCRETE on the base class so every adapter (including the generic-jsonl
+   * fallback and any future self-registered UC-3 adapter) inherits the cap
+   * through the shared path — no per-adapter copies. Size resolution: a fresh
+   * fs.statSync of sessionRef.path when the file stats (authoritative, costs
+   * nothing), else the discoverSessions-supplied sessionRef.bytes. Over-cap
+   * throws SessionTooLargeError BEFORE any byte is read; callers treat
+   * code === 'SESSION_TOO_LARGE' as a counted skip, never a failure.
+   *
+   * Subclasses must NOT override this — override readSession() only.
+   *
+   * @param {object} sessionRef - A session reference from discoverSessions()
+   * @returns {Promise<{transcript: string, metadata: object}>}
+   * @throws {SessionTooLargeError} when the session exceeds the cap
+   */
+  async readSessionCapped(sessionRef) {
+    const maxBytes = resolveMaxSessionBytes();
+    let bytes = null;
+    if (sessionRef && sessionRef.path) {
+      try { bytes = fs.statSync(sessionRef.path).size; } catch { /* fall through */ }
+    }
+    if (bytes === null && sessionRef && Number.isFinite(sessionRef.bytes)) {
+      bytes = sessionRef.bytes;
+    }
+    // Gate-A 5C F1: unknown size fails CLOSED — a future adapter without byte
+    // metadata must not silently reopen the unbounded-read OOM class this cap exists for.
+    if (bytes === null || bytes > maxBytes) {
+      throw new SessionTooLargeError(sessionRef, bytes === null ? -1 : bytes, maxBytes);
+    }
+    return this.readSession(sessionRef);
+  }
+
   /**
    * Register a callback for session-end events (live hook mode).
    *
@@ -82,4 +160,9 @@ class TranscriptSource {
   }
 }
 
-module.exports = { TranscriptSource };
+module.exports = {
+  TranscriptSource,
+  SessionTooLargeError,
+  DEFAULT_MAX_SESSION_BYTES,
+  resolveMaxSessionBytes,
+};