bantamkit-mcp 0.31.0 → 0.32.0

package/dist/memory/component.js

@@ -25,6 +25,8 @@
  * lines carry a `[project] ` tag that the `--store` form never emits. A port validated
  * against only one of them ships a string the deployment never produces.
  */
+import { realpathSync } from 'node:fs';
+import { resolve } from 'node:path';
 import { BantamError } from '../errors.js';
 import { pyStrip } from './factfile.js';
 import { countFacts, loadGrants, MEMORY_DIR_ENV, PROJECT_STORE, resolveProjectStore, } from './layers.js';
@@ -60,6 +62,55 @@ export function normalizeName(name) {
 export function profileStore() {
     return pyJoin(pyHome(), ...PROJECT_STORE);
 }
+/**
+ * Whether two paths name ONE directory, symlinks and `/var` vs `/private/var` included.
+ *
+ * Port of `_same_directory` (`runtime-py/src/bantamkit/memory/component.py`, J47-1,
+ * 0844ccb). Realpath, not string equality, and that distinction is measured rather than
+ * tidy: on macOS the walk up from a cwd under `/var` returns `/private/var/...` while
+ * `pyHome()` returns `/var/...`, so two spellings of one directory compare unequal as
+ * strings. The Stop hook's `samePath` (`tools/hooks/bantamkit-hook.mjs`) compares the same
+ * two roots the same way and for the same reason — it carried the identical defect, and
+ * J47-7 (`a109f99`) brought it to the same `realpathSync.native`, following this function
+ * rather than leading it. When the resolution itself
+ * fails, an absolute-path comparison is the honest fallback: it can only under-report a
+ * match, never invent one.
+ *
+ * AMENDED 2026-09-11 (J47-3B). The paragraph above stands as the reason this function
+ * resolves rather than compares strings, and the fallback's behaviour is unchanged. Two
+ * things it says are now known to be wrong about `fs.realpathSync` in particular, and
+ * measured: (1) it is NOT the twin of `os.path.realpath`. `realpathSync` hands its argument
+ * to `path.resolve` before it resolves anything, and `path.resolve` pops `..` LEXICALLY —
+ * before the symlink in front of it is followed. `os.path.realpath` and the kernel pop it
+ * AFTER. So a `HOME` spelled `<bed>/link/..`, where `link -> <bed>/deep/real`, is
+ * `<bed>/deep` to the reference and `<bed>` to Node: `realpathSync` then threw ENOENT on a
+ * directory that is there, the fallback under-reported, and `layered` bound one directory as
+ * two layers — the 2026-09-10 self-merge, still live on this side until now. (2) "it can
+ * only under-report a match, never invent one" was offered as reassurance, and
+ * under-reporting is the DANGEROUS direction here: a missed match IS the duplicate layer.
+ *
+ * The mechanism is now `realpathSync.native` — libuv's `uv_fs_realpath`, i.e. the platform's
+ * own `realpath(3)` / `GetFinalPathNameByHandle` — chosen because it pops `..` in the
+ * kernel's order and therefore agrees with `os.path.realpath` byte for byte on that bed,
+ * because it keeps the macOS `/var` vs `/private/var` resolution the original was written
+ * for, and because it adds no path arithmetic of this port's own. `statSync` identity
+ * (`dev` + `ino`) was the other candidate and was not taken: `ino` is not dependable on
+ * every Windows filesystem, and this runtime has to answer the same on Windows.
+ *
+ * The fallback stays `resolve(a) === resolve(b)`, and the under-report it can still produce
+ * is provably harmless where `layered` calls this: the native call throws only for a path
+ * that is not on disk, and `binding.path` always is — `layered` constructs that store, which
+ * creates it, before the guard runs — so a throwing side is a directory that does not exist,
+ * and that cannot be the same directory as one that does.
+ */
+function sameDirectory(a, b) {
+    try {
+        return realpathSync.native(a) === realpathSync.native(b);
+    }
+    catch {
+        return resolve(a) === resolve(b);
+    }
+}
 /** The name a layer answers under: the PROJECT directory, not the store directory. */
 export function layerLabel(root) {
     if (pyName(pyParent(root)) === '.bantamkit')
@@ -110,11 +161,21 @@ export class Memory {
                 false,
             ]);
         }
-        mem.layers.push([
-            'profile',
-            new MemoryStore(profileStore(), { k, create: false, ...(today ? { today } : {}) }),
-            false,
-        ]);
+        // ONE DIRECTORY IS ONE LAYER. The walk above starts at the cwd and climbs, so a
+        // session with no `.bantamkit` anywhere above it resolves `~/.bantamkit/memory` —
+        // the profile store — as its PROJECT store. Binding that directory a second time
+        // gave `dream` the same store twice: every fact collided with itself, was merged
+        // into itself, and the "profile copy" that was archived was the same file. It
+        // archived 20 of 20 of the user's real facts on 2026-09-10. Such a session has one
+        // layer, and `dreamOutcome` already has a true thing to say about that.
+        const profileRoot = profileStore();
+        if (!sameDirectory(profileRoot, binding.path)) {
+            mem.layers.push([
+                'profile',
+                new MemoryStore(profileRoot, { k, create: false, ...(today ? { today } : {}) }),
+                false,
+            ]);
+        }
         return mem;
     }
     /** The labels, in order. `_layers` is private in the reference too; this is for the tests. */

package/dist/shiftwork.d.ts

@@ -37,7 +37,10 @@ export declare function clockIn(checkpoint: string): PyValue;
  * `unitId` must name the cursor unit — the contract is execute-the-cursor (driver parity),
  * never pick-a-unit. When `job.roles` names the unit's role, `accounting.model` must be one
  * of that role's models, spelled exactly; a wrong or missing model is refused here, before
- * any mutation and before the accounting line. Mutations: set the unit's status, advance
+ * any mutation and before the accounting line. Extended 2026-09-11 (job47): so is a
+ * `job.roles` value for that role that is not a list of model identifiers — an unreadable
+ * declaration allows no model, and it is refused in the same place, by the same structured
+ * return, writing nothing. Mutations: set the unit's status, advance
  * `plan.cursor` to the first non-terminal unit in PLAN order (`depends_on` is ignored),
  * shallow-merge `handoffPatch` into `handoff`, push `historyEntry` onto the 5-entry ring.
  *

package/dist/shiftwork.js

@@ -39,7 +39,11 @@
  * therefore pinned as per-side literals in each runtime's own tests. The check runs at
  * validation time — after the cursor check, before the first mutation, and so before the
  * log-then-commit pair below — because a refusal taken after the append would leave an
- * orphan accounting line claiming a model that was rejected.
+ * orphan accounting line claiming a model that was rejected. J47-5: a role the map DOES
+ * name whose value is not a list of model identifiers is refused there too — an unreadable
+ * declaration allows no model, and the refusal is the same structured one, taken in the
+ * same place. That makes three refusal strings, not two, and the third is likewise a
+ * per-side literal.
  *
  * WHAT IS NOT PORTED, DELIBERATELY. The `depends_on` field is ignored on cursor advance
  * (v1-linear, the Python module's own ruling), there is no lock (the MCP topology has one
@@ -252,6 +256,25 @@ function pyFormat(value) {
  * string and the sentence says so. Reachable, and therefore measured: `BANTAMKIT_ASSETS` is
  * honoured by both runtimes, so the tests and the conformance corpus drive this branch
  * through a pack whose schema has lost `minItems`.
+ *
+ * AND A DECLARATION THIS CODE CANNOT READ IS NOT A LICENCE (J47-4, ported here as J47-5).
+ * The same ruling, one step further out: a role the map names is constrained by what it
+ * NAMES, and a value that is not a list of model identifiers names nothing, so it allows
+ * nothing. This port failed open five ways and mangled the declaration two more. MEASURED
+ * end to end under a pack whose `job.roles.additionalProperties` is `true`, with
+ * `model: 'haiku'`: a string, a dict, a number, a null and a bool all came back
+ * `{"result":"ok"}` with the status set, the cursor advanced and an accounting line
+ * written — the clock-out COMPLETED — while `[5]` and `['ok', null]` refused with the
+ * unreadable value rendered into the sentence as `5` and `ok, None`. A list holding a
+ * non-string is the shape a bare kind test cannot catch, which is why the property is
+ * LIST OF STRINGS and not merely list; the reference raised `TypeError: sequence item 0`
+ * on exactly that input. Fail CLOSED, through the same structured `_error` return, saying
+ * only what is true — the declaration cannot be read, therefore no model is allowed —
+ * naming no type (a Python type name would not port: `int` against `number`) and
+ * rendering no part of the value. ONE sentence for both accounting shapes: which model
+ * was reported cannot matter when the declaration that would judge it is unreadable.
+ * `[]` is untouched by this — an empty list IS a list of model identifiers and keeps the
+ * sentence J46-10 pinned.
  */
 function modelRefusal(document, unitId, unit, accounting) {
     const role = text(field(unit, 'role'));
@@ -259,8 +282,16 @@ function modelRefusal(document, unitId, unit, accounting) {
     const allowed = roles === undefined || roles.t !== 'dict' ? undefined : roles.v.get(role);
     // `role not in roles`. The `t !== 'list'` arm is a TYPE guard and not a policy: the schema
     // pins the value to an array, so the only way past it is a document no read would accept.
-    if (allowed === undefined || allowed.t !== 'list')
+    // AMENDED 2026-09-11 (J47-5): the two lines above stand as written and are now FALSE as a
+    // description of this code. A document no read would accept is exactly what a shared asset
+    // drifting produces, the arm answered `unconstrained` for every such document and the
+    // clock-out completed, and `t === 'list'` was never the property anyway — `['ok', null]`
+    // passed the kind test and mangled `None` into the sentence. The arm below is a POLICY.
+    if (allowed === undefined)
         return null;
+    if (allowed.t !== 'list' || !allowed.v.every((model) => model.t === 'str')) {
+        return `unit ${unitId} in role ${role} cannot clock out: job.roles.${role} is not a list of model identifiers, so it allows no model`;
+    }
     const names = allowed.v.map((model) => pyFormat(model)).join(', ');
     const offered = asPatch(accounting).get('model');
     if (offered === undefined || offered.t === 'null') {
@@ -280,7 +311,10 @@ function modelRefusal(document, unitId, unit, accounting) {
  * `unitId` must name the cursor unit — the contract is execute-the-cursor (driver parity),
  * never pick-a-unit. When `job.roles` names the unit's role, `accounting.model` must be one
  * of that role's models, spelled exactly; a wrong or missing model is refused here, before
- * any mutation and before the accounting line. Mutations: set the unit's status, advance
+ * any mutation and before the accounting line. Extended 2026-09-11 (job47): so is a
+ * `job.roles` value for that role that is not a list of model identifiers — an unreadable
+ * declaration allows no model, and it is refused in the same place, by the same structured
+ * return, writing nothing. Mutations: set the unit's status, advance
  * `plan.cursor` to the first non-terminal unit in PLAN order (`depends_on` is ignored),
  * shallow-merge `handoffPatch` into `handoff`, push `historyEntry` onto the 5-entry ring.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bantamkit-mcp",
-  "version": "0.31.0",
+  "version": "0.32.0",
   "description": "bantamkit MCP server — pure Node, runnable with npx",
   "type": "module",
   "bin": {