bantamkit-mcp 0.35.7 → 0.35.9

package/dist/mcp/pyargs.d.ts

@@ -7,12 +7,12 @@
  * ship a server whose recovery behaviour differs from the reference's on every mistyped
  * argument, and that is a product difference, not a cosmetic one.
  *
- * WHAT THE URL IS. `https://errors.pydantic.dev/2.13/v/<type>` names an entry in pydantic's
- * public error catalogue. This runtime has no pydantic; the URL is part of the sentence the
- * reference emits, reproduced because the sentence is the contract. `2.13` is therefore a
- * PIN on the reference, not a claim about this process — and it is compared against the
- * live server by `tools/conformance/suites/wire.mjs`, so the day the Python side bumps to
- * 2.14 the suite goes red here instead of the two runtimes drifting apart quietly.
+ * WHY THERE IS NO URL (job65/#185). pydantic ends each error with `For further information
+ * visit https://errors.pydantic.dev/<major.minor>/v/<type>`, naming whichever pydantic pip
+ * resolved. This port used to reproduce it with `2.13` hard-coded, and the reference printed
+ * `2.14` the day PyPI resolved 2.14 — the refusal texts differed by install date. The
+ * reference now sets `PYDANTIC_ERRORS_INCLUDE_URL=0` at import (`bantamkit.mcpserver`), so
+ * neither runtime prints the line; `tools/conformance/suites/wire.mjs` compares the two.
  *
  * EVERY RULE BELOW WAS MEASURED, not read off pydantic's documentation. The probes are in
  * `scratchpad/job38-n7/probe{4,7,8,9}.py` and each drove the real stdio server:
@@ -35,6 +35,12 @@ export interface FieldSpec {
     readonly optional: boolean;
     /** `Field(le=...)`: an inclusive ceiling, checked AFTER the lax int parse succeeds. */
     readonly le?: bigint;
+    /**
+     * `Field(ge=...)`: an inclusive floor, checked the same way. On a `dictInt` it binds the
+     * VALUES — `dict[str, Annotated[int, Field(ge=0)]]` on the reference — so the frame's
+     * location is `usage.<key>`, as the type frame's is.
+     */
+    readonly ge?: bigint;
 }
 export interface ArgModel {
     /** The pydantic model name, which is the FUNCTION name plus `Arguments`. */
@@ -60,6 +66,15 @@ export interface ArgModel {
  * register a tool.
  */
 export declare const OFFSET_MAXIMUM = 9007199254740991n;
+/**
+ * `assets/tools/skill_audit.json` `budget.maximum` — the same `Number.MAX_SAFE_INTEGER` as
+ * `OFFSET_MAXIMUM`, spelled as its own constant because it is tied to a different asset
+ * and would stay where it is if the other ever moved. Bound on the reference as
+ * `Annotated[int, Field(le=SKILL_BUDGET_MAXIMUM)]` (#133, job65): until then the manifest
+ * advertised a ceiling neither runtime enforced, and `budget: 2**53` was audited as if it
+ * were a number a catalogue could be measured against.
+ */
+export declare const SKILL_BUDGET_MAXIMUM = 9007199254740991n;
 /**
  * One model per handler, mirroring `build_server`'s closures signature for signature.
  *
@@ -122,6 +137,7 @@ export declare class PyValidationFailure extends Error {
     readonly detail: string;
     constructor(detail: string);
 }
+export declare function loneSurrogateArgument(args: PyValue): string | null;
 /**
  * `model.model_validate(arguments)` for one tool, or the exact `ValidationError` text.
  *

package/dist/mcp/pyargs.js

@@ -7,12 +7,12 @@
  * ship a server whose recovery behaviour differs from the reference's on every mistyped
  * argument, and that is a product difference, not a cosmetic one.
  *
- * WHAT THE URL IS. `https://errors.pydantic.dev/2.13/v/<type>` names an entry in pydantic's
- * public error catalogue. This runtime has no pydantic; the URL is part of the sentence the
- * reference emits, reproduced because the sentence is the contract. `2.13` is therefore a
- * PIN on the reference, not a claim about this process — and it is compared against the
- * live server by `tools/conformance/suites/wire.mjs`, so the day the Python side bumps to
- * 2.14 the suite goes red here instead of the two runtimes drifting apart quietly.
+ * WHY THERE IS NO URL (job65/#185). pydantic ends each error with `For further information
+ * visit https://errors.pydantic.dev/<major.minor>/v/<type>`, naming whichever pydantic pip
+ * resolved. This port used to reproduce it with `2.13` hard-coded, and the reference printed
+ * `2.14` the day PyPI resolved 2.14 — the refusal texts differed by install date. The
+ * reference now sets `PYDANTIC_ERRORS_INCLUDE_URL=0` at import (`bantamkit.mcpserver`), so
+ * neither runtime prints the line; `tools/conformance/suites/wire.mjs` compares the two.
  *
  * EVERY RULE BELOW WAS MEASURED, not read off pydantic's documentation. The probes are in
  * `scratchpad/job38-n7/probe{4,7,8,9}.py` and each drove the real stdio server:
@@ -54,6 +54,15 @@ const opt = (name, kind, bound = {}) => ({
  * register a tool.
  */
 export const OFFSET_MAXIMUM = 9007199254740991n;
+/**
+ * `assets/tools/skill_audit.json` `budget.maximum` — the same `Number.MAX_SAFE_INTEGER` as
+ * `OFFSET_MAXIMUM`, spelled as its own constant because it is tied to a different asset
+ * and would stay where it is if the other ever moved. Bound on the reference as
+ * `Annotated[int, Field(le=SKILL_BUDGET_MAXIMUM)]` (#133, job65): until then the manifest
+ * advertised a ceiling neither runtime enforced, and `budget: 2**53` was audited as if it
+ * were a number a catalogue could be measured against.
+ */
+export const SKILL_BUDGET_MAXIMUM = 9007199254740991n;
 /**
  * One model per handler, mirroring `build_server`'s closures signature for signature.
  *
@@ -107,9 +116,10 @@ export const ARG_MODELS = {
     bantamkit_status: { model: 'bantamkit_statusArguments', fields: [] },
     // `reserve: int | None = None` on the reference, so it is the same lax `int` as `k`:
     // `'2'`, `True` and `3.0` validate, `'2.5'` is `int_parsing`, `2.5` is `int_from_float`,
-    // and an explicit `null` is the default. The manifest's `minimum: 0` is advisory to the
-    // client; nothing here floors it — a negative value reaches `MemoryStore.compact`, whose
-    // `max(0, min(reserve, budget // 2))` is the only clamp on either side (6b966e5).
+    // and an explicit `null` is the default. Nothing here floors it — a negative value
+    // reaches `MemoryStore.compact`, whose `max(0, min(reserve, budget // 2))` is the only
+    // clamp on either side (6b966e5) — and since #133 (job65) the manifest no longer
+    // advertises a `minimum` it does not enforce: the clamp is stated in the description.
     memory_compact: { model: 'memory_compactArguments', fields: [opt('reserve', 'int')] },
     // `bantamkit_read(path: str, part: str | None = None, offset: int | None = None,
     // limit: int | None = None)` on the reference (job43). `path` and `part` are the strict
@@ -127,16 +137,19 @@ export const ARG_MODELS = {
         model: 'bantamkit_readArguments',
         fields: [req('path', 'str'), opt('part', 'str'), opt('offset', 'int', { le: OFFSET_MAXIMUM }), opt('limit', 'int')],
     },
-    // `skill_audit(root: str, enabled: list[str] | None = None, usage: dict[str, int] | None =
-    // None, check: str | None = None, budget: int | None = None)` on the reference (job44).
-    // `usage` is the only `dict[str, int]` on the surface and the reason `dictInt` exists:
-    // pydantic validates a typed dict's VALUES, so `{'a': 'x'}` is `usage.a` / `int_parsing`
-    // where `handoff_patch`'s `dict[str, Any]` takes anything. `budget` carries no `le`,
-    // because the reference binds none — the manifest's `maximum` is advisory to the client,
-    // and the handler's own refusal is the negative one. `versions` is the only
-    // `dict[str, str]`, and the reason `dictStr` exists beside it: a `str` field is STRICT even
-    // in lax mode, so `{'a': 1}` is `versions.a` / `string_type` where the same value under
-    // `usage` would validate.
+    // `skill_audit(root: str, enabled: list[str] | None = None, usage: dict[str,
+    // Annotated[int, Field(ge=0)]] | None = None, check: str | None = None, budget:
+    // Annotated[int, Field(le=SKILL_BUDGET_MAXIMUM)] | None = None)` on the reference (job44;
+    // the two bounds since #133, job65). `usage` is the only `dict[str, int]` on the surface
+    // and the reason `dictInt` exists: pydantic validates a typed dict's VALUES, so `{'a':
+    // 'x'}` is `usage.a` / `int_parsing` and `{'a': -1}` is `usage.a` /
+    // `greater_than_equal`, where `handoff_patch`'s `dict[str, Any]` takes anything. `budget`'s
+    // ceiling is the manifest's `maximum`, bound the way `bantamkit_read`'s `offset` is;
+    // its floor is still the handler's own refusal (`budget must not be negative`), which
+    // the manifest's `minimum: 0` describes and this table does not pre-empt. `versions` is
+    // the only `dict[str, str]`, and the reason `dictStr` exists beside it: a `str` field is
+    // STRICT even in lax mode, so `{'a': 1}` is `versions.a` / `string_type` where the same
+    // value under `usage` would validate.
     // `dry_run: bool | None = None` on the reference (job45 row 5). LAX bool, and every arm
     // below was MEASURED against the real stdio server, not read off pydantic's docs
     // (`scratchpad` probe, 33 inputs): `0`/`1` and `0.0`/`1.0` coerce; any OTHER integral
@@ -176,9 +189,9 @@ export const ARG_MODELS = {
         fields: [
             req('root', 'str'),
             opt('enabled', 'listStr'),
-            opt('usage', 'dictInt'),
+            opt('usage', 'dictInt', { ge: 0n }),
             opt('check', 'str'),
-            opt('budget', 'int'),
+            opt('budget', 'int', { le: SKILL_BUDGET_MAXIMUM }),
             opt('versions', 'dictStr'),
         ],
     },
@@ -297,7 +310,7 @@ function checkField(spec, value) {
             const bad = [];
             const coerced = new Map();
             for (const [key, item] of value.v) {
-                const checked = checkInt(`${spec.name}.${key}`, item);
+                const checked = checkBoundedInt(spec, `${spec.name}.${key}`, item);
                 if ('value' in checked)
                     coerced.set(key, checked.value);
                 else
@@ -382,24 +395,37 @@ function checkField(spec, value) {
             return wrongType();
         }
         case 'int': {
-            const checked = checkInt(spec.name, value);
-            if (!('value' in checked))
-                return [checked];
-            // `less_than_equal` names the ORIGINAL input, as every constraint error does.
-            if (spec.le !== undefined && checked.value.t === 'int' && checked.value.v > spec.le) {
-                return [
-                    {
-                        loc: spec.name,
-                        type: 'less_than_equal',
-                        msg: `Input should be less than or equal to ${spec.le}`,
-                        input: value,
-                    },
-                ];
-            }
-            return checked;
+            const checked = checkBoundedInt(spec, spec.name, value);
+            return 'value' in checked ? checked : [checked];
         }
     }
 }
+/**
+ * The lax int parse, then the field's `ge`/`le` bounds on what it parsed.
+ *
+ * A constraint frame names the ORIGINAL input, as every pydantic constraint error does:
+ * `usage: {'a': '-1'}` is `greater_than_equal` with `input_value='-1', input_type=str`, the
+ * string the client sent and not the `-1` it parsed to. Measured against pydantic 2.13 on
+ * `dict[str, Annotated[int, Field(ge=0)]]` and `Annotated[int, Field(le=2**53-1)]`,
+ * 2026-10-15 (job65 J65-13 note, §3), and compared over stdio by `suites/wire.mjs`.
+ */
+function checkBoundedInt(spec, loc, value) {
+    const checked = checkInt(loc, value);
+    if (!('value' in checked) || checked.value.t !== 'int')
+        return checked;
+    if (spec.ge !== undefined && checked.value.v < spec.ge) {
+        return {
+            loc,
+            type: 'greater_than_equal',
+            msg: `Input should be greater than or equal to ${spec.ge}`,
+            input: value,
+        };
+    }
+    if (spec.le !== undefined && checked.value.v > spec.le) {
+        return { loc, type: 'less_than_equal', msg: `Input should be less than or equal to ${spec.le}`, input: value };
+    }
+    return checked;
+}
 function checkInt(loc, value) {
     const tooBig = () => ({
         loc,
@@ -550,6 +576,52 @@ export class PyValidationFailure extends Error {
         this.name = 'PyValidationFailure';
     }
 }
+/**
+ * A LONE SURROGATE IN ANY STRING ARGUMENT IS REFUSED BY NAME (job65/#160), before any other
+ * check. JSON can spell `\ud800` on its own; no UTF-8 file or frame can carry it. This port
+ * used to accept it and write U+FFFD ("saved", data silently altered); the reference never
+ * answered at all, because the SDK's frame parser rejects the escape and drops the request.
+ * Both now answer `Error executing tool <name>: argument '<path>' holds a lone surrogate
+ * (U+XXXX), which is not text; nothing was done` — the reference from its stdio reader
+ * (`bantamkit.mcpstdio`), this port from here. `<path>` is the top-level argument, then
+ * `[i]` for a list item and `.key` for a dict member; the first in document order wins.
+ * Keys are not inspected: an unknown key is ignored by both sides anyway.
+ */
+const LONE_SURROGATE = /[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/;
+export function loneSurrogateArgument(args) {
+    const walk = (value, where) => {
+        if (value.t === 'str') {
+            const found = LONE_SURROGATE.exec(value.v);
+            if (found === null)
+                return null;
+            const unit = found[0].charCodeAt(0).toString(16).toUpperCase().padStart(4, '0');
+            return `argument '${where}' holds a lone surrogate (U+${unit}), which is not text; nothing was done`;
+        }
+        if (value.t === 'list') {
+            for (let i = 0; i < value.v.length; i += 1) {
+                const hit = walk(value.v[i], `${where}[${i}]`);
+                if (hit !== null)
+                    return hit;
+            }
+        }
+        if (value.t === 'dict') {
+            for (const [key, item] of value.v) {
+                const hit = walk(item, `${where}.${key}`);
+                if (hit !== null)
+                    return hit;
+            }
+        }
+        return null;
+    };
+    if (args.t !== 'dict')
+        return null;
+    for (const [key, item] of args.v) {
+        const hit = walk(item, key);
+        if (hit !== null)
+            return hit;
+    }
+    return null;
+}
 /**
  * `model.model_validate(arguments)` for one tool, or the exact `ValidationError` text.
  *
@@ -564,6 +636,9 @@ export class PyValidationFailure extends Error {
  * its `input_value` and not the string the wire held.
  */
 export function validateArguments(model, args) {
+    const lone = loneSurrogateArgument(args);
+    if (lone !== null)
+        throw new Error(lone);
     const unwrapped = preParseJson(model, args);
     const supplied = unwrapped.t === 'dict' ? unwrapped.v : new Map();
     const errors = [];
@@ -589,8 +664,7 @@ export function validateArguments(model, args) {
     const head = `${count} validation error${count === 1 ? '' : 's'} for ${model.model}`;
     const body = errors
         .map((e) => `${e.loc}\n  ${e.msg} [type=${e.type}, input_value=${truncateRepr(reprValue(e.input))}, ` +
-        `input_type=${pyTypeName(e.input)}]\n    For further information visit ` +
-        `https://errors.pydantic.dev/2.13/v/${e.type}`)
+        `input_type=${pyTypeName(e.input)}]`)
         .join('\n');
     throw new PyValidationFailure(`${head}\n${body}`);
 }

package/dist/mcp/server.js

@@ -3,7 +3,7 @@
  *
  * A port of `runtime-py/src/bantamkit/mcpserver.py`'s `build_server`, across two unrelated
  * SDK lineages — Python runs `mcp` 2.0.0 (`from mcp.server import MCPServer`), this runs
- * `@modelcontextprotocol/sdk` 1.30.0. Where the two SDKs make a difference unavoidable it is
+ * `@modelcontextprotocol/sdk` 1.31.0. Where the two SDKs make a difference unavoidable it is
  * a `ruling` case in `tools/conformance/suites/wire.mjs`, carrying its reason and required to
  * KEEP differing — a ruling whose case quietly started matching fails the suite too. Where
  * they do not, this file takes the reference's answer even when the SDK offers an easier one.
@@ -27,10 +27,10 @@
  * part of the wire and no asset carries it.
  */
 import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { dirname, join, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
-import { CallToolRequestSchema, ErrorCode, GetPromptRequestSchema, ListPromptsRequestSchema, ListResourceTemplatesRequestSchema, ListResourcesRequestSchema, ListToolsRequestSchema, ReadResourceRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
+import { CallToolRequestSchema, ErrorCode, GetPromptRequestSchema, InitializeRequestSchema, ListPromptsRequestSchema, ListResourceTemplatesRequestSchema, ListResourcesRequestSchema, ListToolsRequestSchema, PingRequestSchema, ReadResourceRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
 import { AssetNotFound, assetsRoot, loadSkill, loadToolAsset } from '../assets.js';
 import { BantamError } from '../errors.js';
 import { bantamkitReadUnknownPart, documentError, documentManifest, documentOffsetPastEnd, documentPage, schemaError, toolFailed, } from '../contract.js';
@@ -174,41 +174,32 @@ function rpcError(code, message, data) {
 const asDict = (value) => (value.t === 'dict' ? value.v : new Map());
 const asText = (value) => (value && value.t === 'str' ? value.v : '');
 /**
- * `work_plan`'s `nodes` as `workplan.plan` takes them.
+ * `work_plan`'s `nodes` as `workplan.plan` takes them: the decoded objects, UNCHANGED.
  *
  * The reference's model is `list[dict[str, Any]]`, so pydantic guarantees a list of dicts
- * and NOTHING about what is inside one; `workplan.plan` then reads `node["id"]`,
- * `node.get("depends_on") or []` and `node.get("priority", 0)` off raw Python objects. This
- * reproduces those three reads and their defaults.
+ * and NOTHING about what is inside one; what is inside is checked by `workplan.plan` itself
+ * on both sides against the item schema `assets/tools/work_plan.json` advertises (#127,
+ * job65). Until that check existed THIS function was where the port diverged: it coerced a
+ * string `depends_on` to `[]`, a non-numeric `priority` to 0 and a numeric id to its
+ * `str()`, so `[{id: 'a', depends_on: 'b'}, {id: 'b', ...}]` was planned with `a` beside
+ * `b` here and `b` before `a` there. Nothing is reinterpreted here any more: `toJs` hands
+ * the planner the same value `json.loads` hands the reference, and a node that contradicts
+ * the schema comes back as the planner's own `{result: 'error', reason: 'nodes[<i>].<field>
+ * must be ...'}` — one sentence, both runtimes, compared over stdio by
+ * `tools/conformance/suites/workplan.mjs`.
  *
- * A NODE WITH NO `id` RAISES, and raising is the port: `node["id"]` is a `KeyError` on the
- * reference, whose `str()` is the key in single quotes, so the SDK's envelope reads
- * `Error executing tool work_plan: 'id'`. Defaulting it here would answer a plan over a
- * node the reference refused to look at.
- *
- * WHERE THE DYNAMIC HALF STOPS, said rather than hidden. Python keeps an id's own type and
- * this side stringifies it with `str()`'s spelling (`reprValue` for every non-`str`), so a
- * document mixing `5` and `"5"` is two nodes there and one here, and a non-numeric
- * `priority` is a `TypeError` there and a 0 here. Both need a node whose types contradict
- * `assets/tools/work_plan.json`, which nothing in the shift-work corpus produces; they are
- * named here because an unwritten difference is the one that is found later.
+ * A NODE WITH NO `id` STILL RAISES, and raising is the port: `node["id"]` is a `KeyError` on
+ * the reference, whose `str()` is the key in single quotes, so the SDK's envelope reads
+ * `Error executing tool work_plan: 'id'` (`tool/no-id` in the same suite). It is reproduced
+ * here, before the planner runs, because the planner's own answer to a missing id is the
+ * non-string-id sentence and the reference never reaches that line.
  */
 function planNodes(value) {
-    const pyText = (v) => (v.t === 'str' ? v.v : reprValue(v));
     const items = value !== undefined && value.t === 'list' ? value.v : [];
     return items.map((item) => {
-        const node = item.t === 'dict' ? item.v : new Map();
-        const id = node.get('id');
-        if (id === undefined)
+        if (item.t === 'dict' && !item.v.has('id'))
             throw new BantamError("'id'");
-        const declared = node.get('depends_on');
-        const priority = node.get('priority');
-        return {
-            id: pyText(id),
-            // `list(node.get("depends_on") or [])`: missing, `null` and `[]` are one case.
-            depends_on: declared !== undefined && declared.t === 'list' ? declared.v.map(pyText) : [],
-            priority: priority !== undefined && (priority.t === 'int' || priority.t === 'float') ? Number(priority.v) : 0,
-        };
+        return toJs(item);
     });
 }
 /** `int | None` after validation: the tagged int, or `null` for the default. */
@@ -480,6 +471,22 @@ function runTool(name, memory, args, version, log, documents) {
         out.set('bantamkit_degraded', { t: 'str', v: line });
         return { t: 'dict', v: out };
     };
+    /**
+     * A reply that is ONE JSON DOCUMENT rendered as text (`skill_audit`, `token_ledger`), plus
+     * the footer if there is one, as a `bantamkit_degraded` key LAST in that document (#124).
+     *
+     * `noted` would append a sentence after the closing brace and the reply would stop parsing.
+     * The key is spliced into the text rather than the document being re-parsed, so every byte
+     * of a degraded reply before the key is the healthy reply's: `asJson` is
+     * `JSON.stringify(dict, null, 2)` of a non-empty object, so it always ends `\n}`, and the key
+     * goes in at that two-space indent, exactly where `json.dumps(indent=2)` would put it.
+     */
+    const notedJson = (document) => {
+        const line = notice();
+        if (line === '')
+            return document;
+        return `${document.slice(0, -2)},\n  "bantamkit_degraded": ${JSON.stringify(line)}\n}`;
+    };
     switch (name) {
         case 'memory_save': {
             const links = args.get('links');
@@ -811,7 +818,7 @@ function runTool(name, memory, args, version, log, documents) {
                     findings: result.findings.length,
                     omissions: result.omissions.length,
                 });
-                return { value: { t: 'str', v: noted(result.asJson()) }, wrapped: true };
+                return { value: { t: 'str', v: notedJson(result.asJson()) }, wrapped: true };
             });
         }
         case 'repo_map': {
@@ -930,7 +937,7 @@ function runTool(name, memory, args, version, log, documents) {
                     requests: result.requests,
                     sessions: result.sessions.length,
                 });
-                return { value: { t: 'str', v: noted(tokenledger.asJson(result)) }, wrapped: true };
+                return { value: { t: 'str', v: notedJson(tokenledger.asJson(result)) }, wrapped: true };
             });
         }
         case 'work_plan':
@@ -1072,7 +1079,8 @@ export function buildServer(memory, wire, version, log = EventLog.fromEnv(memory
     }));
     server.setRequestHandler(ReadResourceRequestSchema, (request) => {
         const uri = request.params.uri;
-        const skill = /^bantamkit:\/\/skills\/([^/]*)$/.exec(uri);
+        const skillName = templateName(uri, 'bantamkit://skills/');
+        const skill = skillName === null ? null : [uri, skillName];
         if (skill) {
             // A skill that pairs with a tool is served on that tool's surfaces and no other. The
             // pairing is the one the reference's `filegraph.py` spells — `load_tool("file_graph")`
@@ -1103,9 +1111,14 @@ export function buildServer(memory, wire, version, log = EventLog.fromEnv(memory
             }
             return { contents: [{ mimeType: 'text/plain', text, uri }] };
         }
-        const rubric = /^bantamkit:\/\/rubrics\/([^/]*)$/.exec(uri);
+        const rubricName = templateName(uri, 'bantamkit://rubrics/');
+        const rubric = rubricName === null ? null : [uri, rubricName];
         if (rubric) {
-            const path = join(assetsRoot(), 'rubrics', `${rubric[1]}.yaml`);
+            // Joined as TEXT, not with `path.join`: `join` folds `x/../y` lexically, and the
+            // reference's `Path / f"{name}.yaml"` does not, so `x%2F..%2Fcode-quality` (no
+            // traversal ABOVE the start, so the security check passes it) would read
+            // `code-quality.yaml` here and nothing there. The kernel resolves `x/..` on both.
+            const path = `${join(assetsRoot(), 'rubrics')}${sep}${rubric[1]}.yaml`;
             let text;
             try {
                 text = pyReadText(path);
@@ -1115,11 +1128,8 @@ export function buildServer(memory, wire, version, log = EventLog.fromEnv(memory
             }
             return { contents: [{ mimeType: 'text/plain', text, uri }] };
         }
-        // The template variable matches ONE segment and MAY BE EMPTY — measured: the reference
-        // answers `bantamkit://skills/` with -32603 `unknown skill asset: `, not with "unknown
-        // resource", so `[^/]*` and not `[^/]+`. A traversal is still not a match at all,
-        // because `bantamkit://skills/../../etc/passwd` has separators in it, and the reference
-        // answers that one -32602.
+        // No template took the URI (`templateName` says how the reference decides), so the
+        // reference's `ResourceNotFoundError`: -32602 `Unknown resource: <uri>` (#180).
         throw rpcError(ErrorCode.InvalidParams, `Unknown resource: ${uri}`, { uri });
     });
     server.setRequestHandler(CallToolRequestSchema, (request, extra) => {
@@ -1167,14 +1177,140 @@ export function buildServer(memory, wire, version, log = EventLog.fromEnv(memory
             ...(structuredValue === null ? {} : { structuredContent: toJs(structuredValue) }),
         };
     });
+    guardRequests(server, wire);
     return server;
 }
+/**
+ * The reference's ONE answer to a request it will not hand to a handler, byte for byte:
+ * `mcp` 2.0.0's `ServerRunner._on_request` raises `MCPError(INVALID_PARAMS, "Invalid request
+ * parameters", data="")` both for params its pydantic model refuses and for a served method
+ * asked before `initialize` was accepted ("pinned compat: the same error shape the union
+ * validation produced"). No pydantic or zod text reaches the wire.
+ */
+const invalidParams = () => rpcError(ErrorCode.InvalidParams, 'Invalid request parameters', '');
+/** The request schema of every method this server answers; `guardRequests` refuses a gap. */
+const REQUEST_SCHEMAS = new Map([
+    InitializeRequestSchema,
+    PingRequestSchema,
+    ListToolsRequestSchema,
+    CallToolRequestSchema,
+    ListResourcesRequestSchema,
+    ListResourceTemplatesRequestSchema,
+    ReadResourceRequestSchema,
+    ListPromptsRequestSchema,
+    GetPromptRequestSchema,
+].map((schema) => [schema.shape.method.value, schema]));
+/** Only `ping` may be asked before `initialize` (`runner._INIT_EXEMPT`). */
+const INIT_EXEMPT = new Set(['ping']);
+/**
+ * #147 AND #178: the two refusals the reference makes before a handler runs, put in front of
+ * every handler the SDK holds.
+ *
+ * #147. The TS SDK parses a request's params INSIDE the handler it registered, so a refusal
+ * left as a thrown zod error: -32603 Internal error with the issue list pretty-printed as the
+ * message (`tools/call` with `params: {}`, `arguments: "notadict"`, `resources/read` with no
+ * `uri`, ...). The reference answers all of them -32602 with a short message. The schema is
+ * the SDK's own, checked here first, so what is refused does not change — only how.
+ *
+ * #178. The TS SDK has no initialization gate: a `tools/call` with no `initialize` before it
+ * was served. The reference refuses every method it serves, except `ping`, until an
+ * `initialize` has been ACCEPTED (its answer, not `notifications/initialized`), with the same
+ * -32602; a method it does not serve is -32601 either way, which the SDK already says because
+ * an unserved method never reaches this table. The gate opens SYNCHRONOUSLY when a valid
+ * `initialize` reaches its handler: the reference parks its read loop while `initialize` runs,
+ * so a request written in the same chunk behind it is served, and here the next handler call
+ * is a later microtask in arrival order. `_oninitialize` cannot refuse a valid request (it
+ * negotiates down to its own latest version), so opening before it returns is not optimism.
+ *
+ * THE SEAM IS THE SDK'S HANDLER TABLE, `Protocol._requestHandlers`: TypeScript-private, and
+ * the only place that sees `initialize` and `ping`, which the SDK registers itself. Pinned to
+ * the capped SDK, and checked here: a table that is not a Map, or a handler with no schema
+ * in `REQUEST_SCHEMAS`, stops the server at startup rather than serving it unguarded.
+ */
+function guardRequests(server, wire) {
+    const table = server._requestHandlers;
+    if (!(table instanceof Map)) {
+        throw new Error('the MCP SDK keeps no _requestHandlers map: the #147/#178 request guard has no seam');
+    }
+    const handlers = table;
+    let accepted = false;
+    for (const [method, handler] of [...handlers]) {
+        const schema = REQUEST_SCHEMAS.get(method);
+        if (schema === undefined)
+            throw new Error(`no request schema for served method ${method}: the #147 guard would skip it`);
+        handlers.set(method, (request, extra) => {
+            // pydantic's optional fields (`cursor`, `arguments`, `_meta`, ...) are `X | None =
+            // None`, so `null` is the same as absent there; zod's `.optional()` refuses it. A
+            // REQUIRED field (`name`, `uri`) is still refused once its `null` is set aside.
+            const params = request.params;
+            if (params !== null && typeof params === 'object' && !Array.isArray(params)) {
+                for (const [key, value] of Object.entries(params))
+                    if (value === null)
+                        delete params[key];
+            }
+            // `?.`: the in-memory test harnesses hand `buildServer` a two-method stub for `wire`.
+            if (wire.paramsRefused?.(extra.requestId) === true || !schema.safeParse(request).success)
+                throw invalidParams();
+            if (method === 'initialize')
+                accepted = true;
+            else if (!accepted && !INIT_EXEMPT.has(method))
+                throw invalidParams();
+            return handler(request, extra);
+        });
+    }
+}
+/**
+ * `mcp` 2.0.0's `ResourceTemplate.matches` for a template `<prefix>{name}`: the decoded
+ * name, or `null` when the reference's resource manager would answer `Unknown resource`
+ * (#180). Three steps, each measured against the running reference:
+ *
+ * - `UriTemplate.match`: a URI past 65 536 code points is no match; the literal prefix must
+ *   be there; a simple `{name}` stops at `/ ? # & ,`, so a tail holding any of them is no
+ *   match (`memory?x=1`, `memory#frag`, `a/b`). The empty tail matches (`bantamkit://skills/`
+ *   is -32603 `unknown skill asset: ` on both sides).
+ * - `urllib.parse.unquote`: `%XX` runs decoded as UTF-8 with replacement, so `%6Demory` IS
+ *   `memory` and `..%2F..%2Fpackage` is `../../package`.
+ * - `ResourceSecurity`'s default policy on the decoded value: a NUL, a `..` that climbs
+ *   above the start (`/` and `\` both separators), or an absolute path (`/x`, `\x`, `C:`)
+ *   raises `ResourceSecurityError`, which the manager turns into `Unknown resource`.
+ *
+ * Before this the port matched `[^/]*` on the RAW text and answered -32603 `unknown skill
+ * asset: ..` for all three of the issue's URIs; neither side ever read outside the pack.
+ */
+function templateName(uri, prefix) {
+    if ([...uri].length > 65_536 || !uri.startsWith(prefix))
+        return null;
+    const raw = uri.slice(prefix.length);
+    if (/[/?#&,]/.test(raw))
+        return null;
+    const name = raw.replace(/(?:%[0-9A-Fa-f]{2})+/g, (run) => new TextDecoder('utf-8').decode(Uint8Array.from(run.split('%').slice(1), (h) => parseInt(h, 16))));
+    if (name.includes('\0') || climbs(name) || isAbsolutePath(name))
+        return null;
+    return name;
+}
+/** `mcp.shared.path_security.contains_path_traversal`: does a `..` climb above the start? */
+function climbs(value) {
+    let depth = 0;
+    for (const part of value.replace(/\\/g, '/').split('/')) {
+        if (part === '..') {
+            depth -= 1;
+            if (depth < 0)
+                return true;
+        }
+        else if (part !== '' && part !== '.')
+            depth += 1;
+    }
+    return false;
+}
+/** `mcp.shared.path_security.is_absolute_path`: POSIX, UNC/root-relative, or a drive letter. */
+const isAbsolutePath = (value) => value !== '' && (value[0] === '/' || value[0] === '\\' || /^[A-Za-z]:/.test(value));
 /** `params.arguments` out of the raw request line, with every number literal intact. */
 function argumentsFrom(line) {
     try {
         const params = asDict(parseJson(line)).get('params');
         const args = params === undefined ? undefined : asDict(params).get('arguments');
-        return args ?? { t: 'dict', v: new Map() };
+        // `arguments: null` is no arguments (pydantic's `dict | None = None`, #147).
+        return args === undefined || args.t === 'null' ? { t: 'dict', v: new Map() } : args;
     }
     catch {
         // Unreachable over a line the SDK already parsed; a re-parse failure must not be the

package/dist/mcp/status.js

@@ -251,11 +251,14 @@ export function indexPressureCondition(memory) {
     // and this comparison is the whole reason they cannot.
     if (size === null || size * 100 < INDEX_PRESSURE_PERCENT * budget)
         return null;
+    // AT OR OVER THE BUDGET IS NOT "CLOSE" (job65/#186): the reply that carried the budget
+    // refusal used to close with "the next save is close to being refused". At `size >= budget`
+    // no save that adds a byte can land, so the sentence says so; the 90 % band keeps its words.
+    const consequence = size >= budget ? 'so it is full and every save is refused until it is compacted' : 'so the next save is close to being refused';
     return {
         key: 'index-budget-low',
-        sentence: `the memory index is ${size} bytes of a ${budget}-byte budget, so the next save ` +
-            'is close to being refused — archive or shorten facts with ' +
-            '`bantamkit-memory compact`.',
+        sentence: `the memory index is ${size} bytes of a ${budget}-byte budget, ${consequence} — ` +
+            'archive or shorten facts with `bantamkit-memory compact`.',
     };
 }
 /**
@@ -422,7 +425,11 @@ export function statusReport(memory, log, conditions, identity, tools, prompts,
                 : `${plural(facts, 'fact')} in the project store`) +
             ', index ' +
             (size === null ? 'unreadable' : String(size)) +
-            ` of ${budget} bytes`,
+            ` of ${budget} bytes` +
+            // job65/#142: the store this line counts, by path. WAS: no path at all, so a store the
+            // walk picked up ABOVE the project — an ancestor's, or `~/.bantamkit/memory` itself —
+            // answered as the writable project layer with nothing on the surface saying where.
+            `; bound to ${memory.store.root}`,
         `event log: ${log.enabled ? 'on' : 'off'}`,
         // THE UPDATE LINE IS NOT A CONDITION, and that is the ruling of 2026-09-19 rather than an
         // omission. A newer version existing is not a fault: the server is serving correctly, and