efaimo 0.1.0 → 0.1.2

package/dist/reporters/pretty.js

@@ -1,6 +1,8 @@
 import pc from "picocolors";
+import { formatWindowShare } from "../weigh/window.js";
 import { sortFindings } from "../core/grade.js";
 import { VERSION } from "../version.js";
+import { safeText } from "../util/safeText.js";
 const DOCS_RULES = "https://github.com/efaimo-ai/efaimo/blob/main/docs/RULES.md";
 let colorOn = true;
 export function setColor(on) {
@@ -31,18 +33,18 @@ function n(x) {
     return x.toLocaleString("en-US");
 }
 function renderFinding(lines, f) {
-    lines.push(`  ${sevGlyph(f)} ${paint(pc.bold, f.ruleId)}  ${f.message}`);
+    lines.push(`  ${sevGlyph(f)} ${paint(pc.bold, f.ruleId)}  ${safeText(f.message)}`);
     if (f.detail) {
-        for (const d of f.detail.split("\n"))
+        for (const d of safeText(f.detail).split("\n"))
             lines.push(paint(pc.dim, `          ${d}`));
     }
     if (f.fixHint)
-        lines.push(paint(pc.dim, `          fix: ${f.fixHint}`));
+        lines.push(paint(pc.dim, `          fix: ${safeText(f.fixHint)}`));
 }
 export function renderCheckPretty(report) {
     const lines = [];
     lines.push(paint(pc.dim, `efaimo v${VERSION}`));
-    lines.push(`check ${report.surface}  ${paint(pc.bold, report.target)}`);
+    lines.push(`check ${report.surface}  ${paint(pc.bold, safeText(report.target))}`);
     const g = report.grade;
     const qualityLabel = report.readiness ? "quality: " : "";
     lines.push(`grade ${gradeColor(g.letter, `${g.letter} (${g.score})`)}   ${qualityLabel}` +
@@ -61,7 +63,7 @@ export function renderCheckPretty(report) {
         if (r.findings.length) {
             lines.push(paint(pc.bold, `2026-07-28 readiness`) +
                 `  ${r.findings.length} item${r.findings.length === 1 ? "" : "s"} to migrate ` +
-                paint(pc.dim, "(a migration diff, not graded: the spec finalizes 2026-07-28)"));
+                paint(pc.dim, "(a migration diff, not graded)"));
             for (const f of r.findings)
                 renderFinding(lines, f);
         }
@@ -71,7 +73,7 @@ export function renderCheckPretty(report) {
     }
     lines.push("");
     for (const note of report.notes)
-        lines.push(paint(pc.dim, `note: ${note}`));
+        lines.push(paint(pc.dim, `note: ${safeText(note)}`));
     lines.push(paint(pc.dim, `rules: ${DOCS_RULES}`));
     return lines.join("\n");
 }
@@ -98,19 +100,22 @@ export function renderTestReportPretty(r) {
         `test  ${paint(pc.bold, r.scenario)}`,
         `skill ${r.skill}   model ${r.model}`,
         "",
-        `  with skill     ${r.withSkill.passes}/${r.withSkill.trials} pass  (${r.withSkill.passRate.toFixed(0)}%)`,
-        `  without skill  ${r.withoutSkill.passes}/${r.withoutSkill.trials} pass  (${r.withoutSkill.passRate.toFixed(0)}%)`,
+        `  with skill     ${r.withSkill.passes}/${r.withSkill.scored} pass  (${r.withSkill.passRate.toFixed(0)}%)`,
+        `  without skill  ${r.withoutSkill.passes}/${r.withoutSkill.scored} pass  (${r.withoutSkill.passRate.toFixed(0)}%)`,
         `  delta          ${paint(pc.bold, `${sign}${r.deltaPoints} points`)}   ${paint(verdictColor, r.verdict)}`,
+        Number.isFinite(r.ci.lo)
+            ? `  significance   p = ${r.p < 0.0001 ? "<0.0001" : r.p.toFixed(4)}   95% CI ${r.ci.lo >= 0 ? "+" : ""}${r.ci.lo} to ${r.ci.hi >= 0 ? "+" : ""}${r.ci.hi} points`
+            : `  significance   not computable: an arm produced no scoreable trial`,
         "",
     ];
     for (const n of r.notes)
-        lines.push(paint(pc.dim, `note: ${n}`));
+        lines.push(paint(pc.dim, `note: ${safeText(n)}`));
     return lines.join("\n");
 }
 export function renderSkillSetPretty(res) {
     const lines = [];
     lines.push(paint(pc.dim, `efaimo v${VERSION}`));
-    lines.push(`check skills  ${paint(pc.bold, res.label)}   ${res.perSkill.length} skill${res.perSkill.length === 1 ? "" : "s"}`);
+    lines.push(`check skills  ${paint(pc.bold, safeText(res.label))}   ${res.perSkill.length} skill${res.perSkill.length === 1 ? "" : "s"}`);
     const dist = { A: 0, B: 0, C: 0, D: 0, F: 0 };
     for (const s of res.perSkill)
         dist[s.report.grade.letter]++;
@@ -125,43 +130,42 @@ export function renderSkillSetPretty(res) {
     for (const s of [...res.perSkill].sort((a, b) => a.report.grade.score - b.report.grade.score)) {
         const g = s.report.grade;
         const c = s.report.counts;
-        lines.push(`  ${gradeColor(g.letter, `${g.letter} (${String(g.score).padStart(3)})`)}  ${s.name.padEnd(nameW)}  ` +
+        lines.push(`  ${gradeColor(g.letter, `${g.letter} (${String(g.score).padStart(3)})`)}  ${safeText(s.name).padEnd(nameW)}  ` +
             `${paint(pc.red, String(c.error))}e ${paint(pc.yellow, String(c.warn))}w ${paint(pc.cyan, String(c.info))}i`);
     }
     if (res.setFindings.length) {
         lines.push("");
         lines.push(paint(pc.bold, "across the set"));
         for (const f of sortFindings(res.setFindings)) {
-            lines.push(`  ${sevGlyph(f)} ${paint(pc.bold, f.ruleId)}  ${f.message}`);
+            lines.push(`  ${sevGlyph(f)} ${paint(pc.bold, f.ruleId)}  ${safeText(f.message)}`);
         }
     }
     const flagged = res.perSkill.filter((s) => s.report.findings.length);
     if (flagged.length) {
         lines.push("");
         for (const s of flagged) {
-            lines.push(paint(pc.bold, `${s.name}  ${gradeColor(s.report.grade.letter, s.report.grade.letter)}`));
+            lines.push(paint(pc.bold, `${safeText(s.name)}  ${gradeColor(s.report.grade.letter, s.report.grade.letter)}`));
             for (const f of s.report.findings) {
-                lines.push(`  ${sevGlyph(f)} ${paint(pc.bold, f.ruleId)}  ${f.message}`);
+                lines.push(`  ${sevGlyph(f)} ${paint(pc.bold, f.ruleId)}  ${safeText(f.message)}`);
                 if (f.fixHint)
-                    lines.push(paint(pc.dim, `          fix: ${f.fixHint}`));
+                    lines.push(paint(pc.dim, `          fix: ${safeText(f.fixHint)}`));
             }
         }
     }
     lines.push("");
-    lines.push(paint(pc.dim, `${res.perSkill.length} skills under ${res.root}`));
+    lines.push(paint(pc.dim, `${res.perSkill.length} skills under ${safeText(res.root)}`));
     lines.push(paint(pc.dim, `rules: ${DOCS_RULES}`));
     return lines.join("\n");
 }
 export function renderServerWeighPretty(w) {
     const lines = [];
     lines.push(paint(pc.dim, `efaimo v${VERSION}`));
-    lines.push(`weigh mcp  ${paint(pc.bold, w.label)}`);
+    lines.push(`weigh mcp  ${paint(pc.bold, safeText(w.label))}`);
     lines.push(`tools ${w.toolCount}   resources ${w.resourceCount}   prompts ${w.promptCount}`);
     lines.push("");
     lines.push("context cost of tool definitions (o200k tokens, estimated)");
-    const pct = ((w.totals.claudeStyle / 200000) * 100).toFixed(1);
     lines.push(`  raw JSON        ${n(w.totals.rawJson).padStart(8)}`);
-    lines.push(`  Claude-style    ${n(w.totals.claudeStyle).padStart(8)}   (~${pct}% of a 200k window)`);
+    lines.push(`  Claude-style    ${n(w.totals.claudeStyle).padStart(8)}   (${formatWindowShare(w.totals.claudeStyle)})`);
     lines.push(`  OpenAI tools    ${n(w.totals.openaiTools).padStart(8)}`);
     if (w.instructionsTokens > 0)
         lines.push(`  server instructions ${n(w.instructionsTokens).padStart(4)}`);
@@ -171,8 +175,17 @@ export function renderServerWeighPretty(w) {
     if (w.perTool.length) {
         lines.push("");
         lines.push("heaviest tools (Claude-style)");
-        for (const [i, t] of w.perTool.slice(0, 8).entries()) {
-            lines.push(`  ${String(i + 1).padStart(2)}. ${t.name.padEnd(28)} ${n(t.tokens.claudeStyle).padStart(7)}   desc ${n(t.descriptionTokens)} | schema ${n(t.schemaTokens)}`);
+        // Derived from the rows actually printed, not a fixed 28. Against the
+        // reference server - the target in --help, on /commands and in every
+        // launch draft - "trigger-long-running-operation" is 30 characters, ate
+        // the pad, and shifted the token column two places right for that one row.
+        // A tool whose pitch is careful measurement was printing a crooked number
+        // column in its own flagship demo. Capped so one pathological name cannot
+        // push the numbers off a terminal.
+        const shown = w.perTool.slice(0, 8);
+        const toolW = Math.min(38, Math.max(20, ...shown.map((t) => safeText(t.name).length)));
+        for (const [i, t] of shown.entries()) {
+            lines.push(`  ${String(i + 1).padStart(2)}. ${safeText(t.name).padEnd(toolW)} ${n(t.tokens.claudeStyle).padStart(7)}   desc ${n(t.descriptionTokens)} | schema ${n(t.schemaTokens)}`);
         }
         if (w.perTool.length > 8)
             lines.push(paint(pc.dim, `      (+${w.perTool.length - 8} more)`));
@@ -182,23 +195,23 @@ export function renderServerWeighPretty(w) {
     }
     lines.push("");
     for (const note of w.notes)
-        lines.push(paint(pc.dim, `note: ${note}`));
+        lines.push(paint(pc.dim, `note: ${safeText(note)}`));
     return lines.join("\n");
 }
 export function renderSkillWeighPretty(w) {
     const lines = [];
     lines.push(paint(pc.dim, `efaimo v${VERSION}`));
-    lines.push(`weigh skills  ${paint(pc.bold, w.label)}   ${w.perSkill.length} skill${w.perSkill.length === 1 ? "" : "s"}`);
+    lines.push(`weigh skills  ${paint(pc.bold, safeText(w.label))}   ${w.perSkill.length} skill${w.perSkill.length === 1 ? "" : "s"}`);
     lines.push("");
     lines.push(`  ${"skill".padEnd(28)} ${"metadata".padStart(8)} ${"body".padStart(9)} ${"lines".padStart(6)}  refs`);
     for (const s of w.perSkill) {
-        lines.push(`  ${s.name.padEnd(28)} ${n(s.metadataTokens).padStart(8)} ${n(s.bodyTokens).padStart(9)} ${String(s.bodyLines).padStart(6)}  ${s.refFileCount ? `${s.refFileCount} files ${n(s.refFileTokens)}` : "-"}`);
+        lines.push(`  ${safeText(s.name).padEnd(28)} ${n(s.metadataTokens).padStart(8)} ${n(s.bodyTokens).padStart(9)} ${String(s.bodyLines).padStart(6)}  ${s.refFileCount ? `${s.refFileCount} files ${n(s.refFileTokens)}` : "-"}`);
     }
     lines.push("");
     lines.push(`totals: metadata ${paint(pc.bold, n(w.totals.metadata))} (always loaded) | body ${n(w.totals.body)} (on trigger) | referenced ${n(w.totals.refFiles)} (on demand)`);
     lines.push("");
     for (const note of w.notes)
-        lines.push(paint(pc.dim, `note: ${note}`));
+        lines.push(paint(pc.dim, `note: ${safeText(note)}`));
     return lines.join("\n");
 }
 export function renderDiffPretty(d, opts) {

package/dist/rules/injection.d.ts

@@ -1,8 +1,7 @@
-import type { Finding, Severity } from "../core/types.js";
+import type { Finding } from "../core/types.js";
 interface InjectionPattern {
     key: string;
     re: RegExp;
-    severity: Severity;
     label: string;
 }
 /**

package/dist/rules/injection.js

@@ -9,19 +9,16 @@ export const INJECTION_PATTERNS = [
     {
         key: "override-instructions",
         re: /ignore\s+(?:all\s+|any\s+)?(?:previous|prior|earlier|above)\s+(?:instructions|messages|rules|prompts)/i,
-        severity: "error",
         label: "attempts to override prior instructions",
     },
     {
         key: "hide-from-user",
         re: /do\s+not\s+(?:tell|reveal|mention|inform|show|disclose)\b[\s\S]{0,40}\b(?:user|human|operator)/i,
-        severity: "error",
         label: "instructs the agent to hide behavior from the user",
     },
     {
         key: "act-without-consent",
         re: /without\s+(?:telling|asking|notifying|informing)\s+(?:the\s+)?(?:user|human)/i,
-        severity: "error",
         label: "instructs the agent to act without user consent",
     },
     {
@@ -29,51 +26,43 @@ export const INJECTION_PATTERNS = [
         // "post" and "token" dropped: they match API documentation ("Token counting
         // POST /v1/...") far more than exfiltration.
         re: /\b(?:api[_-]?key|secret|password|credential)s?\b[\s\S]{0,40}\b(?:send|forward|exfiltrat|upload|leak|transmit|include\s+it)\b/i,
-        severity: "error",
         label: "references sending credentials or secrets somewhere",
     },
     {
         key: "sensitive-file-read",
         re: /\b(?:read|open|cat|print|upload)\b[\s\S]{0,40}(?:\.env\b|\.ssh\b|id_rsa|credentials|\.aws\b|\.npmrc\b)/i,
-        severity: "error",
         label: "references reading sensitive local files",
     },
     {
         key: "disable-safety",
         re: /\b(?:disable|bypass|ignore|remove)\s+(?:safety|guardrails?|filters?|restrictions?|policy|policies)\b/i,
-        severity: "error",
         label: "asks to bypass safety or policy",
     },
     {
         key: "cross-tool-steering",
         re: /before\s+(?:using|calling|running)\b[^.?!]{0,40}?\btools?\b[\s,]{1,4}(?:always\s+|first\s+|please\s+)?(?:call|run|use|fetch|invoke)\b/i,
-        severity: "warn",
         label: "steers the agent to call another tool first (cross-tool steering)",
     },
     {
         key: "templated-exfil-url",
         // Bounded runs (no adjacent unbounded same-class quantifiers) to avoid ReDoS.
         re: /https?:\/\/[^\s"'<>]{1,150}[?&][^\s"'<>]{0,150}(?:\$\{[^}]{1,60}\}|\{\{[^}]{1,60}\}\}|\{[^}]{1,60}\})/,
-        severity: "warn",
         label: "URL with a templated query parameter (possible exfiltration channel)",
     },
     {
         key: "zero-width-chars",
         // eslint-disable-next-line no-control-regex
         re: /[​‌‍⁠]/,
-        severity: "warn",
         label: "zero-width or invisible characters present",
     },
     {
         key: "hidden-html-comment",
         re: /<!--[^>]{0,240}\b(?:must|always|never|call|run|fetch|send|ignore)\b[^>]{0,240}-->/i,
-        severity: "warn",
         label: "HTML comment containing imperative instructions (hidden from rendered view)",
     },
     {
         key: "persona-override",
         re: /\byou\s+are\s+now\b|\bpretend\s+to\s+be\b|\bnew\s+system\s+prompt\b/i,
-        severity: "warn",
         label: "persona or system-prompt override language",
     },
 ];
@@ -93,7 +82,14 @@ export function scanTextForInjection(text, opts) {
                 // Deliberately info: these are shallow heuristics an attacker evades
                 // trivially. Surfacing them must never move a grade or fail CI, or a
                 // clean report would read as a security pass (it is not one).
+                //
+                // `graded: false` is what makes the first half of that true. It used
+                // to be a comment only, while gradeFindings charged every info finding
+                // a point, so ten heuristic hits quietly cost a whole letter -- the
+                // exact "clean report reads as a security verdict" failure this
+                // comment was written to prevent, running in reverse.
                 severity: "info",
+                graded: false,
                 title: "possible injection pattern (heuristic)",
                 message: `${opts.where}: ${p.label}`,
                 target: opts.where,

package/dist/rules/mcp/index.d.ts

@@ -1,4 +1,18 @@
 import type { McpRule } from "../../core/types.js";
+/**
+ * Does this tool name read as destructive?
+ *
+ * This was a single `\b(delete|remove|...)\b` regex, and `_` is a word
+ * character, so `\bdelete\b` has no boundary inside `delete_file` - nor inside
+ * `deleteFile`. Every conventional MCP tool name escaped it: delete_file,
+ * deleteFile, drop_table, removeUser, kill_process, wipe_db all returned
+ * false, while only a bare `delete` or `delete-file` matched. E123 is
+ * documented in docs/RULES.md as catching "a destructive-looking tool lacking
+ * destructiveHint" and it could not fire on essentially any real server.
+ *
+ * Split on separators AND on camelCase boundaries, then test each segment.
+ */
+export declare function readsDestructive(name: string): boolean;
 export declare const MCP_RULES: McpRule[];
 /** E101-E118 are 2026-07-28 readiness rules: reported as a migration diff, not graded. */
 export declare function isReadinessRuleId(id: string): boolean;

package/dist/rules/mcp/index.js

@@ -1,7 +1,8 @@
 import { scanTextForInjection } from "../injection.js";
 import { looksLikeInitGate } from "../../clients/rawprobe.js";
 import { formatTokens, truncate } from "../../util/misc.js";
-const RC = "2026-07-28";
+import { formatWindowShare } from "../../weigh/window.js";
+const SPEC = "2026-07-28";
 function isOutcome(x) {
     return !!x && typeof x === "object" && "ok" in x;
 }
@@ -25,7 +26,7 @@ const REPO_MATCH_RULES = [
         category: "sampling",
         severity: "warn",
         title: "uses deprecated Sampling",
-        message: (c) => `source references sampling/createMessage (${matchStr(c)}); Sampling is deprecated in ${RC} (SEP-2577)`,
+        message: (c) => `source references sampling/createMessage (${matchStr(c)}); Sampling is deprecated in ${SPEC} (SEP-2577)`,
         fixHint: "integrate directly with an LLM provider API instead of MCP Sampling",
     },
     {
@@ -33,7 +34,7 @@ const REPO_MATCH_RULES = [
         category: "roots",
         severity: "warn",
         title: "uses deprecated Roots",
-        message: (c) => `source references roots/list (${matchStr(c)}); Roots is deprecated in ${RC} (SEP-2577)`,
+        message: (c) => `source references roots/list (${matchStr(c)}); Roots is deprecated in ${SPEC} (SEP-2577)`,
         fixHint: "pass directories or files via tool parameters, resource URIs, or server configuration",
     },
     {
@@ -41,7 +42,7 @@ const REPO_MATCH_RULES = [
         category: "sse-resume",
         severity: "info",
         title: "relies on removed SSE resumability",
-        message: (c) => `source references Last-Event-ID/resumability (${matchStr(c)}); stream resumability is removed in ${RC}`,
+        message: (c) => `source references Last-Event-ID/resumability (${matchStr(c)}); stream resumability is removed in ${SPEC}`,
         fixHint: "persist cross-call state behind server-minted handles passed as tool arguments",
     },
     {
@@ -49,7 +50,7 @@ const REPO_MATCH_RULES = [
         category: "elicitation",
         severity: "warn",
         title: "uses legacy elicitation",
-        message: (c) => `source references elicitation/create (${matchStr(c)}); replaced in ${RC} by MRTR results (resultType "input_required" with inputRequests)`,
+        message: (c) => `source references elicitation/create (${matchStr(c)}); replaced in ${SPEC} by MRTR results (resultType "input_required" with inputRequests)`,
         fixHint: "return input_required results and correlate retries via requestState (SEP-2322)",
     },
     {
@@ -57,21 +58,21 @@ const REPO_MATCH_RULES = [
         category: "session-state",
         severity: "info",
         title: "possible in-process session state",
-        message: (c) => `source shows session-state patterns (${matchStr(c)}); ${RC} statelessness expects server-minted handles passed via tool arguments`,
+        message: (c) => `source shows session-state patterns (${matchStr(c)}); ${SPEC} statelessness expects server-minted handles passed via tool arguments`,
     },
     {
         id: "E114",
         category: "ping",
         severity: "info",
         title: "uses removed ping",
-        message: (c) => `source references the ping utility (${matchStr(c)}); ping is removed in ${RC}`,
+        message: (c) => `source references the ping utility (${matchStr(c)}); ping is removed in ${SPEC}`,
     },
     {
         id: "E115",
         category: "subscribe",
         severity: "info",
         title: "uses replaced resource subscriptions",
-        message: (c) => `source references resources/subscribe (${matchStr(c)}); replaced by subscriptions/listen in ${RC}`,
+        message: (c) => `source references resources/subscribe (${matchStr(c)}); replaced by subscriptions/listen in ${SPEC}`,
     },
 ];
 const repoMatchRules = REPO_MATCH_RULES.map((spec) => ({
@@ -105,10 +106,14 @@ const e101 = {
                 ruleId: "E101",
                 severity: "warn",
                 title: "legacy SDK generation",
-                message: `depends on ${s.package}${s.range ? `@${s.range}` : ""} (pre-${RC} line)`,
+                message: `depends on ${s.package}${s.range ? `@${s.range}` : ""} (pre-${SPEC} line)`,
                 detail: s.language === "ts"
-                    ? `the ${RC} revision ships as the new @modelcontextprotocol/server package (2.x beta since 2026-07)`
-                    : `the ${RC} revision ships as mcp 2.x (pre-releases on PyPI since 2026-06)`,
+                    ? // No maturity label here on purpose. This said "2.x beta since
+                        // 2026-07" and stayed saying it after both packages cut 2.0.0 on
+                        // 2026-07-27, which told people to migrate onto a beta that was
+                        // not one. The package name and major line are the durable facts.
+                        `the ${SPEC} revision ships as the new @modelcontextprotocol/server package (2.x)`
+                    : `the ${SPEC} revision ships as mcp 2.x on PyPI`,
                 fixHint: "upgrade to the 2.x SDK line to get stateless transport and MRTR support",
             });
         }
@@ -126,7 +131,7 @@ const e104 = {
                     ruleId: "E104",
                     severity: "warn",
                     title: "uses deprecated MCP Logging",
-                    message: `server declares the logging capability; MCP Logging is deprecated in ${RC} (SEP-2577) and logging/setLevel is removed`,
+                    message: `server declares the logging capability; MCP Logging is deprecated in ${SPEC} (SEP-2577) and logging/setLevel is removed`,
                     fixHint: "log to stderr (stdio) or use OpenTelemetry; per-request level arrives via _meta io.modelcontextprotocol/logLevel",
                 },
             ];
@@ -135,7 +140,7 @@ const e104 = {
             ruleId: "E104",
             severity: "warn",
             title: "uses deprecated MCP Logging",
-            message: `source references MCP logging APIs (${matchStr(count)}); deprecated in ${RC} (SEP-2577)`,
+            message: `source references MCP logging APIs (${matchStr(count)}); deprecated in ${SPEC} (SEP-2577)`,
             detail,
             fixHint: "log to stderr (stdio) or use OpenTelemetry",
         }));
@@ -156,11 +161,28 @@ const e105 = {
                     severity: "warn",
                     title: "requires the removed initialize handshake",
                     message: `the server rejected a bare stateless tools/list as not initialized (${bare.errorMessage ?? `code ${bare.errorCode}`})`,
-                    detail: `${RC} removes initialize and sessions; RC servers answer bare requests carrying version info in _meta. Whether an answering server is RC-conformant is judged separately (E107 resultType, E118 cache fields, E106 server/discover).`,
+                    detail: `${SPEC} removes initialize and sessions; stateless servers answer bare requests carrying version info in _meta. Whether an answering server is fully ${SPEC}-conformant is judged separately (E107 resultType, E118 cache fields, E106 server/discover).`,
                     fixHint: "upgrade to a 2.x SDK, or accept requests without a prior initialize",
                 },
             ];
         }
+        if (bare.kind === "exit") {
+            // A crash on the bare request is not a timeout and not a clean answer: the
+            // server did not serve a stateless tools/list, so a 2026-07-28 client
+            // cannot talk to it. Left unhandled, this outcome produced NO finding, so
+            // a crashing server looked one item MORE migrated than one that answers
+            // with a not-initialized error.
+            return [
+                {
+                    ruleId: "E105",
+                    severity: "warn",
+                    title: "requires the removed initialize handshake",
+                    message: `the server process exited on a bare stateless tools/list (${bare.errorMessage ?? "no reply"}), so it does not answer requests without a prior initialize`,
+                    detail: `${SPEC} removes initialize and sessions; a server that exits on a bare request cannot serve a ${SPEC} client. A server that answers, even with an error, is judged by E106/E107/E118 instead.`,
+                    fixHint: "upgrade to a 2.x SDK, or answer requests without a prior initialize instead of exiting",
+                },
+            ];
+        }
         if (bare.kind === "timeout") {
             return [
                 {
@@ -189,7 +211,7 @@ const e106 = {
                 severity: "warn",
                 title: "server/discover not implemented",
                 message: `server/discover is not implemented (${d.errorMessage ?? "method not found"})`,
-                detail: `${RC} servers MUST implement server/discover (SEP-2575) to advertise versions, capabilities, and identity; clients also use it as the back-compat probe.`,
+                detail: `${SPEC} servers MUST implement server/discover (SEP-2575) to advertise versions, capabilities, and identity; clients also use it as the back-compat probe.`,
                 fixHint: "the 2.x SDKs implement server/discover for you",
             },
         ];
@@ -207,8 +229,8 @@ const e107 = {
                 ruleId: "E107",
                 severity: "info",
                 title: "results missing resultType",
-                message: `results do not carry the resultType field required in ${RC} ("complete" | "input_required")`,
-                detail: "the RC requires resultType on every result (SEP-2322); on list results the value must be \"complete\". RC clients treat missing resultType from earlier-protocol servers as \"complete\", so this is informational until you upgrade.",
+                message: `results do not carry the resultType field required in ${SPEC} ("complete" | "input_required")`,
+                detail: `${SPEC} requires resultType on every result (SEP-2322); on list results the value must be "complete". ${SPEC} clients treat missing resultType from earlier-protocol servers as "complete", so this is informational until you upgrade.`,
             },
         ];
     },
@@ -256,7 +278,7 @@ const e112 = {
                 ruleId: "E112",
                 severity: "warn",
                 title: "nondeterministic tools/list order",
-                message: "tool order differed across two fresh connections; deterministic ordering enables prompt-cache hits in RC hosts",
+                message: "tool order differed across two fresh connections; deterministic ordering enables prompt-cache hits in stateless hosts",
                 fixHint: "sort tools stably before returning them",
             },
         ];
@@ -322,14 +344,26 @@ const e118 = {
     title: "missing cache fields (ttlMs, cacheScope)",
     surface: "mcp",
     check(ctx) {
-        if (ctx.probes?.cacheFieldsPresent !== false)
+        // Two measured surfaces, not one. server/discover only became cacheable in
+        // the spec that published on 2026-07-28 (DiscoverResult extends
+        // CacheableResult); under the locked RC it extended plain Result, so a
+        // server that migrated against the RC can pass tools/list and still miss
+        // this. Undefined means the surface was never measured, which is not a
+        // finding: E106 already owns "server/discover did not answer".
+        const surfaces = [];
+        if (ctx.probes?.cacheFieldsPresent === false)
+            surfaces.push("tools/list");
+        if (ctx.probes?.discoverCacheFieldsPresent === false)
+            surfaces.push("server/discover");
+        if (!surfaces.length)
             return [];
+        const subject = surfaces.length > 1 ? `${surfaces.join(" and ")} results omit` : `${surfaces[0]} result omits`;
         return [
             {
                 ruleId: "E118",
                 severity: "warn",
                 title: "missing cache fields (ttlMs, cacheScope)",
-                message: `tools/list result omits ttlMs and/or cacheScope, which ${RC} requires on list and resource-read results (SEP-2549, CacheableResult)`,
+                message: `${subject} ttlMs and/or cacheScope, which ${SPEC} requires on list and resource-read results (SEP-2549, CacheableResult)`,
                 detail: "required on tools/list, prompts/list, resources/list, resources/read, resources/templates/list, and server/discover; cacheScope is \"public\" or \"private\"",
                 fixHint: "return ttlMs and cacheScope on these results so clients can cache and stop polling; the 2.x SDKs add them for you",
             },
@@ -421,7 +455,34 @@ const e122 = {
         return capList(findings, 5).shown;
     },
 };
-const DESTRUCTIVE_NAME_RE = /\b(delete|remove|drop|purge|destroy|overwrite|truncate|erase|wipe|revoke|reset|format|deploy|kill)\b/i;
+// "format" was in this list and is dropped. It only ever meant "format a
+// disk" in the author's head, but `format_date`, `format_output` and
+// `format_json` are among the most common tool names there are, and once the
+// matcher below started working the word turned into pure noise. Nobody could
+// have found that while the rule was firing on nothing.
+const DESTRUCTIVE_WORDS = new Set([
+    "delete", "remove", "drop", "purge", "destroy", "overwrite",
+    "truncate", "erase", "wipe", "revoke", "reset", "deploy", "kill",
+]);
+/**
+ * Does this tool name read as destructive?
+ *
+ * This was a single `\b(delete|remove|...)\b` regex, and `_` is a word
+ * character, so `\bdelete\b` has no boundary inside `delete_file` - nor inside
+ * `deleteFile`. Every conventional MCP tool name escaped it: delete_file,
+ * deleteFile, drop_table, removeUser, kill_process, wipe_db all returned
+ * false, while only a bare `delete` or `delete-file` matched. E123 is
+ * documented in docs/RULES.md as catching "a destructive-looking tool lacking
+ * destructiveHint" and it could not fire on essentially any real server.
+ *
+ * Split on separators AND on camelCase boundaries, then test each segment.
+ */
+export function readsDestructive(name) {
+    return name
+        .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+        .split(/[^A-Za-z0-9]+/)
+        .some((seg) => DESTRUCTIVE_WORDS.has(seg.toLowerCase()));
+}
 const e123 = {
     id: "E123",
     title: "missing tool annotations",
@@ -441,7 +502,7 @@ const e123 = {
                 fixHint: "annotations let hosts gate confirmations and parallelize safely",
             });
         }
-        const risky = tools.filter((t) => DESTRUCTIVE_NAME_RE.test(t.name) && !(t.annotations && "destructiveHint" in t.annotations));
+        const risky = tools.filter((t) => readsDestructive(t.name) && !(t.annotations && "destructiveHint" in t.annotations));
         for (const t of capList(risky, 5).shown) {
             findings.push({
                 ruleId: "E123",
@@ -482,7 +543,10 @@ const e124 = {
             }
         }
         if (totalParams > 5 && undocumented / totalParams > 0.3) {
-            findings.push({
+            // Prepend, not append: capList keeps the first 5, and on the worst schemas
+            // (5+ oversized enums) an appended summary was exactly the line that got
+            // dropped. The aggregate is the headline, so it leads.
+            findings.unshift({
                 ruleId: "E124",
                 severity: "warn",
                 title: "schema issues",
@@ -586,7 +650,7 @@ const e128 = {
                     ruleId: "E128",
                     severity: "warn",
                     title: "total context tax",
-                    message: `tool definitions alone are ~${formatTokens(total)} tokens (~${((total / 200000) * 100).toFixed(1)}% of a 200k window, estimated) before any work happens`,
+                    message: `tool definitions alone are ~${formatTokens(total)} tokens (${formatWindowShare(total)}, estimated) before any work happens`,
                     fixHint: "trim descriptions/schemas, split the server, or rely on deferred tool loading",
                 },
             ];
@@ -597,7 +661,7 @@ const e128 = {
                     ruleId: "E128",
                     severity: "warn",
                     title: "total context tax",
-                    message: `tool definitions are ~${formatTokens(total)} tokens (~${((total / 200000) * 100).toFixed(1)}% of a 200k window)`,
+                    message: `tool definitions are ~${formatTokens(total)} tokens (${formatWindowShare(total)})`,
                     fixHint: "run \`efaimo weigh\` for the per-tool breakdown",
                 },
             ];

package/dist/rules/skill/index.js

@@ -16,8 +16,10 @@ const s101 = {
         const push = (severity, message, fixHint) => findings.push({ ruleId: "S101", severity, title: "frontmatter does not match the spec", message, target: label, fixHint });
         if (skill.parseError) {
             push("error", `${skill.file}: ${skill.parseError}`, "SKILL.md must start with a --- YAML frontmatter block");
-            if (!skill.frontmatterRaw)
-                return findings;
+            // No early return on empty frontmatter. Returning here after one error let
+            // a skill with NO frontmatter grade higher than one with BROKEN frontmatter
+            // (the required-field checks below never ran), so total absence outscored a
+            // typo by two errors. Absent fields ARE missing fields; report them too.
         }
         const name = skill.frontmatter.name;
         if (typeof name !== "string" || !name.trim()) {
@@ -254,7 +256,7 @@ const s106 = {
                     fixHint: "agents will fail mid-task when they try to open it",
                 });
             }
-            else if (ref.raw.includes("..")) {
+            else if (ref.escapes) {
                 findings.push({
                     ruleId: "S106",
                     severity: "warn",

package/dist/skills/parse.js

@@ -1,7 +1,17 @@
 import fs from "node:fs";
 import path from "node:path";
 import YAML from "yaml";
-import { walkFiles } from "../util/misc.js";
+import { walkFiles, readTextSafe } from "../util/misc.js";
+/**
+ * Cap on a single SKILL.md. Referenced files were already capped at 512KB by
+ * readTextSafe while the body itself went through an uncapped readFileSync:
+ * the safer path had the limit and the main one did not. A 35MB SKILL.md
+ * tokenized to 7.2 million tokens at 367MB resident, and auditing skills you
+ * have NOT installed yet is the stated use case, so this is untrusted input
+ * by construction. 2MB is far above any real skill (the largest in the graded
+ * corpus is a few tens of KB) and far below a memory problem.
+ */
+const MAX_SKILL_BYTES = 2 * 1024 * 1024;
 const MD_LINK_RE = /\[[^\]]*\]\(([^)\s]+)(?:\s+"[^"]*")?\)/g;
 // Only backticked strings that look like a real intra-skill path: a directory
 // separator, no glob star. A bare filename in prose (`package.json`, `*.py`) is
@@ -21,7 +31,15 @@ export function parseSkillFile(file) {
     };
     let raw;
     try {
-        raw = fs.readFileSync(file, "utf8");
+        // Capped, like the referenced files this same module already caps at 512KB
+        // via readTextSafe. The body went through plain readFileSync with no limit
+        // while the SAFER path had a cap, and the stated use case is auditing
+        // skills BEFORE you install them, which is untrusted input by definition.
+        // A 35MB SKILL.md tokenized to 7.2M tokens and 367MB resident.
+        const capped = readTextSafe(file, MAX_SKILL_BYTES);
+        if (capped === undefined)
+            throw new Error("unreadable");
+        raw = capped;
     }
     catch (e) {
         return { ...base, parseError: `cannot read file: ${e.message}` };
@@ -79,7 +97,25 @@ export function parseSkillFile(file) {
                 continue;
             seen.add(cleaned);
             const resolved = path.resolve(dir, cleaned);
-            base.referencedPaths.push({ raw: cleaned, resolved, exists: fs.existsSync(resolved), source });
+            // Does this reference stay inside the skill? Absolute paths, URLs and
+            // globs are already rejected above; `../` was not, and weigh.ts then
+            // READ every referenced file to count its tokens. A skill fetched from
+            // anywhere could point at ../../../.ssh/id_rsa and get back an
+            // existence-and-size oracle, published if --md goes to a CI job summary.
+            // S106 already knew this was wrong and warned about it - but only after
+            // the read had happened, and `weigh` does not run S106 at all.
+            //
+            // Recorded here rather than filtered, so S106 can still report it and
+            // the reader still learns the reference exists. weigh skips the read.
+            const rel = path.relative(dir, resolved);
+            const escapes = rel.startsWith("..") || path.isAbsolute(rel);
+            base.referencedPaths.push({
+                raw: cleaned,
+                resolved,
+                exists: fs.existsSync(resolved),
+                escapes,
+                source,
+            });
         }
     }
     for (const f of walkFiles(dir, { maxDepth: 4 })) {