ftp-mcp 1.1.0 → 1.2.0

package/index.js

@@ -17,62 +17,67 @@ import * as diff from "diff";
 import { z } from "zod";
 import "dotenv/config";
 import { Writable, Readable } from "stream";
+import { SnapshotManager } from "./snapshot-manager.js";
+import { PolicyEngine } from "./policy-engine.js";
+import { SyncManifestManager } from "./sync-manifest.js";
+import crypto from "crypto";
+const DEFAULT_CONFIG_NAME = ".ftpconfig";
+const CONFIG_FILE = process.env.FTP_CONFIG_PATH || path.join(process.cwd(), DEFAULT_CONFIG_NAME);
 
 // --init: scaffold .ftpconfig.example into the user's current working directory
 if (process.argv.includes("--init")) {
   try {
     const { intro, outro, text, password: promptPassword, select, confirm, note } = await import("@clack/prompts");
-    
-    intro('🚀 Welcome to Flowdex MCP Initialization Wizard');
-    
+
+    intro('🚀 Welcome to FTP-MCP Initialization Wizard');
+
     const host = await text({
       message: 'Enter your FTP/SFTP Host (e.g. sftp://ftp.example.com)',
       placeholder: 'sftp://127.0.0.1',
       validate: (val) => val.length === 0 ? "Host is required!" : undefined,
     });
-    
+
     const user = await text({
       message: 'Enter your Username',
       validate: (val) => val.length === 0 ? "User is required!" : undefined,
     });
-    
+
     const pass = await promptPassword({
       message: 'Enter your Password (optional if using keys)',
     });
-    
+
     const port = await text({
       message: 'Enter port (optional, defaults to 21 for FTP, 22 for SFTP)',
       placeholder: '22'
     });
-    
+
     const isSFTP = host.startsWith('sftp://');
     let privateKey = '';
-    
+
     if (isSFTP) {
-      const usesKey = await confirm({ message: 'Are you using an SSH Private Key instead of a password?'});
+      const usesKey = await confirm({ message: 'Are you using an SSH Private Key instead of a password?' });
       if (usesKey) {
         privateKey = await text({
           message: 'Path to your private key (e.g. ~/.ssh/id_rsa)',
         });
       }
     }
-    
+
     const config = {
       default: {
         host: host,
         user: user,
       }
     };
-    
+
     if (pass) config.default.password = pass;
     if (port) config.default.port = parseInt(port, 10);
     if (privateKey) config.default.privateKey = privateKey;
-    
-    const destConfig  = path.join(process.cwd(), ".ftpconfig");
-    await fs.writeFile(destConfig, JSON.stringify(config, null, 2), 'utf8');
-    
-    note(`✅ Successfully generated config file at:\n${destConfig}`, 'Success');
-    
+
+    await fs.writeFile(CONFIG_FILE, JSON.stringify(config, null, 2), 'utf8');
+
+    note(`✅ Successfully generated config file at:\n${CONFIG_FILE}`, 'Success');
+
     outro("You're ready to deploy with MCP! Ask your AI to 'list remote files'");
   } catch (err) {
     console.error(`❌ Init failed: ${err.message}`);
@@ -112,7 +117,7 @@ const DEFAULT_IGNORE_PATTERNS = [
 
 async function loadIgnorePatterns(localPath) {
   const patterns = [...DEFAULT_IGNORE_PATTERNS];
-  
+
   try {
     const ftpignorePath = path.join(localPath, '.ftpignore');
     const ftpignoreContent = await fs.readFile(ftpignorePath, 'utf8');
@@ -124,7 +129,7 @@ async function loadIgnorePatterns(localPath) {
   } catch (e) {
     // .ftpignore doesn't exist, that's fine
   }
-  
+
   try {
     const gitignorePath = path.join(localPath, '.gitignore');
     const gitignoreContent = await fs.readFile(gitignorePath, 'utf8');
@@ -136,20 +141,32 @@ async function loadIgnorePatterns(localPath) {
   } catch (e) {
     // .gitignore doesn't exist, that's fine
   }
-  
+
   return patterns;
 }
 
+function isSecretFile(filePath) {
+  const name = path.basename(filePath).toLowerCase();
+  return name === '.env' ||
+    name.startsWith('.env.') ||
+    name.endsWith('.key') ||
+    name.endsWith('.pem') ||
+    name.endsWith('.p12') ||
+    name.includes('id_rsa') ||
+    name.includes('secret') ||
+    name.includes('token');
+}
+
 function shouldIgnore(filePath, ignorePatterns, basePath) {
   const relativePath = path.relative(basePath, filePath).replace(/\\/g, '/');
-  
+
   if (!ignorePatterns._ig) {
     Object.defineProperty(ignorePatterns, '_ig', {
       value: ignore().add(ignorePatterns),
       enumerable: false
     });
   }
-  
+
   return ignorePatterns._ig.ignores(relativePath);
 }
 
@@ -162,7 +179,14 @@ const ProfileConfigSchema = z.object({
   readOnly: z.boolean().optional(),
   privateKey: z.string().optional(),
   passphrase: z.string().optional(),
-  agent: z.string().optional()
+  agent: z.string().optional(),
+  policies: z.object({
+    allowedPaths: z.array(z.string()).optional(),
+    blockedGlobs: z.array(z.string()).optional(),
+    maxFileSize: z.number().optional(),
+    neverDelete: z.array(z.string()).optional(),
+    patchOnly: z.array(z.string()).optional()
+  }).optional()
 }).passthrough();
 
 async function loadFTPConfig(profileName = null, forceEnv = false) {
@@ -176,7 +200,7 @@ async function loadFTPConfig(profileName = null, forceEnv = false) {
   }
 
   try {
-    const configPath = path.join(process.cwd(), '.ftpconfig');
+    const configPath = CONFIG_FILE;
     const configData = await fs.readFile(configPath, 'utf8');
     const config = JSON.parse(configData);
 
@@ -244,7 +268,7 @@ async function connectSFTP(config) {
     username: config.user,
     password: config.password
   };
-  
+
   if (config.privateKey) connSettings.privateKey = readFileSync(path.resolve(config.privateKey), 'utf8');
   if (config.passphrase) connSettings.passphrase = config.passphrase;
   if (config.agent) connSettings.agent = config.agent;
@@ -254,8 +278,20 @@ async function connectSFTP(config) {
 }
 
 const connectionPool = new Map();
+const connectingPromises = new Map();
 const dirCache = new Map();
 const CACHE_TTL = 15000;
+const snapshotManager = new SnapshotManager();
+const syncManifestManager = new SyncManifestManager();
+
+const telemetry = {
+  activeConnections: 0,
+  cacheHits: 0,
+  cacheMisses: 0,
+  reconnects: 0,
+  bytesTransferred: 0,
+  syncDurations: []
+};
 
 function getPoolKey(config) {
   return `${config.host}:${getPort(config.host, config.port)}:${config.user}`;
@@ -263,7 +299,11 @@ function getPoolKey(config) {
 
 function getCached(poolKey, type, path) {
   const entry = dirCache.get(`${poolKey}:${type}:${path}`);
-  if (entry && Date.now() - entry.timestamp < CACHE_TTL) return entry.data;
+  if (entry && Date.now() - entry.timestamp < CACHE_TTL) {
+    telemetry.cacheHits++;
+    return entry.data;
+  }
+  telemetry.cacheMisses++;
   return null;
 }
 
@@ -281,30 +321,67 @@ function invalidatePoolCache(poolKey) {
 
 async function getClient(config) {
   const poolKey = getPoolKey(config);
+
+  // 1. If we are already connecting to this host, wait for it
+  if (connectingPromises.has(poolKey)) {
+    return connectingPromises.get(poolKey);
+  }
+
   let existing = connectionPool.get(poolKey);
-  
+
   if (existing && !existing.closed) {
     if (existing.idleTimeout) clearTimeout(existing.idleTimeout);
-    return existing.client;
+    return existing;
   }
 
-  const useSFTP = isSFTP(config.host);
-  const client = useSFTP ? await connectSFTP(config) : await connectFTP(config);
-  
-  client._isSFTP = useSFTP;
-  const onClose = () => handleClientClose(poolKey);
-  
-  if (useSFTP) {
-    client.on('end', onClose);
-    client.on('error', onClose);
-    client.on('close', onClose);
-  } else {
-    client.ftp.socket.on('close', onClose);
-    client.ftp.socket.on('error', onClose);
-  }
+  const connectPromise = (async () => {
+    try {
+      telemetry.reconnects++;
+      const useSFTP = isSFTP(config.host);
+      const client = useSFTP ? await connectSFTP(config) : await connectFTP(config);
+      telemetry.activeConnections++;
 
-  connectionPool.set(poolKey, { client, closed: false });
-  return client;
+      client._isSFTP = useSFTP;
+      
+      // Silence MaxListenersExceededWarning during high-activity syncs/sessions
+      if (typeof client.setMaxListeners === 'function') {
+        client.setMaxListeners(100);
+      } else if (client.ftp && typeof client.ftp.socket.setMaxListeners === 'function') {
+        client.ftp.socket.setMaxListeners(100);
+      }
+
+      const entry = {
+        client,
+        closed: false,
+        promiseQueue: Promise.resolve(),
+        async execute(task) {
+          // Use a simple promise chain to serialize operations on this client
+          const result = this.promiseQueue.then(() => task(this.client));
+          this.promiseQueue = result.catch(() => {}); // Continue queue even on error
+          return result;
+        }
+      };
+
+      const onClose = () => handleClientClose(poolKey);
+
+      if (useSFTP) {
+        client.on('end', onClose);
+        client.on('error', onClose);
+        client.on('close', onClose);
+      } else {
+        client.ftp.socket.on('close', onClose);
+        client.ftp.socket.on('error', onClose);
+      }
+
+      connectionPool.set(poolKey, entry);
+      return entry;
+    } finally {
+      connectingPromises.delete(poolKey);
+    }
+  })();
+
+  connectingPromises.set(poolKey, connectPromise);
+  return connectPromise;
 }
 
 function handleClientClose(poolKey) {
@@ -312,7 +389,30 @@ function handleClientClose(poolKey) {
   if (existing) {
     existing.closed = true;
     connectionPool.delete(poolKey);
+    telemetry.activeConnections = Math.max(0, telemetry.activeConnections - 1);
+  }
+}
+
+function redactSecrets(obj) {
+  if (!obj) return obj;
+  if (typeof obj === 'string') {
+    return obj.replace(/(password|secret|key|token|passphrase)["':\s=]+[^\s,;}"']+/gi, '$1: [REDACTED]');
+  }
+  if (typeof obj !== 'object') return obj;
+
+  const redacted = Array.isArray(obj) ? [] : {};
+  for (const [key, value] of Object.entries(obj)) {
+    if (key.toLowerCase().match(/(password|secret|key|token|passphrase)/)) {
+      redacted[key] = '[REDACTED]';
+    } else if (typeof value === 'object') {
+      redacted[key] = redactSecrets(value);
+    } else if (typeof value === 'string') {
+      redacted[key] = redactSecrets(value);
+    } else {
+      redacted[key] = value;
+    }
   }
+  return redacted;
 }
 
 async function auditLog(toolName, args, status, user, errorMsg = null) {
@@ -322,8 +422,8 @@ async function auditLog(toolName, args, status, user, errorMsg = null) {
       tool: toolName,
       user: user || 'system',
       status,
-      arguments: args,
-      error: errorMsg
+      arguments: redactSecrets(args),
+      error: redactSecrets(errorMsg)
     };
     await fs.appendFile(path.join(process.cwd(), '.ftp-mcp-audit.log'), JSON.stringify(logEntry) + '\n', 'utf8');
   } catch (e) {
@@ -341,7 +441,7 @@ function releaseClient(config) {
       try {
         if (existing.client._isSFTP) await existing.client.end();
         else existing.client.close();
-      } catch (e) {}
+      } catch (e) { }
       connectionPool.delete(poolKey);
     }, 60000).unref();
   }
@@ -349,15 +449,15 @@ function releaseClient(config) {
 
 async function getTreeRecursive(client, useSFTP, remotePath, depth = 0, maxDepth = 10) {
   if (depth > maxDepth) return [];
-  
+
   const files = useSFTP ? await client.list(remotePath) : await client.list(remotePath);
   const results = [];
-  
+
   for (const file of files) {
     const isDir = useSFTP ? file.type === 'd' : file.isDirectory;
     const fileName = file.name;
     const fullPath = remotePath === '.' ? fileName : `${remotePath}/${fileName}`;
-    
+
     results.push({
       path: fullPath,
       name: fileName,
@@ -365,40 +465,52 @@ async function getTreeRecursive(client, useSFTP, remotePath, depth = 0, maxDepth
       size: file.size,
       modified: file.modifyTime || file.date
     });
-    
+
     if (isDir && fileName !== '.' && fileName !== '..') {
       const children = await getTreeRecursive(client, useSFTP, fullPath, depth + 1, maxDepth);
       results.push(...children);
     }
   }
-  
+
   return results;
 }
 
-async function syncFiles(client, useSFTP, localPath, remotePath, direction, ignorePatterns = null, basePath = null, extraExclude = [], dryRun = false) {
-  const stats = { uploaded: 0, downloaded: 0, skipped: 0, errors: [], ignored: 0 };
-  
+async function syncFiles(client, useSFTP, localPath, remotePath, direction, ignorePatterns = null, basePath = null, extraExclude = [], dryRun = false, useManifest = true) {
+  const stats = { uploaded: 0, downloaded: 0, skipped: 0, errors: [], ignored: 0, filesToChange: [] };
+
   if (ignorePatterns === null) {
     ignorePatterns = await loadIgnorePatterns(localPath);
     basePath = localPath;
+    if (useManifest) await syncManifestManager.load();
   }
-  
+
   if (extraExclude.length > 0) {
     ignorePatterns = [...ignorePatterns, ...extraExclude];
   }
-  
+
   if (direction === 'upload' || direction === 'both') {
     const localFiles = await fs.readdir(localPath, { withFileTypes: true });
-    
+
     for (const file of localFiles) {
       const localFilePath = path.join(localPath, file.name);
       const remoteFilePath = `${remotePath}/${file.name}`;
-      
+
+      // In some environments (like Windows with ftp-srv), rapid transfers cause ECONNRESET.
+      // A slightly longer delay helps stabilize the socket state during sequence.
+      await new Promise(r => setTimeout(r, 250));
+
+      // Security check first so we can warn even if it's in .gitignore/.ftpignore
+      if (isSecretFile(localFilePath)) {
+        if (dryRun) stats.filesToChange.push(localFilePath);
+        stats.errors.push(`Security Warning: Blocked upload of likely secret file: ${localFilePath}`);
+        continue;
+      }
+
       if (shouldIgnore(localFilePath, ignorePatterns, basePath)) {
         stats.ignored++;
         continue;
       }
-      
+
       try {
         if (file.isDirectory()) {
           if (!dryRun) {
@@ -415,34 +527,73 @@ async function syncFiles(client, useSFTP, localPath, remotePath, direction, igno
           stats.ignored += subStats.ignored;
           stats.errors.push(...subStats.errors);
         } else {
+          // isSecretFile already checked above in the loop
           const localStat = await fs.stat(localFilePath);
           let shouldUpload = true;
-          
-          try {
-            const remoteStat = useSFTP 
-              ? await client.stat(remoteFilePath)
-              : (await client.list(remotePath)).find(f => f.name === file.name);
-            
-            if (remoteStat) {
-              const remoteTime = remoteStat.modifyTime || remoteStat.modifiedAt || new Date(remoteStat.rawModifiedAt);
-              if (localStat.mtime <= remoteTime) {
-                shouldUpload = false;
-                stats.skipped++;
+
+          // 1. Fast check using local manifest
+          if (useManifest) {
+            const changedLocally = await syncManifestManager.isFileChanged(localFilePath, remoteFilePath, localStat);
+            if (!changedLocally) {
+              shouldUpload = false;
+              stats.skipped++;
+            }
+          }
+
+          // 2. Slow check using remote stat
+          if (shouldUpload) {
+            try {
+              const remoteStat = useSFTP
+                ? await client.stat(remoteFilePath)
+                : (await client.list(remotePath)).find(f => f.name === file.name);
+
+              if (remoteStat) {
+                const remoteTime = remoteStat.modifyTime || remoteStat.modifiedAt || new Date(remoteStat.rawModifiedAt);
+                if (localStat.mtime <= remoteTime) {
+                  shouldUpload = false;
+                  stats.skipped++;
+                  if (useManifest) await syncManifestManager.updateEntry(localFilePath, remoteFilePath, localStat);
+                }
               }
+            } catch (e) {
+              // Remote file missing
             }
-          } catch (e) {
-            // File doesn't exist remotely, upload it
           }
-          
+
           if (shouldUpload) {
             if (!dryRun) {
-              if (useSFTP) {
-                await client.put(localFilePath, remoteFilePath);
+              let attempts = 0;
+              const maxAttempts = 3;
+              let success = false;
+              let lastError;
+
+              while (attempts < maxAttempts && !success) {
+                try {
+                  if (useSFTP) {
+                    await client.put(localFilePath, remoteFilePath);
+                  } else {
+                    await client.uploadFrom(localFilePath, remoteFilePath);
+                  }
+                  success = true;
+                } catch (err) {
+                  attempts++;
+                  lastError = err;
+                  if (attempts < maxAttempts) {
+                    await new Promise(r => setTimeout(r, 100 * attempts)); // Backoff
+                  }
+                }
+              }
+
+              if (success) {
+                if (useManifest) await syncManifestManager.updateEntry(localFilePath, remoteFilePath, localStat);
+                stats.uploaded++;
               } else {
-                await client.uploadFrom(localFilePath, remoteFilePath);
+                stats.errors.push(`${localFilePath}: Failed after ${maxAttempts} attempts: ${lastError.message}`);
               }
+            } else {
+              stats.filesToChange.push(localFilePath);
+              stats.uploaded++;
             }
-            stats.uploaded++;
           }
         }
       } catch (error) {
@@ -450,14 +601,63 @@ async function syncFiles(client, useSFTP, localPath, remotePath, direction, igno
       }
     }
   }
-  
+
+  if (ignorePatterns === null && useManifest && !dryRun) {
+    await syncManifestManager.save();
+  }
+
   return stats;
 }
 
+function generateSemanticPreview(filesToChange) {
+  const summary = {
+    configFiles: [],
+    dependencyManifests: [],
+    riskyFiles: [],
+    restartRequired: [],
+    otherFiles: []
+  };
+
+  for (const file of filesToChange) {
+    const name = path.basename(file).toLowerCase();
+
+    if (name === 'package.json' || name === 'composer.json' || name === 'requirements.txt' || name === 'pom.xml' || name === 'go.mod') {
+      summary.dependencyManifests.push(file);
+      summary.restartRequired.push(file);
+    } else if (name.endsWith('.config.js') || name.endsWith('.config.ts') || name === 'tsconfig.json' || name === 'vite.config.js' || name === 'next.config.js') {
+      summary.configFiles.push(file);
+      summary.restartRequired.push(file);
+    } else if (isSecretFile(file) || name.includes('auth') || name.includes('deploy')) {
+      summary.riskyFiles.push(file);
+    } else {
+      summary.otherFiles.push(file);
+    }
+  }
+
+  let output = "Semantic Change Preview:\n========================\n";
+
+  if (summary.dependencyManifests.length > 0) {
+    output += `\n📦 Dependency Manifests Changed (High Impact):\n  - ${summary.dependencyManifests.join('\n  - ')}\n`;
+  }
+  if (summary.configFiles.length > 0) {
+    output += `\n⚙️ Config Files Changed:\n  - ${summary.configFiles.join('\n  - ')}\n`;
+  }
+  if (summary.riskyFiles.length > 0) {
+    output += `\n⚠️ Risky Files Touched (Secrets/Auth/Deploy):\n  - ${summary.riskyFiles.join('\n  - ')}\n`;
+  }
+  if (summary.restartRequired.length > 0) {
+    output += `\n🔄 Likely Restart Required due to changes in:\n  - ${summary.restartRequired.join('\n  - ')}\n`;
+  }
+
+  output += `\n📄 Other Files: ${summary.otherFiles.length} files\n`;
+
+  return output;
+}
+
 const server = new Server(
   {
     name: "ftp-mcp-server",
-    version: "2.0.0",
+    version: "1.2.0",
   },
   {
     capabilities: {
@@ -568,6 +768,15 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
             patch: {
               type: "string",
               description: "Unified diff string containing the changes"
+            },
+            expectedHash: {
+              type: "string",
+              description: "Optional MD5 hash of the file before patching to prevent drift"
+            },
+            createBackup: {
+              type: "boolean",
+              description: "Create a .bak file before patching",
+              default: true
             }
           },
           required: ["path", "patch"]
@@ -654,13 +863,26 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       },
       {
         name: "ftp_search",
-        description: "Find files by name pattern on FTP/SFTP server",
+        description: "Advanced remote search: find files by name, content, or type",
         inputSchema: {
           type: "object",
           properties: {
             pattern: {
               type: "string",
-              description: "Search pattern (supports wildcards like *.js)"
+              description: "Filename search pattern (supports wildcards like *.js)"
+            },
+            contentPattern: {
+              type: "string",
+              description: "Regex pattern to search inside file contents (grep)"
+            },
+            extension: {
+              type: "string",
+              description: "Filter by file extension (e.g., '.js', '.php')"
+            },
+            findLikelyConfigs: {
+              type: "boolean",
+              description: "If true, prioritizes finding config, auth, and build files",
+              default: false
             },
             path: {
               type: "string",
@@ -677,8 +899,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
               description: "Results to skip over",
               default: 0
             }
-          },
-          required: ["pattern"]
+          }
         }
       },
       {
@@ -767,6 +988,11 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
               type: "boolean",
               description: "If true, simulates the sync without transferring files",
               default: false
+            },
+            useManifest: {
+              type: "boolean",
+              description: "Use local manifest cache for faster deploys (drift-aware)",
+              default: true
             }
           },
           required: ["localPath", "remotePath"]
@@ -904,6 +1130,50 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
           },
           required: ["oldPath", "newPath"]
         }
+      },
+      {
+        name: "ftp_rollback",
+        description: "Rollback a previous transaction using its snapshot",
+        inputSchema: {
+          type: "object",
+          properties: {
+            transactionId: {
+              type: "string",
+              description: "Transaction ID to rollback (e.g., tx_1234567890_abcd)"
+            }
+          },
+          required: ["transactionId"]
+        }
+      },
+      {
+        name: "ftp_list_transactions",
+        description: "List available rollback transactions",
+        inputSchema: {
+          type: "object",
+          properties: {}
+        }
+      },
+      {
+        name: "ftp_probe_capabilities",
+        description: "Probe the server to detect supported features (chmod, symlinks, disk space, etc.)",
+        inputSchema: {
+          type: "object",
+          properties: {
+            testPath: {
+              type: "string",
+              description: "A safe remote directory to run tests in (defaults to current directory)",
+              default: "."
+            }
+          }
+        }
+      },
+      {
+        name: "ftp_telemetry",
+        description: "Get connection health and performance telemetry",
+        inputSchema: {
+          type: "object",
+          properties: {}
+        }
       }
     ]
   };
@@ -915,7 +1185,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       const configPath = path.join(process.cwd(), '.ftpconfig');
       const configData = await fs.readFile(configPath, 'utf8');
       const config = JSON.parse(configData);
-      
+
       if (!config.deployments || Object.keys(config.deployments).length === 0) {
         return {
           content: [{
@@ -924,11 +1194,11 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           }]
         };
       }
-      
+
       const deploymentList = Object.entries(config.deployments).map(([name, deploy]) => {
         return `${name}\n  Profile: ${deploy.profile}\n  Local: ${deploy.local}\n  Remote: ${deploy.remote}\n  Description: ${deploy.description || 'N/A'}`;
       }).join('\n\n');
-      
+
       return {
         content: [{
           type: "text",
@@ -949,7 +1219,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       const configPath = path.join(process.cwd(), '.ftpconfig');
       const configData = await fs.readFile(configPath, 'utf8');
       const config = JSON.parse(configData);
-      
+
       if (!config.deployments || !config.deployments[deployment]) {
         return {
           content: [{
@@ -959,10 +1229,10 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           isError: true
         };
       }
-      
+
       const deployConfig = config.deployments[deployment];
       const profileConfig = config[deployConfig.profile];
-      
+
       if (!profileConfig) {
         return {
           content: [{
@@ -972,26 +1242,26 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           isError: true
         };
       }
-      
+
       currentConfig = profileConfig;
       currentProfile = deployConfig.profile;
-      
+
       const useSFTP = isSFTP(currentConfig.host);
       const client = await getClient(currentConfig);
-      
+
       try {
         const localPath = path.resolve(deployConfig.local);
         const stats = await syncFiles(
-          client, 
-          useSFTP, 
-          localPath, 
-          deployConfig.remote, 
+          client,
+          useSFTP,
+          localPath,
+          deployConfig.remote,
           'upload',
           null,
           null,
           deployConfig.exclude || []
         );
-        
+
         return {
           content: [{
             type: "text",
@@ -1013,7 +1283,9 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     try {
       const { profile, useEnv } = request.params.arguments || {};
       currentConfig = await loadFTPConfig(profile, useEnv);
-      
+      const poolKey = getPoolKey(currentConfig);
+      invalidatePoolCache(poolKey);
+
       if (!currentConfig.host || !currentConfig.user) {
         return {
           content: [
@@ -1024,11 +1296,17 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           ]
         };
       }
-      
+
+      let warning = "";
+      const isProd = (profile || currentProfile || '').toLowerCase().includes('prod');
+      if (isProd && !isSFTP(currentConfig.host)) {
+        warning = "\n⚠️ SECURITY WARNING: You are connecting to a production profile using insecure FTP. SFTP is strongly recommended.";
+      }
+
       return {
         content: [{
           type: "text",
-          text: `Connected to profile: ${profile || currentProfile || 'environment variables'}\nHost: ${currentConfig.host}`
+          text: `Connected to profile: ${profile || currentProfile || 'environment variables'}\nHost: ${currentConfig.host}${warning}`
         }]
       };
     } catch (error) {
@@ -1049,560 +1327,880 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             type: "text",
             text: "Error: FTP credentials not configured. Please use ftp_connect first or set environment variables."
           }
-        ]
+        ],
+        isError: true
       };
     }
   }
 
-  if (!currentConfig.host || !currentConfig.user) {
+  if (!currentConfig || !currentConfig.host || !currentConfig.user) {
     return {
       content: [
         {
           type: "text",
           text: "Error: FTP credentials not configured. Please set FTPMCP_HOST, FTPMCP_USER, and FTPMCP_PASSWORD environment variables or create a .ftpconfig file."
         }
-      ]
+      ],
+      isError: true
     };
   }
 
-  const useSFTP = isSFTP(currentConfig.host);
-  let client;
-
   try {
-    client = await getClient(currentConfig);
-    const poolKey = getPoolKey(currentConfig);
-    const cmdName = request.params.name;
-    const isDestructive = ["ftp_deploy", "ftp_put_contents", "ftp_batch_upload", "ftp_sync", "ftp_upload", "ftp_delete", "ftp_mkdir", "ftp_rmdir", "ftp_chmod", "ftp_rename", "ftp_copy", "ftp_patch_file"].includes(cmdName);
-    
-    if (isDestructive) {
-      if (currentConfig.readOnly) {
-        const errorResp = {
-          content: [{ type: "text", text: `Error: Profile '${currentProfile}' is configured in readOnly mode. Destructive actions are disabled.` }],
-          isError: true
-        };
-        await auditLog(cmdName, request.params.arguments, 'failed', currentProfile, 'readOnly mode violation');
-        return errorResp;
-      }
-      invalidatePoolCache(poolKey);
+    const entry = await getClient(currentConfig);
+  const client = entry.client;
+  const useSFTP = client._isSFTP;
+  const poolKey = getPoolKey(currentConfig);
+  const cmdName = request.params.name;
+  const isDestructive = ["ftp_deploy", "ftp_put_contents", "ftp_batch_upload", "ftp_sync", "ftp_upload", "ftp_delete", "ftp_mkdir", "ftp_rmdir", "ftp_chmod", "ftp_rename", "ftp_copy", "ftp_patch_file"].includes(cmdName);
+
+  const policyEngine = new PolicyEngine(currentConfig || {});
+
+  if (isDestructive) {
+    if (currentConfig.readOnly) {
+      const errorResp = {
+        content: [{ type: "text", text: `Error: Profile '${currentProfile}' is configured in readOnly mode. Destructive actions are disabled.` }],
+        isError: true
+      };
+      await auditLog(cmdName, request.params.arguments, 'failed', currentProfile, 'readOnly mode violation');
+      return errorResp;
     }
+    invalidatePoolCache(poolKey);
+  }
 
-    const response = await (async () => {
-      switch (cmdName) {
-      case "ftp_list": {
-        const path = request.params.arguments?.path || ".";
-        const limit = request.params.arguments?.limit || 100;
-        const offset = request.params.arguments?.offset || 0;
-        
-        let files = getCached(poolKey, 'LIST', path);
-        if (!files) {
-          files = useSFTP ? await client.list(path) : await client.list(path);
-          files.sort((a,b) => a.name.localeCompare(b.name));
-          setCached(poolKey, 'LIST', path, files);
-        }
-        
-        const total = files.length;
-        const sliced = files.slice(offset, offset + limit);
-        
-        const formatted = sliced.map(f => {
-          const type = (useSFTP ? f.type === 'd' : f.isDirectory) ? 'DIR ' : 'FILE';
-          const rights = useSFTP && f.rights ? `, ${f.rights.user || ''}${f.rights.group || ''}${f.rights.other || ''}` : '';
-          return `${type} ${f.name} (${f.size} bytes${rights})`;
-        }).join('\n');
-        
-        const paginationInfo = `\n\nShowing ${offset + 1} to ${Math.min(offset + limit, total)} of ${total} items.`;
-        return {
-          content: [{ type: "text", text: (formatted || "Empty directory") + (total > limit ? paginationInfo : '') }]
-        };
-      }
+  const response = await entry.execute(async (client) => {
+    switch (cmdName) {
+        case "ftp_list": {
+          const path = request.params.arguments?.path || ".";
+          const limit = request.params.arguments?.limit || 100;
+          const offset = request.params.arguments?.offset || 0;
+
+          let files = getCached(poolKey, 'LIST', path);
+          if (!files) {
+            files = useSFTP ? await client.list(path) : await client.list(path);
+            files.sort((a, b) => a.name.localeCompare(b.name));
+            setCached(poolKey, 'LIST', path, files);
+          }
 
-      case "ftp_get_contents": {
-        const { path, startLine, endLine } = request.params.arguments;
-        let content;
-        
-        if (useSFTP) {
-          const buffer = await client.get(path);
-          content = buffer.toString('utf8');
-        } else {
-          const chunks = [];
-          const stream = new Writable({
-            write(chunk, encoding, callback) {
-              chunks.push(chunk);
-              callback();
-            }
-          });
-          
-          await client.downloadTo(stream, path);
-          content = Buffer.concat(chunks).toString('utf8');
-        }
-        
-        if (startLine || endLine) {
-          const lines = content.split('\n');
-          const start = Math.max((startLine || 1) - 1, 0);
-          const end = endLine ? Math.min(endLine, lines.length) : lines.length;
-          const totalLength = lines.length;
-          
-          content = lines.slice(start, end).join('\n');
-          content = `... Showing lines ${start + 1} to ${end} of ${totalLength} ...\n${content}`;
+          const total = files.length;
+          const sliced = files.slice(offset, offset + limit);
+
+          const formatted = sliced.map(f => {
+            const type = (useSFTP ? f.type === 'd' : f.isDirectory) ? 'DIR ' : 'FILE';
+            const rights = useSFTP && f.rights ? `, ${f.rights.user || ''}${f.rights.group || ''}${f.rights.other || ''}` : '';
+            return `${type} ${f.name} (${f.size} bytes${rights})`;
+          }).join('\n');
+
+          const paginationInfo = `\n\nShowing ${offset + 1} to ${Math.min(offset + limit, total)} of ${total} items.`;
+          return {
+            content: [{ type: "text", text: (formatted || "Empty directory") + (total > limit ? paginationInfo : '') }]
+          };
         }
-        
-        return {
-          content: [{ type: "text", text: content }]
-        };
-      }
 
-      case "ftp_patch_file": {
-        const { path, patch } = request.params.arguments;
-        
-        let content;
-        try {
+        case "ftp_get_contents": {
+          const { path, startLine, endLine } = request.params.arguments;
+          let content;
+
           if (useSFTP) {
             const buffer = await client.get(path);
             content = buffer.toString('utf8');
           } else {
             const chunks = [];
-            const stream = new Writable({ write(chunk, encoding, callback) { chunks.push(chunk); callback(); } });
+            const stream = new Writable({
+              write(chunk, encoding, callback) {
+                chunks.push(chunk);
+                callback();
+              }
+            });
+
             await client.downloadTo(stream, path);
             content = Buffer.concat(chunks).toString('utf8');
           }
-        } catch (e) {
-          return {
-            content: [{ type: "text", text: `Error: File not found or unreadable. ${e.message}` }],
-            isError: true
-          };
-        }
-        
-        const patchedContent = diff.applyPatch(content, patch);
-        if (patchedContent === false) {
-          return {
-            content: [{ type: "text", text: `Error: Failed to apply patch cleanly. Diff may be malformed or out of date with remote file.` }],
-            isError: true
-          };
-        }
-        
-        if (useSFTP) {
-          const buffer = Buffer.from(patchedContent, 'utf8');
-          await client.put(buffer, path);
-        } else {
-          const readable = Readable.from([patchedContent]);
-          await client.uploadFrom(readable, path);
-        }
-        
-        return {
-          content: [{ type: "text", text: `Successfully patched ${path}` }]
-        };
-      }
 
-      case "ftp_put_contents": {
-        const { path, content } = request.params.arguments;
-        
-        if (useSFTP) {
-          const buffer = Buffer.from(content, 'utf8');
-          await client.put(buffer, path);
-        } else {
-          const readable = Readable.from([content]);
-          await client.uploadFrom(readable, path);
-        }
-        
-        return {
-          content: [{ type: "text", text: `Successfully wrote content to ${path}` }]
-        };
-      }
+          if (startLine || endLine) {
+            const lines = content.split('\n');
+            const start = Math.max((startLine || 1) - 1, 0);
+            const end = endLine ? Math.min(endLine, lines.length) : lines.length;
+            const totalLength = lines.length;
 
-      case "ftp_stat": {
-        const { path } = request.params.arguments;
-        
-        if (useSFTP) {
-          const stats = await client.stat(path);
-          return {
-            content: [{
-              type: "text",
-              text: JSON.stringify({
-                size: stats.size,
-                modified: stats.modifyTime,
-                accessed: stats.accessTime,
-                permissions: stats.mode,
-                isDirectory: stats.isDirectory,
-                isFile: stats.isFile
-              }, null, 2)
-            }]
-          };
-        } else {
-          const dirPath = path.substring(0, path.lastIndexOf('/')) || '.';
-          const fileName = path.substring(path.lastIndexOf('/') + 1);
-          const files = await client.list(dirPath);
-          const file = files.find(f => f.name === fileName);
-          
-          if (!file) {
-            throw new Error(`File not found: ${path}`);
+            content = lines.slice(start, end).join('\n');
+            content = `... Showing lines ${start + 1} to ${end} of ${totalLength} ...\n${content}`;
           }
-          
+
           return {
-            content: [{
-              type: "text",
-              text: JSON.stringify({
-                size: file.size,
-                modified: file.modifiedAt || file.rawModifiedAt,
-                isDirectory: file.isDirectory,
-                isFile: file.isFile
-              }, null, 2)
-            }]
+            content: [{ type: "text", text: content }]
           };
         }
-      }
-
-      case "ftp_exists": {
-        const { path } = request.params.arguments;
-        let exists = false;
-        
-        try {
-          if (useSFTP) {
-            await client.stat(path);
-            exists = true;
-          } else {
-            const dirPath = path.substring(0, path.lastIndexOf('/')) || '.';
-            const fileName = path.substring(path.lastIndexOf('/') + 1);
-            const files = await client.list(dirPath);
-            exists = files.some(f => f.name === fileName);
-          }
-        } catch (e) {
-          exists = false;
-        }
-        
-        return {
-          content: [{ type: "text", text: exists ? "true" : "false" }]
-        };
-      }
 
-      case "ftp_tree": {
-        const { path = ".", maxDepth = 10 } = request.params.arguments || {};
-        const cacheKey = `${path}:${maxDepth}`;
-        let tree = getCached(poolKey, 'TREE', cacheKey);
-        if (!tree) {
-          tree = await getTreeRecursive(client, useSFTP, path, 0, maxDepth);
-          setCached(poolKey, 'TREE', cacheKey, tree);
-        }
-        
-        const formatted = tree.map(item => {
-          const indent = '  '.repeat((item.path.match(/\//g) || []).length);
-          return `${indent}${item.isDirectory ? '📁' : '📄'} ${item.name} ${!item.isDirectory ? `(${item.size} bytes)` : ''}`;
-        }).join('\n');
-        
-        return {
-          content: [{ type: "text", text: formatted || "Empty directory" }]
-        };
-      }
+        case "ftp_patch_file": {
+          const { path: filePath, patch, expectedHash, createBackup = true } = request.params.arguments;
 
-      case "ftp_search": {
-        const { pattern, path = ".", limit = 50, offset = 0 } = request.params.arguments;
-        const cacheKey = `${path}:10`;
-        let tree = getCached(poolKey, 'TREE', cacheKey);
-        if (!tree) {
-          tree = await getTreeRecursive(client, useSFTP, path, 0, 10);
-          setCached(poolKey, 'TREE', cacheKey, tree);
-        }
-        
-        const regex = new RegExp(pattern.replace(/\*/g, '.*').replace(/\?/g, '.'));
-        const matches = tree.filter(item => regex.test(item.name));
-        
-        const total = matches.length;
-        const sliced = matches.slice(offset, offset + limit);
-        
-        const formatted = sliced.map(item => 
-          `${item.path} (${item.isDirectory ? 'DIR' : item.size + ' bytes'})`
-        ).join('\n');
-        
-        const paginationInfo = `\n\nShowing ${offset + 1} to ${Math.min(offset + limit, total)} of ${total} matches.`;
-        return {
-          content: [{ type: "text", text: (formatted || "No matches found") + (total > limit ? paginationInfo : '') }]
-        };
-      }
+          try {
+            policyEngine.validateOperation('patch', { path: filePath });
+          } catch (e) {
+            return { content: [{ type: "text", text: e.message }], isError: true };
+          }
 
-      case "ftp_analyze_workspace": {
-        const path = request.params.arguments?.path || ".";
-        let files = getCached(poolKey, 'LIST', path);
-        if (!files) {
-          files = useSFTP ? await client.list(path) : await client.list(path);
-          setCached(poolKey, 'LIST', path, files);
-        }
-        
-        const importantFiles = ['package.json', 'composer.json', 'requirements.txt', 'pyproject.toml', 'Cargo.toml', 'go.mod', 'README.md'];
-        const found = files.filter(f => importantFiles.includes(f.name));
-        
-        let summary = `Workspace Analysis for: ${path}\n============================\n\n`;
-        if (found.length === 0) {
-          summary += "No recognizable project configuration files found.";
-          return { content: [{ type: "text", text: summary }] };
-        }
-        
-        for (const file of found) {
-          const filePath = path === "." ? file.name : `${path}/${file.name}`;
+          let content;
           try {
-            let content;
             if (useSFTP) {
-              content = (await client.get(filePath)).toString('utf8');
+              const buffer = await client.get(filePath);
+              content = buffer.toString('utf8');
             } else {
               const chunks = [];
-              const stream = new Writable({ write(c, e, cb) { chunks.push(c); cb(); } });
+              const stream = new Writable({ write(chunk, encoding, callback) { chunks.push(chunk); callback(); } });
               await client.downloadTo(stream, filePath);
               content = Buffer.concat(chunks).toString('utf8');
             }
-            
-            if (file.name === 'package.json' || file.name === 'composer.json') {
-              const parsed = JSON.parse(content);
-              summary += `[${file.name}]\nName: ${parsed.name || 'Unknown'}\nVersion: ${parsed.version || 'Unknown'}\n`;
-              if (parsed.dependencies || parsed.require) summary += `Dependencies: ${Object.keys(parsed.dependencies || parsed.require).slice(0, 10).join(', ')}...\n`;
-            } else if (file.name === 'README.md') {
-              summary += `[README.md (Preview)]\n${content.split('\n').filter(l => l.trim()).slice(0, 5).join('\n')}\n`;
-            } else {
-              summary += `[${file.name}]\n${content.split('\n').slice(0, 10).join('\n')}...\n`;
-            }
-            summary += '\n';
           } catch (e) {
-            summary += `[${file.name}]\nCould not read file contents: ${e.message}\n\n`;
+            return {
+              content: [{ type: "text", text: `Error: File not found or unreadable. ${e.message}` }],
+              isError: true
+            };
           }
-        }
-        
-        return {
-          content: [{ type: "text", text: summary.trim() }]
-        };
-      }
 
-      case "ftp_copy": {
-        const { sourcePath, destPath } = request.params.arguments;
-        
-        if (!useSFTP) {
-          return {
-            content: [{ type: "text", text: "Error: ftp_copy is only supported for SFTP connections. For FTP, download and re-upload." }]
-          };
-        }
-        
-        const buffer = await client.get(sourcePath);
-        await client.put(buffer, destPath);
-        
-        return {
-          content: [{ type: "text", text: `Successfully copied ${sourcePath} to ${destPath}` }]
-        };
-      }
+          if (expectedHash) {
+            const currentHash = crypto.createHash('md5').update(content).digest('hex');
+            if (currentHash !== expectedHash) {
+              return {
+                content: [{ type: "text", text: `Error: File drift detected. Expected hash ${expectedHash}, but got ${currentHash}.` }],
+                isError: true
+              };
+            }
+          }
 
-      case "ftp_batch_upload": {
-        const { files } = request.params.arguments;
-        const results = { success: [], failed: [] };
-        
-        for (const file of files) {
-          try {
+          // Try exact match first
+          let patchedContent = diff.applyPatch(content, patch);
+          let confidence = 100;
+
+          // If exact match fails, try fuzzy match
+          if (patchedContent === false) {
+            patchedContent = diff.applyPatch(content, patch, { fuzzFactor: 2 });
+            confidence = 50; // Arbitrary lower confidence for fuzzy match
+          }
+
+          if (patchedContent === false) {
+            return {
+              content: [{ type: "text", text: `Error: Failed to apply patch cleanly. Diff may be malformed or out of date with remote file.` }],
+              isError: true
+            };
+          }
+
+          const txId = await snapshotManager.createSnapshot(client, useSFTP, [filePath]);
+
+          if (createBackup) {
+            const backupPath = `${filePath}.bak`;
             if (useSFTP) {
-              await client.put(file.localPath, file.remotePath);
+              const buffer = Buffer.from(content, 'utf8');
+              await client.put(buffer, backupPath);
             } else {
-              await client.uploadFrom(file.localPath, file.remotePath);
+              const readable = Readable.from([content]);
+              await client.uploadFrom(readable, backupPath);
             }
-            results.success.push(file.remotePath);
-          } catch (error) {
-            results.failed.push({ path: file.remotePath, error: error.message });
           }
+
+          if (useSFTP) {
+            const buffer = Buffer.from(patchedContent, 'utf8');
+            await client.put(buffer, filePath);
+          } else {
+            const readable = Readable.from([patchedContent]);
+            await client.uploadFrom(readable, filePath);
+          }
+
+          return {
+            content: [{ type: "text", text: `Successfully patched ${filePath} (Confidence: ${confidence}%)\nTransaction ID: ${txId}${createBackup ? `\nBackup created at: ${filePath}.bak` : ''}` }]
+          };
         }
-        
-        return {
-          content: [{
-            type: "text",
-            text: `Uploaded: ${results.success.length}\nFailed: ${results.failed.length}\n${results.failed.length > 0 ? '\nErrors:\n' + results.failed.map(f => `${f.path}: ${f.error}`).join('\n') : ''}`
-          }]
-        };
-      }
 
-      case "ftp_batch_download": {
-        const { files } = request.params.arguments;
-        const results = { success: [], failed: [] };
-        
-        for (const file of files) {
+        case "ftp_put_contents": {
+          const { path: filePath, content } = request.params.arguments;
+
+          try {
+            policyEngine.validateOperation('overwrite', { path: filePath, size: Buffer.byteLength(content, 'utf8') });
+          } catch (e) {
+            return { content: [{ type: "text", text: e.message }], isError: true };
+          }
+
+          const txId = await snapshotManager.createSnapshot(client, useSFTP, [filePath]);
+
+          if (useSFTP) {
+            const buffer = Buffer.from(content, 'utf8');
+            await client.put(buffer, filePath);
+          } else {
+            const readable = Readable.from([content]);
+            await client.uploadFrom(readable, filePath);
+          }
+
+          return {
+            content: [{ type: "text", text: `Successfully wrote content to ${filePath}\nTransaction ID: ${txId}` }]
+          };
+        }
+
+        case "ftp_stat": {
+          const { path } = request.params.arguments;
+
+          if (useSFTP) {
+            const stats = await client.stat(path);
+            return {
+              content: [{
+                type: "text",
+                text: JSON.stringify({
+                  size: stats.size,
+                  modified: stats.modifyTime,
+                  accessed: stats.accessTime,
+                  permissions: stats.mode,
+                  isDirectory: stats.isDirectory,
+                  isFile: stats.isFile
+                }, null, 2)
+              }]
+            };
+          } else {
+            const dirPath = path.substring(0, path.lastIndexOf('/')) || '.';
+            const fileName = path.substring(path.lastIndexOf('/') + 1);
+            const files = await client.list(dirPath);
+            const file = files.find(f => f.name === fileName);
+
+            if (!file) {
+              throw new Error(`File not found: ${path}`);
+            }
+
+            return {
+              content: [{
+                type: "text",
+                text: JSON.stringify({
+                  size: file.size,
+                  modified: file.modifiedAt || file.rawModifiedAt,
+                  isDirectory: file.isDirectory,
+                  isFile: file.isFile
+                }, null, 2)
+              }]
+            };
+          }
+        }
+
+        case "ftp_exists": {
+          const { path } = request.params.arguments;
+          let exists = false;
+
           try {
             if (useSFTP) {
-              await client.get(file.remotePath, file.localPath);
+              await client.stat(path);
+              exists = true;
             } else {
-              await client.downloadTo(file.localPath, file.remotePath);
+              const dirPath = path.substring(0, path.lastIndexOf('/')) || '.';
+              const fileName = path.substring(path.lastIndexOf('/') + 1);
+              const files = await client.list(dirPath);
+              exists = files.some(f => f.name === fileName);
             }
-            results.success.push(file.remotePath);
-          } catch (error) {
-            results.failed.push({ path: file.remotePath, error: error.message });
+          } catch (e) {
+            exists = false;
           }
+
+          return {
+            content: [{ type: "text", text: exists ? "true" : "false" }]
+          };
         }
-        
-        return {
-          content: [{
-            type: "text",
-            text: `Downloaded: ${results.success.length}\nFailed: ${results.failed.length}\n${results.failed.length > 0 ? '\nErrors:\n' + results.failed.map(f => `${f.path}: ${f.error}`).join('\n') : ''}`
-          }]
-        };
-      }
 
-      case "ftp_sync": {
-        const { localPath, remotePath, direction = "upload", dryRun = false } = request.params.arguments;
-        const stats = await syncFiles(client, useSFTP, localPath, remotePath, direction, null, null, [], dryRun);
-        
-        return {
-          content: [{
-            type: "text",
-            text: `${dryRun ? '[DRY RUN] ' : ''}Sync complete:\nUploaded: ${stats.uploaded}\nDownloaded: ${stats.downloaded}\nSkipped: ${stats.skipped}\nIgnored: ${stats.ignored}\n${stats.errors.length > 0 ? '\nErrors:\n' + stats.errors.join('\n') : ''}`
-          }]
-        };
-      }
+        case "ftp_tree": {
+          const { path = ".", maxDepth = 10 } = request.params.arguments || {};
+          const cacheKey = `${path}:${maxDepth}`;
+          let tree = getCached(poolKey, 'TREE', cacheKey);
+          if (!tree) {
+            tree = await getTreeRecursive(client, useSFTP, path, 0, maxDepth);
+            setCached(poolKey, 'TREE', cacheKey, tree);
+          }
+
+          const formatted = tree.map(item => {
+            const indent = '  '.repeat((item.path.match(/\//g) || []).length);
+            return `${indent}${item.isDirectory ? '📁' : '📄'} ${item.name} ${!item.isDirectory ? `(${item.size} bytes)` : ''}`;
+          }).join('\n');
 
-      case "ftp_disk_space": {
-        const { path = "." } = request.params.arguments || {};
-        
-        if (!useSFTP) {
           return {
-            content: [{ type: "text", text: "Error: ftp_disk_space is only supported for SFTP connections" }]
+            content: [{ type: "text", text: formatted || "Empty directory" }]
           };
         }
-        
-        try {
-          const sftp = await client.sftp();
-          const diskSpace = await new Promise((resolve, reject) => {
-            sftp.ext_openssh_statvfs(path, (err, stats) => {
-              if (err) reject(err);
-              else resolve(stats);
-            });
-          });
-          
+
+        case "ftp_search": {
+          const { pattern, contentPattern, extension, findLikelyConfigs, path: searchPath = ".", limit = 50, offset = 0 } = request.params.arguments;
+
+          if (!pattern && !contentPattern && !findLikelyConfigs) {
+            return { content: [{ type: "text", text: "Error: Must provide pattern, contentPattern, or findLikelyConfigs" }], isError: true };
+          }
+
+          const cacheKey = `${searchPath}:10`;
+          let tree = getCached(poolKey, 'TREE', cacheKey);
+          if (!tree) {
+            tree = await getTreeRecursive(client, useSFTP, searchPath, 0, 10);
+            setCached(poolKey, 'TREE', cacheKey, tree);
+          }
+
+          let matches = tree;
+
+          if (findLikelyConfigs) {
+            const configRegex = /config|env|auth|deploy|build|package\.json|composer\.json|dockerfile/i;
+            matches = matches.filter(item => configRegex.test(item.name));
+          }
+
+          if (pattern) {
+            const regex = new RegExp(pattern.replace(/\*/g, '.*').replace(/\?/g, '.'), 'i');
+            matches = matches.filter(item => regex.test(item.name));
+          }
+
+          if (extension) {
+            const ext = extension.startsWith('.') ? extension : `.${extension}`;
+            matches = matches.filter(item => item.name.endsWith(ext));
+          }
+
+          const total = matches.length;
+          let sliced = matches.slice(offset, offset + limit);
+          let formatted = "";
+
+          if (contentPattern) {
+            const contentRegex = new RegExp(contentPattern, 'gi');
+            const contentMatches = [];
+
+            for (const item of sliced) {
+              if (item.isDirectory || item.size > 1024 * 1024) continue; // Skip dirs and files > 1MB
+
+              try {
+                let content;
+                if (useSFTP) {
+                  content = (await client.get(item.path)).toString('utf8');
+                } else {
+                  const chunks = [];
+                  const stream = new Writable({ write(c, e, cb) { chunks.push(c); cb(); } });
+                  await client.downloadTo(stream, item.path);
+                  content = Buffer.concat(chunks).toString('utf8');
+                }
+
+                const lines = content.split('\n');
+                for (let i = 0; i < lines.length; i++) {
+                  if (contentRegex.test(lines[i])) {
+                    const start = Math.max(0, i - 1);
+                    const end = Math.min(lines.length - 1, i + 1);
+                    const context = lines.slice(start, end + 1).map((l, idx) => `${start + idx + 1}: ${l}`).join('\n');
+                    contentMatches.push(`File: ${item.path}\n${context}\n---`);
+                    break; // Just show first match per file to save space
+                  }
+                }
+              } catch (e) {
+                // Ignore read errors during search
+              }
+            }
+            formatted = contentMatches.join('\n');
+          } else {
+            formatted = sliced.map(item =>
+              `${item.path} (${item.isDirectory ? 'DIR' : item.size + ' bytes'})`
+            ).join('\n');
+          }
+
+          const paginationInfo = `\n\nShowing ${offset + 1} to ${Math.min(offset + limit, total)} of ${total} matches.`;
+          return {
+            content: [{ type: "text", text: (formatted || "No matches found") + (total > limit ? paginationInfo : '') }]
+          };
+        }
+
+        case "ftp_analyze_workspace": {
+          const path = request.params.arguments?.path || ".";
+          let files = getCached(poolKey, 'LIST', path);
+          if (!files) {
+            files = useSFTP ? await client.list(path) : await client.list(path);
+            setCached(poolKey, 'LIST', path, files);
+          }
+
+          const fileNames = files.map(f => f.name);
+          const importantFiles = ['package.json', 'composer.json', 'requirements.txt', 'pyproject.toml', 'Cargo.toml', 'go.mod', 'README.md'];
+          const found = files.filter(f => importantFiles.includes(f.name));
+
+          let summary = `Workspace Analysis for: ${path}\n============================\n\n`;
+
+          // Framework Detection
+          let framework = "Unknown";
+          let recommendedIgnores = [];
+          let dangerousFolders = [];
+
+          if (fileNames.includes('wp-config.php') || fileNames.includes('wp-content')) {
+            framework = "WordPress";
+            recommendedIgnores = ['wp-content/cache/**', 'wp-content/uploads/**', 'wp-config.php'];
+            dangerousFolders = ['wp-content/uploads', 'wp-content/cache'];
+          } else if (fileNames.includes('artisan') && fileNames.includes('composer.json')) {
+            framework = "Laravel";
+            recommendedIgnores = ['vendor/**', 'storage/framework/cache/**', 'storage/logs/**', '.env'];
+            dangerousFolders = ['storage', 'bootstrap/cache'];
+          } else if (fileNames.includes('next.config.js') || fileNames.includes('next.config.mjs')) {
+            framework = "Next.js";
+            recommendedIgnores = ['.next/**', 'node_modules/**', '.env*'];
+            dangerousFolders = ['.next'];
+          } else if (fileNames.includes('vite.config.js') || fileNames.includes('vite.config.ts')) {
+            framework = "Vite/React/Vue";
+            recommendedIgnores = ['dist/**', 'node_modules/**', '.env*'];
+            dangerousFolders = ['dist'];
+          } else if (fileNames.includes('package.json')) {
+            framework = "Node.js (Generic)";
+            recommendedIgnores = ['node_modules/**', '.env*'];
+            dangerousFolders = ['node_modules'];
+          } else if (fileNames.includes('composer.json')) {
+            framework = "PHP (Composer)";
+            recommendedIgnores = ['vendor/**', '.env*'];
+            dangerousFolders = ['vendor'];
+          }
+
+          summary += `Detected Framework: ${framework}\n`;
+          if (recommendedIgnores.length > 0) {
+            summary += `Recommended Ignores: ${recommendedIgnores.join(', ')}\n`;
+          }
+          if (dangerousFolders.length > 0) {
+            summary += `Dangerous/Cache Folders (Avoid Overwriting): ${dangerousFolders.join(', ')}\n`;
+          }
+          summary += `\n----------------------------\n\n`;
+
+          if (found.length === 0) {
+            summary += "No recognizable project configuration files found.";
+            return { content: [{ type: "text", text: summary }] };
+          }
+
+          for (const file of found) {
+            const filePath = path === "." ? file.name : `${path}/${file.name}`;
+            try {
+              let content;
+              if (useSFTP) {
+                content = (await client.get(filePath)).toString('utf8');
+              } else {
+                const chunks = [];
+                const stream = new Writable({ write(c, e, cb) { chunks.push(c); cb(); } });
+                await client.downloadTo(stream, filePath);
+                content = Buffer.concat(chunks).toString('utf8');
+              }
+
+              if (file.name === 'package.json' || file.name === 'composer.json') {
+                const parsed = JSON.parse(content);
+                summary += `[${file.name}]\nName: ${parsed.name || 'Unknown'}\nVersion: ${parsed.version || 'Unknown'}\n`;
+                if (parsed.dependencies || parsed.require) summary += `Dependencies: ${Object.keys(parsed.dependencies || parsed.require).slice(0, 10).join(', ')}...\n`;
+              } else if (file.name === 'README.md') {
+                summary += `[README.md (Preview)]\n${content.split('\n').filter(l => l.trim()).slice(0, 5).join('\n')}\n`;
+              } else {
+                summary += `[${file.name}]\n${content.split('\n').slice(0, 10).join('\n')}...\n`;
+              }
+              summary += '\n';
+            } catch (e) {
+              summary += `[${file.name}]\nCould not read file contents: ${e.message}\n\n`;
+            }
+          }
+
+          return {
+            content: [{ type: "text", text: summary.trim() }]
+          };
+        }
+
+        case "ftp_copy": {
+          const { sourcePath, destPath } = request.params.arguments;
+
+          if (!useSFTP) {
+            return {
+              content: [{ type: "text", text: "Error: ftp_copy is only supported for SFTP connections. For FTP, download and re-upload." }]
+            };
+          }
+
+          const buffer = await client.get(sourcePath);
+          await client.put(buffer, destPath);
+
+          return {
+            content: [{ type: "text", text: `Successfully copied ${sourcePath} to ${destPath}` }]
+          };
+        }
+
+        case "ftp_batch_upload": {
+          const { files } = request.params.arguments;
+          const results = { success: [], failed: [] };
+
+          for (const file of files) {
+            try {
+              if (useSFTP) {
+                await client.put(file.localPath, file.remotePath);
+              } else {
+                await client.uploadFrom(file.localPath, file.remotePath);
+              }
+              results.success.push(file.remotePath);
+            } catch (error) {
+              results.failed.push({ path: file.remotePath, error: error.message });
+            }
+          }
+
           return {
             content: [{
               type: "text",
-              text: JSON.stringify({
-                total: diskSpace.blocks * diskSpace.bsize,
-                free: diskSpace.bfree * diskSpace.bsize,
-                available: diskSpace.bavail * diskSpace.bsize,
-                used: (diskSpace.blocks - diskSpace.bfree) * diskSpace.bsize
-              }, null, 2)
+              text: `Uploaded: ${results.success.length}\nFailed: ${results.failed.length}\n${results.failed.length > 0 ? '\nErrors:\n' + results.failed.map(f => `${f.path}: ${f.error}`).join('\n') : ''}`
             }]
           };
-        } catch (error) {
+        }
+
+        case "ftp_batch_download": {
+          const { files } = request.params.arguments;
+          const results = { success: [], failed: [] };
+
+          for (const file of files) {
+            try {
+              if (useSFTP) {
+                await client.get(file.remotePath, file.localPath);
+              } else {
+                await client.downloadTo(file.localPath, file.remotePath);
+              }
+              results.success.push(file.remotePath);
+            } catch (error) {
+              results.failed.push({ path: file.remotePath, error: error.message });
+            }
+          }
+
           return {
-            content: [{ type: "text", text: `Disk space info not available: ${error.message}` }]
+            content: [{
+              type: "text",
+              text: `Downloaded: ${results.success.length}\nFailed: ${results.failed.length}\n${results.failed.length > 0 ? '\nErrors:\n' + results.failed.map(f => `${f.path}: ${f.error}`).join('\n') : ''}`
+            }]
           };
         }
-      }
 
-      case "ftp_upload": {
-        const { localPath, remotePath } = request.params.arguments;
-        
-        if (useSFTP) {
-          await client.put(localPath, remotePath);
-        } else {
-          await client.uploadFrom(localPath, remotePath);
+        case "ftp_sync": {
+          const { localPath, remotePath, direction = "upload", dryRun = false, useManifest = true } = request.params.arguments;
+          const startTime = Date.now();
+          const stats = await syncFiles(client, useSFTP, localPath, remotePath, direction, null, null, [], dryRun, useManifest);
+          const duration = Date.now() - startTime;
+
+          if (!dryRun) {
+            telemetry.syncDurations.push(duration);
+            if (telemetry.syncDurations.length > 100) telemetry.syncDurations.shift(); // Keep last 100
+          }
+
+          let resultText = `${dryRun ? '[DRY RUN] ' : ''}Sync complete in ${duration}ms:\nUploaded: ${stats.uploaded}\nDownloaded: ${stats.downloaded}\nSkipped: ${stats.skipped}\nIgnored: ${stats.ignored}\n${stats.errors.length > 0 ? '\nErrors:\n' + stats.errors.join('\n') : ''}`;
+
+          if (dryRun && stats.filesToChange.length > 0) {
+            resultText += `\n\n${generateSemanticPreview(stats.filesToChange)}`;
+          }
+
+          return {
+            content: [{
+              type: "text",
+              text: resultText
+            }]
+          };
         }
-        
-        return {
-          content: [{ type: "text", text: `Successfully uploaded ${localPath} to ${remotePath}` }]
-        };
-      }
 
-      case "ftp_download": {
-        const { remotePath, localPath } = request.params.arguments;
-        
-        if (useSFTP) {
-          await client.get(remotePath, localPath);
-        } else {
-          await client.downloadTo(localPath, remotePath);
+        case "ftp_disk_space": {
+          const { path = "." } = request.params.arguments || {};
+
+          if (!useSFTP) {
+            return {
+              content: [{ type: "text", text: "Error: ftp_disk_space is only supported for SFTP connections" }]
+            };
+          }
+
+          try {
+            const sftp = await client.sftp();
+            const diskSpace = await new Promise((resolve, reject) => {
+              sftp.ext_openssh_statvfs(path, (err, stats) => {
+                if (err) reject(err);
+                else resolve(stats);
+              });
+            });
+
+            return {
+              content: [{
+                type: "text",
+                text: JSON.stringify({
+                  total: diskSpace.blocks * diskSpace.bsize,
+                  free: diskSpace.bfree * diskSpace.bsize,
+                  available: diskSpace.bavail * diskSpace.bsize,
+                  used: (diskSpace.blocks - diskSpace.bfree) * diskSpace.bsize
+                }, null, 2)
+              }]
+            };
+          } catch (error) {
+            return {
+              content: [{ type: "text", text: `Disk space info not available: ${error.message}` }]
+            };
+          }
         }
-        
-        return {
-          content: [{ type: "text", text: `Successfully downloaded ${remotePath} to ${localPath}` }]
-        };
-      }
 
-      case "ftp_delete": {
-        const { path } = request.params.arguments;
-        
-        if (useSFTP) {
-          await client.delete(path);
-        } else {
-          await client.remove(path);
+        case "ftp_upload": {
+          const { localPath, remotePath } = request.params.arguments;
+
+          if (isSecretFile(localPath)) {
+            return {
+              content: [{ type: "text", text: `Security Warning: Blocked upload of likely secret file: ${localPath}` }],
+              isError: true
+            };
+          }
+
+          try {
+            const stat = await fs.stat(localPath);
+            policyEngine.validateOperation('overwrite', { path: remotePath, size: stat.size });
+          } catch (e) {
+            return { content: [{ type: "text", text: e.message }], isError: true };
+          }
+
+          const txId = await snapshotManager.createSnapshot(client, useSFTP, [remotePath]);
+
+          if (useSFTP) {
+            await client.put(localPath, remotePath);
+          } else {
+            await client.uploadFrom(localPath, remotePath);
+          }
+
+          return {
+            content: [{ type: "text", text: `Successfully uploaded ${localPath} to ${remotePath}\nTransaction ID: ${txId}` }]
+          };
         }
-        
-        return {
-          content: [{ type: "text", text: `Successfully deleted ${path}` }]
-        };
-      }
 
-      case "ftp_mkdir": {
-        const { path } = request.params.arguments;
-        
-        if (useSFTP) {
-          await client.mkdir(path, true);
-        } else {
-          await client.ensureDir(path);
+        case "ftp_download": {
+          const { remotePath, localPath } = request.params.arguments;
+
+          if (useSFTP) {
+            await client.get(remotePath, localPath);
+          } else {
+            await client.downloadTo(localPath, remotePath);
+          }
+
+          return {
+            content: [{ type: "text", text: `Successfully downloaded ${remotePath} to ${localPath}` }]
+          };
         }
-        
-        return {
-          content: [{ type: "text", text: `Successfully created directory ${path}` }]
-        };
-      }
 
-      case "ftp_rmdir": {
-        const { path, recursive } = request.params.arguments;
-        
-        if (useSFTP) {
-          await client.rmdir(path, recursive);
-        } else {
-          if (recursive) {
-            await client.removeDir(path);
+        case "ftp_delete": {
+          const { path: filePath } = request.params.arguments;
+
+          try {
+            policyEngine.validateOperation('delete', { path: filePath });
+          } catch (e) {
+            return { content: [{ type: "text", text: e.message }], isError: true };
+          }
+
+          const txId = await snapshotManager.createSnapshot(client, useSFTP, [filePath]);
+
+          if (useSFTP) {
+            await client.delete(filePath);
           } else {
-            await client.remove(path);
+            await client.remove(filePath);
           }
+
+          return {
+            content: [{ type: "text", text: `Successfully deleted ${filePath}\nTransaction ID: ${txId}` }]
+          };
         }
-        
-        return {
-          content: [{ type: "text", text: `Successfully removed directory ${path}` }]
-        };
-      }
 
-      case "ftp_chmod": {
-        const { path, mode } = request.params.arguments;
-        
-        if (!useSFTP) {
+        case "ftp_mkdir": {
+          const { path } = request.params.arguments;
+
+          if (useSFTP) {
+            await client.mkdir(path, true);
+          } else {
+            await client.ensureDir(path);
+          }
+
           return {
-            content: [{ type: "text", text: "Error: chmod is only supported for SFTP connections" }]
+            content: [{ type: "text", text: `Successfully created directory ${path}` }]
           };
         }
-        
-        await client.chmod(path, mode);
-        
-        return {
-          content: [{ type: "text", text: `Successfully changed permissions of ${path} to ${mode}` }]
-        };
-      }
 
-      case "ftp_rename": {
-        const { oldPath, newPath } = request.params.arguments;
-        
-        if (useSFTP) {
-          await client.rename(oldPath, newPath);
-        } else {
-          await client.rename(oldPath, newPath);
+        case "ftp_rmdir": {
+          const { path, recursive } = request.params.arguments;
+
+          if (useSFTP) {
+            await client.rmdir(path, recursive);
+          } else {
+            if (recursive) {
+              await client.removeDir(path);
+            } else {
+              await client.remove(path);
+            }
+          }
+
+          return {
+            content: [{ type: "text", text: `Successfully removed directory ${path}` }]
+          };
         }
-        
-        return {
-          content: [{ type: "text", text: `Successfully renamed ${oldPath} to ${newPath}` }]
-        };
-      }
 
-      default:
-        return {
-          content: [{ type: "text", text: `Unknown tool: ${request.params.name}` }],
-          isError: true
-        };
+        case "ftp_chmod": {
+          const { path, mode } = request.params.arguments;
+
+          if (!useSFTP) {
+            return {
+              content: [{ type: "text", text: "Error: chmod is only supported for SFTP connections" }]
+            };
+          }
+
+          await client.chmod(path, mode);
+
+          return {
+            content: [{ type: "text", text: `Successfully changed permissions of ${path} to ${mode}` }]
+          };
+        }
+
+        case "ftp_rename": {
+          const { oldPath, newPath } = request.params.arguments;
+
+          try {
+            policyEngine.validateOperation('delete', { path: oldPath }); // Renaming is effectively deleting the old path
+            policyEngine.validateOperation('overwrite', { path: newPath });
+          } catch (e) {
+            return { content: [{ type: "text", text: e.message }], isError: true };
+          }
+
+          const txId = await snapshotManager.createSnapshot(client, useSFTP, [oldPath, newPath]);
+
+          if (useSFTP) {
+            await client.rename(oldPath, newPath);
+          } else {
+            await client.rename(oldPath, newPath);
+          }
+
+          return {
+            content: [{ type: "text", text: `Successfully renamed ${oldPath} to ${newPath}\nTransaction ID: ${txId}` }]
+          };
+        }
+
+        case "ftp_rollback": {
+          const { transactionId } = request.params.arguments;
+          try {
+            const results = await snapshotManager.rollback(client, useSFTP, transactionId);
+            return {
+              content: [{
+                type: "text",
+                text: `Rollback complete for ${transactionId}:\nRestored: ${results.restored.length}\nDeleted: ${results.deleted.length}\nFailed: ${results.failed.length}\n${results.failed.length > 0 ? '\nErrors:\n' + results.failed.map(f => `${f.path}: ${f.error}`).join('\n') : ''}`
+              }]
+            };
+          } catch (error) {
+            return {
+              content: [{ type: "text", text: `Rollback failed: ${error.message}` }],
+              isError: true
+            };
+          }
+        }
+
+        case "ftp_list_transactions": {
+          try {
+            const transactions = await snapshotManager.listTransactions();
+            if (transactions.length === 0) {
+              return { content: [{ type: "text", text: "No transactions found." }] };
+            }
+
+            const formatted = transactions.map(tx => {
+              return `ID: ${tx.transactionId}\nTime: ${tx.timestamp}\nFiles: ${tx.files.map(f => f.remotePath).join(', ')}`;
+            }).join('\n\n');
+
+            return { content: [{ type: "text", text: `Available Transactions:\n\n${formatted}` }] };
+          } catch (error) {
+            return {
+              content: [{ type: "text", text: `Failed to list transactions: ${error.message}` }],
+              isError: true
+            };
+          }
+        }
+
+        case "ftp_telemetry": {
+          const avgSyncDuration = telemetry.syncDurations.length > 0
+            ? telemetry.syncDurations.reduce((a, b) => a + b, 0) / telemetry.syncDurations.length
+            : 0;
+
+          return {
+            content: [{
+              type: "text",
+              text: `Connection Health Telemetry:\n===========================\nActive Connections: ${telemetry.activeConnections}\nTotal Reconnects: ${telemetry.reconnects}\nCache Hits: ${telemetry.cacheHits}\nCache Misses: ${telemetry.cacheMisses}\nCache Hit Rate: ${telemetry.cacheHits + telemetry.cacheMisses > 0 ? Math.round((telemetry.cacheHits / (telemetry.cacheHits + telemetry.cacheMisses)) * 100) : 0}%\nAverage Sync Duration: ${Math.round(avgSyncDuration)}ms (last ${telemetry.syncDurations.length} syncs)`
+            }]
+          };
+        }
+
+        case "ftp_probe_capabilities": {
+          const { testPath = "." } = request.params.arguments || {};
+          const capabilities = {
+            protocol: useSFTP ? 'SFTP' : 'FTP',
+            chmod: false,
+            symlinks: false,
+            diskSpace: false,
+            atomicRename: false,
+            checksums: false
+          };
+
+          const testFile = `${testPath}/.ftp-mcp-probe-${Date.now()}.txt`;
+          const testRename = `${testPath}/.ftp-mcp-probe-renamed-${Date.now()}.txt`;
+
+          try {
+            // 1. Test basic write
+            if (useSFTP) {
+              await client.put(Buffer.from('test', 'utf8'), testFile);
+            } else {
+              await client.uploadFrom(Readable.from(['test']), testFile);
+            }
+
+            // 2. Test chmod (SFTP only usually)
+            if (useSFTP) {
+              try {
+                await client.chmod(testFile, '644');
+                capabilities.chmod = true;
+              } catch (e) { }
+            }
+
+            // 3. Test atomic rename
+            try {
+              await client.rename(testFile, testRename);
+              capabilities.atomicRename = true;
+            } catch (e) { }
+
+            // 4. Test disk space (SFTP only usually)
+            if (useSFTP) {
+              try {
+                const sftp = await client.sftp();
+                await new Promise((resolve, reject) => {
+                  sftp.ext_openssh_statvfs(testPath, (err, stats) => {
+                    if (err) reject(err);
+                    else resolve(stats);
+                  });
+                });
+                capabilities.diskSpace = true;
+              } catch (e) { }
+            }
+
+            // Cleanup
+            try {
+              if (capabilities.atomicRename) {
+                if (useSFTP) await client.delete(testRename);
+                else await client.remove(testRename);
+              } else {
+                if (useSFTP) await client.delete(testFile);
+                else await client.remove(testFile);
+              }
+            } catch (e) { }
+
+          } catch (error) {
+            return {
+              content: [{ type: "text", text: `Probing failed during basic operations: ${error.message}` }],
+              isError: true
+            };
+          }
+
+          return {
+            content: [{
+              type: "text",
+              text: `Server Capabilities:\n${JSON.stringify(capabilities, null, 2)}`
+            }]
+          };
+        }
+
+        default:
+          return {
+            content: [{ type: "text", text: `Unknown tool: ${request.params.name}` }],
+            isError: true
+          };
       }
-    })();
-    
+    });
+
     await auditLog(cmdName, request.params.arguments, response.isError ? 'failed' : 'success', currentProfile, response.isError ? response.content[0].text : null);
     return response;
   } catch (error) {
+    console.error(`[Fatal Tool Error] ${request.params.name}:`, error);
     return {
       content: [{ type: "text", text: `Error: ${error.message}` }],
       isError: true
     };
   } finally {
-    if (client) {
+    if (currentConfig) {
       releaseClient(currentConfig);
     }
   }