glasspane-mcp 1.18.0 → 1.19.0

package/dist/dispatch.d.ts

@@ -26,7 +26,7 @@ export declare const MCP_PROTOCOL_VERSION: "2025-06-18";
 export declare const SUPPORTED_PROTOCOL_VERSIONS: readonly string[];
 export declare const SERVER_INFO: {
     readonly name: "glasspane-mcp";
-    readonly version: "1.18.0";
+    readonly version: "1.19.0";
 };
 export declare const PARSE_ERROR = -32700;
 export declare const INVALID_REQUEST = -32600;

package/dist/engine-client.d.ts

@@ -439,6 +439,19 @@ export declare class EngineJsonRpcClient {
      */
     private helloStateRoot;
     get reportedStateRoot(): string | null;
+    /**
+     * The version the daemon named in its own `hello`, or null when no handshake on this
+     * connection has reported one.
+     *
+     * This is the *producer's* measurement, and it is what the provider attribution line
+     * states (`providers.ts`'s `attributeCapability`): the verdict an agent is being told
+     * about came out of the daemon's build, not this package's. Read rather than assumed —
+     * `null` means "not measured on this connection", never "therefore it is the shell's
+     * own version", which is the mistake that made an app bundle older than the shell
+     * report a verdict from a build that did not produce it.
+     */
+    private helloVersion;
+    get reportedEngineVersion(): string | null;
     /**
      * Sink for facts that cannot be attached to any request of the caller: a
      * late reply, a frame with an id this client never issued, a daemon that

package/dist/errors.d.ts

@@ -81,4 +81,5 @@ export interface ToolErrorText {
  */
 export declare function formatToolError(code: string, message: string, remedy: string): string;
 export declare function formatToolErrorShape(error: ToolErrorText): string;
+export declare function quoteShellArg(value: string): string;
 //# sourceMappingURL=errors.d.ts.map

package/dist/http-gateway-cli.js

@@ -189,13 +189,17 @@ function formatToolError(code, message, remedy) {
 function formatToolErrorShape(error) {
   return formatToolError(error.code, error.message, error.remedy);
 }
+var SHELL_INERT_WORD = /^[A-Za-z0-9@%+=:,./_-]+$/;
+function quoteShellArg(value) {
+  return SHELL_INERT_WORD.test(value) && !value.startsWith("-") ? value : `'${value.split("'").join("'\\''")}'`;
+}
 
 // src/engine-client.ts
 function daemonUnreachableRemedy() {
   const here = path.dirname(fileURLToPath(import.meta.url));
   const installerCli = path.resolve(here, "..", "..", "installer", "cli.js");
   if (fs2.existsSync(installerCli)) {
-    return `run "node ${installerCli} --restore-launchd" (auto-restores and verifies the launchd-managed daemon), then retry`;
+    return `run \`node ${quoteShellArg(installerCli)} --restore-launchd\` (auto-restores and verifies the launchd-managed daemon), then retry`;
   }
   return "ensure the glasspane daemon is running (launchd job com.glasspane.daemon; in a repo checkout run `node installer/cli.js --restore-launchd`), then retry";
 }
@@ -452,6 +456,21 @@ var EngineJsonRpcClient = class {
   get reportedStateRoot() {
     return this.helloStateRoot;
   }
+  /**
+   * The version the daemon named in its own `hello`, or null when no handshake on this
+   * connection has reported one.
+   *
+   * This is the *producer's* measurement, and it is what the provider attribution line
+   * states (`providers.ts`'s `attributeCapability`): the verdict an agent is being told
+   * about came out of the daemon's build, not this package's. Read rather than assumed —
+   * `null` means "not measured on this connection", never "therefore it is the shell's
+   * own version", which is the mistake that made an app bundle older than the shell
+   * report a verdict from a build that did not produce it.
+   */
+  helloVersion = null;
+  get reportedEngineVersion() {
+    return this.helloVersion;
+  }
   /**
    * Sink for facts that cannot be attached to any request of the caller: a
    * late reply, a frame with an id this client never issued, a daemon that
@@ -828,6 +847,10 @@ var EngineJsonRpcClient = class {
       return;
     }
     const report = result;
+    const version = typeof report.version === "string" ? report.version.trim() : "";
+    if (version !== "") {
+      this.helloVersion = version;
+    }
     const protocol = typeof report.protocolVersion === "string" ? report.protocolVersion : null;
     if (protocol === null) {
       this.report(`engine self-report has no protocolVersion (engine=${jsonOrString(report.engine)}); expected '${expected}' \u2014 compatibility unverified`);
@@ -837,14 +860,14 @@ var EngineJsonRpcClient = class {
       this.report(`protocol mismatch: engine speaks '${protocol}', this shell speaks '${expected}' \u2014 upgrade or restart one side before trusting tool results`);
       return;
     }
-    const version = typeof report.version === "string" ? report.version : null;
+    const reportedVersion = version === "" ? null : version;
     const reportedRoot = typeof report.stateRoot === "string" ? report.stateRoot.trim() : "";
     if (reportedRoot !== "") {
       this.helloStateRoot = reportedRoot;
     }
     const wantVersion = this.identity?.version;
-    if (version !== null && wantVersion !== void 0 && version !== wantVersion) {
-      this.report(`version mismatch: engine self-reports '${version}', this MCP shell ships '${wantVersion}' (single version line) \u2014 one side is stale`);
+    if (reportedVersion !== null && wantVersion !== void 0 && reportedVersion !== wantVersion) {
+      this.report(`version mismatch: engine self-reports '${reportedVersion}', this MCP shell ships '${wantVersion}' (single version line) \u2014 one side is stale`);
     }
     if (this.expectedDaemonMethods.length > 0) {
       const advertised = Array.isArray(report.capabilities) ? report.capabilities.filter((item) => typeof item === "string") : null;
@@ -1652,8 +1675,65 @@ var ProviderRegistrationSchema = z8.strictObject({
     seen.add(method.name);
   });
 });
+var PROVIDER_CODES = {
+  duplicateId: "KERNEL_E_PROVIDER_DUPLICATE",
+  unknown: "KERNEL_E_PROVIDER_UNKNOWN",
+  missingMethod: "KERNEL_E_PROVIDER_METHOD"
+};
+var KernelProviderError = class extends Error {
+  code;
+  providerId;
+  remedy;
+  constructor(code, providerId, message, remedy) {
+    super(`${code}: ${message}`);
+    this.name = "KernelProviderError";
+    this.code = code;
+    this.providerId = providerId;
+    this.remedy = remedy;
+  }
+};
+function emptyProviderRegistry() {
+  return {};
+}
+function registeredIds(registry) {
+  const ids = Object.keys(registry).sort();
+  return ids.length > 0 ? ids.join(", ") : "(none registered)";
+}
+function registerProvider(registry, provider) {
+  const checked = ProviderRegistrationSchema.safeParse(provider);
+  if (!checked.success) {
+    throw schemaErrorFrom("provider registration", checked.error);
+  }
+  const parsed = checked.data;
+  if (Object.prototype.hasOwnProperty.call(registry, parsed.id)) {
+    throw new KernelProviderError(PROVIDER_CODES.duplicateId, parsed.id, `provider "${parsed.id}" is already registered`, "choose a distinct id, or replace the registration explicitly rather than by order of appearance");
+  }
+  return { ...registry, [parsed.id]: parsed };
+}
+function resolveProvider(registry, id) {
+  const provider = registry[id];
+  if (!provider) {
+    throw new KernelProviderError(PROVIDER_CODES.unknown, id, `no provider registered under "${id}"`, `registered: ${registeredIds(registry)}`);
+  }
+  return provider;
+}
+function requireMethod(registry, id, method) {
+  const provider = resolveProvider(registry, id);
+  const found = provider.methods.find((entry) => entry.name === method);
+  if (!found) {
+    throw new KernelProviderError(PROVIDER_CODES.missingMethod, id, `provider "${id}" does not offer "${method}"`, `it offers: ${provider.methods.map((entry) => entry.name).join(", ")}`);
+  }
+  return found;
+}
 
 // ../node_modules/iterate-kernel/dist/parse.js
+function parseOrThrow(schema, input, label) {
+  const result = schema.safeParse(input);
+  if (result.success) {
+    return result.data;
+  }
+  throw schemaErrorFrom(label, result.error);
+}
 function parseEvidencePackRead(input) {
   const result = EvidencePackReadSchema.safeParse(input);
   if (result.success) {
@@ -1661,6 +1741,9 @@ function parseEvidencePackRead(input) {
   }
   throw schemaErrorFrom("evidence pack", result.error);
 }
+function parseProviderRegistration(input) {
+  return parseOrThrow(ProviderRegistrationSchema, input, "provider registration");
+}
 
 // src/canonical.ts
 function canonicalJson2(value) {
@@ -1681,6 +1764,169 @@ function sortKeys(value) {
   return value;
 }
 
+// src/providers.ts
+import fs3 from "node:fs";
+import path2 from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+var GLASSPANE_AE_PROVIDER_ID = "glasspane-engine-ae";
+var GLASSPANE_EVIDENCE_PROVIDER_ID = "glasspane-evidence";
+var MANIFEST_NAME = "glasspane-mcp";
+var cachedProductVersion;
+function shellManifestPath() {
+  return path2.resolve(path2.dirname(fileURLToPath2(import.meta.url)), "..", "package.json");
+}
+function shellProductVersion() {
+  if (cachedProductVersion === void 0) {
+    cachedProductVersion = readShellProductVersion();
+  }
+  return cachedProductVersion;
+}
+function readShellProductVersion() {
+  let raw;
+  try {
+    raw = fs3.readFileSync(shellManifestPath(), "utf8");
+  } catch {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return null;
+  }
+  const record = parsed;
+  if (record.name !== MANIFEST_NAME) {
+    return null;
+  }
+  return typeof record.version === "string" ? record.version : null;
+}
+function shellProviderDrafts(version) {
+  return [
+    {
+      schemaVersion: PROVIDER_SCHEMA_VERSION,
+      id: GLASSPANE_AE_PROVIDER_ID,
+      kind: "ae-diagnosis",
+      version,
+      origin: "glasspane",
+      methods: [
+        { name: "diagnose", requires: ["ax-event", "attribution", "circuit-breaker"] }
+      ]
+    },
+    {
+      schemaVersion: PROVIDER_SCHEMA_VERSION,
+      id: GLASSPANE_EVIDENCE_PROVIDER_ID,
+      kind: "evidence-source",
+      version,
+      origin: "glasspane",
+      methods: [
+        { name: "capture", requires: ["ax-tree"] },
+        { name: "last-evidence", requires: [] }
+      ]
+    }
+  ];
+}
+function shellProviderRegistry(version) {
+  return shellProviderDrafts(version).reduce(
+    (registry, draft) => registerProvider(registry, parseProviderRegistration(draft)),
+    emptyProviderRegistry()
+  );
+}
+function coveredMethods(signals, registry) {
+  const present = /* @__PURE__ */ new Set();
+  for (const name of signals) {
+    present.add(name);
+  }
+  const provider = resolveProvider(registry, GLASSPANE_AE_PROVIDER_ID);
+  return provider.methods.filter((method) => method.requires.every((need) => present.has(need)));
+}
+var CAPABILITY_CLAIMS = [
+  { engineMethod: "diagnose", providerId: GLASSPANE_AE_PROVIDER_ID, method: "diagnose" }
+];
+var CLAIMED_ENGINE_METHODS = CAPABILITY_CLAIMS.map((claim) => claim.engineMethod);
+function claimForEngineMethod(engineMethod) {
+  const found = CAPABILITY_CLAIMS.filter((claim) => claim.engineMethod === engineMethod);
+  const only = found.length === 1 ? found[0] : void 0;
+  return only === void 0 ? null : only;
+}
+function attributeCapability(engineMethod, query = {}) {
+  const claim = claimForEngineMethod(engineMethod);
+  if (claim === null) {
+    return { status: "not-claimed" };
+  }
+  const measured = typeof query.producerVersion === "string" && query.producerVersion.trim() !== "" ? query.producerVersion.trim() : null;
+  const own = query.shellVersion === void 0 ? shellProductVersion() : query.shellVersion;
+  const usable = (value) => value !== null && value.trim() !== "" ? value.trim() : null;
+  const registrationVersion = measured ?? usable(own) ?? UNSTATED_REGISTRATION_VERSION;
+  let target = query.registry;
+  try {
+    if (target === void 0) {
+      target = shellProviderRegistry(registrationVersion);
+    }
+    const declared = requireMethod(target, claim.providerId, claim.method);
+    const provider = resolveProvider(target, claim.providerId);
+    const covered = coveredMethods(declared.requires, target);
+    const only = covered.length === 1 ? covered[0] : void 0;
+    if (only === void 0 || only.name !== claim.method) {
+      return { status: "refused", error: coverageAmbiguous(claim, covered) };
+    }
+    return {
+      status: "ok",
+      provider: {
+        // Never `provider.version`: that field is whatever the registration was built
+        // with, which can be the placeholder. The version an agent is told is the one the
+        // producer itself reported.
+        id: provider.id,
+        version: measured,
+        method: declared.name,
+        requires: declared.requires,
+        versionNote: versionNote(measured, usable(own))
+      }
+    };
+  } catch (error) {
+    if (error instanceof KernelProviderError) {
+      return { status: "refused", error: { code: error.code, message: error.message, remedy: error.remedy } };
+    }
+    if (error instanceof KernelSchemaError) {
+      return {
+        status: "refused",
+        error: {
+          code: error.code,
+          message: `${error.message} \u2014 the kernel refused a registration this product writes itself, built with the version from ${registrationVersionSource(measured, usable(own))}`,
+          remedy: "fix shellProviderDrafts in mcp-shell/src/providers.ts; it is the contract both harnesses read, so it cannot be relaxed at a call site \u2014 run node scripts/check-kernel-corpus.mjs and compare against kernel/fixtures/provider-registration.ok-01.json"
+        }
+      };
+    }
+    throw error;
+  }
+}
+var UNSTATED_REGISTRATION_VERSION = "unmeasured-registration-placeholder";
+function registrationVersionSource(measured, own) {
+  if (measured !== null) {
+    return "the daemon's own hello self-report";
+  }
+  return own === null ? `the ${MANIFEST_NAME} manifest this build cannot read at ${shellManifestPath()}` : "this build's own manifest";
+}
+function providerAttributionLine(attributed) {
+  const needs = attributed.requires.length > 0 ? attributed.requires.join(", ") : "none";
+  const version = attributed.version === null ? "version unmeasured" : `version ${attributed.version}`;
+  return `provider: ${attributed.id} ${version} method ${attributed.method} | declared prerequisites: ${needs} | ${attributed.versionNote} | the verdict above is the engine's, transcribed unchanged; this line names the registered producer this surface attributes it to, from the kernel's provider-registration contract`;
+}
+function versionNote(measured, own) {
+  const producer = measured === null ? "the producer's version is unmeasured: no daemon hello handshake has been answered on this connection, so this line states no version" : "the producer's version is the daemon's own hello self-report, read on this connection";
+  return own === null ? `${producer}; this build cannot read its own ${MANIFEST_NAME} manifest at ${shellManifestPath()}, so it states no version of itself either` : producer;
+}
+function coverageAmbiguous(claim, covered) {
+  const names = covered.map((method) => method.name).join(", ");
+  return {
+    code: GP_E_INTERNAL,
+    message: `the prerequisites declared for '${claim.method}' cover ${covered.length === 0 ? "no" : `${covered.length} parallel`} method${covered.length === 1 ? "" : "s"} of provider ${claim.providerId}${names === "" ? "" : ` (${names})`}`,
+    remedy: "give each declared method a prerequisite list that tells it apart from the others, or ask for the method by the one name the contract distinguishes \u2014 naming a verdict's producer by guessing which of two indistinguishable declarations ran is the default resolution this contract forbids"
+  };
+}
+
 // src/update-state.ts
 var CA_ROOTS_STATUSES = ["ok", "probe-failed", "empty", "unavailable", "write-unverified"];
 var KNOWN_CA_ROOTS_STATUSES = new Set(CA_ROOTS_STATUSES);
@@ -1696,9 +1942,9 @@ var TRAIL_PROVENANCE_NOTES = {
 };
 
 // src/project-registry.ts
-import fs3 from "node:fs";
+import fs4 from "node:fs";
 import os2 from "node:os";
-import path2 from "node:path";
+import path3 from "node:path";
 import { randomBytes } from "node:crypto";
 import { z as z9 } from "zod";
 var CROCKFORD_BODY_RE = "[0-9A-HJKMNP-TV-Z]{26}";
@@ -1751,8 +1997,8 @@ function systemHome() {
 }
 function daemonProjectsPath(daemonStateRoot) {
   const named2 = typeof daemonStateRoot === "string" ? daemonStateRoot.trim() : "";
-  if (named2 !== "") return path2.join(named2, "projects.json");
-  return path2.join(systemHome(), ".glasspane", "projects.json");
+  if (named2 !== "") return path3.join(named2, "projects.json");
+  return path3.join(systemHome(), ".glasspane", "projects.json");
 }
 var FIRMLINK_PREFIX = "/System/Volumes/Data";
 var FORCE_OVERWRITE_ENV = "GLASSPANE_PROJECTS_FORCE_OVERWRITE";
@@ -1783,7 +2029,7 @@ function projectsPath(daemonStateRoot) {
 function loadRegistry(filePath) {
   let raw;
   try {
-    raw = fs3.readFileSync(filePath, "utf8");
+    raw = fs4.readFileSync(filePath, "utf8");
   } catch (error) {
     if (nodeErrorCode(error) === "ENOENT") {
       return { projects: [], failure: null };
@@ -1852,7 +2098,7 @@ function requireUsableRegistry(filePath, snapshot) {
   }
   const discarded = `${filePath}.unreadable-${uniqueToken()}`;
   try {
-    fs3.renameSync(filePath, discarded);
+    fs4.renameSync(filePath, discarded);
   } catch (error) {
     throw new ProjectRegistryError(
       GP_E_INTERNAL,
@@ -1862,7 +2108,7 @@ function requireUsableRegistry(filePath, snapshot) {
   return { projects: [], discarded };
 }
 function registryReaders(target) {
-  return `\`/usr/bin/plutil -p ${target}\` or \`/bin/cat ${target}\` \u2014 both absolute, so they run from whatever directory the reader is in and need nothing that may be off PATH`;
+  return `\`/usr/bin/plutil -p ${quoteShellArg(target)}\` or \`/bin/cat ${quoteShellArg(target)}\` \u2014 both absolute, so they run from whatever directory the reader is in and need nothing that may be off PATH`;
 }
 function unreadableMessage(filePath, failure) {
   return `projects.json at ${filePath} ${failure}. gp_project_set refused to write it: replacing an unreadable registry discards every registration in it. See the damage with ${registryReaders(filePath)} and repair that file, or set ${FORCE_OVERWRITE_ENV}=1 and retry to rebuild the registry from scratch \u2014 the unloadable file is moved aside as ${filePath}.unreadable-<id> rather than deleted, and every existing project entry is lost.`;
@@ -1874,7 +2120,7 @@ var STATE_DIR_MODE = 448;
 var STATE_FILE_MODE = 384;
 function tightenMode(target, want, kind) {
   try {
-    fs3.chmodSync(target, want);
+    fs4.chmodSync(target, want);
   } catch (error) {
     throw new ProjectRegistryError(
       GP_E_INTERNAL,
@@ -1883,7 +2129,7 @@ function tightenMode(target, want, kind) {
   }
   let mode;
   try {
-    mode = fs3.statSync(target).mode & 511;
+    mode = fs4.statSync(target).mode & 511;
   } catch (error) {
     throw new ProjectRegistryError(
       GP_E_INTERNAL,
@@ -1899,7 +2145,7 @@ function tightenMode(target, want, kind) {
 }
 function fileIdentity(filePath) {
   try {
-    const stat = fs3.statSync(filePath);
+    const stat = fs4.statSync(filePath);
     return `${stat.mtimeMs}:${stat.size}:${stat.ino}`;
   } catch (error) {
     if (nodeErrorCode(error) === "ENOENT") return null;
@@ -1921,47 +2167,47 @@ function assertNoConcurrentWrite(filePath, openedAs) {
 function syncDirectory(dir) {
   let dirFd = null;
   try {
-    dirFd = fs3.openSync(dir, "r");
-    fs3.fsyncSync(dirFd);
+    dirFd = fs4.openSync(dir, "r");
+    fs4.fsyncSync(dirFd);
   } catch (error) {
     const code = error?.code;
     if (code === "EIO" || code === "ENOMEM") throw error;
   } finally {
-    if (dirFd !== null) fs3.closeSync(dirFd);
+    if (dirFd !== null) fs4.closeSync(dirFd);
   }
 }
 function saveProjects(filePath, entries) {
-  const dir = path2.dirname(filePath);
+  const dir = path3.dirname(filePath);
   const tmpPath = `${filePath}.tmp-${uniqueToken()}`;
   try {
-    fs3.mkdirSync(dir, { recursive: true, mode: STATE_DIR_MODE });
+    fs4.mkdirSync(dir, { recursive: true, mode: STATE_DIR_MODE });
     tightenMode(dir, STATE_DIR_MODE, "directory");
-    const fd = fs3.openSync(tmpPath, "w", STATE_FILE_MODE);
+    const fd = fs4.openSync(tmpPath, "w", STATE_FILE_MODE);
     try {
-      fs3.writeFileSync(fd, JSON.stringify(entries, null, 2), "utf8");
-      fs3.fsyncSync(fd);
+      fs4.writeFileSync(fd, JSON.stringify(entries, null, 2), "utf8");
+      fs4.fsyncSync(fd);
     } finally {
-      fs3.closeSync(fd);
+      fs4.closeSync(fd);
     }
     tightenMode(tmpPath, STATE_FILE_MODE, "file");
-    fs3.renameSync(tmpPath, filePath);
+    fs4.renameSync(tmpPath, filePath);
     syncDirectory(dir);
     tightenMode(filePath, STATE_FILE_MODE, "file");
   } catch (error) {
     try {
-      fs3.unlinkSync(tmpPath);
+      fs4.unlinkSync(tmpPath);
     } catch {
     }
     if (error instanceof ProjectRegistryError) {
       throw new ProjectRegistryError(
         error.code,
-        `${error.message}; projects.json at ${filePath} was therefore not published as owner-only, and gp_project_set refuses to report a write the daemon's own modes did not hold. Bring the state root to them yourself (chmod 700 ${dir}, chmod 600 ${filePath}) and retry \u2014 a volume that ignores chmod (read-only mount, ACL, immutable flag) needs the daemon's --state-dir moved to one that honours permissions; until then the registry on disk and this shell disagree about who can read it`
+        `${error.message}; projects.json at ${filePath} was therefore not published as owner-only, and gp_project_set refuses to report a write the daemon's own modes did not hold. Bring the state root to them yourself (chmod 700 ${quoteShellArg(dir)}, chmod 600 ${quoteShellArg(filePath)}) and retry \u2014 a volume that ignores chmod (read-only mount, ACL, immutable flag) needs the daemon's --state-dir moved to one that honours permissions; until then the registry on disk and this shell disagree about who can read it`
       );
     }
     const errno = error?.code ?? "unknown";
     throw new ProjectRegistryError(
       GP_E_INTERNAL,
-      `projects.json at ${filePath} was not published: committing the bytes to the device failed (${errno}). gp_project_set answers "not saved" here rather than "saved", because a registration a power loss can drop is not a registration. This is the write's own failure, not a verdict about the file's contents: check what the volume will do (\`ls -lO ${dir}\` for an immutable flag, \`diskutil info -live ${dir}\` for a read-only or remote mount), fix that, then retry the same call.`
+      `projects.json at ${filePath} was not published: committing the bytes to the device failed (${errno}). gp_project_set answers "not saved" here rather than "saved", because a registration a power loss can drop is not a registration. This is the write's own failure, not a verdict about the file's contents: check what the volume will do (\`ls -lO ${quoteShellArg(dir)}\` for an immutable flag, \`diskutil info -live ${quoteShellArg(dir)}\` for a read-only or remote mount), fix that, then retry the same call.`
     );
   }
 }
@@ -2065,7 +2311,7 @@ function daemonRestartNotice(filePath, daemonStateRoot) {
   const named2 = typeof daemonStateRoot === "string" && daemonStateRoot.trim() !== "" ? daemonStateRoot.trim() : null;
   const daemonPath = daemonProjectsPath(named2);
   const authority = named2 === null ? "its default root is the folder under this user's home record (where a service started with no --state-dir looks)" : `its root is the one the running daemon named in its hello (${named2})`;
-  if (path2.resolve(filePath) !== path2.resolve(daemonPath)) {
+  if (path3.resolve(filePath) !== path3.resolve(daemonPath)) {
     return `Saved in ${filePath}. The background service does not read this path because of anything in its own configuration: ${authority}. It loads ${daemonPath} once when it starts, and ${PROJECTS_FILE_ENV} \u2014 the variable that pointed this write here \u2014 is honoured by this MCP shell only, so as far as the service's own configuration goes it never reads that file, and no restart of the service will make it load this one. ${rootDiscriminator()} To land the entry where that root looks: unset ${PROJECTS_FILE_ENV} for this shell (or point it at ${daemonPath}) and repeat gp_project_set, then restart the background service so it reloads \u2014 ${restartCommand()}`;
   }
   if (named2 !== null) {
@@ -2100,7 +2346,7 @@ function checkAgentPath(field, value) {
       throw badPath(field, value, `must not contain "." or ".." components (got "${value}")`);
     }
   }
-  const logical = path2.posix.normalize(value);
+  const logical = path3.posix.normalize(value);
   const given = stripFirmlink(logical);
   const resolved = stripFirmlink(resolveExistingAncestor(logical));
   const refusal = strongestRefusal(given === resolved ? [resolved] : [resolved, given], resolved);
@@ -2149,7 +2395,7 @@ function refuseHomeDotDirectory(target, home) {
   return named(`a dot-directory of the current user's home directory (~/${first}), which is where that account's credentials and client configuration live (\`~/.ssh\`, \`~/.aws\`, \`~/.gnupg\`, \`~/.config\`) or the daemon's own private state (\`~/.glasspane\`); the daemon chmods a registered storage root to 0700 and writes evidence packs into it, and prunes expired ones out of it, so this is not a place a project archive may be pointed at \u2014 name a directory inside the project instead, e.g. "the project tree/${first}"`);
 }
 function refuseCandidate(target) {
-  const home = stripFirmlink(path2.posix.normalize(systemHome()));
+  const home = stripFirmlink(path3.posix.normalize(systemHome()));
   if (target === home) return named("the current user's home directory");
   if (isInside(`${home}/Library`, target)) return named("inside the current user's Library folder");
   const homeDot = refuseHomeDotDirectory(target, home);
@@ -2178,7 +2424,7 @@ function refuseUnownedTree(target) {
   }
   let stat;
   try {
-    stat = fs3.statSync(ancestor);
+    stat = fs4.statSync(ancestor);
   } catch (error) {
     return `under a nearest existing directory ${ancestor} that cannot be inspected (${describeError(error)})`;
   }
@@ -2193,10 +2439,10 @@ function refuseUnownedTree(target) {
 function nearestExistingAncestor(target) {
   let cursor = target;
   for (; ; ) {
-    if (fs3.existsSync(cursor)) {
+    if (fs4.existsSync(cursor)) {
       return cursor;
     }
-    const parent = path2.posix.dirname(cursor);
+    const parent = path3.posix.dirname(cursor);
     if (parent === cursor) return parent;
     cursor = parent;
   }
@@ -2216,12 +2462,12 @@ function resolveExistingAncestor(target) {
   const missingTail = [];
   for (; ; ) {
     try {
-      const real = fs3.realpathSync(cursor);
-      return missingTail.length === 0 ? real : path2.posix.join(real, ...missingTail);
+      const real = fs4.realpathSync(cursor);
+      return missingTail.length === 0 ? real : path3.posix.join(real, ...missingTail);
     } catch {
-      const parent = path2.posix.dirname(cursor);
+      const parent = path3.posix.dirname(cursor);
       if (parent === cursor) return target;
-      missingTail.unshift(path2.posix.basename(cursor));
+      missingTail.unshift(path3.posix.basename(cursor));
       cursor = parent;
     }
   }
@@ -3707,6 +3953,14 @@ async function handleToolForward(name, req, client, res) {
     );
     return;
   }
+  const claim = attributeCapability(spec.engineMethod, {
+    producerVersion: client.reportedEngineVersion ?? null
+  });
+  if (claim.status === "refused") {
+    fail(res, httpStatusForEngineCode(claim.error.code), claim.error.code, claim.error.message, claim.error.remedy);
+    return;
+  }
+  const attribution = claim.status === "ok" ? providerAttributionLine(claim.provider) : void 0;
   try {
     const result = await client.call(spec.engineMethod, checked.value);
     if (spec.engineMethod === "last_evidence") {
@@ -3717,7 +3971,7 @@ async function handleToolForward(name, req, client, res) {
         return;
       }
     }
-    ok(res, result);
+    ok(res, result, attribution);
   } catch (error) {
     await failEngine(res, error, spec, checked.value);
   }
@@ -3824,8 +4078,8 @@ function makeNotFetchedNote(notFetched, format) {
   const sentence = `not fetched within this request's ${EVIDENCE_FANOUT_BUDGET_MS}ms wait: ${notFetched.length} ${label} left unanswered: ${notFetched.join(", ")}. Fetch one by id with GET /v1/evidence/<operationId>, or ask again with a shorter ids= list`;
   return format === "html" ? `<p class="gp-not-fetched">${escapeHTML(sentence)}</p>` : `> ${sentence}`;
 }
-function ok(res, result) {
-  writeJson(res, 200, { ok: true, result });
+function ok(res, result, attribution) {
+  writeJson(res, 200, attribution === void 0 ? { ok: true, result } : { ok: true, result, attribution });
 }
 function fail(res, status, code, message, remedy) {
   writeJson(res, status, { ok: false, error: { code, message: forHttpCaller(message), remedy: forHttpCaller(remedy) } });

package/dist/http-gateway.d.ts

@@ -75,6 +75,13 @@ export interface EngineClientLike {
         method: string;
         result: unknown;
     }) => void): void;
+    /**
+     * The version the daemon named in its own `hello` on this connection, or null when no
+     * handshake has reported one. Optional so a fake may omit it — the seam then attributes
+     * what it can measure and says the version is unmeasured, which is exactly what the
+     * stdio doorway does for the same client.
+     */
+    readonly reportedEngineVersion?: string | null;
 }
 export interface HttpGatewayOptions {
     /** Daemon socket path handed to the engine client (the default connector). */