glasspane-mcp 1.19.0 → 1.20.0

package/README.md

@@ -11,7 +11,9 @@ package alone does not give you a working verification engine.
 只装本包不会得到可用的验证引擎——先装引擎：
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/jingzhao-l/GlassPane/main/install.sh | sh
+# Fetch install.sh, then run it — two steps on purpose: piped into `sh`, a curl that fails
+# leaves stdin empty and the pipeline exits 0 while nothing was installed.
+curl -fsSL https://raw.githubusercontent.com/jingzhao-l/GlassPane/main/install.sh -o /tmp/gp-install.sh && sh /tmp/gp-install.sh
 # 或：npx glasspane-install
 ```
 

package/dist/dimension.d.ts

@@ -0,0 +1,64 @@
+/**
+ * dimension.ts — 面 A's declared review dimension, shape-checked by the kernel (场景② 的对称半边).
+ *
+ * WHY THIS FILE EXISTS. The fork surface (面 B) has carried this argument since the run-plan
+ * work: an agent says which dimension a call was serving, the shell refuses a malformed id
+ * before the daemon sees anything, strips the annotation from the engine frame, and echoes the
+ * declaration back as its own content item. This shell is the other doorway to the same engine,
+ * and until now it had no such slot — so a run driven through `glasspane-mcp` could not say what
+ * a call was for, and the compaction account could only ever read coverage from the fork's own
+ * calls. That asymmetry is the whole reason the dimension counter looked healthy in one harness
+ * and empty in the other.
+ *
+ * WHAT THIS IS NOT. The shape comes from `iterate-kernel/dimension-context`
+ * (`DIMENSION_ID_PATTERN` / `DIMENSION_ID_MAX_LENGTH`) — the same constants the run plan is
+ * validated against — so a plan id and a declaration cannot be spelled two ways. Nothing here
+ * knows what a dimension *means*: it refuses malformed tokens and never checks a name against a
+ * list, because the list belongs to whoever configured the run.
+ *
+ * WHY A MALFORMED ID IS REFUSED AND AN ABSENT ONE IS NOT. `dimensionContext` counts a planned
+ * dimension as verified only when a recorded decision carries that id. A declaration that reaches
+ * the ledger malformed is therefore the lying case — it would be counted as an *unplanned*
+ * dimension and silently rename what the session claims it covered. An honest but unread
+ * declaration is merely blind, so absence is legitimate and means "this call served no declared
+ * dimension"; compaction then reports that dimension as unverified rather than inventing one.
+ *
+ * Only `gp_last_evidence`'s reply carries an evidence pack, and a pack is what a decision is
+ * recorded from (`Dispatcher.swift:156`), so a dimension declared on `gp_attach`, `gp_observe`,
+ * `gp_act` or `gp_diagnose` records nothing and its dimension stays reported unverified. It is
+ * still accepted and still echoed on those calls, for the reason in the paragraph above: a
+ * refused-but-unreadable declaration is a lie, an echoed-but-unrecorded one is a fact the model
+ * can see. The echo is a separate content item so `content[0]` stays the daemon's frame byte for
+ * byte — the same rule the provider attribution line follows, and the reason the Python relay can
+ * classify per item instead of reading a joined string.
+ */
+import { type ToolErrorText } from "./errors.js";
+/**
+ * The advertised half of the kernel's rule, for the JSON Schemas in `tools.ts`.
+ * `test/dimension.test.mjs` compares it against the published
+ * `kernel/schemas/*.schema.json` and against 面 B's own copy, so no side can be tightened or
+ * loosened alone.
+ */
+export declare const DIMENSION_ID_LIMITS: {
+    readonly pattern: RegExp;
+    readonly maxLength: 64;
+};
+export declare function validateDimension(value: unknown): {
+    ok: true;
+    dimension?: string;
+} | {
+    ok: false;
+    error: ToolErrorText;
+};
+/**
+ * Drop the shell-side annotation from what the daemon is asked to do. The engine has no
+ * `dimension` parameter and never learns the word; exported so the fixed-point test can name the
+ * invariant "the engine never sees our annotation" rather than infer it from a passing call.
+ */
+export declare function engineBody(params: Record<string, unknown>): Record<string, unknown>;
+/**
+ * The echo line — one content item, its own prefix, and it claims only what this shell knows.
+ * `none` is never printed: an undeclared call keeps the reply byte-identical.
+ */
+export declare function dimensionAttributionLine(dimension: string): string;
+//# sourceMappingURL=dimension.d.ts.map

package/dist/dispatch.d.ts

@@ -26,7 +26,7 @@ export declare const MCP_PROTOCOL_VERSION: "2025-06-18";
 export declare const SUPPORTED_PROTOCOL_VERSIONS: readonly string[];
 export declare const SERVER_INFO: {
     readonly name: "glasspane-mcp";
-    readonly version: "1.19.0";
+    readonly version: "1.20.0";
 };
 export declare const PARSE_ERROR = -32700;
 export declare const INVALID_REQUEST = -32600;

package/dist/engine-client.d.ts

@@ -7,6 +7,14 @@ import { LineIo } from "./io.js";
  * restore command: it detects a boot-out'd launchd job, bootstraps it, and
  * verifies the daemon's hello self-report — the only remaining human action
  * (TCC checkbox) stays honest. Falls back to generic wording otherwise.
+ *
+ * The ", then retry" tail belongs here and only here: every caller of this
+ * function is an answer for a request that did *not* go out (the write failed,
+ * {@link EngineJsonRpcClient.call}'s catch, or no request was in flight at all),
+ * so nothing can be performed twice by following it. A request that was already
+ * on the wire when the transport died gets {@link transportDeathRemedy}, which
+ * keeps the command and drops the tail for the methods whose re-issue is the
+ * harm.
  */
 export declare function daemonUnreachableRemedy(): string;
 /** Env override for the daemon socket path (default below). */
@@ -505,6 +513,19 @@ export declare class EngineJsonRpcClient {
      * uses it (R9-高1) — and fail that one call only.
      */
     private failOversizedReply;
+    /**
+     * The daemon's error frame, mapped into this shell's error.
+     *
+     * An error frame is a three-field shape — code, message, remedy — and each
+     * field has to actually say something for the answer to be usable by an agent.
+     * `??` only catches null/undefined, so a frame carrying `code: ""` used to be
+     * forwarded verbatim as an error with no name and no cause, while the remedy arm
+     * below already treats `""` as absent: one rule for three fields on the same
+     * frame. A blank is now read as "not stated" for every one of them, and a
+     * non-blank value — including one that merely looks odd — passes through
+     * untouched, because this function forwards the daemon's own words and has no
+     * authority to rewrite them.
+     */
     private engineError;
     /**
      * Oldest request this client still tracks, settled ones included: that is the
@@ -549,6 +570,13 @@ export declare class EngineJsonRpcClient {
      * "this shell stopped tracking it" from "it never happened" — the difference
      * that decides whether it re-performs an `act` on the user's screen (R9-中1).
      * The reverse mutation is to delete this note and keep the silent clear.
+     *
+     * The message is one sentence for every request — it states what happened to
+     * the transport, which is the same fact for all of them — while the remedy is
+     * written per method (`remedyFor`): what the caller may do next depends on
+     * whether re-issuing that particular request would perform it a second time,
+     * and one remedy for the whole batch is how "…, then retry" reached an
+     * outstanding `act` at all. See {@link transportDeathRemedy}.
      */
     private teardown;
     private report;

package/dist/errors.d.ts

@@ -70,6 +70,52 @@ export declare const GP_E_UNKNOWN = "GP_E_UNKNOWN";
  * `projects.json` for the second case sends it to a file that is fine.
  */
 export declare const GP_E_NO_USER_RECORD = "GP_E_NO_USER_RECORD";
+/**
+ * Shell-only: a state root **the daemon reported about itself** (`hello`'s
+ * `stateRoot`) names a path this process will neither create nor re-permission —
+ * the filesystem root, the account's home directory itself, or a value that is not
+ * an absolute path at all.
+ *
+ * The daemon refuses the same shapes for its own `--state-dir` (`StateRoot.classify`
+ * → `StateRoot.notADedicatedRoot`) and then `tightenPermissions` that root to 0700,
+ * so the argument parse is the only thing standing between `--state-dir ~` and a
+ * locked home directory. It has no code for the refusal because the refusal is an
+ * exit message, not an error frame — which is why this shell cannot reuse one
+ * either: the root arrives over a socket with **no peer authentication** (SECURITY.md:
+ * same uid = full authority), so a value in a reply frame can name `/Users/<you>` and
+ * this shell's own `mkdirSync(…, 0700)` + `chmod` would obey it. `test/remedy-surface.test.mjs`
+ * checks this stays absent from the daemon's enum, so the split has to be re-read if
+ * the daemon ever does declare it.
+ *
+ * 它**不**列进下面那份 `SHELL_REQUEST_REFUSAL_CODES`：这一码说的不是"你给的参数不对"，
+ * 而是"服务报了一个我们不能照做的根"，改参数重试不会有用；HTTP 那一侧因此按
+ * shell-only 的规矩答 503（与 `GP_E_REGISTRY_DRIFT` 同一族："什么都没写，去看服务"），
+ * 而不是 4xx。
+ */
+export declare const GP_E_STATE_ROOT_REFUSED = "GP_E_STATE_ROOT_REFUSED";
+/**
+ * Shell-only: a declared review dimension is malformed. The daemon has no dimension
+ * vocabulary at all — a dimension is the harness's annotation on a call, never an engine
+ * parameter — so this code can only ever come from the two surfaces that accept the argument,
+ * and `test/remedy-surface.test.mjs` checks it is genuinely absent from the daemon's enum.
+ * 面 B (`tool/glasspane/kernel.ts:validateDimension`) spells the same code for the same refusal:
+ * an agent that drives the app through either doorway must see one vocabulary, and
+ * `mcp-shell/test/dimension.test.mjs` is the leg that compares the two surfaces' tool lists so a
+ * slot added on one side reddens on the other.
+ */
+export declare const GP_E_DIMENSION = "GP_E_DIMENSION";
+/**
+ * Codes this shell authors **about the caller's request**, as opposed to about its own failure.
+ *
+ * They are absent from the daemon's enum for a reason that has nothing to do with blame: the
+ * daemon has no `dimension` concept to declare, because the argument is stripped before the frame
+ * is built. So "the daemon does not declare it" cannot be read as "this gateway did not finish the
+ * request", and `test/http-gateway.test.mjs` therefore partitions shell-only codes with this list
+ * instead of with enum membership — the infrastructure codes (`GP_E_ENGINE_TIMEOUT`,
+ * `GP_E_ENGINE_BACKLOG`, …) still may never be answered as a 4xx, while a code listed here must be
+ * *proven* to come from argument validation, by the HTTP test that drives the real route.
+ */
+export declare const SHELL_REQUEST_REFUSAL_CODES: readonly string[];
 export interface ToolErrorText {
     code: string;
     message: string;